0480a2b7b44fd8d7b3ef1d38715a456d77e5bf52235a64fe0542b73698caae61

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ELDEN.RING.NIGHTREIGN.v1.03.3-OFME.torrent
Size 271KB
Sample260713-wlevssdv2n
SHA256 0480a2b7b44fd8d7b3ef1d38715a456d77e5bf52235a64fe0542b73698caae61
MD5 a224a40c5fc6c006997f931cf46161bb
SHA1 681573569672274d594900706a7e53923421e263
SHA512 ca376bdf7ba8810b3f91af79feb02e5b1a0821cb160b051e8fd812e2feea150dbcbac3c938abf7ce8827801dad3086a8542267f2abf4fdc3bba32c58edda36d1
SSDEEP 6144:laBOmW3bKTqllUYfEifLwubeE/J5buOEZ6C05EwkriqJ:jaqjUY8aUueKSZl0uw0HJ
TLSH
T127442264F16A1FB1746EBDF99CE9B1716615188461B67033EE809F330F2784903E5EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2204_434366417\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2204_1130697078\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2204_1130697078\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2204_269688426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2204_269688426\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284393021569481"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8716B3EF-E159-4969-8772-E5B77CC08FD1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	OpenWith.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1712	2204	msedge.exe	90
PID 2204 wrote to memory of 2692	2204	msedge.exe	91
PID 2204 wrote to memory of 5012	2204	msedge.exe	92
PID 2204 wrote to memory of 5012	2204	msedge.exe	92
PID 2204 wrote to memory of 5012	2204	msedge.exe	92
PID 2204 wrote to memory of 4800	2204	msedge.exe	93
PID 2204 wrote to memory of 4800	2204	msedge.exe	93
PID 2204 wrote to memory of 5192	2204	msedge.exe	94
PID 2204 wrote to memory of 5192	2204	msedge.exe	94
PID 2204 wrote to memory of 5192	2204	msedge.exe	94
PID 2204 wrote to memory of 3424	2204	msedge.exe	95
PID 2204 wrote to memory of 3424	2204	msedge.exe	95
PID 2204 wrote to memory of 3424	2204	msedge.exe	95
PID 2204 wrote to memory of 5196	2204	msedge.exe	98
PID 2204 wrote to memory of 1980	2204	msedge.exe	97
PID 2204 wrote to memory of 5196	2204	msedge.exe	98
PID 2204 wrote to memory of 5196	2204	msedge.exe	98
PID 2204 wrote to memory of 1980	2204	msedge.exe	97
PID 2204 wrote to memory of 1980	2204	msedge.exe	97
PID 2204 wrote to memory of 2504	2204	msedge.exe	100
PID 2204 wrote to memory of 2504	2204	msedge.exe	100
PID 2204 wrote to memory of 1964	2204	msedge.exe	101
PID 2204 wrote to memory of 1964	2204	msedge.exe	101
PID 2204 wrote to memory of 2424	2204	msedge.exe	102
PID 2204 wrote to memory of 2424	2204	msedge.exe	102
PID 2204 wrote to memory of 4520	2204	msedge.exe	104
PID 2204 wrote to memory of 5552	2204	msedge.exe	105
PID 2204 wrote to memory of 5552	2204	msedge.exe	105
PID 2204 wrote to memory of 5360	2204	msedge.exe	108
PID 2204 wrote to memory of 5360	2204	msedge.exe	108
PID 2204 wrote to memory of 1680	2204	msedge.exe	109
PID 2204 wrote to memory of 1680	2204	msedge.exe	109
PID 2204 wrote to memory of 1680	2204	msedge.exe	109
PID 2204 wrote to memory of 4708	2204	msedge.exe	111
PID 2204 wrote to memory of 4728	2204	msedge.exe	112
PID 2204 wrote to memory of 2984	2204	msedge.exe	113
PID 2204 wrote to memory of 5440	2204	msedge.exe	114
PID 2204 wrote to memory of 5440	2204	msedge.exe	114
PID 2204 wrote to memory of 4792	2204	msedge.exe	118
PID 2204 wrote to memory of 4792	2204	msedge.exe	118
PID 2204 wrote to memory of 4412	2204	msedge.exe	119
PID 2204 wrote to memory of 4412	2204	msedge.exe	119
PID 2204 wrote to memory of 3808	2204	msedge.exe	120
PID 2204 wrote to memory of 3808	2204	msedge.exe	120
PID 2204 wrote to memory of 2560	2204	msedge.exe	121

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ELDEN.RING.NIGHTREIGN.v1.03.3-OFME.torrent
1⤵
- Modifies registry class
PID:6124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\WatchUse.xhtml
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffcd606c188,0x7ffcd606c194,0x7ffcd606c1a0
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,13651048238377850086,7135677872856519191,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,16828170417036661789,5386596368150680328,262144 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,16346492169248496938,3359340385225922968,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,6743813196449082042,6920491553699981935,2097152 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,12582400038712974250,11004141524957289924,2097152 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,18239662564526212376,7611011135728766755,2097152 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5164534332174482680,15856225041971117100,2097152 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,8321635827883452230,16463750025127061281,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13847290325624605969,1284063033164312786,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,18140221151193189235,10907649168524977136,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9201368780559643931,12798553324848184136,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,9201368780559643931,12798553324848184136,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,16089554034017763569,316310860457079076,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,5109948023925302518,7758607310766330238,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6412,i,12049037104003485735,1841463571235314479,2097152 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,7025316564961003319,17836881342827853829,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,4144130289051245622,8804539196293652485,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,12062928969318333548,4919255974350728181,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,8827820924734336630,7243682203769975057,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6624783487040804947,59947083022320581,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,11773773995269627465,12064348424370901744,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,4730841660296084648,12765993522347842017,524288 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5888,i,4992284570789261715,7969524364747063937,262144 --field-trial-handle=2356,i,16485221460542454213,2383204238693680071,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 401KB
SHA256 98f245dd4ea1657ec5caee3b61220fe47bdf506065cc6cb3157571c88c360407
MD5 1c4c724076400ec414becc254150cb71
SHA1 b7b863185d901d1d66dee8013eeab87dfbbb7584
SHA512 78d9fc2bed91ac369b7574f103da89bd820a7db176c43adf9c083f9e74f3cf7d93fe25998af31d44f55378d352ac855c04f15d572d9c8d8c2b81453ed32402da
SSDEEP 12288:PtfgtaUcQd6jMZlyexMi26SLYUmYEw+Qc8n4KhUSQOgnC8Hz7:Fgt9CwZ4exXwkUqqB48NgnFHv
TLSH
T11394234FDEB0F07B772C88531FE4A80F66D676A209BDFEEA15F15726E31D0A109A0548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 67KB
SHA256 2b5ed041424f24d8f0473eb3defed6fe82ab0c9c21d51f959935e8c7f569292a
MD5 068702a04ed266e5f85a1bd7b7beb3d6
SHA1 9c9e100c94193fe904ca224d8ae3fd766cb54db5
SHA512 50e31424bbe13a5080c5634d89eb6d100284ef15cea34ac21dcc5548668577c01c3cee500705b9f2edc51aa76f0d13c6b062d58e4e80d5ab0a9142c40a0a80d9
SSDEEP 1536:E3B7N5R5hwirOGHn+ofuxzIJG6vAzDqWKGWM03PL8jAN+Zh5aSUgK3Gkb:EVN5zYzoiUI6vAzBKl0jA0Zo
TLSH
T14E630285CE4DAEF296352B7AE31AAF51550CD2B5CFAE62BF3EF1C11342C4C55886402A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 32KB
SHA256 1a9fb14265d4be1ec64591aa91109141b2fe9ea306ad33e876c024f3922b5fe1
MD5 99455129eb036f317ec3c14803644a10
SHA1 b04d65857359bb3273bb7176cf462f3674e505be
SHA512 0582c8cef7a10876e61e6f20eca99666480e5451aa40f29ca4e63b56f30e3f246b688b213ddfa2e2a64933bfab9ddbf387b6031115bc2ce1d940832a37fd72f2
SSDEEP 384:oLH+SezZ45YN5YP901TRYyG2/IFf9ni64wjkGQKMd+ZRzQNP:oLHIzZ4ODcYTRRF/IFf9nd4wtg+C
TLSH
T177E2E012FF055BC4C19E71B6A62AE93ED2F34458304834564D95B6E18B37470ED3F947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 43KB
SHA256 e753bb54bfed6b8e23865b85fff621bed15d2d003a5fd0ac4051e32eae5f4276
MD5 fe59870e1e2ed93037179b8082bf38bd
SHA1 2ab0ef0f6b6077cffd00ea86ae95ba5757c429bd
SHA512 2cedd56631c824726fdbb9b27f1d800e33bccacca3a40c2d07a5398b09a16087f971bf3b55c6a184618ee7cde4ff23c5dd91430623c5bfe50354537579975acc
SSDEEP 768:ZGe5ly7m6NyDs95E8usyufZ0GXAfJHj0CXKXwkrgXj2PrrLYNrDTmK2G1JRL:ZGe5o7jyDsvEhufyVfJD0UMgioDCKL1H
TLSH
T10F13026F4B02D6D0C404169E221AFAF284ED06327B289A5DB57F55CF78C1EF36614E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 26KB
SHA256 7e1b3886862b79b5c1e0156339d0c61461b98c1322f8f8638e767958443a26bb
MD5 8db914ea4fb536b51c967dbc40a1702c
SHA1 1e0bc8a02343c8b7c3bfe540cfb84390b1c96089
SHA512 dc55ac5f38229a08648f51674c796d7e9c3b56589dec5c452371cebe9b54ca67d4dc50a1565f75d3ec3adc01b3015cce6c403fca30994925133e420f96164422
SSDEEP 768:ZiNTVJ42sTg5M21VZ8RM9nFsNV/jyZZAYKj3:ZiNTVJb9pjZGMdOyZZAYq
TLSH
T15FC2F15A3002D72084FF907682E0293521A8A7E2F7E1F55D518E0BECADB57F67641DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e5f7b39eb56160cb1da9a2831d4e0bedc410203b36ee8026cd4f2385d294af7
MD5 99579e466888012933f1d45dae62ebf0
SHA1 7ac86db3ed4764bd37757f738a561d8b2fd88c0d
SHA512 0fdd929f81fcadf36373821d60ed2e3699d096101a8f633e2063e0635bf8be731628123de63c71483d6e5a782312bf5a6074919965aaca9f5a95168c54c3d5b6
TLSH
T11D811B54A2ED25C2DF0418B16B730CA93CE8A098111EE34343069FBCE56BEE115FDE5B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2a5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2a5d.TMP
Size 3KB
SHA256 9206c7a59216b79203fadf2ade2520d29a42e58b152a9285dd920209ff814ce9
MD5 c22913605df72304077273d65cbc7909
SHA1 69915accb5386b655050c221ef137c7557112906
SHA512 5343141d21fccec24e06b871366d35ffce083d5d40f04622d23ffc175642e7b3cf253bcaad9746900c69a444845ffa9a3061ac4b18118345a337eb2eaa23bd7b
TLSH
T135519591632DB9D2DF258C75AAF3548D31F968E9010FDF0280426F34E6A6FA470F106B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d34a176256193d3fa650a576161a4016fc370c47448e45418b3b1fe2e6e4f703
MD5 b11e217247b309f7699af3b422acb4e4
SHA1 fa3215f42dae3eae23f97d898dd493f3d1f724e8
SHA512 1ca31dfc2c502452309986eab3c1d44b0a2666e8c67b48a98b41c7093ad6965ec75c4d6777e41b6381ff2a3045951f4ca08006bbb4e7a1fe979bbe67695a43a3
SSDEEP 96:D8OGUfqjfa1HzBwBj6YEGc5GORBU/HiDGO:D3GUfqjfa91kj6YEGc57HU/CDGO
TLSH
T10791CBF3C3E9866DD91191F0AA186F1FCE190556436C3D5A89E4AF0BA3F24B1E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8b32fe772ac51fb4a315947f6fef78afd7bf722b89d9464e799b6b5787d390e8
MD5 5db2d654651bab985a514a168097d833
SHA1 c2ded431e0deba5de738b622f0db5b279d8336e0
SHA512 95e269078c1232f6c2ca92d4db7b00997bded76cb9838bf710bc5782f9f52bbab0848e726780eb0dff0d4f24f953c9c52144a14e15f37bd24893f8fcae2a5e23
SSDEEP 192:sxRoRqyM/jK1Ml8wbVv/fNsAgA0ZuzoA8p49/g6+WNIYoXCYfGuIgtJ:sxRoMlVv/fNsJAKTA/5IyY3
TLSH
T1CB52D915AA285937CCDBD31DFA557F93D6F91573A2901E44AAFC8B0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3ef87708b5f62281d0d0a23fa2bfd7173986c3cc60171ff4cbb710e179627516
MD5 5f05a22ab3c2b233e014ec6fab608669
SHA1 34d1396cbbd0861f7c42add33b89b436d44557ad
SHA512 72281273af17a4dc7c65126cdef912337e0e62f940cea10d6338cafd1300f64986f27114f1861d8d0cb9e8da4bfbd4d52f818d25cc1efa1d303d3cb1716ab79c
SSDEEP 192:sxR3RqyM/jK1Ml8wGOVv/fNsdgA0ZLumbeGoA8pJx9/g6+WNP52/Yo+CYfGuIgDF:sxR3McOVv/fNs6AKLuLNZ/5E/1YR
TLSH
T14272E916A6385D3BDCDBD21DF941BB93D6F81473A6905E48A6FCCA0C04F6ADD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 01e344aad8c8cd63ac28905097a8a2cb5bae82520cc3d6a92bd44e238c6525d3
MD5 fdf8c539b49db61f796ac23b8063a58a
SHA1 449f2108a90480e2498a18fdf2a905475950a6ce
SHA512 d1526105b9c4799784be57a354d1583bd75076782ebf2b56daa4ad8cf829261c3e7677e061d4cc628dfc93ed64931e074db6dc6b72b0e43af73b23106cb4e68f
SSDEEP 192:sxR3RqyM/jK1Ml8UQ4GOVv/fNsdgu0ZLumbeGoA8pXx9/g6+WNP52/YoiCYfGuIY:sxR3MqTOVv/fNs6uKLuLNf/5E/RYf
TLSH
T11472E916A5285D37DCDBD21DF941BB93D6F81473A6905E48A6FCCB0C04F6ADD221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 06ff1b48965544e1f99161724b60cdc0962d898a5ea954c7e44e9906d2dfe0db
MD5 10e0c04ea94fd08a2a1fe2f3e7895190
SHA1 5217fa634a7bedadab7df865ad2eeb99ce00bec1
SHA512 20f8c2f06ffc087a20c5594d3a4ae8825f6873accbfd45ab4287817c1b1590a172967d7b89670429236cfcb42ef7d1d3480222b669d1848deda5c5aed793a7e2
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVNBpVuGHrock2ex:jXwHnUE7gRWgs2fJ2u1jayBp4GUdHn
TLSH
T1BCE2FC7B680CCBBE4F40499CEC29BD9EADA802CB56D88D5447FA840C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index
Size 360B
SHA256 795d4b976135c302693ad5566f48dbe0b5906b3c930f28d922d6d829183a3dbd
MD5 467fdf2d00fb3d58ccec54a4a66be7cb
SHA1 44231e82b62701b8fdcf931b087da9062041bb3b
SHA512 805035e96a5bd920ecc41bb9672d63f9a3cc7bd7244e47d8db34da7447e7f45ab4982d746fc36fb3c3e52dce902467bbcb12b45865ecba4528a28d8c68a97174
TLSH
T1FBE02B8E8C63A943CE36B87A0673A42E333F0AFD1605AE5A50FE541EA65263C8242605
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index
Size 2KB
SHA256 cc01279c6b7347b941d478b1b19853ef1fe86590b084c735002cb649fddf3c59
MD5 cd4f5102e28ccc98e55ab42781498b04
SHA1 1fa54c7c5e43f387acaf84da5c6dab99c069585c
SHA512 a35304fe10ed9a9ce867d7468e3b6ada8fe5461ae93ffe775fce7ab2a63234c88e9703bf137fd3c358b564361f502b4d9b28afe4063a30811413703e47195533
TLSH
T1CB51D78F4C8A388BD93D14B275FB2695373D2CEE1715CE0B26AD563878D723C1A14254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index~RFe59ab79.TMP
Size 360B
SHA256 e5bcbb1961dfb984d07f7190ad886a428b30dad2ab9945fb0581f00e5370ff9a
MD5 252b93af57b77bfbe79d2778e7ee8e7f
SHA1 ce5cf58ab5706c1577ffb0a2a0534f6dff05af39
SHA512 4dffc61f7aec77e6e3b8cf9bed16ec3453a783f5635d80b3d29111ddb8ceef7c3451bdc1a372d5bb57d111bf0c5d1341ba69b4535d03dba6407646627789a8ac
TLSH
T140E02BDF40919E52C92669391542553E333F08243505D61A50AE585E15627BC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 55eb93ebbdf3c25273f993d5e548dde2b21c3355ea3a10706a658f162a1089fa
MD5 5d0aa8bbbdfcafd605ff2c966f26d192
SHA1 fa81bd6acf7d55e73f9accd2505a51dd3de6559a
SHA512 66dc759e4155fc801072dc1acf04ac4fcb433dddb6e0281bd9414c44a1d962b99d2078fe8dd5f1188051594fd8884eb397da27b934a1870a508299726f6c0458
TLSH
T16AA00214168A3011D0021BB23AE60E63329449D102CD173542A6004DC8D0B55455A00D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 c55055216df4af382dbcb24cda5a5c3be63079a4c01cf6e8fd4765ec475b558a
MD5 332a4c2b254c2da5a0da0cf821c0bec8
SHA1 991474e6016a55fbfba5f0e942d5c9ddc9632329
SHA512 f12084bb928eac5188fd3eef933a92df157e57592ed98cb6a71a5872c846935e1f80bcd31f7f6e5da4e0987045b23f351b330fcbab68cae111c2ce0ea8291227
TLSH
T13FA002242780704AE01226B716D6036192008CE0510052268091004CDCE5E44499105D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 53b887258bbb018dc3473efd5138d06dc5bab0d29e3fde586001a2d32c9d70ee
MD5 42271083b31562b89c140e310c946274
SHA1 48e15b959f27daad9b3a86fcc799290a915ba57a
SHA512 fd7d963b01d2f49a0eac64c0108d1b6af2c21476e34441054dd1cfbafd754586bf3ad74063bc77b4d6e2c654ed5cd337b7de9ac613aecb68215ae56b6531a741
TLSH
T1E8E068B23AE32814FCAF93F52834A8A405507554C848AC8FA11A93C200B13163856C31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 293a594f49cbdc5bbbe9b4dc3828135306143472764e61859dc5465018767cca
MD5 f543c85987603534ec3487987b5c6da3
SHA1 ddd6a9a3cc5ba6ec1ad32a2c17bc4cbe9252ad54
SHA512 da088b2e764c6cbb39661acf569776c2c7d16386dd6642bf93be4f7f7015369e542c8b6bdc2ba99ef840e3ccf7a35a9927c3835ce7e0a4e04aeb0d89ec2e9af4
TLSH
T134A002D18D659047C0404671A0E301C83E928ADC46352A1190EC4059887254042F6044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ffb3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ffb3.TMP
Size 48B
SHA256 c471e664fd790b15bdb0188521872a4d862e38cd1ba506ae3f967c8a2528a73b
MD5 47a2d008ec2331d13b56de33390fc279
SHA1 70a99117c8385fa2a7e57a046c1f01308d6a5193
SHA512 9587bc732d567f28316e4dec6718479b951b36bfb27f167f46cb1aafd01b75fa76eb0cecbce2f60988eb228f9cc54752974ab7c3b70abaa5d659be2644a11728
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6543.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6543.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 609c55026f38239aaa64e7fe4e4fdc9c07bf5638dd3cd6661a5420e8e19a35bb
MD5 aa592eb8dc0971f1f2a69800d92963a0
SHA1 5ec383acd874a7bcf4fb6d6ab6e75b760024b0d6
SHA512 9df988c8dcee0ad3da74020c83bed4e92c2730701eb72a473ac2104aa241fcbc19d43e99c8d13a4ffc9d43d6a9a60dc7c246cb0031f5d8f3b6f198e2ef7047da
SSDEEP 768:hrv+4UNbdz3SY/TBOWQttgONXyer1IRCzniBneVH1SK7:hbsbV39bSIqncEH1l
TLSH
T1AB03CF32A4A89E338DE2A3D6B14777037FB86057C6840B90E9DE1F4E069B99D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4fe2f3ef07bd339c0b8c26fef65a22a4d517220a91d223985f1b06243b589292
MD5 516de941097ce394e6b9182fe5eda67d
SHA1 fb5f2a3f0366547e888e3219eb556f57f8172ee3
SHA512 c8d2c3b266329bef3884ecb051d3638ffb36103594d27a60980403781e7dc456d52b6c31db6da621cc2107190fc6eea8ed0942c8df18d030ff1d38469276f0f3
SSDEEP 768:tj+9u3nvyt/TBOWQtt2mONXyer1IRCzni96b9Mk:I9u3n0+SIqnNb+k
TLSH
T103F2BE31E4568E238CD2A3D6B2473797BEF42177C6C50A44EEDA5F0E09D3A5D170A41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ab9965a052643f75d49d6958167275f072c1f65a1e2a5121061a2f0adfd05ca7
MD5 6fca5c7abb14bfe794bad3cff37696fd
SHA1 627bf6c65bfa5e36babfb8b19abe753b96084ac2
SHA512 1110efdf34b6be53523838dbba90449ae8ab07fee98c99fb94f1de9853ec48678773214e458c8fddc819a009a8ae1634baae6a4e0fcb1caee7d65c81c43d1dd6
SSDEEP 768:crv+4UNbdE37y0/TBOWQtt2AONXyer1IRCzni96eVH1SK3:cbsbq37BoSIqnNEH1R
TLSH
T1E813B031A468DE334DE2A396B14777477FB82067C9840B90EED61F4E099759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 80396fa23abfbb548dfcc402cb329bd1e55ffb47e6871049552a56eba77bd037
MD5 5c2d9eef8dfdaecd20b54c7851f1f885
SHA1 90f36338a5607c1868008c41ff39c86429fd1c0c
SHA512 a892d19c5b71ab9fe3ae75828a59671e9de574b93249d0fa43e68b47b4599647c7491489199be5db45c0c5fffc2eaae16fe5bb081b95df2c9efc385e7bb05e84
SSDEEP 768:hj+9u3yvyt/TBOWQtt2mONXyer1IRCzni96b9Mk:89u3y0+SIqnNb+k
TLSH
T1C7F2BF31E45A8E238CD2A3E6B2473797BEF42177C6C50A44FEDA5F0E09D3A5D130A41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3b46f68725a03f2cfcc94a80d1584fc1a13f4f25b041d479ae2250b72b014d38
MD5 acacefc405a7ebf9272185e98d2ba2fb
SHA1 c2874053e07415f3754dbf591e0be1946b436b58
SHA512 3c68cd52f331875925f7d7b46f5ad20452687069c51804013a35dd578c51edc970a2645af72700c1f5c8bf75015ec10bdc9290dd6d3dfb6a1e06b154aca93a33
SSDEEP 768:XF1j+9f3fwgyvyypsOWQtt2JONXyer1IRCzni96b9Mk:e9f383sSIqnNb+k
TLSH
T18B038C36D895CE279DE297D6B206778BEEF011A7C6C989C4EADA5F4D00D359D030A80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

d6bc2310-17eb-4450-ba6e-e61e70af3cd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d6bc2310-17eb-4450-ba6e-e61e70af3cd2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2204_1343724751\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download