50316451b3f7fa04b6367ae73b09291f2cf2451c870a1e3a877429fd379c9f2c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
etrader.jnlp
Size 2KB
Sample260812-an81rsssew
SHA256 50316451b3f7fa04b6367ae73b09291f2cf2451c870a1e3a877429fd379c9f2c
MD5 ae092f0eef8449da02d41e5f2a8c4d6d
SHA1 013f70212401c5b0312aace70ea6fe728fcaea1e
SHA512 6a4f2481101024db67aaa10cad2d03aab7eef672446f92267f6a8348cc72c52df51f15b724abc7f27ec443c41a5e24a342961215aa970fd5160949a52b905510
TLSH
T19D413012C8D471964BB35211FC319548EB339B6BB66A4C2DBBDC125F2FB19574A63408
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6604	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1867239157\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_189040417\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_753747701\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_110616869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_189040417\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_217609316\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_110616869\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6604_1061465145\_locales\mn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6444	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309678201860028"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{358B5F07-A331-4C49-8126-5FD3994D0B5A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5644	javaws.exe
5644	javaws.exe
5644	javaws.exe
5644	javaws.exe
6188	msedge.exe
6188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6604	msedge.exe
6604	msedge.exe
6604	msedge.exe
6604	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6604	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 5644	1128	jp2launcher.exe	91
PID 5644 wrote to memory of 4724	5644	javaws.exe	92
PID 5644 wrote to memory of 4508	5644	javaws.exe	93
PID 5644 wrote to memory of 3168	5644	javaws.exe	94
PID 5644 wrote to memory of 6604	5644	javaws.exe	95
PID 6604 wrote to memory of 1036	6604	msedge.exe	96
PID 6604 wrote to memory of 2796	6604	msedge.exe	97
PID 6604 wrote to memory of 6444	6604	msedge.exe	98
PID 6604 wrote to memory of 2796	6604	msedge.exe	97
PID 6604 wrote to memory of 2796	6604	msedge.exe	97
PID 6604 wrote to memory of 3052	6604	msedge.exe	100
PID 6604 wrote to memory of 3052	6604	msedge.exe	100
PID 6604 wrote to memory of 5984	6604	msedge.exe	101
PID 6604 wrote to memory of 7000	6604	msedge.exe	102
PID 6604 wrote to memory of 5984	6604	msedge.exe	101
PID 6604 wrote to memory of 5984	6604	msedge.exe	101
PID 6604 wrote to memory of 7000	6604	msedge.exe	102
PID 6604 wrote to memory of 7000	6604	msedge.exe	102
PID 6604 wrote to memory of 2124	6604	msedge.exe	103
PID 6604 wrote to memory of 2124	6604	msedge.exe	103
PID 6604 wrote to memory of 2124	6604	msedge.exe	103
PID 6604 wrote to memory of 6580	6604	msedge.exe	105
PID 6604 wrote to memory of 6580	6604	msedge.exe	105
PID 6604 wrote to memory of 4292	6604	msedge.exe	104
PID 6604 wrote to memory of 4292	6604	msedge.exe	104
PID 6604 wrote to memory of 3392	6604	msedge.exe	107
PID 6604 wrote to memory of 7088	6604	msedge.exe	112
PID 6604 wrote to memory of 6852	6604	msedge.exe	113
PID 6604 wrote to memory of 6320	6604	msedge.exe	114
PID 6604 wrote to memory of 2076	6604	msedge.exe	115
PID 6604 wrote to memory of 2076	6604	msedge.exe	115
PID 6604 wrote to memory of 440	6604	msedge.exe	116
PID 6604 wrote to memory of 440	6604	msedge.exe	116
PID 6604 wrote to memory of 2384	6604	msedge.exe	117
PID 6604 wrote to memory of 2384	6604	msedge.exe	117
PID 6604 wrote to memory of 2640	6604	msedge.exe	119
PID 6604 wrote to memory of 2640	6604	msedge.exe	119
PID 6604 wrote to memory of 4640	6604	msedge.exe	120
PID 6604 wrote to memory of 4640	6604	msedge.exe	120
PID 6604 wrote to memory of 7132	6604	msedge.exe	121
PID 6604 wrote to memory of 7132	6604	msedge.exe	121
PID 6604 wrote to memory of 5340	6604	msedge.exe	122
PID 6604 wrote to memory of 5340	6604	msedge.exe	122
PID 6604 wrote to memory of 6188	6604	msedge.exe	123
PID 6604 wrote to memory of 1228	6604	msedge.exe	124
PID 6604 wrote to memory of 1228	6604	msedge.exe	124

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\etrader.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\etrader.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.381.2" "update"
    3⤵
    PID:4724
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.381.2" "1786494210"
    3⤵
    PID:4508
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.381.2" "false"
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://java.com/inst-dl-redirect
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9505fc188,0x7ff9505fc194,0x7ff9505fc1a0
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,7438877072034944036,5348546503559811386,262144 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5015824035618852102,15055294361569744818,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,12776638338430127324,10737541313128933757,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,18147481067449195914,15015355103583537927,2097152 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,13489100022240855894,15023005836229737863,2097152 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5052,i,7506740581277061352,2324922423046525105,2097152 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,12069928848306798296,8861532978149017781,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,217778196306592885,5612507737965536079,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,9927205025584175910,14834144130397953623,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,9927205025584175910,14834144130397953623,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,4291303436502854692,4771844123745621735,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,728946069249732407,1819793629491662405,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,1750730572038663843,325116378093729327,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2856,i,8967040614053836896,12312043907650377088,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9466945712643572771,5802719500446960814,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13716916112752247517,8050220129847384176,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,10838129080693833414,2538963093065531797,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6654218866425822537,1081976000363082735,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12305878118382248536,13617720563113155007,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,17712751873008017708,14247789072692067118,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,2694679909975836005,3871768089650442178,262144 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,11823714277661751757,13909240832383522591,524288 --field-trial-handle=2596,i,10410282338243997207,15892515667131451588,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e0b427440348d440b7b6887f494bfc2c176b1fb31f1de6c63475f2d179fd39aa
MD5 cc11573e8484694c0b101647285e0b5e
SHA1 e604afe245df64613f14f69d779ec3e366e0811f
SHA512 7d628294b961b6241b889b57ba0fe6a15ef5c16ca710f14e4fa8af9123160acc482432a8f3749db8466f1ddd002926ee12459fc519db9e90f4dd8506609be362
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 f9bebf1b4b4e14f013dfb1ede78e46706df8503940330409fd2ca2ece92fc632
MD5 b36e7279d5bd4de8d09cce677aff0168
SHA1 093d132d7b56af3e5855d55db13de095faf02e3a
SHA512 36c1ad30d4f336fa7b291b28b1742d10a562aefa5b6647a2fe96b9a1044dafe62f0b0d45001cecdc45bada068b3d73af7a96f4341d6d47955dfead3986c10643
TLSH
T130110882B81BA07039513132F9CF42F63BB2977C08A52275B1C058CDB871F3606A3C29
MD5 SHA1 SHA512 TLSH

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 897B
SHA256 21f262371b243822e8209fba5ef36d41b6a4b44f4b8da6447f3841907fa91e0b
MD5 9f44a2a43d298f7a5cb114dea087b9d1
SHA1 4a5973cd14955b0d64c86ffd21fb71381004dccc
SHA512 35d3ab97cb88f835c01e551fbbd5f6518b16f5f357ffa25fdec1fcdfa86672177637682c7b5711d682623a51f53234d5ed3797719c7dbf72f21c6a444141e3dd
TLSH
T11B110892B81BA07079513172F9CF83F63BB2977C48952175B1C058CEB871F3616A3C28
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 46faf7929f6e318b17df8b58129a6503278d408bb3e0b3840f4fcc1fa72ed79c
MD5 f707270af7544ad55c1d399e5373b4c7
SHA1 8f6c3d78a1c85c2100a05005284a93a947d38d38
SHA512 ec290bc94a7663c4094f8a9d099fa0353a91c603d8a576f4d894a8a4a6c0aa48bcd619cb3c5631364cc177abe8b6fd38f7447c81c4fbbff63890c8d93f0aee67
TLSH
T181E02BB5C920BC276DFC1B1C61680647E750135B3B51980B3B3C826D4FB06374286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c340b6d970743e2f7b449adf033b71fd72c9512a5850ba8057a7e1da8955d074
MD5 f08598ae61741b74405a583c2671f9f8
SHA1 f755cfba257aca25bf05b774a970837f6254ed9e
SHA512 482d9e5a3fdeed84c0c8e1cf3149d15070557d5963d0da523af926c21f86a3de9555c4094ac4a898b88142253006612de8bfb2f610d2df1f659441a4f346ee58
TLSH
T136710CA447B1DDE2FB287CB123DD0A6AFEF19699214B8FC600D46D70590AF7642DD047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e536.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e536.TMP
Size 3KB
SHA256 348af53b31748701647fe3adaa2179ed3a7e0dcf0c4f0e456837ac585c43b02f
MD5 ebc2d8f1f058282ba3a85ab2fac33334
SHA1 384ead20e6d1d3c7241dac33eddeb9a57cf787f3
SHA512 f0190a91b4225c9f78b5a0d053e924450e946122978067d60911145d13a379e8720577a490193e3196dca35f180ba814708b063e7902397dd1c07aaf6405f2e9
TLSH
T11961FA6043B1CED2FB217CB127ED484AFEF49698210B9FC644E46E349902F7956EE04B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 870dbf681d552286602acd3a8d65866178433c7296e644c4bae897853a8fd839
MD5 5df1d7a2fcef8de2aedb699311b01454
SHA1 1c3136d9f1019bbcaab076c756c10d0bf00c8345
SHA512 6499b89e26f84aaaaf3209d01907b20e2933459daf3355a09c9f39a833f51d0684ca133e56c7c41e3a4b78183c87d952f3044bf0883d62b13627d7fc5c806803
TLSH
T125518EF743B4866EDA1191F0AA186F2BCF1D0521431C799A85E4AE2793F3461E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 664685ecf4a9dfa3de38b6b5b2ccb65be9f3efb9b9c52807e60f91af7a699188
MD5 4b2d7e2904a825c15c37caba72249f4c
SHA1 c3b16b6077c6b9e01d32f62e5b586e8e2bd3b5bf
SHA512 48322db1d4c7dba2a3c225f2e90ebd69f585f96aaa53190ca0f57f94eff45799c663f28bd2ca6f82313d3227dd15e5a2b8e6cafb0ae58eba85b2c51d44d1cbd3
SSDEEP 384:sxRlo8M/fQs01jN/RIFkP/51/4R5FsGQ8jQo:sJNM/fwvWw/5J4R5FsGQRo
TLSH
T1C472E916A6249D3B9CDBD219FA85BF63D2F95133A1905E44AAFCCA1C00E76EC6103C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 eaf846f85a9bf89152a71d1f0a3e9a4b62ff5c77cec8ed5abcce63cae60185d7
MD5 38200b8882ec3f26f5f28a9eea6964f2
SHA1 e5479980a15fcb9bfcaf3caa43811ea01a510de0
SHA512 ee59a33b15488e2f8149f2caa8b9f9fb42d84e70830b7d3a11aa0cf41562278051ee6de1e33688a6d3a52f7a133ec950b36268790f70ffe2f533eda778b88f0f
SSDEEP 384:sxRloqcM/fQsr1yN/RIFkP/51/4R5NsGQ82D:sJvcM/fnSWw/5J4R5NsGQ3
TLSH
T15E72D716A6245E3B9CDBD219FA85BB63D2F95133A1901E44AAFCDE1C00E76ED6103C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8aec5daafefb83f35638c76b088f1ca19ed398d6a53cbad428febc9db34493a5
MD5 8c0b9b7481d6a8f09de28e578c18aa79
SHA1 ac96ad9d9db5fe9174bac93a4e3d0c74d98f35d9
SHA512 20db593175a37ed5b791b41e0c4a767a1628a2e70c6eff9685791384e6872f43543a307f76af7e3f3d4e87b296d3b9a7bd50d631938305bd4d1362e43a9714ee
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRobbDwzro84N:Ob4YZnE7yTWg1NfwBu1jaCobHwADN
TLSH
T1F1E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 936dc8e1649e18097f00b25f0abce9c266dbe2ca13a681924a6d127a78c06089
MD5 6b727be5bc356614f825daeb0d0cd3ff
SHA1 2c37bfdafe318e97099ce65238798ae4efaeb6d0
SHA512 460d6c623f606bb42fcfdae7326b4f025a5cdd5b4c3845d68686d64b72d02eb09ab0059c6ac2ef63a48f2b7280c2102b6dc2816a7ed47891039a0dcda2433827
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EkRC2kyCtmfyuIwB0ns0X+CJDsT:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRU
TLSH
T1D1B25D51713F4280383EA91C95B8981E96C2B4637419F52F7BA801A65F6BE03DDFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d3943ecf271d1dcd82d39ccd3df1ac6295ea29070639e673de70a041134d3b96
MD5 3ff8a700b66f5f60c6241b625553c362
SHA1 de910e9193f0b371276cc8856770f063a48d75a8
SHA512 ba3fdf6ca2b2c060864b57d893e30e0ca181cd8214aa483206e30888fdad700168640598345663f753758fd6b7d87a1223b5f4f2191adeea82bab87f471d915d
SSDEEP 384:nfiF1tNn/s3n9Sn8NgH8TUNTUlIRiPvuTuRREnf+GGrpNdshPWkLLOObjI9G6w7A:qF1j+9SXHwgUuYAGrfdsjL29MA
TLSH
T108C25B36E865CEBBECE64F99B64A7A17EEE01163859859C4EAD82D0C00C71ED4703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 34b46914e60bcadbb72b2a7d56824bf251788696a28c7503040e8d56dd50e669
MD5 b29d8f61f5692fa60602e6116e1007ec
SHA1 02f718ad9280f7e50eadd61e36b5fe55f909b6a6
SHA512 cb86e3d973df2fb3965ecf17d60839c0618b7371e2cc3a286365cd95710952d2b8d1da39616b5c48634b9365719b1a5842ff9908aca9fb1355c24207150311ba
SSDEEP 384:nkiFiZcIZ8NLN8TUNTUlIRoPvuT+35ECf+GGrpNdshPWmBp+FSJCMsRnlYPBc8LC:/FQZQNwgmuq7GrfdsvPe0Chn25i
TLSH
T1DBE2C3F198E38976E8EE4B87677D6E5299FCD063B4888994B7C45D0CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f9971f031765ef31cabdffd1ef3f10c6c577f19ca12e71426568d3db7524f71c
MD5 94362d64d40ffe989dbaa24e931a194f
SHA1 0e93e5c139ee2684df51d4713d2d5d04117e330a
SHA512 027c58830de302a6766bfdd130986684d6e1ea55c6a59c1b77e2aae1373fd99693e1d5ebf551f9cf90f57c9a4a20ba794d43b59d65cbb9b50dcad901ed79e3d4
SSDEEP 384:nTiFiZcI58NLN8TUNTUlIRoPvuT+g5Enf+GGrpNdshPWmBp+FCdCMsRnlYPBc8LC:+FQ5QNwgmu1YGrfdsvPeEChn25i
TLSH
T1E9D25C32DCA4CEB7ACFA8F85B6497652DEE0516394CC9ED4E6C85E4C00876DE470BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 105c36f35ec3b8f408f1c5aff7bf357a35f15f98921c3e3ce9274aa042d2eba4
MD5 32f4c8746b82f54b2a813e7127c23a50
SHA1 0d541f5ed17826483b25990c429ca8a268e6cf57
SHA512 0a447eaf980332e23153ec9e962f0681fe2d3493f52e37993eb9a28b2355e41daef1c105bfcd737b0f653fd9a20c7d1a10c158af4d1dac225e4831427ebab365
SSDEEP 384:nXiFiZcI58NLN8TUNTUlIRoPvuT+g5Enf+GGrpNdshPWmBp+FCdCMsRnlYPBc8LC:SFQ5QNwgmu1YGrfdsvPeEChn25i
TLSH
T191D25C32DCA4CEB7ACFA8F85B6497656DEE0516394CC9ED4E6C85E4C00835DE470BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c916217601bc973a3ed42d3f1f876c8aa3997bd063b44a569b4e1605939830c5
MD5 9bd3cbd96861dbd62e8c1f35e18b3ee0
SHA1 550e20675bfb8cc0d2ca0634f7ce1e911d0a5a87
SHA512 0e2efe942d1f74db45ef467edc05a9182419ca2bca267a3cf9089d467ee417b20c9e607542e4fb4f6d6f634074a5b613d951c40c850712c146b105a26131c03e
SSDEEP 384:nYiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTNQ5Enf+GGrpNdshPWmBp+FCkCOObjIh:jF1j+9SXNwgUuuYGrfdsvPerC29MA
TLSH
T1E9C25C32E855CEB7ECEA8F94B24A7A56EEE001B3889C5EC4E6C95D4C00872DD4B07C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1076cef9e25f74e423574beb18d36da4cb9fca5694ed277076ac6f94b69d74b8
MD5 f57d191cc55c4ba4a115bcb4ad91dfc9
SHA1 f3d20b025e868ff0461128d383575afa149c0ab0
SHA512 82a878b086d56d27b9718b31938c9c4ba8d32f9d320f7a38210766b5b21613fb5674b4e5105c4d3a106601033edd9bc28db941ed78281ec275491e4b6321ea3a
SSDEEP 384:nTiF1tNn/s3n9Sn8NLN8TUNTUlIREPvuT+g5Enf+GGrpNdshPWmBp+FCdCMsRnlb:+F1j+9SQNwgSu1YGrfdsvPeEChn25s
TLSH
T13DD25C32DC64DEB7ACEA8FD5B64A7656DEE011A388C89DD4E6C85E4C00C72DD4707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 06b6d15a0c95ee46ef55781db3b6599348bc9b81a23733c4b43d32297e3418e2
MD5 abf6a334fc8e30fe9db154a4b61a2daf
SHA1 c390eaedabc7bb7e16a9b876d975bdb19eb83d2e
SHA512 0b791dd5e87c7a0af64fd612e4b25348020c52b66f30de9a6366706234b3d4d0814c5815abbe7a13b9f88401952c7052b980ec8274e97ffe43b4e9f1054f6574
TLSH
T164412DE05C3D2AD1D4BE0E6FB45729FC94EC9726F8A434382899E968967A60D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3aec44bd442d1235d2bb80ab5e54fafe273f81017ecfa39c06804c853003fa1e
MD5 bbc491b4a91504bdd76f978f5d95dad9
SHA1 2f7e41ac9e6eef6cf5e67bf5ad28b74395ab6a5d
SHA512 63e55c11c31b4086d33b5a1d307d713de3138ea0ee139e5b0022af3a8de580429e94dccf9b3b84f219de6fffa4076f2cfe446105fa4f49938beb2c439a6d7d76
TLSH
T101413FE05C3D29D1D0FE0E6F749739FC94E89726F8A430382898E958967E60D354483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d67ec0b83e75ac9d25e93d1335ff1668519744187f0a77db08608bf05d1bb420
MD5 e63e02e00eafa81115853b216717f531
SHA1 aa9823c60057aadb084b11722383184883a725c6
SHA512 24f3dca268efaa01b2d42b839f2c46f839703dfd37050dd2a1c6aa1792d7e4c0c8878730303f80071dd37b5f65f8fef7d7c080bd6e4192d717ca4a4e9334b260
TLSH
T1CA413FE05C391AD1D4FE0E6FB85729FC94EC9726F8A4343C2898E968967960E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 21fc176072a600ef09ed88a42422d0a72f26704adcd4cd29bd4d7ab475b07520
MD5 49a134a2e4e79f77f3182843642fe85e
SHA1 ea934080d0a7daf9efe4d3da12427317b0705c7d
SHA512 e2f3f22c2209f01654d860921d096422d5b39a8378e2f32a8dca0487faa0c290509166895899d7938acc9eb988ca24ce03af95ec023fa1f409c108436a99f478
TLSH
T154413DE04C3D29D1E4FE0E6EB49739FC85E89726F8A434382899E959867A60D344483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3168-61-0x0000023FE5F70000-0x0000023FE5F71000-memory.dmp

Download

memory/4508-41-0x000001F38C2C0000-0x000001F38C2C1000-memory.dmp

Download

memory/4724-20-0x00000221BC220000-0x00000221BC490000-memory.dmp

Download

memory/4724-2-0x00000221BC220000-0x00000221BC490000-memory.dmp

Download

memory/4724-19-0x00000221BA9F0000-0x00000221BA9F1000-memory.dmp

Download