9ddb75606572fce64c8423cfb623bd22142e1a66bb12556aa8f28942b17987b3

Analysis

user interaction
yes
max time kernel
102s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 289KB
Sample260809-t5e9kasakf
SHA256 9ddb75606572fce64c8423cfb623bd22142e1a66bb12556aa8f28942b17987b3
MD5 d7f0fd52b3c860599968da06ee16adc4
SHA1 62fefa5ad0e704a47022966ab9bfe3fe97729203
SHA512 277bd76b85ce002e6d0ee095f904dae7951df455180b029f11d6e389acee433c5cf5a8e39d2004c67e95bc377b4d803d03b111907e98cebd3ddede2bcab62772
SSDEEP 6144:jG106wpc9JguwzqwqHIpf3koXeMH5xMjZ/XFRmJI5HaxS:Ndc9/CqHIBLeMScIQxS
TLSH
T1CC545B726304B03BB813EDA0A6BE6E0E3C75E12BDC0A86F86591E530DFE2EB1551571D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4844	goodbyedpi.exe
3568	WinDivert64.sys
5440	goodbyedpi.exe

Loads dropped DLL 2 IoCs

pid	Process
4844	goodbyedpi.exe
5440	goodbyedpi.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
163	camo.githubusercontent.com
164	camo.githubusercontent.com
165	camo.githubusercontent.com
166	camo.githubusercontent.com
167	camo.githubusercontent.com
168	camo.githubusercontent.com
169	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe
5388	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2832	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307671042634315"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{B7E73326-12A3-4BD2-880F-0927619D941E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5032	7zG.exe
Token: 35	5032	7zG.exe
Token: SeSecurityPrivilege	5032	7zG.exe
Token: SeSecurityPrivilege	5032	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
5032	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1996	4768	msedge.exe	86
PID 4768 wrote to memory of 2832	4768	msedge.exe	87
PID 4768 wrote to memory of 4764	4768	msedge.exe	88
PID 4768 wrote to memory of 1448	4768	msedge.exe	89
PID 4768 wrote to memory of 4764	4768	msedge.exe	88
PID 4768 wrote to memory of 4764	4768	msedge.exe	88
PID 4768 wrote to memory of 1448	4768	msedge.exe	89
PID 4768 wrote to memory of 4684	4768	msedge.exe	90
PID 4768 wrote to memory of 4684	4768	msedge.exe	90
PID 4768 wrote to memory of 4684	4768	msedge.exe	90
PID 4768 wrote to memory of 1028	4768	msedge.exe	91
PID 4768 wrote to memory of 1028	4768	msedge.exe	91
PID 4768 wrote to memory of 1028	4768	msedge.exe	91
PID 4768 wrote to memory of 4588	4768	msedge.exe	93
PID 4768 wrote to memory of 2604	4768	msedge.exe	94
PID 4768 wrote to memory of 4588	4768	msedge.exe	93
PID 4768 wrote to memory of 4588	4768	msedge.exe	93
PID 4768 wrote to memory of 2604	4768	msedge.exe	94
PID 4768 wrote to memory of 2604	4768	msedge.exe	94
PID 4768 wrote to memory of 1376	4768	msedge.exe	98
PID 4768 wrote to memory of 1376	4768	msedge.exe	98
PID 4768 wrote to memory of 1640	4768	msedge.exe	99
PID 4768 wrote to memory of 1640	4768	msedge.exe	99
PID 4768 wrote to memory of 1264	4768	msedge.exe	101
PID 4768 wrote to memory of 924	4768	msedge.exe	102
PID 4768 wrote to memory of 924	4768	msedge.exe	102
PID 4768 wrote to memory of 924	4768	msedge.exe	102
PID 4768 wrote to memory of 4432	4768	msedge.exe	103
PID 4768 wrote to memory of 4432	4768	msedge.exe	103
PID 4768 wrote to memory of 4432	4768	msedge.exe	103
PID 4768 wrote to memory of 1676	4768	msedge.exe	104
PID 4768 wrote to memory of 1676	4768	msedge.exe	104
PID 4768 wrote to memory of 3764	4768	msedge.exe	105
PID 4768 wrote to memory of 3764	4768	msedge.exe	105
PID 4768 wrote to memory of 3764	4768	msedge.exe	105
PID 4768 wrote to memory of 3064	4768	msedge.exe	106
PID 4768 wrote to memory of 3064	4768	msedge.exe	106
PID 4768 wrote to memory of 3064	4768	msedge.exe	106
PID 4768 wrote to memory of 1156	4768	msedge.exe	107
PID 4768 wrote to memory of 1156	4768	msedge.exe	107
PID 4768 wrote to memory of 1156	4768	msedge.exe	107
PID 4768 wrote to memory of 700	4768	msedge.exe	108
PID 4768 wrote to memory of 700	4768	msedge.exe	108
PID 4768 wrote to memory of 700	4768	msedge.exe	108
PID 4768 wrote to memory of 1028	4768	msedge.exe	109
PID 4768 wrote to memory of 1028	4768	msedge.exe	109
PID 4768 wrote to memory of 1028	4768	msedge.exe	109
PID 4768 wrote to memory of 4904	4768	msedge.exe	112
PID 4768 wrote to memory of 4232	4768	msedge.exe	113
PID 4768 wrote to memory of 2304	4768	msedge.exe	114
PID 4768 wrote to memory of 2320	4768	msedge.exe	118
PID 4768 wrote to memory of 2320	4768	msedge.exe	118
PID 4768 wrote to memory of 3432	4768	msedge.exe	119
PID 4768 wrote to memory of 3432	4768	msedge.exe	119
PID 4768 wrote to memory of 3432	4768	msedge.exe	119
PID 4768 wrote to memory of 4500	4768	msedge.exe	120
PID 4768 wrote to memory of 4548	4768	msedge.exe	129
PID 4768 wrote to memory of 4548	4768	msedge.exe	129
PID 4972 wrote to memory of 4844	4972	cmd.exe	133
PID 4768 wrote to memory of 3924	4768	msedge.exe	137
PID 4768 wrote to memory of 3924	4768	msedge.exe	137
PID 4768 wrote to memory of 3924	4768	msedge.exe	137
PID 5388 wrote to memory of 5440	5388	cmd.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14660539771521198803,7187544665445620512,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,3238188242513350359,465986543653937715,262144 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,18274052236103380489,11656552779537573191,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,15480320758704890989,7495204028988301559,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,18203232075112928916,6107929710675156837,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,5417078423192576691,15990525308184733875,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,16297479539591702604,3037162735364846795,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16502812599564972737,7607042128509873551,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9569688616991338362,13882636788347547586,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10236550450239364055,11584695832643694007,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10236550450239364055,11584695832643694007,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6384,i,14648603325938419182,6529727858723066339,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4232,i,13038842907634364311,5867741873130989944,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,6952230925212281899,15731436830231547312,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6544,i,1649602206763874305,15002119792487852509,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4484,i,14065266855049677634,10082264740549600812,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6536,i,3760337135480839270,7798367071341569529,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6600,i,2483864017536425914,12793087837018737019,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6676,i,11554553273212845303,2531990692012814720,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,10579049556446101786,8032148231552150843,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,1456433064020907638,10638613379288080556,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,8829801777263424772,3052218388396340886,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,3494729252741966825,5416982562064122361,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4000,i,1133213913341298349,9922502770437789580,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,12835971201881364992,17232337709787268997,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,16757869000968793424,15307958672201161349,524288 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3748,i,1895150264224318795,8823856195082024160,2097152 --field-trial-handle=2916,i,5548013232224434116,8177340887631319181,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap32603:110:7zEvent9319
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\turkey_dnsredir.cmd" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\Desktop\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --set-ttl 5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4844

C:\Users\Admin\Desktop\x86_64\WinDivert64.sys
C:\Users\Admin\Desktop\x86_64\WinDivert64.sys
1⤵
- Executes dropped EXE
PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\turkey_dnsredir.cmd" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Users\Admin\Desktop\x86_64\goodbyedpi.exe
  goodbyedpi.exe -5 --set-ttl 5 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b82f3ed4d6d857ec07ec9208e2b4720b0252188b092045a9944c3bf4df2dc466
MD5 2fca869d7ed50b536ecd2d93f4589e0f
SHA1 85f04ab3ab5e3656ccd7dc5b241cadb7d23ae9cd
SHA512 612f9306b4e0a8bd9c445d1b4cdf9d1d2dd5c92ac76295b6aeb1fdba6fde5a8ebc06afadaf416b8ce69622e767cb5fd85f0a6e22e0f16dc33863adf3980129cb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1E3B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 406KB
SHA256 c9ec15f6b284850a9e9c19a7e64a22154929e0f9e15a44f9f7e394111739fb9d
MD5 9216d5af8ede8d6bad7e05785c4f1536
SHA1 6196a652118779feec14a3c1d560d8a85fb296ac
SHA512 4707760777c417037805268bcd345cea67cdbf895ea01a002a157f9442c81520dbff93cee7047922e1513321e90db2bbc4d62365a5cbe51f308f484d7aedbec3
SSDEEP 12288:O+3o7mAmn/5Y8dgX4V+1iOF8MB/noCWnm3LMZT7LDkwFdqM:OrKAmxDgoV+YlMVn3kKLMZTbkwh
TLSH
T1879423FE7405ADD11AAB541F91A0DF9284D045E178637B997EBF4CE8A84CA27C4C8ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 68KB
SHA256 096265551a5ee356be7ccefaa40a7de3929105288e029cda15c965cb65b55eaa
MD5 f6709d44783ca7b4b921437ca7dd2727
SHA1 a0c6e731ea03274fd0420c360b5f8079ca719138
SHA512 34b45e20793f4de99caac1c28fca40953d4bc2902ddf4dac70c55bc28ae28cf01632095b20317c8c661832fc1b971fdc2eb05450ef8fcdafe74a5084589ad52a
SSDEEP 1536:GeXJHPV3M/Ib+Npon9pSlmtHf+SxQBEnhB35LsKMCoNx5p1WFK:GYV8xNan/rp+SxQSnhB3aKMCix5fWM
TLSH
T10C6302D8DB1C78A3B3A11891398B31876F920AD1DB0C79167D7F521E5B623EF4071B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 77KB
SHA256 f6419bb8a7143a2d4aeadfacd1aa7346fad4248fea46f30307556e707e361c0e
MD5 5fee10d43a603d19328c4813ca52f826
SHA1 2da1f3fe5299a70f197637ab7a628d834547abbb
SHA512 543c4b9a60a04697b28ae92589f7da4d61f55d2a05448715d23579caa94e2bb81c43997547af470fd9e92d1108561fbae12523b2c98e3ef385d93030ce313d41
SSDEEP 768:Ih09NbhjvT7ZfAy3U3zCebUBetygauhyJwoDPlxmb4mJXn8nJOFiJ2gun82GC/6u:IaXHtAtHUJwYmB8kFbn+AWJ+zCe
TLSH
T149730273EC76A544A2A9E13484121AEFE279E3C7531C2F77195136AC2C2784EDC31A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 16KB
SHA256 21e567d667f0debde217442964c11e53ec074908e61083aaa85c30e0991c4a6d
MD5 27868df963f84e26a3661e1aa6155378
SHA1 8c03f2ab06d038181b2752d844478359f63efcb0
SHA512 4fd7028792d5738dac9143d0bfe1c43104060b1911c6ffcfa157c50ecc9b3947d99fa600e06ef64fc0ce956da77d75dde57e94bdc82eac3d24fbcd64d7b57c70
SSDEEP 384:j+AQhCvTMgiBK2+y9NV7LBKKSzIq21Jp6I/FlRlrzLtFTiHX:C5bgOKjILHaEN3zLtFTiHX
TLSH
T1C972E113E1B1415FC87412B7A69C1F5E0B22649CD4D97CD39632AD3A0A5E864A71F389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 60KB
SHA256 973d7c4cd91c428490204d4647f283b60daacc9ff0e8c83bf8c1bf994528602d
MD5 b96f8d90119f9f8307274adc5695da21
SHA1 57e36157b36dbc401c5701d0e27ec2885193a4ae
SHA512 e267cd9d04f6ced28190e549640aa7e08060673a0f616b7ade1ef3aba4f7c8ef52a082266ec362f42ad2bf3982141bb8476e4be4c97ef8c40248a1d9e25efea1
SSDEEP 1536:G3gKQfQWtQJzaGw3WZiWX0K1pFlvnC2c+6LABHgO:G3g94oSZFkulqJ+6LAZ
TLSH
T1895302A1F19608BE6EBA88B35DEC427A99F9F4E653D66D32D54F124021B8821D937C04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 72KB
SHA256 e21ce53d43bd9e404759b9a267e44c63106a423e70263f87d9e13ccfad4f61f3
MD5 1d4e7b902aa7d072fff5861353725adf
SHA1 3ab24c6848aa072854995d7f477604f2474fd6a6
SHA512 4667de5c55d95d200c604614114228180b0bec7b1e2f4bc204de5e28048301dd956ac0105516cc734757da33643cbef9ef42a2a04ca7ec6810200fed1f842d05
SSDEEP 768:U8XRyk5xUzO+ZR6lrxcgNbZcHTnGWRVmcrODcgAhR0C35hYNeJET+KoASRBqFqTE:UKRfo0rxzbcbzfSDccNaAJ0W9nKr+wM
TLSH
T1DD73023BCC97140DC7999B27A829A32EC10892C6A01F7D3B46C4347975233C5B667DD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 17KB
SHA256 45f853bfde5497fee0ec39e378b8940d9bedee1c9ec26cd0609d31786f00cc33
MD5 fb22a9c1cb9acb212cd5879b029d1006
SHA1 a7fd325e50874c33ae4992100d1e54c71d3111f7
SHA512 02fe622a593b7bb3f7c2c8dbbf7fb6262a70c9761b74b759c5f37bca13239d7d6aaae5877c1b25c52914dff3fdd33377d2c44866100db28e992545f3aaa21eaa
SSDEEP 384:h1v82unP6XE7WxwJ3ejNo+EsRAvzG2+LUosD1O5G7:hCxnPHJ3yoB2AiRUo1G7
TLSH
T1AA82D11D17E188E06E3CF8016CA5A8246CD17BBB7FD2167D1A09796D2CF98B01AF9714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 68KB
SHA256 9e4788840f43b463a51534f036f6bd9a36e5293bd6da8e4654b43e1d83714d81
MD5 0032df338799c529f8900ed1df3fe473
SHA1 3552463fe133dad96c5fbb369d3225e51f729c51
SHA512 15265ff935bcd4e70263c233fcc97185785291a454838bde98267e26dc2143af16720dae70710ff0149a783ffa484ca7478ae76fc451fe2743c2c1069d7b04e0
SSDEEP 1536:U6UIpg9QPWEgHpuRQAPmrc930G+7F4rwzk50fpuMSKlZh:U6LO9AQy+GnSfDS+Zh
TLSH
T12863129CB8B56F8C40B28EB153ABA01DD306C65DC47B93FAC214B64F029D129A43769F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 38KB
SHA256 49e64d3ed6fa7cd75bd9e1d68a4a6db1667e4706f6354a97bf562dced5c78464
MD5 543599d2ca352c98f24b367fed1efe87
SHA1 a478e6c9c448b507158198b2b9936c8fab198cdc
SHA512 ad6705236eebff2e182a7dc1a1163741962ca6d87e485663843a4badece80424fec831260826f95890b1d4663026198ec5646cb5c7b9ed813374627ec2a96147
SSDEEP 768:GHRXACTGqn4j/ADPN0Qo7pPg0gbCy6E9pvZwcWx83rmnbhaRbRkhQl6:HeR4bA7CVjgbZpP3Wk6b8ruT
TLSH
T1DF03F1AF2B7D6A752F2A9394013F0AF4D48DE01E3465A158A26721F97D2C8D7748B0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 301KB
SHA256 b1f93b2e9434d93c5321275c4a3d0a87f3b822c552eceabdbeb1610c879e1863
MD5 78cb0650461d2194cecde1d92b8d15dd
SHA1 374bc8d83ae35cdd7db02265648e5379ecb7ac20
SHA512 6094a16569279f9e94dad62e4aa54a9a5348a20247a75c092c139b563d69832fa86d7dc30bf871a6e997f0c2928ccb20b3cd40b463767d8990c4935020fac189
SSDEEP 6144:AtScsXc4aVSZGIFH0Yev0fUIo4rhAN6v0Wh6ZguYbytxHKMKkcIo4rhs:PXEVaGIBO0v9rhAHWh6Zg1I+29rhs
TLSH
T13E6423FBF9E80D7FED1D9ABAB126484F93D034804030F55B6A5C700615A77CC8B56AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 0feb892c07b03d45ab2bbb11c3500ed5081d0de029448ad51c2801dd4c837b68
MD5 aec5e81aab523e623c9e760c08e19f91
SHA1 b88435cdba5ee53169f234d62e0c7f95bda5523c
SHA512 a0e389e2c3de2b66b0f7300b6907d3a484b6bbfff72f8cada979fb6bb270ec09e3112549cef1b33f1845dd556f473ac02aebdd0d954320745993c74bbae4373f
SSDEEP 192:7LZUjXBSI0Gq7hGvDyS/1WEiQ8oaaVz/y5TpmqoRoG:7VqEIgaDx1WPoagz/+to1
TLSH
T16D22FABA39DB8853EF50547914E23B7036366AE6FC1B1EB61BED4F301A837A1B355024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c324201883d4af64ed0d1840deed546d6d2af0ab8b9c140e83b66e978887d74b
MD5 25c2589222a4cd8acfc1f62c3aa3dd7a
SHA1 f5fd18b8792ad6d07ebb716fbd23f7f8b54fe4a8
SHA512 c6167411c0636eba922a1f05587d98474818ba5b89ac306bf341a9d50d9a60fec94f8efd82258b3abf7900407392d0dded247a1d0b0ace377137332d72e97452
SSDEEP 192:UAtWwwuBSI0ymgba8nC9PiQ86ayNDxRimzoRvn:UCkxIXZaf9U6aGDxo/
TLSH
T14E12E7B47A9B8853EF10503914E23B7136316AE6FC0B1EB62FDD5F742A923B2B355024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e24d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e24d.TMP
Size 3KB
SHA256 2c3d2f6bacaf1d514f291efcce7b8ffb1f7c78910d643f8ef7aa8b55009899ef
MD5 faf1cb1de891155ed449821739b3ac38
SHA1 a73dc0a228f2dc60cd8a0cf0bb9264f70a1a86b4
SHA512 f2d22d4183c7cc9bf35c1cd431013085681b1050cc9c20133c8ed130bc3b9905b7eafb438efd26443ff24324ec6dfd806056a8c09519b78a727f372a57356ce0
TLSH
T156714CB04EDB0563FB60803168E333667731B7FAFC175E9902E24B302795761F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 aaee48a57bbd58e301cf82a2a3a3bc0789e44d42e66fbb9bc9ba3fd655dac5d0
MD5 1442dd983d469f9047b18212abd8e22c
SHA1 adff25f78367ef4c36253c18206a01b82ee61b2d
SHA512 4807afa9bbdc9b8517595e36ff3ff1cb9808b2993dfb753731c7eda0472bcac48b6ff2ddbf6492af5b2c6d8de82e88d00e735b84bf62640c35a17ca5dbeec940
SSDEEP 192:DQxfYqO1Afm76uSuFc7lGTR/MdigmhmGmrmB2mDmt0mzmH:DQxfYqO1Afm76uSuFc7lGTR/MdigmhmQ
TLSH
T1FAD1DEF783E5862DD91151F09A18AF1BCE2D0556832C3C6AC5E4BE4BA3F2471E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1bdad1fdb01068a4e9234e1ae4828d9c78f81aaaf5d21a0e705b54c81907bd20
MD5 9a8683685653fa088c7378b94b67220c
SHA1 7bd82b3b7950fdf3b8af5125e58ded7b52c8a6f8
SHA512 4af35b81c33b23cbbf4f11e3f5293ae4c70d06cb86770beb27a0b29fa6f6a9970cdd30e18f84a5103d81e11aad40938c6a4c787b00d14adccd79a7b89c2b6032
TLSH
T10BD023B3194170B5555C7ED56155FC4FC33710D15853DFD815D45598153145C8617149
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58b8eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58b8eb.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 181a54f34940e104e4ae0f5726225cbf83d330675f3029857e4781cfe0d52bfa
MD5 2a8e63c9c0cdf6ce92f4b84cb69895d2
SHA1 51f30d9c9979059684294aa639b65c7397d4bff4
SHA512 1a44a5adf5dc307152a406b1b09a50dbf72c58ceb0e958d67f67971b8f2ee14e49dc7d0ff9e9345e789050dfe5b9fedf235d87406e2957c7053537bfc9ea6faf
SSDEEP 192:sxZoR+yM/jK1Ml8Mk7/fNscW+Idpd4HW6+WNGYIkX+pIgrJ:sxZoAM7/fNscWv2HbGH9
TLSH
T14E42D6116B34697BCCCBD209FA457F53D6F91472A2941E44A9FCDA1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c66e44c469293c0f739abe4115d984b6ac0b152fd2060c183a9381be1b69eea2
MD5 84764cad5c0eac08d6477bccb6dd4a38
SHA1 8028af2c9cb3274e2bb1ee70cf4c4f8c09af4bf8
SHA512 bf82b57116722662693f33422a574fc8720d3f3be692e30f77379b222f7191699763c6f30307d166b7403ae6cb263a85f23eb8b8d682be6c14d46957ec30612c
SSDEEP 192:sxZkR+yM/jK1Ml8MCcB47/fNsGDXdTb/qddp9OXBGhBHW6+WNHhWbHzh/YAvP+p5:sxZkwam47/fNsGDXdfUFHbid/aI1uFQo
TLSH
T11A82F95266248D7BCCDBD209B9257F63D2F41872D9510E5CAAFCD91C00EBAFD220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 64cd42c1c2d598bf6522fc32738df694da58625153558efd35442d0af6e3a273
MD5 e7db8a4aa57df6feafabf646aea9185f
SHA1 7a7835c4d09c51269dccab41ee9970c452e6ed1e
SHA512 3927aaedd6e64c0ba9aac57ed6a663b0c29f078c4319094bf285e895fe935730ce0101b601686082b96168716fb1a34ee89489452f6c354447deaa44e67ef0d8
SSDEEP 192:sxZkR+yM/jK1Ml8M0cB17/fNsGDXdTb/qddp9OXBGhBHW6+WNHhWbHzh/YAvX+pB:sxZkwsm17/fNsGDXdfUFHbid/eA1uFQo
TLSH
T18C82F95266248D7BCCDBD219B925BF63D6F41872C9510E5CAAFCD90C04EB6FD220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3ba7fe5e6d2b13777a43dfd2a698e9b247f779fe1c7323fb8734e57ab308163a
MD5 5e7f8b5b48d793b74e5042b3a376eece
SHA1 da7538821636dce902ec75d9bf46da3343f4ba41
SHA512 f95dda70ed13bfb5688a871341a3af708bdc1e6f312d2e7eda9e514893804b128a638b43f4c9060ab49c9fc7e08a691cd032ef9d4eca0f79461917edffce5782
SSDEEP 192:sxZoR+yM/jK1Ml8M0cB17/fNsGWUdTb/qddpmXlG2HW6+WNHhWbHzh/YAKX+pIg8:sxZowsm17/fNsGWUdfUYHbid/Z8
TLSH
T12062E6126A345D7B8CDBD219B905BF63D6F418B2D6900E94A9FCED1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fbf4fac60f0eaa88cb90c8dc89a4c0662367794ed796b6df2283e59ea92e1cc4
MD5 4ecbd50fd5c3efb82d5b1b2591a2bd7b
SHA1 fad027e3d5d7ca72c92902878bc806c89571202a
SHA512 06c0b6902703ff5af3eb4ce35e60f03b390f36cb54faea804acca9c14624916fb597a265331abae397b349023d614dafa2fdd7aff38e5afa6a05ad4032bd12e8
SSDEEP 768:uQsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR95roufG:uQsqxXlWvJD6Tu1ja54LAs9yuu
TLSH
T14DD21C3B694CCB7D4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 2c649bd80d2af62813ff93087dba85e911c70c05b90b93023d7fa37c2ad85490
MD5 313316f05c8a352f0e93b3746f4a8f04
SHA1 3b59e6b4cafd3a9d74617aa8201ca729025ce66c
SHA512 de38aff3becae2df137e6e967a8b0ac8f7127272cecae3cf78f90adcd3d5b0e03d76bbc187c26cee0851c7bc2f8f25fcb57d27dd06a61f526b9253219c7af2f2
TLSH
T1C431518E8E50959FE9A449B2147261B53670C9CC2B01E7134C3C71373D2736A2A1B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586acb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe586acb.TMP
Size 1KB
SHA256 d1cdf6e5cd2d0d3bfab310ced9926332eb80e6ce023f63342f2a05ac1489a879
MD5 e0a809d1398c1ddd6b3783cfbee5653d
SHA1 1aa62034bbb78d52fd48930da3472c4a364532fc
SHA512 9f8746912c87a0ab286fc827a896c2d11d634c74f002d7882d528e8b2efcc73e305df35d0d043e1de16e7ee238d612e2d05b701d8ae62fefc18a738e77bf1933
TLSH
T19031938A8A418A1FE8D440720992E4B83379C940532277C7987C6239BC757BE1E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 ad1f100d3f727e853d31de14b61a3fb71760905af2bb2aa67ef122a888a6d427
MD5 592a1c6e703ba7848d9988a7b1e9d357
SHA1 55c0c7b05e1cff2a5c759379f1cdd26c3f45acd5
SHA512 1acec13ced9a13eadf2230c4d1cf15f6d4d09c5d0c60dc3f2271b3260fcd1b8bdc8a53670c2198e7ac795e6ae4d3500f1dbe5eabc611ec5d4b34c6186f737536
TLSH
T1D6E068762AE70814A8ABC3DA087244964514F428CC51EC4F0129928310622602832C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0c18bb73985a921b902baf6eab8425de2ec9cb59db1035ad1d7636a66612db40
MD5 9776f3b8eee674e29560c275e83d49f7
SHA1 31cc10282c9d42ce42bb0741ef3ce90e79b56705
SHA512 03d075150a676d6623534c89b9885cfa750f9a82e4ae029de8b68099708e14282c4cf8caf635730663c396f22957887e7c978e0894c5d163f564981d0a779b84
TLSH
T143A0022ECF5DD545C14B137094A141AC2A10DCED0B06631948EC009C889254041E2635
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599dec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599dec.TMP
Size 48B
SHA256 03eb83eeb6f32002a211b00fbb5e79d36ecbf732f51fcae8b191f3d071531b27
MD5 2b3592de6d6d2d369e5c1707247d28be
SHA1 2956e9e43a3b69086227dc06aa4f45bcf1f530e5
SHA512 f5b013109331f3a72410884ece05d875adcb7db04e8928e3c32adb1ba143f24e93ad453b28225510fc9c3f8dc41ac9e247a084f6191dc66fc4fecfd5d4f17143
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e095f3211b390ea97cc1276a4c23317630c1f88c26c2ea6371eefe3ef0e51b23
MD5 ad85f0b2423f5a085006859c4a31476f
SHA1 1e17133156511cf90411ac9af14d4c495b064c9b
SHA512 68eab8c4846449e2b742c37307eb7c537629fc3833ce3160593d0761aaec569c9bbdfde1ae683d609945702d8b0d27f014940d9844795930c3fce8583449135c
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ28:ExZBdPxzL
TLSH
T13CE18C52713B821238BE690CA2B695378E8373A77518A56F7F7870720E66E110DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5911b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5911b9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cbbd50d40d1b8ca7cc37065ab675b1a1f3e263694bbdaf1f6ebc9e08b9feda74
MD5 59af6ba4ca7b4417cfcd1c5a7728bcdd
SHA1 b2c58d82f4dfb4ed91d13f6def5546986019fcf1
SHA512 90935010ba9346a2119a2371277a8a363ba33699eefdd4daad0118d9fbd0f35ef101570f358c7a27cd48d89a778bc4ed37fa627e7b5deac052e110a91c9275bd
SSDEEP 384:9ZcIhsNRsF87MblDCVRNVOK+t9F4cnTKwBODNZOC55z:lhR8kQHVOKs9OcnewBKZOyz
TLSH
T1C9927C716D381C7B5EE6B545F98B32174EF89077E6C82F94D1ECAB1C01EAA98130BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 47482ceb391750fb1d45291572b0a661e5986bf1097602b304bf830b960b8d57
MD5 b89c538094f663db9b8e5d55c6b7c3ff
SHA1 41930a67cde755b80847f44533c6ebefd1b930e5
SHA512 cdf60079873b1fdeabbdc6b692a7f70b4aaf4b6731741b9151e984262eed435237458b227d83f1936293e95b71059e541e6a06158da999e8c643578dc24ad128
SSDEEP 384:RiFLZcIRfsNj8TUNTUlIlYTt87MbVrj2VRNVOK+t9FNcnTKwBODNZOC55z:4FTFOwgg88jUHVOKs9DcnewBKZOyz
TLSH
T156D219F249DB483AD9AE6707A77E2D174EBCD063F5845A50B3986A0CCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 327b961bba3a252f727ba9fc1f27b883f617e2f60beeed90f5059f4211da7fc8
MD5 a2831db52fe5781e27fcd4783ce404c0
SHA1 e5419dca9261b02de7024a412458714ce2ad641a
SHA512 9e3a6ee8b5964951d9a3ce296cdfcc158fe2cc7f6fb44468621ad2bf8f3a8645a81dabc5f7251d6063c26301787735542da91ab64c9f53b220791a6a036b48f9
SSDEEP 384:wZcIFsNRYTt87MbVcj2VRNVOK+t9F4cnTKwBODNZOC55z:OFt8RjUHVOKs9OcnewBKZOyz
TLSH
T179927C716D381C775DE6B505F94B361B8EB89077E6C82F94D1ECAB1C01EB698230BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 df2a340b4b0c7492703749ecb90046842ecf936166a31a48ce857d1b0031777b
MD5 376d61ab96c97e9bd61afddd49c089dc
SHA1 e9309edade7b2ab34914e6200a3521d7a4d5d611
SHA512 da3f3452785d1d47dd3844a4c9e9e468bf3c7a40df0b224dbba971b5221d82310e12cc4de05d681d9048d80253984b5e15c6191a0ff7374acebfb2af8f95bfa4
SSDEEP 192:tONc6JkRtQmiUyf1W+RNVOmSY+y9h3/ReU6:tONc6UrOW+RNVOK+GUU6
TLSH
T11A02E8357D381CBB9EF26E0AB48B27175FA8203BE9856B80D6D81F0C01DB65C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ba717a500c2f3cce6a6b0061801138e84157a51dee689d22bd6cd77571f36004
MD5 a1471d3b1ced246ed2a60d9d8d576674
SHA1 3cc8a640e92b3254d5ce7460621164a1c4e4c36c
SHA512 324c3125fe509756f287f6755a5600b16c39c9741bf9d84d427b666504a532d8179348577ef3ebbe811044eda9627cb62d698495319ad590402d16c399273560
SSDEEP 384:bZcI4sNRsTt87MbVcj2VRNVOK+t9F4cnTKwBODNZOC55z:D4t8RjUHVOKs9OcnewBKZOyz
TLSH
T183927C716D381C7B5DE6B505F94B36174EB8A077E6C42F94A1ECAB1C01EB698230BD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4961ec187e7befd9162657b3c08b250a4dddf41ec522ba032f04eb5203cace52
MD5 b8fce04ddb95d9dcfa24374d9d7f28a2
SHA1 0dcb09a04e90a0bb9a3b543d2b86534d45eeba19
SHA512 bac41484111628e5ea0a8f7b45b925678db7be22b32045f2f987050bfba34150490cf95ebccfe2a88f0cf3e33c205f0db0fbc28419224dedb23b015dd6e14752
SSDEEP 192:0ON6V6JkRfQmiUyw1e+RNVOmSY+y6l9nFWVcMqZgU6:0ONc6UhXe+RNVOK+t9FxcU6
TLSH
T1F5121B35AD385C7B5EE26945F48736274EB5512BEA897F90D1DC2E0C01DFA9C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b21099522698d4171e69419c190f102ed39447cdd74fc257ff8c07e2c3ac5e86
MD5 5db1a0ad6697c930286bb7eef4d3ee62
SHA1 4a4960eef24e601abfdfeeaf9c66dbeff6b28835
SHA512 0502ef8416f204ff55694af6e5c44d7a29ca1223d22dc95cec60b837da70c9460b77a1dbdd0d8c5d972fa801721ea4cec3fe7fc7249e2d5871cbc162ff248010
TLSH
T1B5E002059304007BC01C033051C71B14BEE1891042F21245477111AC1C337003931F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fc0e76ed4a24ca04598af9ee8bcca8bf342accade13c87440f9ba771427efce5
MD5 ab83d3c43f8bcb68e762c7ff6312c9dd
SHA1 c539e9652ad0beb479e7a03833472d69d882eae9
SHA512 3b80c6f29c5a946f29e0878605b4fae2e1d356ceb10663571eb9c2eb50092026debc5d44460cfcff8c82296972d69faf393730ccf9e8f51f405d5fdac2347a2a
TLSH
T116E001069204007BC068033051C71B25BEE5891082E31246477412AC2C327043A35FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589c3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589c3b.TMP
Size 392B
SHA256 ecfd90abb851ffa3dddbb116de6a9e4724cca5e19db91b84081c756154cbd3a5
MD5 d296a7a73c372f31464af42d3860dc2a
SHA1 1027ce70e8faa06b4d9d42d2ebbf66e6f3b5d6fe
SHA512 7eb30d3c7bc3e42898d81318ac35804550aa40f5c1a4579b675ab39f95d248078291c4d08b60f8bfaa59af8ee47fc9465c1c2569674220e47342673e9d85869c
TLSH
T14EE002059300007AC01C033010871214AAE1851042F21245456001A41C137001930F90
MD5 SHA1 SHA512 TLSH

Submit Download

9d946a37-aff9-47d0-8233-a9bcd86cfe1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d946a37-aff9-47d0-8233-a9bcd86cfe1d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 52ffc5cf8abd3f33d618517e7c19e9256f0eebf84458f1d01a60b1f1406d01c3
MD5 07a866491558536b2c134b7a05eda2f0
SHA1 a43c039d12442176321559ae442a9d3af2697d2e
SHA512 50f6ee4aa94fbf414540b5ac2f8fb6a9844757e0ba84a702c4b0e020ea44ba275c44f6617fae43b9504c5febe1238b9fee3bfa772b26d39d2ce8064993ecb379
TLSH
T16F410958B6E91148B3777E5A9BF7A86D487EB8772E06D55D10010D4F0A23B80C8A2B33
MD5 SHA1 SHA512 TLSH

Submit Download

turkey_dnsredir.cmd

Path C:\Users\Admin\Desktop\turkey_dnsredir.cmd
Size 303B
SHA256 b1961df58e25db76e6d2c22b582a97a1cb135800a4878466e8d1fa6f10c63e22
MD5 775a903331912fd9867a99b994e1b859
SHA1 54c9e428e4a178b9ab1c720387703c204ff18245
SHA512 c92a86261a6b6879061995b6e8b00ffb20307af9d7f6dac7434d4a159b388a1aad48ae984ecd80aa7a1b7ae5516dc80967822c6c43bdb8192c9cd30e14b22035
TLSH
T1E8E07D3E03CC517CF78ED10120282002F4D5D0176E31A6E6A4B8B5301B263DFC4C1159
MD5 SHA1 SHA512 TLSH

Submit Download

WinDivert.dll

Path C:\Users\Admin\Desktop\x86_64\WinDivert.dll
Size 46KB
SHA256 6110bfa44667405179c3e15e12af1b62037e447ed59b054b19042032995e6c7e
MD5 88e1c19b978436258f7c938013408a8a
SHA1 09b77c8c85757e11667a7b83231598dd67fe0b8b
SHA512 eaa0d8369b76fd9a4978f14702716ae31d801cd0dc36a86531f9320b4ddb683265c4f0e07af2b9d2e85f513270d98d1b11ae7d501d08287442bc505176d16e14
SSDEEP 768:itSVluu2agCfRSB3QEw2VWHxWYuaO6JXtltdUUwhqWB8TicI:bUZWECHxWDABdIyTic
TLSH
T13E23C703F64251BBC568C27083AED3526E22FCC66354FADF829FF7952885F42DB1A509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\Users\Admin\Desktop\x86_64\WinDivert64.sys
Size 89KB
SHA256 e69b5ba3f0cd6cfb2983e442636e7f0b342b61b15264b0328317d4559c82cf50
MD5 6a33620de63bccaf5e5314ee49cd58fb
SHA1 ac728b339681b2e27099fecc1419821f01d04b34
SHA512 638d1b8aa4dc0e4ac504f51aaa3ec8375ccc3d69a4d36821f6bb98060b58586007f47966b9d58d222b9f067e12e80755f56559286cbabec8746146acaf24f945
SSDEEP 1536:8ovgCRgYL/h//oJJw5AdPtey2AyWpdsihch9WXi2v6MuO2:84jmJJsKle9A5pdsiqg/vsO2
TLSH
T1D9934C46A2E201C5F9F6C97895B59213EF31FA81AB22D7DF11D0981E4F61BE0BD78321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goodbyedpi.exe

Path C:\Users\Admin\Desktop\x86_64\goodbyedpi.exe
Size 99KB
SHA256 8d412b094bb9c137ff25ba9a794d1122ecc84bb776debff6c249723a13cc31cd
MD5 afa7f66231b9cec7237e738b622c0181
SHA1 478f336ab054623abfa691f11f12bc3be31deabe
SHA512 a3833d6018c6ddb63c5bc5b1a2efe2f9e517e80d28d6c59661ff625d42397e484e902ae5f211fc1586a25901c1f0d1700364f604c51a536fcc467703ce76e9d8
SSDEEP 1536:KuiGy47O/sFTEx/H6+FI87tZQkMvKghPf651Lz5e0yNgnIcm:KTGy47O/sFTExysf7PQ9KghP43VUgID
TLSH
T108A32C1AF353A4F8C51A827046AB2732AB71BC265130EF7E73ACE6701F51E605F1E664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-1357-0x00007FF6B4FB0000-0x00007FF6B4FD2000-memory.dmp

Download

memory/4844-1358-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4844-1372-0x00007FF6B4FB0000-0x00007FF6B4FD2000-memory.dmp

Download

memory/5440-1594-0x00007FF6B4FB0000-0x00007FF6B4FD2000-memory.dmp

Download

memory/5440-1604-0x00007FF6B4FB0000-0x00007FF6B4FD2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads