f2f858fe13e11fa01833d35be82bc036a81b3bf02ea8715bce009397946b6b1e

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Risk of Rain Returns/Risk of Rain Returns.exe
Size 32.4MB
Sample260703-rskx6sf14p
SHA256 f2f858fe13e11fa01833d35be82bc036a81b3bf02ea8715bce009397946b6b1e
MD5 59070de32c96d771f0eb8f1cfa3248b4
SHA1 c910a6658c10df31a56e095f24fcda386a65752f
SHA512 762cfbdf0735e917323f61382f15b3cd977dcb0e70ef0f032fb9866407d6fd4e137982bfc7e0fdf186192206c234e13fa3a7d12a3b7fb632cacaa361c263374a
SSDEEP 393216:MK4zQTe64cBjs4nhO5YeT1ElW7W5tr5bo3Q2uXJ5e6Fus3:0Yjs48qXneAuo
TLSH
T17B774B24395ADA9DD076C47CCA22DA53E6203CE8C7394AFBC5B036170FFE6E09535A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
70	discord.com
71	discord.com
83	discord.com
148	discord.com

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1740_42427636\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275638510965464"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E53208E2-C00E-408B-8C85-043166842B4A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2732	Risk of Rain Returns.exe
2732	Risk of Rain Returns.exe
2732	Risk of Rain Returns.exe
2732	Risk of Rain Returns.exe
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2732	Risk of Rain Returns.exe
2732	Risk of Rain Returns.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1740	2732	Risk of Rain Returns.exe	84
PID 1740 wrote to memory of 1844	1740	msedge.exe	85
PID 1740 wrote to memory of 224	1740	msedge.exe	86
PID 1740 wrote to memory of 3276	1740	msedge.exe	87
PID 1740 wrote to memory of 3276	1740	msedge.exe	87
PID 1740 wrote to memory of 3276	1740	msedge.exe	87
PID 1740 wrote to memory of 4708	1740	msedge.exe	88
PID 1740 wrote to memory of 4708	1740	msedge.exe	88
PID 1740 wrote to memory of 4496	1740	msedge.exe	90
PID 1740 wrote to memory of 4496	1740	msedge.exe	90
PID 1740 wrote to memory of 4496	1740	msedge.exe	90
PID 1740 wrote to memory of 4348	1740	msedge.exe	91
PID 1740 wrote to memory of 4348	1740	msedge.exe	91
PID 1740 wrote to memory of 4348	1740	msedge.exe	91
PID 1740 wrote to memory of 884	1740	msedge.exe	92
PID 1740 wrote to memory of 884	1740	msedge.exe	92
PID 1740 wrote to memory of 884	1740	msedge.exe	92
PID 1740 wrote to memory of 1484	1740	msedge.exe	93
PID 1740 wrote to memory of 1484	1740	msedge.exe	93
PID 1740 wrote to memory of 1484	1740	msedge.exe	93
PID 1740 wrote to memory of 4080	1740	msedge.exe	96
PID 1740 wrote to memory of 4080	1740	msedge.exe	96
PID 1740 wrote to memory of 2824	1740	msedge.exe	98
PID 1740 wrote to memory of 2824	1740	msedge.exe	98
PID 1740 wrote to memory of 4220	1740	msedge.exe	99
PID 1740 wrote to memory of 4220	1740	msedge.exe	99
PID 1740 wrote to memory of 4220	1740	msedge.exe	99
PID 1740 wrote to memory of 2460	1740	msedge.exe	100
PID 1740 wrote to memory of 2460	1740	msedge.exe	100
PID 1740 wrote to memory of 2460	1740	msedge.exe	100
PID 1740 wrote to memory of 1936	1740	msedge.exe	101
PID 1740 wrote to memory of 1936	1740	msedge.exe	101
PID 1740 wrote to memory of 1936	1740	msedge.exe	101
PID 1740 wrote to memory of 3596	1740	msedge.exe	103
PID 1740 wrote to memory of 3596	1740	msedge.exe	103
PID 1740 wrote to memory of 412	1740	msedge.exe	102
PID 1740 wrote to memory of 412	1740	msedge.exe	102
PID 1740 wrote to memory of 3104	1740	msedge.exe	104
PID 1740 wrote to memory of 3104	1740	msedge.exe	104
PID 1740 wrote to memory of 3104	1740	msedge.exe	104
PID 1740 wrote to memory of 5320	1740	msedge.exe	106
PID 1740 wrote to memory of 5320	1740	msedge.exe	106
PID 1740 wrote to memory of 5540	1740	msedge.exe	108
PID 1740 wrote to memory of 5140	1740	msedge.exe	118
PID 1740 wrote to memory of 5140	1740	msedge.exe	118
PID 1740 wrote to memory of 5376	1740	msedge.exe	119
PID 1740 wrote to memory of 5388	1740	msedge.exe	120
PID 1740 wrote to memory of 5016	1740	msedge.exe	121
PID 1740 wrote to memory of 5532	1740	msedge.exe	122
PID 1740 wrote to memory of 5532	1740	msedge.exe	122
PID 1740 wrote to memory of 5860	1740	msedge.exe	123
PID 1740 wrote to memory of 5860	1740	msedge.exe	123
PID 1740 wrote to memory of 5136	1740	msedge.exe	126
PID 1740 wrote to memory of 5260	1740	msedge.exe	127
PID 1740 wrote to memory of 5136	1740	msedge.exe	126
PID 1740 wrote to memory of 5260	1740	msedge.exe	127
PID 1740 wrote to memory of 2976	1740	msedge.exe	128
PID 1740 wrote to memory of 2976	1740	msedge.exe	128
PID 1740 wrote to memory of 3176	1740	msedge.exe	129
PID 1740 wrote to memory of 3176	1740	msedge.exe	129
PID 1740 wrote to memory of 1148	1740	msedge.exe	130
PID 1740 wrote to memory of 5336	1740	msedge.exe	133
PID 1740 wrote to memory of 5336	1740	msedge.exe	133

C:\Users\Admin\AppData\Local\Temp\Risk of Rain Returns\Risk of Rain Returns.exe
"C:\Users\Admin\AppData\Local\Temp\Risk of Rain Returns\Risk of Rain Returns.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e4,0x7ffb81b7c188,0x7ffb81b7c194,0x7ffb81b7c1a0
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,5640320735186101193,10395363694222744078,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,4889082440128163369,8789089139635033690,262144 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,1029141849220594944,15005476861871696889,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3320,i,11704201073736735428,13180160789021653583,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3324,i,13783068564251244320,8613883700480509082,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,12640070968355816404,14220209362038712268,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,8213439751487210052,14611273978374395188,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,4964879371567477851,3160378934517967764,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6739225038076035442,579064447051604459,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5392,i,4508397487123839916,3832982236950049351,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5532,i,7714423841760555660,9517263115842160089,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5680,i,3844460519481270123,12932092362257331776,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7501500926385287350,6453900187623239968,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,17300452637071186667,8416734391336743068,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6064,i,942767328162811298,7404633797169841780,2097152 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,2032687745248237014,1159056155309117473,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13962415290709400374,6975642039567935262,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13962415290709400374,6975642039567935262,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,17874287549122544302,7066596379956058197,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,817085992872161391,15650843459285228664,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,14923258255930881190,8294500114209329135,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:8
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,5963289009783196377,1424144796964484793,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,3015167300458628267,492530872321613205,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8335262315934134500,14636673925412102113,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,2874468970081420746,2798813049479352817,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,11561573655097639147,15675991754100805536,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,11898312499763629362,1593673390116975596,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10715181758829202456,4107887321293527858,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:8
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6644,i,8073326896549767541,1242297392993745443,262144 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,12244777053470433501,6946031015241775934,524288 --field-trial-handle=2320,i,12677889401493316734,15615029719042824144,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1740_42427636\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 12801138a0c4206fe355f56d1aac28c57a669a764a3a8cf065855462e377dff6
MD5 fe0eb85c60680e52b022cf70c70d6325
SHA1 61854abbf9cfd3460b801449aca2f929877967b6
SHA512 14e5d900d35382391cf8636283d0403c3db7607acdabdab50f76b23bbbf4a41b614540d76bdb742a41e5aedcefa993f93c274e5a1e71b2b8883e973b84501ab4
TLSH
T109811B76C602D4F0DFB780708AD9A2B1713197D8FD43CE8A2D8FA9B90A1C3D54DD504A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 2e00ccec1889638fd33d372b172323e60377aed14bcbcd25fe6e76e47ab33077
MD5 b38334662e8f65f645f66db8c51c4b21
SHA1 a7d8c0319130738b14c57b6418dbaf1f8ad40dab
SHA512 55ff57647844dfd9decfdde1235ecb2b79fc94940ea63aea5e6acb59571f64206168bf3beb7d353f0652a8f60f2377c24522b103bdeef5149e972f1de7212c38
SSDEEP 192:DFjPNwswi77U85dxValrlh/4JEKN5rwz2DM78/r5z0uqi5wZU4:DFjVwswi77U85dxValrlh/4JEKN5rwzV
TLSH
T1D8025EF7C2D8C56F982255F86614AF2BDE5D052943283C1689D5DFCBE3E3472E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba987c496028490dd78b18c8b6a92a65aa9145b6b02069a714ebd9c7f95e190a
MD5 dc98189f4461d4bcb15fd806f45b1fb5
SHA1 56915a645ece571de790e81530ea612e3034ce17
SHA512 ba36f831e070fe8d083a13aaa4b7e3dffd20b1cbe504402323deb8f2a7994bb97f184636b41b266cf3499584c3724428dbd36e9c290bb9dcee4bfa7a49b141dd
SSDEEP 192:sxZQRZyM/jK1Ml8MiG/fTsRCqpaV8Edp8UHW6+WNb0q/BvkImnvfjDYIg4J:sxZQ3qG/fTsRCk0hHbx/Qgc
TLSH
T1DE52C9626A34597B8CDBD219FA54BB57E6F51472E2900E549AFCCA0C01F7AEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1191306d09b50919983ab9ef41ec7454728ec14318897f1953d0f6894ec1c368
MD5 c657dc308d3b97c627f2e62205cd6d02
SHA1 828e36f30c95d22b416a310e477d161b08197cc6
SHA512 f268ed1c999d4567f1958ddf67ef4127ae7f6856f928fa2eabeee5e339a46f88df26ade7916113be6389611c3b4530a6d0f5896cebc36f7ef596a60326e51811
SSDEEP 192:sxZQRZyM/jK1Ml8UQTiG/fTsnCqsaV8Idp2UHW6+WNb0q/BvkImnvibzDYIg5DJ:sxZQ3qmG/fTsnCFYLHbx/Bgj
TLSH
T10752D8226A34597B8CDBD219F984BB57E6F51472E2900E549AFCCA0C01F7AED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 745d54bdd4f6538513f7f66a7952800e23675b3f89baa62e23901dc68ed1c2a5
MD5 ee0534ca8281e4f4ef07c2431e6d8798
SHA1 c21fa25a6e45de2a4396f172bfc7425de5f3ef24
SHA512 bdb14f30802465d8d826ec31982733f3ae7d2dd618f27f15fc2c2945f02e1186e223be4dad86f985eb2334f8d0ce25846635fede86abe06a59ef3140218d8d4d
SSDEEP 768:DvseJQxWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5cLly0pp9ro8e:DvseJQxWvhfwnu1jaqcL88p2l
TLSH
T12CE20B2B280CCB7E4F844E6DEC2A6F966EE801CB57944D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a40a610bd213fc10d5ec11d9832008a012a799a20370c1dcffed18cd6edc3477
MD5 cb03e581f84b26bb3158d5ab78a318fe
SHA1 55ef02d4cc747490f89a2a0f7bae725b9f19ac0a
SHA512 75528545629599a0fc118a83883e233a1cb2fd161d5f65040c4739709b90466db650656ef4d4db55d7dc2133b978a11152518a4b93c10bd16d624d6b33aa6125
SSDEEP 96:KYH+KggmehuKqcCuTaKccoB+BzBCB+B4BABwBmWBgBFBNgB+BmK4BjgB8BmcBbBU:49pNBbB+BzBCB+B4BABwBRBgBFBeB+Bp
TLSH
T10CB19716313B0302387E2559A6A7D5374E8272A33498A97FBB7800668E27E135DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d947be5-8666-4a78-853f-4b75ac12d519.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5d947be5-8666-4a78-853f-4b75ac12d519.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6ef7799755c881fbd268fe6eeaffe399c4049e3652ebbd908b6f9b2a496ce940
MD5 018f8f26c8da4bd5ba5f64fee075d98d
SHA1 e3ae200b32c8d640a73e1ad0bce5e5e1efe066e6
SHA512 32a4be2a4696f159e90939421741435d74508cd8f5902dfc56456c3f99a315d45be01ea2827ec19bb951eb8ea2374253d97321f2088c0a25808498de8c93bb09
SSDEEP 192:uuVLsN3RQuuwM7IGFQmiU13kZvB4MTp8CfKBY6Fd3Ew8z1OqoU+9:nJsN3Rvk7DjcvuAfKhdUJn+9
TLSH
T18C421871AC799C2BA8E7F14AF58A33532EF420BB98845F44E9D95F1C00D76982707917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a8532b812c4530e6dbd6892d223b13518a5b4783d2f546ca93fdcde8749a4b89
MD5 4be753a704538dcee8fd3dfb6e16f9e5
SHA1 f247796bac5a56738cff543b6bd3b826d5137035
SHA512 bd425e9d0d7bef4fe172832a70e22cb702779e3a26d57cf4f232f983dfec8ae1a1c38282ec83423b028abd2dfc995b18e5514079152eef85b038d6a325920ead
SSDEEP 384:nnMiF1tNn/s3n9SfsNJ8TUNTUlIlrvk7DjcvuE/RfRzfKhdU5n/O:3F1j+9UAwgZk4XXzQU5n/O
TLSH
T189922A729C95CD3BEDFA97C4F64B33866EF011B798C15A84EAC96E0C01836AC170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c30fec2ce98f6ada88da77ea06a1808034592bc93d6f359e6ead46f79ec9106
MD5 ddb52586599125e180db83169a9d3ad9
SHA1 203c9a3ad58aaee3f946c9f1f871fae6b1866844
SHA512 3e6574a954a6a1b8726560faf85ee95c65717a8f54ee5119dc0f8620a67e98aa66d3a1f1f9b54ac54d774864ff74448f22cd1a29e5becbd583c858195f6cd13b
SSDEEP 192:lONl6vMtPQmiUyxkiThTp8CfKBp847irU/u:lONl6UtRsTHfK3kU/u
TLSH
T1B402F876BC685C6BAAA3BD45F48E27171FE421ABE5905B50EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 aae4f533a97b9a43cc68408db6ae4bfca679189bc42c9a2c5ca603aa8bd73b4b
MD5 b245a9f9e82235c65306bff8db935faf
SHA1 b86e29def23925b297a9fad598e5c893ca30003d
SHA512 b5a479f0d20b0e8114d5df04ec2d0768fba954e9f4e5badaebec579f703ea8457455b5ec9f12a2504e69dcdacea34e3c7e854db523418dcbdbefbde865c037e7
SSDEEP 384:nvbtNn/s3n9SfsN3rvk7DjcvuAfKhdUJn/O:zj+9Uyk4hQUJn/O
TLSH
T1BA625B72AC399C3BA9E6E149F58A37472EF420BB95C01F44E9D96F1C00D776C1707A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a9538eb9f82c40551e3dafaa022e527cb06ec9d2d05e46b8fff86b9bb9e349c4
MD5 f835b4c8ec2a547c9a7dcc5c7ebbd89b
SHA1 01df1d403886b6097f640c1718a4a7137bfc38a9
SHA512 d1c584a0a0719f85e7f0c08c6f890724d5c2d00869a44a1c5f3a531fc5f91fdf6eeb9e656b48110efd93bdda423faac338f64184e5774e1a57c8e92238fe5a39
SSDEEP 192:dONK6vMcPQmiUyIkiShTp8CfKBY6Fd3EJ80IOqoUU/u:dONK6UcRrSHfKhdUenU/u
TLSH
T14A12F9B2B8699C2BA997F145F4CA23576EB061BBE9805F40FAD92F1C00D775C2707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 1b82175e14a1c205db4b11ea2a1b1329c7f1286f112a81a5e30ec8c885090b3b
MD5 d65e155ded435370b53e8883106d4335
SHA1 99ef0ff7dac36dd9074928040d113bd0e49f394a
SHA512 fca0197984106c18cdd128a9fea6e8ee62dfd25bc6b2c95505b10ef3bb37aa98391ce1d31e04561eaa3bf25bc99ed0d016a4c0fe7f3feade8a868d1e87831b4c
TLSH
T1EA51296626A243BF8E752EB6DF04A6607ED8DEB426675040C2221A918CDB0770C173FE
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe593f9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe593f9f.TMP
Size 585B
SHA256 39bbde6a5e21f5fe36bcc0b135bc4e0627ef15ea683563878822184e12cfdb77
MD5 17f0087cfa787ffc9494a9f3fba68f69
SHA1 abd3b0d559681653da0bc96743d264103ac5d916
SHA512 b16d455c184427b59d6240310ff710b016b475b6f9133440559e510ba0721a93b109f7ed564a5a1ae833ee87505a5277b17bbd0044e98702302b06db0cece87b
TLSH
T19EF04171F8454E93CEF9D3B03D412E6E089933E8132432072A58C68321F189D85502BF
MD5 SHA1 SHA512 TLSH

Submit Download

2fd86088-4251-49c3-995e-80ee5df28a5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2fd86088-4251-49c3-995e-80ee5df28a5b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f620177768fafb4338844c3a856dda6f74c4b46bbe55137a0d22f213750c3173
MD5 a9a35a3dd8e0ec6147a023aa4f9a406e
SHA1 661da901e68fa7b8281a23a6ac30143eb7b2c623
SHA512 95ec3f0add8cb89e77c5096dad6c4ae38e56f8173c028f336e12a4326ac862bbdbbc3950dba16a92f15f30acd826acf92ebc46737532df355838eb93b5834cea
TLSH
T1F541195866FA1108B3B36E5AABF6A96E487FB9372E07945D00110E4E0663E40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

1310978a-51c0-4ac1-8bdf-d69e8b71733c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1310978a-51c0-4ac1-8bdf-d69e8b71733c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c33f7b6a-ecd6-4f50-98be-c67d09a525c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\c33f7b6a-ecd6-4f50-98be-c67d09a525c3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8255ea7f-831b-435f-8b79-2b1c5ac27798.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1740_1601704624\8255ea7f-831b-435f-8b79-2b1c5ac27798.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1740_676440409\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH