29ae222c36f90a684438eabb5c7bd218c240f1e7327e74ab0a6e8d652a0bb020

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4e107a0ba5b8a5ea54d892fa64a978a5_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 5.6MB
Sample260815-lf792stbld
SHA256 29ae222c36f90a684438eabb5c7bd218c240f1e7327e74ab0a6e8d652a0bb020
MD5 4e107a0ba5b8a5ea54d892fa64a978a5
SHA1 0e84e832eb45cfc0dc97b0d2e22123a6c21b4a20
SHA512 fd80a4ea65a7b75b23072c21a123ef8bdb101d1d796a99586b80de230f7dc0806f9eb44bb15bc8b217e7080b875615719f9e4da738d18323860c355e8cf80339
SSDEEP 49152:40FfdVrxCcwAeh7bD8vKQNJQ52sv9oRlx5cv1n8BV51a41TV2WQxEuNzNGd/JZkI:BfzdDObDPQN29o2MVJIM1oO
TLSH
T1D5466C03F2EA41E8E0BAD6758B265232E972BC454B34A2DF075036151E79FE49F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1207341650\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1207341650\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1911839980\manifest.json	msedge.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_44035031\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1207341650\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1911839980\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b39ed24f-3782-4a29-839e-bf80e0534469.tmp	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1207341650\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1911839980\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_724374612\domain_actions.dll	msedge.exe
File opened for modification	C:\Program Files\msedge_installer.log	2026-08-15_4e107a0ba5b8a5ea54d892fa64a978a5_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1292_13431259795399594_1292.pma	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_724374612\manifest.json	msedge.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_44035031\manifest.json	msedge.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\51c15aa3-cbc2-4048-bcc6-355e75ba6813.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3912_13431259795345258_3912.pma	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1911839980\keys.json	msedge.exe

Loads dropped DLL 1 IoCs

pid	Process
5628	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312597950532833"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{20ED3EF0-7B2C-4AEA-A724-F02DE5A5AB33}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5628	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5628	4616	2026-08-15_4e107a0ba5b8a5ea54d892fa64a978a5_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	86
PID 5628 wrote to memory of 4688	5628	msedge.exe	87
PID 5628 wrote to memory of 4668	5628	msedge.exe	88
PID 5628 wrote to memory of 5296	5628	msedge.exe	89
PID 5628 wrote to memory of 4668	5628	msedge.exe	88
PID 5628 wrote to memory of 4668	5628	msedge.exe	88
PID 5628 wrote to memory of 3156	5628	msedge.exe	90
PID 5628 wrote to memory of 3156	5628	msedge.exe	90
PID 5628 wrote to memory of 5704	5628	msedge.exe	92
PID 5628 wrote to memory of 3420	5628	msedge.exe	93
PID 5628 wrote to memory of 5704	5628	msedge.exe	92
PID 5628 wrote to memory of 5704	5628	msedge.exe	92
PID 5628 wrote to memory of 3420	5628	msedge.exe	93
PID 5628 wrote to memory of 3420	5628	msedge.exe	93
PID 5628 wrote to memory of 5652	5628	msedge.exe	94
PID 5628 wrote to memory of 988	5628	msedge.exe	95
PID 5628 wrote to memory of 5020	5628	msedge.exe	96
PID 5628 wrote to memory of 4740	5628	msedge.exe	105
PID 5628 wrote to memory of 4740	5628	msedge.exe	105
PID 5628 wrote to memory of 3208	5628	msedge.exe	106
PID 5628 wrote to memory of 3208	5628	msedge.exe	106
PID 5628 wrote to memory of 5468	5628	msedge.exe	108
PID 5628 wrote to memory of 1292	5628	msedge.exe	111
PID 1292 wrote to memory of 5400	1292	setup.exe	112
PID 1292 wrote to memory of 3912	1292	setup.exe	113
PID 3912 wrote to memory of 6140	3912	setup.exe	114
PID 5628 wrote to memory of 3852	5628	msedge.exe	121
PID 5628 wrote to memory of 3852	5628	msedge.exe	121
PID 5628 wrote to memory of 5136	5628	msedge.exe	126
PID 5628 wrote to memory of 5136	5628	msedge.exe	126
PID 5628 wrote to memory of 5900	5628	msedge.exe	127
PID 5628 wrote to memory of 5900	5628	msedge.exe	127
PID 5628 wrote to memory of 2368	5628	msedge.exe	128
PID 5628 wrote to memory of 2368	5628	msedge.exe	128
PID 5628 wrote to memory of 2840	5628	msedge.exe	129
PID 5628 wrote to memory of 1484	5628	msedge.exe	130
PID 5628 wrote to memory of 1484	5628	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4e107a0ba5b8a5ea54d892fa64a978a5_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4e107a0ba5b8a5ea54d892fa64a978a5_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,14844684933213142324,16148571234863578315,262144 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,7904322087758857495,1682801097437954400,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,5072219226715655123,5173215212614840386,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2852,i,3317425884692217754,8225596403676614840,2097152 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14045149981102767671,300646896395676730,2097152 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,6239668660635208001,14476812550751256978,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,14321282316337038226,3442800027832457107,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,3426614537173384833,2312710901930677768,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1955983658512703586,16698867644473330703,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12467420574503701795,14754810893750938044,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,15860711768354189694,9831023751345098833,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,15860711768354189694,9831023751345098833,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff60dbc04c8,0x7ff60dbc04d4,0x7ff60dbc04e0
      4⤵
      Drops file in Program Files directory
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff60dbc04c8,0x7ff60dbc04d4,0x7ff60dbc04e0
        5⤵
        Drops file in Program Files directory
        
        PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3140,i,5406896443572966721,14903501108093754694,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,388036290905932524,16591136547471163070,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,10630128305544830146,7346148287697231324,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11213386504764661309,11407335035058258743,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6036,i,26426501076887549,14693719594959666558,262144 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,6194599697493601074,16706898665140295615,524288 --field-trial-handle=2240,i,8899183462553364017,15436894104011410230,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1292_13431259795399594_1292.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1292_13431259795399594_1292.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3912_13431259795345258_3912.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3912_13431259795345258_3912.pma
Size 944B
SHA256 77b4f7a56226dac723e75967c9932bdbb93d57796bd00730b75d96408e00fd55
MD5 275c4b2adfbc66c86da785e53cc8dd97
SHA1 1f376d1be6e80c6ac9602be5b5383f93c429d9e7
SHA512 e50bd3a9e27bfac5177608e704e51051da32aedffc334900b89ad192204e8d7b3af474273ef292c82aae671f2ce18d94e3cf71e1d1395d78e1ec88c031c2558d
TLSH
T1CB11478577685A17D8038B31C4FA03563FB6F9E42B424B6B1545B60F0E132C88E8A080
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1207341650\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5628_1911839980\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5628_724374612\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 127KB
SHA256 c8d220c8aad95e6fb9b1d1705038fbbe7aa507506cfcb5f94dfc60e7167d26e4
MD5 f7b4fe945ad3a9658844b1a725e59dd1
SHA1 886f12f29a1f83c6939d0d4e6f02e0853a5abe21
SHA512 885a40fca6ceee7c588e9fb1c6cb84b77b79c20c16f90f82fbb981978b0fb3431d1070bfe1ebf9121592b603a81ebfd2cee0c529cee28a5f2b3243d54a77d40b
SSDEEP 3072:wJdSkwhKxBr1NmsNwXFGaoJgw6dUgfDGrjx62:wJdSkwhSwXsJgwcUgfDGrjx62
TLSH
T16CD3547D7F1641BB6B49AF9F2623393825FD2243E1C41B96BF58E400B0C7A96505B0EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 129KB
SHA256 3a4dc394295923a03277704140022300a0dbd8ac9bbdf35310d8db5e37711b4c
MD5 cb7a20ba7e3c2eaa0733ba4ec5c12edc
SHA1 1b02978e35ac487145eb6be9db3aaa57f8b53495
SHA512 757cd92bd00ede1c8e68f2f378fd1c0dae5a3168c93a232c6707ce27f36c6150e6ecfee320161ee3e5dcfa706e0c9955bf0a2df5dfba978aa402875cdc688301
SSDEEP 3072:wJdSkwhKxBr1NmsNwXFGaoJgw6dUgfDGrjx6q:wJdSkwhSwXsJgwcUgfDGrjx6q
TLSH
T19CD3647D7F1641BB6B49AF9F2623393825FD2243E1C41B96BF58E400B0C7A96505B0EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6e7084b00c9d8d44fa6bd593e4124178e41f47b553bf7dd7be345c3806d1a9d0
MD5 9e11f3182eb09529b7802cbad09de011
SHA1 71a4f75cf88af985e840cd0316409c808ee0f7d1
SHA512 db8284090764784140f99be0373633ad7c0cc9b2c683982e5b0e36e23913395a06d6209daccb9d71e9010e2826b8a6347f61cf81f95b7dc9ca35293f5275f1c3
TLSH
T16AE02BB5C861FC270CFD1718605D4646E71513273680898F3B3D810C8FB0A3795C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0dbde4524a800100e79fb68df3ebbcaa59222a255e8ad2b8c993835b478f32a0
MD5 2e099041ae5bb0e52a90f0ddde9236e3
SHA1 b606d9894eadfdc877be40d1491847898a5f549c
SHA512 88aae54f6611063d4f20d5c2f576534d6e6953bf0473693926dfb12bc9f4fbe6093b8b814134896b9e2857e9fab1a141d0920cdc50ce79c2b1a053e2bf73736a
SSDEEP 96:7I17hLh6ZA1sfJEYq3QPu/Hi08HVFihnWjOkLfV0HxNO:7IZhtTseYUgHu1GCjO
TLSH
T190B17FB7C9827A90FFB5643168B10DE53D30C8EAF772FA6B04447C20D917A88895F8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 34b43e04d3a7bd15047986795583075411fd93fed5ceba4430e0c1affa606372
MD5 140c67e52fc08320829813d46896cef2
SHA1 be7210cf852d7b8dc3fc8cc70310c8cbdd11a2ea
SHA512 e61995d92f0b7744a2258dff20ed9cc35100fb97a2089c4b89140bd3454d67a44576fb460ab331d1693476600fe35e73b737c007326af7bf389d1d99387dcefe
TLSH
T13F81DDF783B5812DDA1195F0AA14AF1BCF2C0456436C3D9A89E4AF5BA3F2471E141B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6f5273ed427bc0ce07954132eb5ea32e83e058d6554c5e1140bd7d530eb3d6aa
MD5 d70634a3a6586bba0576f7ba13d53722
SHA1 0a7cb2eb75cfb3631bb3a841491d17da6b1b1efc
SHA512 96921847534f1b97ef14f86f5fd29ecd9c2df502be965d5e9d8c1d1892df2f011593d8c81b106a1288345b93ebc18a5704e1c9a644449ae7769c1990e5212940
SSDEEP 192:sxZQRpyMqZjK1Ml8UQb37/fSsO/ZdIaRuvidrbuqm7odp4VOHW6+WNBzQ/YveuDi:sxZQ+qL7/fSsO/zIKYikqmEpHb2/pBNr
TLSH
T1CA820915AA24597B8CD7D219F945BB93D7F80463A1944E88A9FC8F1C04E7BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c63d8868f52f13bf80e24ebaac681571f027c8d87592b7bef7b73e99fed60c58
MD5 c90633fae17779955072f8adaf5cdb9a
SHA1 6f0d91c602a487c88df087c200368bfc4716b1dd
SHA512 01a72534d43c537ee61e6a7555e41b57742eba19368c8c92c2a4a129b74f3dee5a364b8e8532c8ed549325a2c5c60413ba2526e96e11bf4f64be02d06235a53d
SSDEEP 384:sxZQ+/7/fSssS1azIKYikqmEpHb2/hBja:s4a7/f2S1az5HbshI
TLSH
T1347209066A24593B8DD7D219F945BB53D3F81563A1944E48A9FCCB0C04E7BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 228807b3b85a516e3c6427b9c6234e86b34d3c6e9f6a37a94284de9bd6c78e65
MD5 39ff5f29b6ddd4282c82577f951af248
SHA1 9aaa240a13246fbe006307465c42071c16a78004
SHA512 7ba6bbbbd956d0f49eda34994a1674608f343590ee0bf33289ddb71aedb64531147eaedc83c752915dd39275d7db00bc5b44bdf9044a05f5798e4dcdd1cc5d98
TLSH
T1FA51FA0E4C851E6DCA6D41B25CF9194037BE7CCEB3499A5BA66DA130FCC333A2E54324
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 1KB
SHA256 0595b6026ae171101b2c7690d4f86bbf270c62a7a5fdd08f72ca3917a6dd2440
MD5 311fd3015de268e4e451a7043eeeb212
SHA1 39ec6ae9b1003f747fb83533c1c46b581d6060e4
SHA512 15b67e2c4561adf71967896b3c6c1f32ef3593bdc66bf42094b55338bb1a80a1a8d2d15ceb8e4ffe8693d8abb608d1d67e21bac4ee002d667dcaa457aee4a2d3
TLSH
T1F241968D4D518A9FED9441B200F664A437B4DCCD2B1192578C7D333BBC6336E2A5B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58676f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe58676f.TMP
Size 1KB
SHA256 d8c74a6dbf24bc2c430ecc64ef927be0fa52bcc198cbe5d49e42d0f676664f89
MD5 29ae7fd470e6137de07bcb59f44c9427
SHA1 852c53bbe5d3ac3916c8fd3a3ede74d44a827a1a
SHA512 1f3dbecd305fe9cc67b8df9bd13c4deeda1362d392be84a99ebb0f0cd16854a287f408cd5e1c8af39b164bf9541dcb9410c0558c52e0e29e366c5edb4eef0804
TLSH
T13241A58A4E41861FDCD040730993B4B43339E90097227B4BA4BC523AB8B17FE2E4E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 29171b2e2a2139b1d93ba2c2e952fe8d032a2fb66c15f14395a4693b47a2d459
MD5 c818f4b1f944c1a4bbac202a475655c2
SHA1 87e67fadd867ceaaa353bca1d81811bfe9fab43d
SHA512 e9b7e58b3c89b3f9aa3f7f9d95d6244b153af55672ccdac3369cdf5d3a4ecb326b4ce48ef601f14d9743b170055aa2251a863e5cb42d3fb694923cf42f98ff0d
TLSH
T10FA00211C394C109C11711B69DA212813740C8943505134F41990545CC944544EC144F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 8d6c2c33fdbb49f64035883a6d59c9a48c4b3310829586d9a06869d938ad542d
MD5 b61c3ab1ef1cc4cc8c15b3293d5b76d3
SHA1 892d24f94602a70efd5e07529dffcffb3fa11dd4
SHA512 8131085960ffc7125c4f79a42debb9b9f5b9ee59995c6ba070b52cd2102468456d38eee414eedfabe413acd66826d44e7ecf10191437ea53fdd24765aeda8d3b
TLSH
T140A0021543C0D241C80612F02596D5A533A06E100201131D67D01554C8549C5454115C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9d797a5da19bae5bf61f9ecfdf48dd8a0b95a1be911c53db3060a4a6320a5b64
MD5 c7cfc02a9997cb1654082cf707d66055
SHA1 8e5a4b0980bf04b1d4f904651b315337afa4e510
SHA512 14ad3578e4cefe4d0a3c00f0e749c8fd122ff24a3573b38437f8f6b40558b17a12356b5f47de1d3bf84e5ed2a9c263f52b527e3f9119b4197f35e7dcbe4aa46a
TLSH
T16CE068B33EFB1C50FC7B93D6213158A40045759098409D0F2416B2C724B1319205ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6884076fac62af38167559888b4fe6d0ca5cf0cd371b7061ac1dcc422cc40d21
MD5 c8d1b9c1590aabdab37e587267779b4d
SHA1 5f24c4468e20fa0e1b3e2d6ad3670d0b836934cd
SHA512 463092963e149027e2ffc491e026c974dcc7d560cce46c9b502808fe895b1db007364c20a33f5be5e4c860f94f477c87eb296f7b1d44a3cf6b116751ef1748ae
TLSH
T13EA00260CE5DA0C1E80A4771106556C873605DDA0206531199DE90BC8DE55C051E5612
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd8e.TMP
Size 48B
SHA256 4ea52cfa3d4b8d46164c96851d46d1f364619fc1ca11b322f3cdf7de9697f38e
MD5 1350d3d1075a4ce9ef89837ea145d014
SHA1 3cff161bc795d27244e18147ce03d3520a8ca991
SHA512 c1a62888a9ae3b618974b26a5a3c774ca695031da5ecedf7ddc645b1c614c5dbdd9d1ea10935f8fcd9004e28187b08424f0670614e269641c27bbe1efdfc5bb6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7f5b78efa520053cfeb1686116a1d798f2e1ccdd04057f838db2bbbde96ee850
MD5 f500f1b31b46da834bdd2e65060f1559
SHA1 22323930984fda6d653eeef9e9b70a63ff7f87bc
SHA512 1c7d6b0a6b8ffe2d57f6805aa04dccd09d55bb3716a5f206c5280ef462d72036c03864ac3cd1c7903e5ad5a35c842abb095bc4f8689d7e2f482107ba6df52ba6
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9NpZE9qpdXfB:0LppY93PBZJPtN53NTE9qpdXfB
TLSH
T16CB25A5A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7c77fda-3ae8-4453-8d1c-340d3867d684.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7c77fda-3ae8-4453-8d1c-340d3867d684.tmp
Size 35KB
SHA256 1065f0a5ee29c495657436fba3f7611f3989a838a005fe762fa0393cfed9b7b9
MD5 9a8133e56d7d26cfc2368d4f94368d68
SHA1 0fc85f96c5234b6f99010cf862ad2ae8bbbab1f2
SHA512 a17773804683e41f85af797026d8431de815c178eabdc98ffda68a237f68767b6eadba101b48816a42370b37361ce77fc3d974883a87682d47ead0e9274b7316
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeysy10Llp:eY8Od/HEnFhWvFvmXu1jamt10Lm2Nuji
TLSH
T1E9F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1535fabf1ac966eb8b596b34a4229b843435f94b43f4f927fd8a0fc9125822be
MD5 184ebf57aba6a7d775073cdf046c48a1
SHA1 e628948e9b1ab24070e30453dffbdbaa85f603ef
SHA512 4beaa3ebd4ed91cc377c13e2d73ce9ae231f77fa7d7aebde04a8e17c57d5e93f723646c13cb0f6fdc1e226e2c9139e1fad04415efc0ae427fb9da0f79a7ee0ee
SSDEEP 384:nsiFiZcI/3sNd8TUNTUlI4TQckCr5/1phiftGNZO0saBkyraRebOPrXLpe8C/Mt1:XFQ/3owgckqboGNElsaRebi9PT
TLSH
T171D25B72E8A4DAA7ACFB5F89A75A3607EEF40263D5CC5AD8D9D95E0C00C719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9ae9e9cbe677931152efc08ed043ecb647b71cd5eeebff48250358452bb690be
MD5 61797e24e57e8f8c1b9d90051cf862d4
SHA1 74cbdecf6147ac41e08c7748791a5eb3f2d41410
SHA512 841e819676765fad2bdd004ec189c34044df0512a7c49cbbd6dff666ac44582cc15e04f02a47a37db3677ac3f41c4e4c3dff406c73ed8fb9d5ba95a40c105e71
SSDEEP 384:nXiFiZcIo3sNd8TUNTUlI4TQckCr5/1phiftGNZO0saBkyraRebOPrXLpe8C/Mt1:SFQo3owgckqboGNElsaRebi9PT
TLSH
T1CCD25B72E8A4DAA7ACFA5F89A75A3607EEF44263D58C5AD8D9D85E0C00C719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ceaae92b090382fcd41a771f097ddc3db5000cd0b6471a1842a232736ee4b3c4
MD5 5677507d7deced892c06bae244438251
SHA1 12132ac227245112986ac4e50704b82959d494a9
SHA512 bd48cdeb98ae4cabc4de08d0be816c4403b86e881afc0d692b9ab4f456d15df13e5421d1577ea245dffe8d90df2c89e20436e3d7c9c10cd11493dfcc7499a40c
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9l3KphiftGNZO0saDvp6e4KV8p054HVt:peFccps38wgbkUdkoGNEssI8p0gH
TLSH
T1BEB25C36EC68CEB7ECE74F99B74A7A07DEE01227859C5AD4CAD81E0D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b5b734f3db23492187d5bbe75122a62aa63b1d0166d7b9b1ccac39b04bc19382
MD5 d00343999184e70ab3194ff5fc0eee8e
SHA1 9e1bbaa6bbc5c634ccce8e505a51409142c74b01
SHA512 38cfd9eb597ef1e4b6e1a7045c464aeec6c5d09c0b309e87cbd434c801c116cc348836db7125bc1162de2b625cbde9c1fd3312a567bc33bdf86d03aa94f17fd6
SSDEEP 384:npViF9CcmyWCB3sNd8TUNTUlI4TQckCrHK1phiftGNZO0saBkyr2RepMty/7Igq:pcFccpB3owgckVboGNEls2Res
TLSH
T131B23A32E8A8DAB7ACE75B89A74A3643DEE04163C58C5AD4D9D91E1C00DB1DD530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 071d8b00a9e6d1ccbc61ef96a6d8989a970b9f76a5cf02bf87b996680212a57b
MD5 6fcbebbaa389cc42b7c881fc98ea9f56
SHA1 aaa98da05f28013122fac7f7c4562cc9dcb94e6a
SHA512 01d735ba40f60519c40eb3e402b32c737b89f043903c3e2ae0865771f8b5fb9d73955e993fd51acbc80ddeed64bfb7d7a93d47854e1b786e0233eac43595e031
SSDEEP 384:npKiF9CcmyWCs3sNB8TUNTUlIm2QckCr9pv2phiftGNZO0saBkyrQRee4KV8p05o:pBFccps34wgbkUdooGNElsQReI8p0gH
TLSH
T1C6C25C32EC58CEB7ECE74B99A74A3607DEE05227868C9AE4D9DD2E1C00D71DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 793092c453dd3ef625228015b229e8f5df4178fbdea5138267e518846a842a4a
MD5 3f0db7d52b9fc6d0dffe380f9deaebd4
SHA1 6819f236423bd29715dafc8ef7ba2d5ffe3c0e6b
SHA512 4ea34a990ba84297eff9c318cc6456eb9145af38883d723bbf6ac8e381a6c50c9552ca81aade034ac4f5507579d64191b32b4c6ceed54003fb7a97c857686230
SSDEEP 384:npViFiZcI/3sNd8TUNTUlI4TQckCr5/1phiftGNZO0saBkyraRebOPrXLpe8C/MP:pcFQ/3owgckqboGNElsaRebi9PT
TLSH
T1D7D25B72E8A4DAA7ACFB5F89A75A3607EEF40263D5CC5AD8D9D95E0C00C719D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa00708795980dd39e40dcf72192ae432c9723c4b876d8aa0ee7c09d221ec36d
MD5 b86a7c58ee40356fcb8e3d4a647fb35b
SHA1 a1aff380eca039177f45bf8900772f4cdfd67b5f
SHA512 a8810fb130020ed22dc5e572a3a2567513dffc1534601ff2765cc0c70a5f04631f65a431dc87cb2dccfe29d9a39e8f6784267d29cfebb9f38552e7b41af92e79
TLSH
T174414FD14C380AD2C4BC0EBEB49739FC85E8D726B1E0347D6898E9940A7E54E709583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 706f44fc94310b8f9e8ce4f3b9bc912fd12a30245f4c80e92d7f23fc3c10f6f9
MD5 3a453591469cf31b306761d3055947d4
SHA1 54bf97722d27c01659cdca31ab2aff0623379d01
SHA512 57aaf6bc8907d19b2dd231518d6febdc433a3aa16641a9f1a42f7a1d053bc6a7675484b7d45c8ec107c70ef870a75c492549c7fc9b6efc1000f08179c070a9f1
TLSH
T198414FD04C380AE6C4BC0E7EB49739FC85E8E725F4A4347C6898E9980A6E50D349183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 74a526757f2741633566c7bbe88e53f464d6350409cedcd1fe8a43a32de3d1ff
MD5 9638b772d19e2738794e01148cacce5f
SHA1 9c1658965b741f88762157928d9f027286279548
SHA512 5253b0031ef74ed62c1ab3c58c450f3a7a9e380ee14c52e06a28352a12c34ab96efa6d3160cf55f8b1a9d7fe82eaeebc0a8856f459d73798998a698fc37d9b15
TLSH
T113414FD00C381AE2C4BC0E7EB49739FC85E8D625B5A4347C6898E9A84A6E50D749183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce26b3826982cde101215c09dd5a8a290ccebfd6eb5397633717647888251070
MD5 c95b4747dcba46eeb74773f8c89d8c90
SHA1 593b5efafa13340fbc7919b0b193c8ef032b26f4
SHA512 8cefbde7b82c40f13cfb0ba2c553a9544855f668396ecc4a31082f9ed36ac538f807408bbc49a62800c8e0886e8f8e450147beb7b89fd750b263ba3d8bab9bc5
TLSH
T1DD412698BAE91048B3B77E5AABF7A82D587FB9772E06905D10110E4F4A63A00DD71733
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 8da465f43855403e6dde0f7e542d487d56c451e4abae33d12bfb12a2296b1b0d
MD5 b666d5a4614b5e64f4076521f75f6767
SHA1 c6b93b6494dd5a86227c72e6b54ae4fd08e03241
SHA512 c5ea7dc25784b0525540793c0701326808ccc92117a34c88065e6e92970b604c393ab063ce6c5eb0e96497547772cf5c270bbd05a25c1eb59667ceae0b4c148f
TLSH
T14E41D0045BD90639F3F69E71D5B37A21AA3BB809D9140B2E008443440C23F0AC92DFB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5468-821-0x00000206D4750000-0x00000206D5750000-memory.dmp

Download