f6243a3dc785e169005111e882cffc78aa2c1b901b6e2e96f61ca44e60b463e4

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cJaUA3hJ6gWZ.exe
Size 27.5MB
Sample260809-herzwswtcs
SHA256 f6243a3dc785e169005111e882cffc78aa2c1b901b6e2e96f61ca44e60b463e4
MD5 019d04a6d5ab52061f4d812419425d90
SHA1 346713c63b6d016e0045e6cb556f828997f2881c
SHA512 ada4a5d2a0867c4f46b97120b638cfe4a590f4464154d59e39472f5fe006a608a738fda335b49095ec5c81a324e17260d52fe8b42c2b6040832bb59d1bc5eea5
SSDEEP 786432:A2HLFqGS4kN6+kL4E2oA2kKxSbfG3BpJvB:A2kGS4T+CmoAaSbmHJ
TLSH
T1995712C669D482FDC751C539D2861BF9E1C938998EBA892FBFC644013570C85C8E7E3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3216	cJaUA3hJ6gWZ.exe
3216	cJaUA3hJ6gWZ.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3216-1-0x0000000140000000-0x000000014333E000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1213163831\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_789845707\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1096678057\_locales\hy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307312497637600"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{7D4126CF-D8E4-43EA-8154-5E8338569F7E}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5556	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5476	5556	msedge.exe	90
PID 5556 wrote to memory of 4392	5556	msedge.exe	91
PID 5556 wrote to memory of 2036	5556	msedge.exe	92
PID 5556 wrote to memory of 2036	5556	msedge.exe	92
PID 5556 wrote to memory of 2036	5556	msedge.exe	92
PID 5556 wrote to memory of 1916	5556	msedge.exe	93
PID 5556 wrote to memory of 1916	5556	msedge.exe	93
PID 5556 wrote to memory of 3204	5556	msedge.exe	95
PID 5556 wrote to memory of 3204	5556	msedge.exe	95
PID 5556 wrote to memory of 3204	5556	msedge.exe	95
PID 5556 wrote to memory of 2716	5556	msedge.exe	96
PID 5556 wrote to memory of 2716	5556	msedge.exe	96
PID 5556 wrote to memory of 2716	5556	msedge.exe	96
PID 5556 wrote to memory of 5692	5556	msedge.exe	97
PID 5556 wrote to memory of 1296	5556	msedge.exe	98
PID 5556 wrote to memory of 5692	5556	msedge.exe	97
PID 5556 wrote to memory of 5692	5556	msedge.exe	97
PID 5556 wrote to memory of 1296	5556	msedge.exe	98
PID 5556 wrote to memory of 1296	5556	msedge.exe	98
PID 5556 wrote to memory of 3284	5556	msedge.exe	99
PID 5556 wrote to memory of 3284	5556	msedge.exe	99
PID 5556 wrote to memory of 5004	5556	msedge.exe	101
PID 5556 wrote to memory of 5004	5556	msedge.exe	101
PID 5556 wrote to memory of 1268	5556	msedge.exe	102
PID 5556 wrote to memory of 1268	5556	msedge.exe	102
PID 5556 wrote to memory of 5576	5556	msedge.exe	105
PID 5556 wrote to memory of 3568	5556	msedge.exe	106
PID 5556 wrote to memory of 3568	5556	msedge.exe	106
PID 5556 wrote to memory of 2336	5556	msedge.exe	107
PID 5556 wrote to memory of 2336	5556	msedge.exe	107
PID 5556 wrote to memory of 860	5556	msedge.exe	110
PID 5556 wrote to memory of 860	5556	msedge.exe	110
PID 5556 wrote to memory of 1900	5556	msedge.exe	111
PID 5556 wrote to memory of 1900	5556	msedge.exe	111
PID 5556 wrote to memory of 4316	5556	msedge.exe	113
PID 5556 wrote to memory of 4724	5556	msedge.exe	114
PID 5556 wrote to memory of 3144	5556	msedge.exe	115
PID 5556 wrote to memory of 3188	5556	msedge.exe	116
PID 5556 wrote to memory of 3188	5556	msedge.exe	116
PID 5556 wrote to memory of 2132	5556	msedge.exe	120
PID 5556 wrote to memory of 2132	5556	msedge.exe	120
PID 5556 wrote to memory of 3080	5556	msedge.exe	121
PID 5556 wrote to memory of 3080	5556	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\cJaUA3hJ6gWZ.exe
"C:\Users\Admin\AppData\Local\Temp\cJaUA3hJ6gWZ.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc3e19c188,0x7ffc3e19c194,0x7ffc3e19c1a0
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,9525170966249543332,14512959290481803181,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,1286735762885733221,9271385620986158595,262144 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,4275608271556092103,12170239521809136913,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,11055902776282691206,7960887131332357112,2097152 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,1702007968417489231,4951629688164679724,2097152 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13309767353593174819,1171947764875680688,2097152 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,9137819667213450063,2233763692607871063,2097152 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:9
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17617512829792592341,10917194187617394099,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,8756039130321187313,3763523923020460502,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,11992732907949959896,3673072576117199527,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11380397203335248405,6278116655930766914,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11380397203335248405,6278116655930766914,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,3057651918774413278,5784832674516109221,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,3542879331107024033,13743511646199361975,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,1742629067868975369,6221006675873808450,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,9150198835750283286,15888085202138363003,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,9856115796457726726,8345233680831218587,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,14412425351464079935,9860995981698982530,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,15420149243108966148,9134399731163670041,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,1468379479064660354,18092819592793977096,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,3271334920901468703,235568085440859518,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,3291504778778110551,5184595201126339116,524288 --field-trial-handle=2324,i,4449625930458553102,1197249796978044477,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
  2⤵
  PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

8b3f7a0c-4f01-428e-a7d4-7da37f4b392e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b3f7a0c-4f01-428e-a7d4-7da37f4b392e.tmp
Size 14KB
SHA256 f9afe284c0fa2dda2743a4cd1c9e76c50dc8f741b07439ed91a42961ba78a875
MD5 6b2969fee3415a644a3f5bfcefd54615
SHA1 310cad93997403e1e975ff6bc0731eb1b4fa7566
SHA512 af62dc3a6416113d332736e05925c0147ca8828764b752bd8bfd0af0a84e87ab181349604669f5739af831425cfa5fe13cc567615fb744c47aa07f548910dc38
SSDEEP 192:sxRAQUn0R0x9/fIsfU8ZEgJpibRc0hSoA8pJO/g6+WNPdS/YbrrZ6vGeIgVlVIJ:sxRGn0o9/fIsfUCXac0h5g/5Y/i6hO
TLSH
T15152F8166924693BACD7D21DFE16BB63E6FD1032A4D01E4DE6FC8A0C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 486c9d045e65355a64b71d44f189dfd35d460ea9a1e67e5a311f8eda67641f7a
MD5 8f9c89a8dcccf802bab17fd8033016bb
SHA1 13330202ccf2a865965a52111c3559622250c8b8
SHA512 db73a5bb080a67bd7ea8ab4dc46251fb954de8e5daec65c7004c4026f0df67dcf3bdbe806cb4af39adccf47cd5f27dc27459371535d4cd743d67eb8e14ad093a
SSDEEP 96:tAC1j8uCVbyoJTCyLKaZpuoLPgFxAmOb6P0q4fNYjoNe:t91j8uCEYTCyLKaZpu+exAmj0q4fNYjz
TLSH
T16891BCA6B3E3A493CFA476B198A15D58BF24F07B647B0BD71DDA2D3464432C881F1813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a8c92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8c92.TMP
Size 2KB
SHA256 29296ef90a563ed5b1386e2cfd42b66bc920b2eacae27bb1ae11b6a2a52eff5b
MD5 a254b100ba3cf8079f638724589e83d0
SHA1 4c111213971028d15b19d85001d284791aedcbbc
SHA512 b93f47117519d760fd42a274b21de650e9495f6512c437c163b423de1bda025fb7e751a59f84552971a8da5c01b705539f7b2a3f30a507494179fab116584cee
TLSH
T19C5172F6B3F708D2C3F4A7B1ACE097983B74C47A35376FD2605A25B09A873C46061022
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 71d80188cfa7d23b14040fe52d74539a7237854c830ba190c7879d334a5e48a7
MD5 3a1bb62bdf8d5780be5581136f8e0e61
SHA1 fd85d5ad45b0404cff8da607269f7992a4bbcf2a
SHA512 fc79ecf3318468e5c5c334fa5d45e666a3ec122a59b497d77fe0c5b760e949f6794659646919baaa42b23258f98ea59dd84de4614600de713e04b04c1831e771
TLSH
T1AD81CDF3C3E5816DC91191F0AA186F1BCE2E0555436C3D5A88E4AE5BA3F24B1E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f20f4ae4c3d32e124fd35cecf9fcf84f1ef4b9336600139cb7d7f38bd8e1a68a
MD5 7a20d75e8aee7009cefc0066c5f3e856
SHA1 9888b7cacf0e126c68b8c3c63bdfaa21de4f04d0
SHA512 fd6c00df305162f89a476ddddd2be1b965a173eee023073a23dbc52b4f9cfbea13b2f02e13965e1cb174fb83d90db2701c81d8056747420b31dba4bcd9cbb234
SSDEEP 192:sxRlQUn0R0x9/fIspm8ZEgJpibRc0hSoA8pJO/g6+WNPdS/YbLrZ6vGeIgDHlVIJ:sxRNn0o9/fIspmCXac0h5g/5Y/c6hU
TLSH
T17762F8166924693BACD7D21DBE56BB63E6FD103294D01E4DE6FC8A0C04EB6DD230380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 47e1a838f3dcce454dd739f924a5653350fe8f9d28cb4289f1fae7a84fc563c5
MD5 e45e7a29f0ff84b48c75748cc6787269
SHA1 dc9b8319dbebb072e94afad6136adf58d72484b3
SHA512 7fcb57e90bcfe62073e5ea7829deb81df8882021cb63be1124f0cb5ec1787b7d17f144e27875aa7c325a5dd20563fa821dcc90502dbf05d5cc41ab952db95ea1
SSDEEP 192:sxRlQUn0R0x9/fIspU8ZEgJpibRc0hSoA8pJO/g6+WNPdS/YbrrZ6vGeIgDdlVIJ:sxRNn0o9/fIspUCXac0h5g/5Y/i6ha
TLSH
T11A62F8166924693BACD7D21DBE56BB63E6FD1032A4D41E4DE6FC9A0C04EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 382904f4c30b989946c72ee2a07f43099c4b5b856c20920f9ac268387598e725
MD5 d05d4598b15a64e2a3847d3f58e877be
SHA1 3b665e122b01ae0a0bfd665b06ac94111439dc42
SHA512 41b9d94ff4c9dc1f4484aeda33f48259e6b718f6f6e884567f0e859ad36bc29737bd4599c3ac7977989ba01996c1dd8935cb518492e4f46229ecc14235a0d9e0
SSDEEP 768:Fb1phU7pLuLf2tWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVqhpJ8ISroSjR:Fb1phYEf2tWgikfq4u1jaNhpyIJq
TLSH
T148D2DA3B640CCA7F4F804ADDDC19BA9F6D6802CB96D8CD8447FA941C02C7BEA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f206291-4b3a-408c-90d1-8e683c0ad29e\index-dir\the-real-index
Size 72B
SHA256 979443ca5b63c1446e54b303de840f580c1fffda2372e2713dd60d11f302a899
MD5 df025002056ddbf65fcf7ed039f40fd9
SHA1 85540683d79d3dad3438b9d4e6a73fdcccf7e8a4
SHA512 6010a56d09d2e1934f3fc15254bd12f159868973739c67daba3debbd722f6f3d9077f7102f96ab9c07ac9329db5ec0ef0be56ab1c3bee871fe5fe3541ff6501c
TLSH
T115A0025542C0CA51C01312F0A69ADAA173B45D200621370D61D84059D8F85C5498101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f206291-4b3a-408c-90d1-8e683c0ad29e\index-dir\the-real-index
Size 72B
SHA256 56afbec366910735aad9ade30c5fef83272debcf986153c962cb84677d1ede28
MD5 7397bdd6490470b115e36deb734c9b0e
SHA1 7def5ac95863a93ebbc6c8213f425aa0bb812d66
SHA512 b64ebc242998670d1b004010b54cf7343830f5c9ac8af8b9bf0eb0028c2adb21e6815855613570fbb6c22bcf3a9654d1da41fe39d3cc7dab663edb1654d8f885
TLSH
T17DA0041413C11147D11711F11DD303751340CC51F131330F51D14345CC50D70CD4304C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a7e30921-d82f-41cd-b569-7ef621c933f6\index-dir\the-real-index
Size 3KB
SHA256 b1cfc5a1e6c7c009364297dcdc42e9ce99677e7abf24c3f83ea1b89664070bcf
MD5 8038f8f5d3076fc2abca6e0ddf22cdc4
SHA1 d9cfd4ad35dacec2c2a1795bd88c54da13f1b947
SHA512 8248375b752fa9c7db9e4f516418f4e9b27cd7feb15e31263441b28e4ffe8f416e72737a12ea951f5be5d20d05b1a3242113b00842b2adab616ef4e02447b365
TLSH
T19B51F84E4C476F66DD9D24F318F61852B73534FE92855F07999CE8383CC32291CAAA15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a7e30921-d82f-41cd-b569-7ef621c933f6\index-dir\the-real-index
Size 144B
SHA256 f4027b4bfa2b2df19cf72c7fa561b81f8bdacbbb6c112a816eb04a92048cd18e
MD5 15247957dd8bf36ce3348bfc6e66539f
SHA1 6c1a5d44b5b20551b94eb032e70637a4ab19145e
SHA512 40307321d7ce807827e09c6951680a8531da35975130eb3412ef6a9e992ae89dd610ab76dd05df0a2e16532b1b4f5afe0756e3170aba8e0cf10ca02afd391954
TLSH
T1DCC01202CC6B5569C807363132BB106A2B330EFD1D677F1E10DD5C06A472459C3D7848
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0a90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a7e30921-d82f-41cd-b569-7ef621c933f6\index-dir\the-real-index~RFe5a0a90.TMP
Size 144B
SHA256 46d42a95afdcf5b09817f4fce930aa36ae01309b8c1fcaa4a142eed760e9798a
MD5 ed9465689e5586f9746708b1fb4c6ad9
SHA1 8ec0df490019bc5a1ee26350b6a220b94060f3ce
SHA512 a7b901a4963a5f2a94f17b1f62dfd086ebc0f2c0942ef96e63d15826de9765c11dfa22e38eb56e526aca67550efc0f6f62dce635a86493f69272d3be5dfbfd91
TLSH
T1ADC01216CA5398B0C40F5570108B821A336B1C300031B62E60DD4C6F68B10C8C1D7D08
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 100c8407e33f978d9c6ed7ce9311ee0bd794e78d5b66d2ea454de53b9093162f
MD5 cb76eb545f0a9abc4979be225ac98067
SHA1 84846306ee2fa0f25f7f85ce10923190116866ac
SHA512 79353c00a391964a9b60dc0602210c22a66a0dd432d97475934569f3e45fd9f21a60c1d47d0e0644f8ad6ecaebb177492d3637e0e9630dcc74669135892731b2
TLSH
T10AE0D8FA2DE71914F9AF93EA253290A581977D54C884AD4F142AA2C7D4712002889C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 940f2543850d08d127362aec3d4e3679300762b5b29a7e0eaf8a4f4ac132bbc3
MD5 5228c6e09c666bc6b2708df6c3753321
SHA1 97926957795c7ac90f22d3c5ac0c5ce398e5dc79
SHA512 d7014d7fa115edafb4d8e2a71d9e797b466767d85a18f4035149922855794281435276367a04d7d4fd52130d1ac05ed87f3d011a9848dd3a873edd4e0187eb05
TLSH
T1E2A0027ADF4AD002C04407F02671569C6A11DEAD89062721CCA80086C8E314141D50A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a636e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a636e.TMP
Size 48B
SHA256 152b2fa6c1971b2c715d187035b2af95c552db7090ac286ab53a643ddadcaf33
MD5 9d927fbbb9792a4539739b401773d254
SHA1 1c7998a83a82691b975aac840dd9ea9b09a0045d
SHA512 315b82bec128ca86cd3cd8cd70e8c5bc8de22b3bea2c75bcb2b899659a78ede03c21b2c5a79d3b272c0c8cf06c496e639702b6c113d4d95bbe42cb32535689ab
MD5 SHA1 SHA512

Submit Download

1bcd6ab0-ca6d-411a-b900-448400b1d7a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1bcd6ab0-ca6d-411a-b900-448400b1d7a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 43c015742e07ed07a34d933ef2a207f9be9b5f851fe6c55dc41fc47ef6238089
MD5 c856c6eddc87cbc2a8cb17fc1203b3ab
SHA1 037dcab72c6754d8b130ce427aa14005e47ae783
SHA512 4622d9864534fc469e7b1eb22535afea30d83cd32306c230593be6647a0ea77efa478cd5fcb59d0705b782879966ace259c3e7f23d859d001bad1a7cf97cabf2
SSDEEP 768:JF0rv+4UNbdo3SwgTnShR4vRetZu4aWADIidy8LukCmU7RRx1:sbsba3GnGtZzaNsuVLDCm8RRH
TLSH
T12A23AE36E856DA77E8F65280F2467A47FEF451A3C8C949E5D9D81E8D00CB0EE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9587b7d2541b350067eb7e426e6521eb28c4340235fe80c5f21bd32348dafb2a
MD5 61a893f2044b62a42d84e9aa1723fc4e
SHA1 d13f316a4e7f30e5f10047626776567ab7f70c4d
SHA512 f9f716293502fc18096925109d7545821185025d010559682f4b47871eb8c6ebc8556c8addb9bb4e1e6745b8b738aadcb6de9b2765c7464bf01a4d44203df0d3
SSDEEP 768:9rv+4UNbdC3b6hBqobGRupZu4aWADIidy8LqgeVH1S1C:9bsbw3upZzaNsuVLTEH1d
TLSH
T11203BF36FC599A779CF79284B1877A077EF89263C6880AD088DD1B4E42DB4AE1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 f6a5796132ebdd13de5bb12f227ea8c07a256f8322869e05b7b336acb5a06d86
MD5 2c3fcf834bdada8af10bd0d55662e2cc
SHA1 1cc4b85fb9072036f80e80120f19d9164492acf0
SHA512 12060764e2ac1ff37eb288f18cdb3e1ede5e0e416cfd3c1ce308c4bc0254be88d8677813a7f6b6b022a925be80ef3314cb2f2fb98b26abd02af49f0baf74a5b4
SSDEEP 768:Crv+4UNbdC3gnSh6BqobGR0tZu4aWADIidy8LukCmU7RRx1:Cbsbw3gnrtZzaNsuVLDCm8RRH
TLSH
T14B13BF35F85ADE73D8F6A140B1837A43BEF8656388C90AA5D8D84B4E05CB4AE131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 177b43d1676747124d3c7683e7a40833706b34246ba9fa532182fce0a666a95a
MD5 57845ad3185fe2785472699d22a1a0f5
SHA1 bd11c13dd34cf4600ae1637356c94cd109420bc7
SHA512 8b5fb38013fcbff1ee3047aa19f96ef8a5447d768e3ae62ad8cbb15ff778edfaa8fad5cdcf9366072fc370e743c9163e027c43eed43b4b3bb7efa54f08c76aeb
SSDEEP 768:5rv+4UNbdC3LnSJ6BqobGRrtZu4aWADIidy8LukCmU7RRx1:5bsbw3LnUtZzaNsuVLDCm8RRH
TLSH
T13213BF35F85ADE7398FAA140B1837A43BEF8617388C50AA5D8DD0B4E05CB0AE131BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3f6054491bcccdc7967a2e48cf8034ef894bc47419bd7f6131aaaa04838a9cb9
MD5 c2a40c03633c52f01a9b35c0a6358c83
SHA1 21f9fdfdf485c0f5754ba4dd4e519d30ae59db27
SHA512 370f3b101029dc4f9fb2e3caed91d1734c60d70d542e3437713a2007572c64c6125340192d5779994baa947b3ab33555e4c3eeaa53c180a67c336af35d36fc27
SSDEEP 768:Qrv+4UNbdC3K7EBqobGRGtZu4aWADIidy8LbkeVH1S1C:Qbsbw3ttZzaNsuVLQEH1d
TLSH
T13403BF35F85A9E739CFB6244B0877A477EF8616389890AD4D8DC1B4E05CB4AE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1190be1-1123-4558-af64-dc3feeb0645c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1190be1-1123-4558-af64-dc3feeb0645c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a2aea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a2aea.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

7e35ecc4-6bf3-4cad-bc87-d77149198997.tmp

Path C:\Users\Admin\AppData\Local\Temp\7e35ecc4-6bf3-4cad-bc87-d77149198997.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5556_100533803\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-1-0x0000000140000000-0x000000014333E000-memory.dmp

Download

memory/3216-0-0x0000000140836000-0x00000001417BE000-memory.dmp

Download

memory/3216-2-0x0000000140000000-0x000000014333E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads