3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe
Size 11.4MB
Sample260708-klpt8adv8x
SHA256 3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c
MD5 2752c3d9c9f0d41c7b9d8b9b9d3352ce
SHA1 02a7d7c34e7c4d82672311179eac72833706cf20
SHA512 256364d351834e9f6fd1d0e69ff54f97e74893570477f6f5cc3dc54aad81152a20a3069f928ffb419e025642230ec286d565b6952192ae3cbd18f4603ff3c791
SSDEEP 196608:Vh/MFs0a238sSsUROsbK8HguJzq396ftmlOcx0Db9a9mABLFMk0e3:7/cTP3dSHOO5HLW96ffGitkpd33
TLSH
T105C63380BD49E109F0CD5830E1E4E2FE2476FCBADA9314AF54F97E4A3AB32469D0551B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5608	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5608-0-0x0000000000400000-0x0000000001B2C000-memory.dmp	upx
behavioral2/memory/5608-11-0x00000000077A0000-0x000000000785E000-memory.dmp	upx
behavioral2/memory/5608-12-0x0000000000400000-0x0000000001B2C000-memory.dmp	upx
behavioral2/memory/5608-13-0x0000000000400000-0x0000000001B2C000-memory.dmp	upx
behavioral2/memory/5608-14-0x0000000000400000-0x0000000001B2C000-memory.dmp	upx
behavioral2/memory/5608-15-0x0000000000400000-0x0000000001B2C000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1680544067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_890936067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_890936067\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1536241985\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4504_1536241985\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279737157977595"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{08E1E5A7-5CCD-4141-82E7-AFDDC896793D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4504	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5608	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe
5608	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 4504	5608	3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe	88
PID 4504 wrote to memory of 1404	4504	msedge.exe	89
PID 4504 wrote to memory of 5904	4504	msedge.exe	90
PID 4504 wrote to memory of 4972	4504	msedge.exe	91
PID 4504 wrote to memory of 4972	4504	msedge.exe	91
PID 4504 wrote to memory of 4972	4504	msedge.exe	91
PID 4504 wrote to memory of 4800	4504	msedge.exe	92
PID 4504 wrote to memory of 4800	4504	msedge.exe	92
PID 4504 wrote to memory of 2500	4504	msedge.exe	94
PID 4504 wrote to memory of 1564	4504	msedge.exe	95
PID 4504 wrote to memory of 2500	4504	msedge.exe	94
PID 4504 wrote to memory of 2500	4504	msedge.exe	94
PID 4504 wrote to memory of 1564	4504	msedge.exe	95
PID 4504 wrote to memory of 1564	4504	msedge.exe	95
PID 4504 wrote to memory of 2220	4504	msedge.exe	96
PID 4504 wrote to memory of 2220	4504	msedge.exe	96
PID 4504 wrote to memory of 2220	4504	msedge.exe	96
PID 4504 wrote to memory of 1476	4504	msedge.exe	97
PID 4504 wrote to memory of 1476	4504	msedge.exe	97
PID 4504 wrote to memory of 1476	4504	msedge.exe	97
PID 4504 wrote to memory of 5048	4504	msedge.exe	98
PID 4504 wrote to memory of 5048	4504	msedge.exe	98
PID 4504 wrote to memory of 2828	4504	msedge.exe	100
PID 4504 wrote to memory of 2828	4504	msedge.exe	100
PID 4504 wrote to memory of 5392	4504	msedge.exe	101
PID 4504 wrote to memory of 5392	4504	msedge.exe	101
PID 4504 wrote to memory of 3108	4504	msedge.exe	103
PID 4504 wrote to memory of 1872	4504	msedge.exe	106
PID 4504 wrote to memory of 1872	4504	msedge.exe	106
PID 4504 wrote to memory of 6016	4504	msedge.exe	107
PID 4504 wrote to memory of 6016	4504	msedge.exe	107
PID 4504 wrote to memory of 692	4504	msedge.exe	109
PID 4504 wrote to memory of 1984	4504	msedge.exe	110
PID 4504 wrote to memory of 5592	4504	msedge.exe	111
PID 4504 wrote to memory of 3760	4504	msedge.exe	112
PID 4504 wrote to memory of 3760	4504	msedge.exe	112
PID 4504 wrote to memory of 5280	4504	msedge.exe	116
PID 4504 wrote to memory of 5280	4504	msedge.exe	116
PID 4504 wrote to memory of 5004	4504	msedge.exe	117
PID 4504 wrote to memory of 5004	4504	msedge.exe	117
PID 4504 wrote to memory of 1556	4504	msedge.exe	118
PID 4504 wrote to memory of 1556	4504	msedge.exe	118
PID 4504 wrote to memory of 4732	4504	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe
"C:\Users\Admin\AppData\Local\Temp\3d7cf8c4b8b4fa71df15ee5eb02a48dc6eb824eed0cefb6d3db884a09b0cea8c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.qq.com/doc/DV3ZEZ3BGSkdkY3JI
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x364,0x7ffe44bec188,0x7ffe44bec194,0x7ffe44bec1a0
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9897483601915466665,9300095522433827104,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6527604909024494400,15316104624879575265,262144 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12037099511903490971,13545345475215805693,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,5705799955330720895,2405153924491119084,2097152 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,2345737757745019242,6314425872574665106,2097152 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,4503242832042840966,9370626300842981154,2097152 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,4057669192652802493,16229694838500626106,2097152 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11099457992617662238,12020131457698123758,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,15249193878157946230,13998772149850792549,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,15320383773707291514,3440299113976911195,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15803626753214531675,13124019780145997338,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15803626753214531675,13124019780145997338,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4640457170391338120,12923514372971059855,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,4974833154724271252,17721365226884761935,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,18024568710474878528,1393611310668747003,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,4196186578610524395,3663442674816228718,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,4641573288277719648,3022539645107486501,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,446417391779533171,3832697314529648740,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,2695710468071197514,12185688798313680358,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,9922342327515219640,13392989563194833372,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,8073616717976458997,11328817806150066202,524288 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:14
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,4014612259450446739,12395059108569499756,262144 --field-trial-handle=2516,i,6345228938151582200,11811931205438744014,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 0c740d816ac838555cd91b4778d47b07c378b892c22a2087dc1e251a9da95a96
MD5 d519efc3ca769b1f911b1928d02cbb35
SHA1 66d1280fb5f682bd30597463a5ec2f917b43375e
SHA512 0521ee8dc2c820153483667d25381aee32f501dc783c1cfabefbb248043b0c07f7d6b3b00a808c95111e76e1c93126a5645d404111dd9178bec0ce31cd65f57b
SSDEEP 96:aQt+m6Djdp6Cjp8BbQJ8unLsGEAC/YEbz7EDIjctoRy5c1IJFpuVPO8MG8Milly7:atro68uno8UfgXuZVO1r2v
TLSH
T1B102E91643FACFD1EB276C7A54DC89A2363562A5A183EFC33234603DBC0638C558E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f140d039f1c751f47a4b29355d45ca518be590426b1de4eb5deb47887d2bc239
MD5 e84833ec598aa4902b92afe2aaa7b16e
SHA1 5815b75e3e9be711532343b2b7187bd5297cd264
SHA512 08778c623c321fd13b1e049c8b020fbb39bb36800d17fca9bd07f303dcdc08f2d69787a9cbac8a532bec07a8722cd473797955c0b23b1e6a49d164992fb6c1ee
TLSH
T19B61E95347740FE9F3298E7361E1D8D23A31BBFA4247AF132074B178F91A755681A234
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d59ca50a2a4897471d08cd82a0d879019eb5527d2b98cc695460c3d285073a8d
MD5 baa4e60c198d29e2be8b55248efee858
SHA1 e26808b3eace9cb3c002b7df26a076885592e3cc
SHA512 5a4f51b13f1b67eb2f85a1ca4d154d510dfff9398cf794f1b9923b8097c43f995b838a748c40dac762c7e3db3fd3a716f736bc3ea341aec7d3845ffe965b9747
SSDEEP 96:VQt+m6Djdp6Cjp8BbQJ8unLsGEAC/YEbz7EDIjctoRy5c1IJFpuVPOUMG8Millym:Vtro68uno8sfgXuZVO1rL
TLSH
T17C02DA1643FACFD1EB276C7654DC89A6363562A5A183EFC33234603DBC0638C558E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59cea1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cea1.TMP
Size 3KB
SHA256 6ce257ce8aab3e5c30f2aa833a2951d7a00abeaf4dd40b0885ac95f193f8a72c
MD5 c9cf40916b6ee0a45c06341cdf959e17
SHA1 c8f71eeba6f2dce5accd3cdaa947ebc69ab9898b
SHA512 8eae99d45ceb7260e1c3c055c075151f212d770cb1db3fb14cc4f5cd03a4d79cbd20c4ff3294baa14e47a3b83069a5446247866ac9afd2063b35ed6c6fde5f38
TLSH
T13861E95347740FE9F3298E7361E1D8D63A31BBFA4147AF132074B178F91A755681A234
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_docs.qq.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fbdd412f32a42238bfd6097136525f824dae488fa3990239c15cc47e653553b0
MD5 1a575a226e580f3f653a03973a661e25
SHA1 50949ff44f932d5edf71cd8bd481d2b98ce8e0e4
SHA512 86cdbb59036f5689195f2ac2e6e72933d04212a0f74561c78bc784374c8a3a1d39dee214a41aaba60b7d0fe5112807ac8ffb9942590bf11e81c581b59ee917ef
TLSH
T10181FFF787B8456E8A1195F0EA186E2BCF5D0512436C7C9E85E46F17A3F3871E180E4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7862c9da79f166a8f6ac069810caec4c1967dd50e5c7eaa0c96ff475ff83bd5d
MD5 d3036d18d5245289c5a09f610fb54ef1
SHA1 736810d9e6bdbce1c1f8f78883f23d33c0b9b53c
SHA512 22523ffa77ac20dcab145355e18ff5fcd9af56d7367ce65d2d6cb10bece1d847c210294a867e8221c7e1631dad3abf3d41476efbb66ffe8ce59aa2174489c0b5
SSDEEP 192:sxRyRyyM/jK1Ml8wCv/fWs8CT0ZsWOGzoA8pZHn/g6+WNUdJZ/YPadlN+GRIgtJ:sxRys8v/fWs8+KWh/5+/VLH3
TLSH
T17B62C9566A24993B8CDBD20DBA557F53D6F81573A2901E44AAFCCB0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1ef7988591c2466bd57d3d38f42673421d4738209c5aad56d046b4773e32c95a
MD5 1fe4f6ec0b2114602ea468288cee9a2f
SHA1 494ddcedb058f916c9a94d099bc78694c06ffb06
SHA512 10a785d6f8455ab0f88fc6c6d42bd6f2a185722f6990353eb750781679a95ee144bdedea74fb9e8d1e8048d0ed0aae1fa94909949c7702b5bbb731d76f36f9c1
SSDEEP 192:sxRMRyyM/jK1Ml8UQNCv/fWsMCH0ZsWOCzoA8p7Hn/g6+WNUdJZ/YPKdlN+GRIgr:sxRMsqsv/fWsMOKw7/5+/jLHr
TLSH
T1D262D956AA2499779CDBD20DBA51BF53D6F81473A2901E44AAFCCB0C01E76DD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b19400ce811377f3550a38f2a01250a71be24eb37d340195d356ef82a6e576d
MD5 2df822f98bf50bccad26de157ca8719d
SHA1 3e468f9155b4c811c606a3409392e4b3c3d79ef8
SHA512 26ec9692e932621ffcae3adacb55d124bbac2edde958f94e5d620795abc46f3ad7be3bb65b0727f48ae427c17c76ea999a053f3107a1ad0cd16b1fcf83bffb80
SSDEEP 192:sxRMRyyM/jK1Ml8wCv/fWsMCH0ZsWOCzoA8pZHn/g6+WNUdJZ/YPKdlN+GRIgD9J:sxRMs8v/fWsMOKwh/5+/jLHr
TLSH
T12162EA56AA34997B9CDBD20DBA517F53D6F81533A2901E44AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bfb891e952ac611bb141739543ba0b870edbe300e728c8834baa16b06d984b83
MD5 24a24d348a9f90952d70ca814cac6bdb
SHA1 28be1daa991ee9f2d096f77b1e078c1286017a6a
SHA512 4da98fa597d8224a920c1aaafbb4ca98ff2aa098323ac9a5ce9e65dc8191413202ec5274dca46af5090620f4985549a9bc3230c92a7431c083a48b91cc5b931c
SSDEEP 192:sxRVRyyM/jK1Ml8wCv/fWsMCT0ZsWOGzoA8pZHn/g6+WNUdJZ/YPadlN+GRIgDHJ:sxRVs8v/fWsM+KWh/5+/VLH9
TLSH
T1BD62DA56AA34993B8CDBD20DFA557F53D6F81573A2901E44AAFC8B0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 db566d0157041429b497b02213c6f8438e0517ede335a68c76e681b7b313f823
MD5 64ef6a7375da9f8627cd75afe32b1b17
SHA1 c0251b19055a686b91c59597a71e93ab6eeb203d
SHA512 2af6c82c8ab5f0a50608b85e80aeadc1c2c9e136d95c4d055fdd76e0408abb59d3f12cd9bfcdc1d9afa25140b02da53eaf58862afea67e92589f48d00939ee2f
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0Kfj/edroVXx:5+McBwE7MpWgFZfslu1jaPKfTeWVXx
TLSH
T165E2EC3B680CCB7F4F404A9CEC29B99A6DE801CF96D8895447FA881C03C66EF56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f340b808fafa9fa07eec310becde92c3437f580b\9d18fedf-840c-45d4-a481-b5ff8f12df23\index-dir\the-real-index
Size 72B
SHA256 c22d320e81d37794e93080080098d5581c35ff7e8a17eb595c7e451f233b3df3
MD5 92871a556444cab93cd04fb138fdd346
SHA1 f5e5b620a729840e5bba0aed2acc21ea59cc3db6
SHA512 c64ef11eced0e23cb4172caf9d0d767b1340328e1ce6e9e30086b88e380ad385577b61110ad690fe513143c51cf4d87a8537484a41d1a937e15a999dc6cb8702
TLSH
T17CA0022019D0A41BC01113B460C2118676315DA40357030160D44479CC527944D41509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a377c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f340b808fafa9fa07eec310becde92c3437f580b\9d18fedf-840c-45d4-a481-b5ff8f12df23\index-dir\the-real-index~RFe5a377c.TMP
Size 48B
SHA256 3a4719fff0ebf4bab52365cd7ca6f7ab1ddc44ec452d53c0b193d6edfc756a57
MD5 95bf4557644f4e3ca0d60d216e17845e
SHA1 e02cee0bbe86276589f339f940d5152984716d25
SHA512 3082bfecb82265ccdf5097e8c41dba372a3366506b60468948c202e76e4237311b70cf2e4b0ff629abb0623e89f6b1260b15b8154083a4231905d4bf0f56dda0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f340b808fafa9fa07eec310becde92c3437f580b\index.txt
Size 159B
SHA256 e7afce051c51dccde41570aa4c2fb4568994892d66082190b93bb859dbc93b97
MD5 148b23c4007846cdaa7215be6a826936
SHA1 67b9595f6bbb3fedcceab702e5557dacdf5089e4
SHA512 5e3c39a5c6ca2f85f8b275f82acbfce686e1cf03f7bdbf0db3fa619164413880e6cbc8a2035229ad2d3101e7045cf5a2070ea9753a24672840b6ed328a470e96
TLSH
T18CC08C6F641611241F339F4043811873874A3EAB6A41CE8890E80014A93AA26B223D39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a37bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f340b808fafa9fa07eec310becde92c3437f580b\index.txt~RFe5a37bb.TMP
Size 165B
SHA256 abe706ac541399c6a9d3095f184472f30315a09c65fd1caec8fc9f0289f71550
MD5 d2bbbbaef4e4e4a94d536f221ef3b030
SHA1 e8c9ffa394672d7e8eff301ac7e66ff8941032ed
SHA512 daea2f68d05d2cbf117eed3c043d3e6ab6cfac80a7a411f6a0c436a4992ef7b315a80d79670b44825d79861d2a9dea009da9518feb9a8e2fbfbeba2695a9c81f
TLSH
T121C08C6F642611241F335F40829118A7875B3EAB6E41CE9890E97114A93AA2AB222D39
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e48ff150c0436911a9df06ffe4b130ce7218daad3e41a31b3b12fdd6fd403ee8
MD5 2074a8ebf999f1375f8d395a3e924b62
SHA1 d952221459e14e3b08779a8bd686b55509527977
SHA512 4fa39a8130e1e9b0f3cc03f73b8694ae8916ec9b8ca287aac10596465b73cee2e0084eb4fc359f1524b1cbfb5390266125d334580fd9d1acba014e95b1ba9082
SSDEEP 96:KRHQ1xHF1ZWBu0g5ZK4wg3Zc/32p1qHeTieYgQGWAltgeGK4DgcGcW+9M+KvWK8E:CHQ1xHF1UBuF5Twg3m/32p1qHeTieYgP
TLSH
T1B691F104723A12803C3F694D89A4D86796C5B2A33015B53BB7A806E65F67E019EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff0f7366-d1c0-42d1-b35f-2e4b9d06c3e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff0f7366-d1c0-42d1-b35f-2e4b9d06c3e2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 468042040ce43063bc77db61e70c5bd0d37895d82e65ef5f3ae8bd221bc36f95
MD5 c13c7c34bb5d4203d47788a57103d3e1
SHA1 86c13cfa043557d8dc31adb6af863194f6084d45
SHA512 5e57d755ecf34fa1961b56b2f2ce50936a574468fd12b15e0820abae375f4b2ce8c3367498ad14618fea9953bcaae16f3b73d844bb6a39301ae282de508dfa24
SSDEEP 768:O9j+9F3YgWuRJGkMf5xi5WFbxsz56f0+ynob4aMj4v:O49F3Ygsf/i5WkQ58aLv
TLSH
T112F2BF32AC26DCA75DE6D289F7573787AFA415B385C00E98DADC6F0D05836AC1317C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a906b485035fa33f7b9d5f0393e30401767e9d320f247ce1e7c42a71a67197f
MD5 dadf6604af0fcb0647a6c64993b60564
SHA1 384a62831bdbf048b3d7085190ed50e57443f39f
SHA512 6ca5430cb247c7972cf1957cae1cb2a0345f29ea7850614ec683c2ad342a2cd318466ba4ac828d05ad27c4f015b54e625959ad3d07fd1ca4fe314c521a0448da
SSDEEP 768:OYrv+4UNbdf3cgWQRJGkMf5xU5WFbxsz56f0+ynob4aCe:OYbsbJ3cg4f/U5WkQ58aB
TLSH
T1E403CF31A829D9B35DF3D285F25736837EB425A3D6C00E98DACD2B4D464799E230BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 be5a0e7d080c5dd92f59ee713f23e9df289c865c289777076227fb888967080a
MD5 54a1192a919aa067595759cac345575c
SHA1 3647afd7295b2750ee152c8f968a0403903a04ee
SHA512 fdd56b8cf545876b6b50cd35d2b13604d7518178a48001ed83011a812111e46cccb55b5ae1f68f650fe444b8d74eb94051e492e0e799d7ea7512357a2656d916
SSDEEP 768:mpFJj+943RwgLgWzwif5xe5WFbxsz56f0+ynob4aMj4v:mM943bgef/e5WkQ58aLv
TLSH
T1301319F698D38977D99E8787A73D6E469EBCD163B5844884B7C81D4CCC825BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e014419fdb919f3a242a856d36191ae2bcc1906f3ef31108338cf44bd50ed0af
MD5 67147140949869a1ba843b524886cdd3
SHA1 ce5af58c0f1824d555ba12b04b65c297c6d3f7d6
SHA512 40cb95cc8040038bef143b8c8d691b000ef2a6a2926776bd5d30faf712ed29dfdd54f303e5e64113623e51d973945ed89d4418662d20eb8fae325bd6b1e2d3d0
SSDEEP 768:Dirv+4UNbdl3tvDTJGkMf5xh5WFbxsz56f0+ynob7UixK:Dibsbr3Vsf/h5WkQ5PUX
TLSH
T15903CF36A82499B78EF3D685B28B76477FB81163D6C00E98C9DD3B0C469B49D2307D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

b5c92050-fcbb-40e4-9b17-b2d5f4ade322.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b5c92050-fcbb-40e4-9b17-b2d5f4ade322.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4504_1882826983\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Roaming\Downloader\libcurl.dll
Size 729KB
SHA256 cf6e5d1db6eb6965e639db3bdffaee8eb38c9a603ed5317e2e7c92e8ea7bdc1d
MD5 f28f2bc74c40804a95c870ea710d5371
SHA1 8654243c7de98a74ede2bcf45e8506f92e77d6fa
SHA512 2542aad8117f91a039d27fe4d844675dd88dc267cc8643c6b2820fc05ab1b02ee05c77d7bdc6d9f56a992572ab67bfaab32bda3b03947a2c7175cd16fbf5726b
SSDEEP 12288:Hq0LmxUpXBg33CLjrdC0r6NW32atYaAhgi28B0J1c6H5Gx5GSdjejj7K/Ho9kRlp:K70XBg33CLjRC0WU32atYakgi28B0Jla
TLSH
T189F48D21BE80C032D2A72435A2BD8BB71CBD6430276495D7A3D468B99E701D3B73E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5608-1-0x0000000001B2B000-0x0000000001B2C000-memory.dmp

Download

memory/5608-11-0x00000000077A0000-0x000000000785E000-memory.dmp

Download

memory/5608-12-0x0000000000400000-0x0000000001B2C000-memory.dmp

Download

memory/5608-2-0x0000000010000000-0x0000000010116000-memory.dmp

Download

memory/5608-13-0x0000000000400000-0x0000000001B2C000-memory.dmp

Download

memory/5608-0-0x0000000000400000-0x0000000001B2C000-memory.dmp

Download

memory/5608-14-0x0000000000400000-0x0000000001B2C000-memory.dmp

Download

memory/5608-15-0x0000000000400000-0x0000000001B2C000-memory.dmp

Download