3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/Debug/net10.0-windows/spoofer.exe
Size 159KB
Sample260729-eafjhsv1bv
SHA256 3c8b3b1bbcd18be70b28184c4df7bef1dbb25d9fd7ca8bf7db361bb80dc82104
MD5 a54d9cb6d84c6e88440e01df3a4f1024
SHA1 575ad7eac8126dc9895d75664043d4453b011644
SHA512 441b3f3c9540730b52ffad02298a1b100d81d94b110ab20169a258ab64356b717d0ab3b5b17ab76055762a8e8cc67e5f40ac12e07b7b3e761b5d70994da53cce
SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dePYseJwmI82jT6jbD:jlxnlRLfyQXN4XDMG
TLSH
T107F33B13A6AC51FEE1B3D678C9924941FB7278594B71A6CF03504EBA0F76BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
94	5124	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_1233004534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_940_1375347809\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_387451637\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_387451637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_1036212229\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_1233004534\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_387451637\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping940_161675943\_locales\fa\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297703057450697"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{4F2E9495-650D-4859-8B52-01243174C189}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 940	1772	spoofer.exe	89
PID 940 wrote to memory of 4288	940	msedge.exe	90
PID 940 wrote to memory of 6088	940	msedge.exe	91
PID 940 wrote to memory of 5124	940	msedge.exe	93
PID 940 wrote to memory of 6088	940	msedge.exe	91
PID 940 wrote to memory of 6088	940	msedge.exe	91
PID 940 wrote to memory of 6136	940	msedge.exe	94
PID 940 wrote to memory of 6136	940	msedge.exe	94
PID 940 wrote to memory of 244	940	msedge.exe	95
PID 940 wrote to memory of 244	940	msedge.exe	95
PID 940 wrote to memory of 244	940	msedge.exe	95
PID 940 wrote to memory of 4612	940	msedge.exe	96
PID 940 wrote to memory of 4612	940	msedge.exe	96
PID 940 wrote to memory of 4612	940	msedge.exe	96
PID 940 wrote to memory of 6064	940	msedge.exe	97
PID 940 wrote to memory of 6064	940	msedge.exe	97
PID 940 wrote to memory of 6064	940	msedge.exe	97
PID 940 wrote to memory of 1704	940	msedge.exe	98
PID 940 wrote to memory of 1704	940	msedge.exe	98
PID 940 wrote to memory of 1704	940	msedge.exe	98
PID 940 wrote to memory of 4628	940	msedge.exe	99
PID 940 wrote to memory of 4628	940	msedge.exe	99
PID 940 wrote to memory of 6068	940	msedge.exe	101
PID 940 wrote to memory of 1952	940	msedge.exe	102
PID 940 wrote to memory of 6068	940	msedge.exe	101
PID 940 wrote to memory of 1952	940	msedge.exe	102
PID 940 wrote to memory of 5612	940	msedge.exe	104
PID 940 wrote to memory of 5092	940	msedge.exe	105
PID 940 wrote to memory of 5092	940	msedge.exe	105
PID 940 wrote to memory of 5092	940	msedge.exe	105
PID 940 wrote to memory of 3544	940	msedge.exe	106
PID 940 wrote to memory of 3544	940	msedge.exe	106
PID 940 wrote to memory of 3812	940	msedge.exe	107
PID 940 wrote to memory of 3812	940	msedge.exe	107
PID 940 wrote to memory of 3624	940	msedge.exe	110
PID 940 wrote to memory of 3624	940	msedge.exe	110
PID 940 wrote to memory of 6120	940	msedge.exe	111
PID 940 wrote to memory of 6120	940	msedge.exe	111
PID 940 wrote to memory of 3652	940	msedge.exe	112
PID 940 wrote to memory of 3652	940	msedge.exe	112
PID 940 wrote to memory of 4568	940	msedge.exe	113
PID 940 wrote to memory of 4568	940	msedge.exe	113
PID 940 wrote to memory of 4568	940	msedge.exe	113
PID 940 wrote to memory of 5104	940	msedge.exe	114
PID 940 wrote to memory of 4932	940	msedge.exe	116
PID 940 wrote to memory of 4456	940	msedge.exe	117
PID 940 wrote to memory of 2012	940	msedge.exe	118
PID 940 wrote to memory of 472	940	msedge.exe	119
PID 940 wrote to memory of 472	940	msedge.exe	119
PID 940 wrote to memory of 3692	940	msedge.exe	123
PID 940 wrote to memory of 3692	940	msedge.exe	123
PID 940 wrote to memory of 5724	940	msedge.exe	124
PID 940 wrote to memory of 5724	940	msedge.exe	124
PID 940 wrote to memory of 6068	940	msedge.exe	125
PID 940 wrote to memory of 6068	940	msedge.exe	125
PID 940 wrote to memory of 3328	940	msedge.exe	126
PID 940 wrote to memory of 240	940	msedge.exe	127
PID 940 wrote to memory of 240	940	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bin\Debug\net10.0-windows\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\bin\Debug\net10.0-windows\spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffa3234c188,0x7ffa3234c194,0x7ffa3234c1a0
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,13030486494361642159,17888286168138643119,262144 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,5370179074154549938,14443861727537210667,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,16072068508129797101,3999983387052621394,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,5793977054573442150,13016310860907128408,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,1338731014670127325,1072321746962274737,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9896711684627618103,16195997149766446027,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4755118777876716693,11044068077401721418,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,4131488584112400859,5407309356259531265,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,725540183901840383,566786680157264833,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4457175945547465026,1108673105196637539,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4067665080284688720,5672537398840811544,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,4067665080284688720,5672537398840811544,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5972,i,10061961120739286039,17728712155154200615,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9991850082534224777,5521350163077119159,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,6749028664277012449,13447663544946592486,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,216955754658016017,4483081374545193757,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,5857965130354155283,11404225490380560980,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,10145604759490886417,6627431409751394861,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:14
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6376,i,14079842891433990520,9862404614367433775,2097152 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,7581603351511556846,14975978621327456126,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10305269771282649259,8966876572843997937,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17548515163983630203,5022028698284748891,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,17604080944027248179,15709713198594095340,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11302172577426396196,5663389959387391410,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,1170253692280592522,849651270493339170,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:14
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8946958594766145011,18378086607854857982,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7760,i,2460185222167489334,8078117883702106103,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:6068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,17318221031922105263,2463974394713148693,262144 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,2959137740014455230,17976950567412651136,524288 --field-trial-handle=2304,i,7495227831040104818,7021789687756836707,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:14
    3⤵
    PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22688924-bdaa-477f-969d-e123ad81872c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22688924-bdaa-477f-969d-e123ad81872c.tmp
Size 38KB
SHA256 28062fd18580ae78f9a5a81b4a25b762f886a3c1608b073ce254e997af9fac79
MD5 b068d70a6ef7457713d628be2912a2ba
SHA1 c7b98c43bdae44c1cb2ba5c1db3b461384aa4666
SHA512 6531f0d64b8d6451a00694d5df27dae5778adcd34efddc1d70cf5cd293e5f565dbced7762ba18703235f3d5c98a7ec72923b27e72415d3e36d3486401cfe0334
SSDEEP 768:arv+4UNbdl3YPkKL22ejF669yrqUjWiIwwxMRiSUiler:absbX3/1jF66INWZTMBUsQ
TLSH
T16503CE31AC589AB7CCF2C68672533783BFB4109396C50B88CADC670D469B0DD2343A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 643dc94c024ec999092f9c5f946e5158c09f387ad334609b53b9043989b6dd82
MD5 6f20aacc2b8d520d66a4f8f29d87c856
SHA1 4fdd410431902fd7d5dc8ae8df6bb5913293c8e3
SHA512 72ccf9d39287336085e9ebb7675882cb824e967b50e57ae1fbd88cf02fca38e7ed033c1aa15d67e90d90cb981077443eea84bfe0aea96af44c46c846d230e2bf
TLSH
T17B513C56C3A816E2C7749AFC11E44E57337884FD0B07AE0C8DB8E0F0EADA35B6610023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 61a77688ae90a6ddd756aaae5b0b7a4433a1453f54b9dd78da3679fa6f15f7ef
MD5 1e97457eaa73cf4642b9ac3178afae1d
SHA1 2f3e29ad53f9f6eae77bde8972cba2223cd6425c
SHA512 fa0c85b94288cb53ea859d89be5f262cc5007ebfb44e42b961bff82301a1849e2b23886bfe5ade9b0a9b27d3a2055a872a5ebe632fdf6a14e0c22aa44260dc30
TLSH
T10C518BF783A4856E8A0196F09A18AE2FDF2D0615431C7C6989D4EE27D7E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cb2fdc01ef1fe5e4d4c90653a3ce4f3e0080ee2e640c49bc7331b89f4ba57b79
MD5 b99b05c6e95f2a323c96ddd4e77e51d7
SHA1 2208b20132f8b9db62fe5142dd7b9d41a9550da3
SHA512 8dad64dbbb6c99e4e414c9c43072ba080b2e8dd4c972b1cbebdc7be863b3e3ae0f234b0cb86dd4faf8ad76de1669594950c900c01604c6b816bc42393dec32fb
SSDEEP 192:sxR8R1yM/jK1Ml8wTr/fLsHruE0ZEPA2rzoA8p9b/g6+WNZMs/AMxVw0GAIgVfHQ:sxR89Fr/fLsHruEKum5/5d/csu
TLSH
T1B462CA16AA385977DCDBD209FA557F63D6F91533E2900E44AAFC8B0C04E66DD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2b9313b617f31a0b20b92a7bc4919ca1bf1e6894e99c470ea7970081f5be7ae
MD5 e04cea7c3c8e4f9f935012c6c0ed237f
SHA1 9c2977a8e42d9222a554ff35346c23bb6e8a26de
SHA512 a0bf3f04d63e72536a0d272c7cf8560942baa736c4fbc714f3382864579939c483d5135019ca22cd8b958b72506a342556791cd4a29561b99f92ef0bf1751e12
SSDEEP 192:sxRrR1yM/jK1Ml8UQKTr/fLsSruH0ZEPA2rzoA8pLb/g6+WNZzeXAMx3Zw0GAIgE:sxRr9qAr/fLsSruHKumv/5gXxqsE
TLSH
T1F462B91AA5385977DCDBD209FA457F63D6F95532E2900E48AAFCCB0C00E66DD620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0b5c0f29c14b2ce0a506c20029f52719930ff908755cd822c0b68b6a462eb4df
MD5 0f849353701a93a3fb21c2475f9a157a
SHA1 82b0aa7424122b11ba160d183c115be3bd1bfdb7
SHA512 1801e21258e1af7669d693d712856bb53bc830ac789f06330216eb39c13a7ce69457b5416ca8048966ea5a0e8413a41e922be7800bab9fc0eadcc79a20dead4a
SSDEEP 192:sxRrR1yM/jK1Ml8wTr/fLsSruE0ZEPA2rzoA8p9b/g6+WNZMs/AMxVw0GAIgDVfw:sxRr9Fr/fLsSruEKum5/5d/csy
TLSH
T1B362DA16AA385977DCDBD209FA457F63D6F91573E2900E44AAFC8B0C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 280ea5f239f70e5194ab8c2b445606a4f47c8934c4503b911b8fa34d82e9097f
MD5 cbe0cc7c63470d3d8a34c10d135a92d3
SHA1 a15dd50fdda47fd81d3695853d3a6b33128b6e00
SHA512 a9343720d7e69c04480e3397bed4179262952b53764b9c305297c91a9052419e21020236c87f217b0a3475f7b23c19431ede1f26426d5d62c91d1ffbe593e235
SSDEEP 768:0xCyNH7pLuLfUjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MHrVALroJfdZr:0xCyNBEfUjWgbrfM1u1ja0MHpA4Jfdg6
TLSH
T1EFE2EC7B680CCB7E4F404A9DEC297E9B6DE802CF96D8C95447EA880C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 868a7f06f3e293c47a0ad95669eb6fb3bf31c723c25b3db7dbe09600f2bef55c
MD5 d2fab562a2c5cc52324153e3c52b2a2e
SHA1 2dcceeb88b4d190b6c4b8d2f724cafc4d0c8cd1e
SHA512 462d9fa61226c88f0d6c3c174b31083a9e393821aab7be7e2b6191bbc4c5bfd21ab002253a161fc4ad75d88751db66dbd752f5e488a322ddc94fac8b9a09b461
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/mu:UpHGpVn
TLSH
T147C1C196B17A164028BE260C92E4EA17D6D170F33468A42B7FE814F55F26F425FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1f41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1f41.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 984e1c9465bb46400256a76122c11e866cc1f86b4c1f4e821f4fa01536e8adf7
MD5 62b2e80950eefa75240565701d37b03d
SHA1 2f8d5f73e1126286a99636c09a58bebf1d8598c3
SHA512 349a3905aac9f3b4d3850fd1bfdd9f8f9764dc27d545f010c809a4efcc79b34da6a005922891ec7b9c7b86db15bd4d8166ed5dfb0242c7ef57ec1db214e4514e
SSDEEP 768:5FQ53DwgqCYoynF669yrqUjWiIwwxMtDMje:4530lnF66INWZTMxd
TLSH
T1651319F598D78976D5AE8743633D2E429EBCC0A3B5844988B7C85E0DCC860BFD747825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f9633ee8301d51fa978cec096f7d4d7c61b4f6b1ba1c3193aa5abe79622ff529
MD5 fb488035902ca6656f5236d8d6931204
SHA1 d1c372b80026673a4e83c7864be1a4da28eb0ef9
SHA512 6e52035165042fc76220437eeb85e3eb91ffbddbbbd67319bedadf40ebc8cb06171b83411a5338a5f9673ed58824b8c440a4e04f5e77c68cdd7c0d35270335cb
SSDEEP 768:LA3uhxkKL22njF669yrqUjWiIwwxMtDMje:LA3ucCjF66INWZTMxd
TLSH
T1E4F2AEB06CA59AB7C9FAD745B11237C2AEB010A3D6C40F8CDADD9B0D05875D9174783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa04f11e1266e7b81bbd34d6f56c2c392b128db6711076f68cc189a1da24346f
MD5 db64a30a05c0f324da15863e40608d12
SHA1 1716fc3794e64f69dd51999d4630477f2e7a4731
SHA512 72c9e22e3b76e3df61b25b498c3dab32a5caa584570bc7919c6133cb6524a97228f3a610b957e195efa731c6954753743eac080c41729d3c3383d148f657479b
SSDEEP 768:uA3nhxkKL22njF669yrqUjWiIwwxMtDMje:uA3ncCjF66INWZTMxd
TLSH
T11CF2AEB06CA59EB7C9FAD746B11237C2AEB010A3D6C40F8CDADDAB0D05875D9174783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3004c67c89873e5e6c81423856af025a35e825b36899d16965f0719db0d3d9e2
MD5 eba89c54bc23ff1d46eb219305b3dd4d
SHA1 d1f469d4d13142741c2c778619460aab024f5422
SHA512 e38958691e3b43b3b4551aadfa37a68dc1d89e0e3a70c53989df90a5874a10829165cb26aeaa7194cec7c9efcc9111547dee003aed48f658bf08711cdd0baa45
SSDEEP 768:qrv+4UNbd33n+xkKL22njF669yrqUjWiIwwxMtD5q:qbsbp3nfCjF66INWZTMxI
TLSH
T1FF03BF70B8689AB38DF6D785B11337C3BF7410A395C40F98DAC9AB0D458B4DA274B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

66e24f76-bb78-4865-89b4-b951da55d97e.tmp

Path C:\Users\Admin\AppData\Local\Temp\66e24f76-bb78-4865-89b4-b951da55d97e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir940_1561203218\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download