a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
geometry dash auto speedhack.exe
Size 14KB
Sample260816-s71slsec75
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3204_802736228\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313688784733285"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D728D173-369B-411C-9AD2-D2E1113C4BEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2584	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
3948	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
5024	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
1792	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe
2132	geometry dash auto speedhack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2944	geometry dash auto speedhack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 5024	5032	geometry dash auto speedhack.exe	95
PID 5032 wrote to memory of 2584	5032	geometry dash auto speedhack.exe	96
PID 5032 wrote to memory of 1792	5032	geometry dash auto speedhack.exe	97
PID 5032 wrote to memory of 3948	5032	geometry dash auto speedhack.exe	98
PID 5032 wrote to memory of 2132	5032	geometry dash auto speedhack.exe	99
PID 5032 wrote to memory of 2944	5032	geometry dash auto speedhack.exe	100
PID 2944 wrote to memory of 3156	2944	geometry dash auto speedhack.exe	102
PID 2944 wrote to memory of 4756	2944	geometry dash auto speedhack.exe	106
PID 4756 wrote to memory of 3204	4756	msedge.exe	107
PID 3204 wrote to memory of 3148	3204	msedge.exe	108
PID 3204 wrote to memory of 4148	3204	msedge.exe	110
PID 3204 wrote to memory of 3852	3204	msedge.exe	111
PID 3204 wrote to memory of 3852	3204	msedge.exe	111
PID 3204 wrote to memory of 3852	3204	msedge.exe	111
PID 3204 wrote to memory of 2032	3204	msedge.exe	112
PID 3204 wrote to memory of 2032	3204	msedge.exe	112
PID 3204 wrote to memory of 5036	3204	msedge.exe	113
PID 3204 wrote to memory of 5036	3204	msedge.exe	113
PID 3204 wrote to memory of 4444	3204	msedge.exe	114
PID 3204 wrote to memory of 5036	3204	msedge.exe	113
PID 3204 wrote to memory of 4444	3204	msedge.exe	114
PID 3204 wrote to memory of 4444	3204	msedge.exe	114
PID 3204 wrote to memory of 2996	3204	msedge.exe	115
PID 3204 wrote to memory of 2996	3204	msedge.exe	115
PID 3204 wrote to memory of 2996	3204	msedge.exe	115
PID 3204 wrote to memory of 4128	3204	msedge.exe	116
PID 3204 wrote to memory of 4128	3204	msedge.exe	116
PID 3204 wrote to memory of 4128	3204	msedge.exe	116
PID 3204 wrote to memory of 4564	3204	msedge.exe	123
PID 3204 wrote to memory of 4564	3204	msedge.exe	123
PID 3204 wrote to memory of 1984	3204	msedge.exe	121
PID 3204 wrote to memory of 1984	3204	msedge.exe	121
PID 3204 wrote to memory of 4564	3204	msedge.exe	123
PID 3204 wrote to memory of 4564	3204	msedge.exe	123
PID 3204 wrote to memory of 4532	3204	msedge.exe	122
PID 3204 wrote to memory of 4532	3204	msedge.exe	122
PID 3204 wrote to memory of 3592	3204	msedge.exe	125
PID 3204 wrote to memory of 5704	3204	msedge.exe	127
PID 3204 wrote to memory of 5704	3204	msedge.exe	127
PID 3204 wrote to memory of 5740	3204	msedge.exe	128
PID 3204 wrote to memory of 5740	3204	msedge.exe	128
PID 3204 wrote to memory of 5740	3204	msedge.exe	128
PID 3204 wrote to memory of 5780	3204	msedge.exe	129
PID 3204 wrote to memory of 5780	3204	msedge.exe	129
PID 3204 wrote to memory of 6136	3204	msedge.exe	130
PID 3204 wrote to memory of 6136	3204	msedge.exe	130
PID 3204 wrote to memory of 1932	3204	msedge.exe	131
PID 3204 wrote to memory of 1932	3204	msedge.exe	131
PID 3204 wrote to memory of 2376	3204	msedge.exe	132
PID 3204 wrote to memory of 2376	3204	msedge.exe	132
PID 3204 wrote to memory of 6016	3204	msedge.exe	133
PID 3204 wrote to memory of 6016	3204	msedge.exe	133
PID 3204 wrote to memory of 6016	3204	msedge.exe	133
PID 2944 wrote to memory of 5268	2944	geometry dash auto speedhack.exe	136
PID 5268 wrote to memory of 5256	5268	msedge.exe	137
PID 3204 wrote to memory of 1088	3204	msedge.exe	138
PID 3204 wrote to memory of 1088	3204	msedge.exe	138
PID 3204 wrote to memory of 1088	3204	msedge.exe	138
PID 3204 wrote to memory of 4680	3204	msedge.exe	139
PID 3204 wrote to memory of 4680	3204	msedge.exe	139
PID 3204 wrote to memory of 4680	3204	msedge.exe	139
PID 3204 wrote to memory of 5632	3204	msedge.exe	140
PID 3204 wrote to memory of 5604	3204	msedge.exe	141
PID 3204 wrote to memory of 5652	3204	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffee810c188,0x7ffee810c194,0x7ffee810c1a0
        5⤵
        
        PID:3148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6085455986901649491,12879601521569579686,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,871592525960746664,16388558197239991987,262144 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:2
        5⤵
        
        PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,3775123010211449182,8969012713766537836,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
        5⤵
        
        PID:2032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6070857796030272939,11838551054452815749,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15591048686329442985,15738551199350169252,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:4444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4182762579907312579,15056995788023863827,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
        5⤵
        
        PID:2996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,3542695584960144029,13167472657363653518,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,2379431896575053012,9592845429669444351,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,10090896614699549936,18161664032939104853,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:1984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11693791880958778154,15048580667070309688,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,7300624637676286089,1593066980234093636,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2731454061526987092,9407818183182718110,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
        5⤵
        
        PID:3048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2731454061526987092,9407818183182718110,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
        5⤵
        
        PID:3592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,6514812159063771163,4041593565747153122,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=120,i,17210538266822242010,4001970010910787640,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
        5⤵
        
        PID:5740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,2243425448788390981,3357827920473725175,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,4859851205147859177,633211918817233748,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        5⤵
        
        PID:6136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,17333838245185871435,11041627385054052791,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
        5⤵
        
        PID:1932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,6729092068170311307,8010856857845854418,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
        5⤵
        
        PID:2376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3652,i,12497294982903028132,12732784718213862281,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5264,i,12927141841611634625,2247964726966962184,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4508,i,4289891286808010197,8972590763151728562,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,18340812304681219713,12818153993435107487,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,1984268217454154949,16179975205964752130,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,3231822013913989400,16553345061018737652,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
        5⤵
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=2612,i,5635795420623594379,13410320314814592205,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3612,i,11909238552563302039,17013181832111459800,2097152 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:5340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,15943479714412903236,6407860733974985044,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,2461096252184526107,8835048296748039023,524288 --field-trial-handle=3048,i,18299331911298392607,8988868168720478181,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
        5⤵
        
        PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
    3⤵
    PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x300
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3204_802736228\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac0a0af9458d274946d96ce651c728d84d1359be0adc212cfa93491070d37da5
MD5 802508a69efceca9b92bebc33b909ed2
SHA1 f4bb65fff8a840c871cff801fd3fb282d0401bb3
SHA512 18157213480db586b3aa3574df052eed4f8aa50f734ad34e8f784b83e628bd9da9045d9d1bd285e728fc9d08a477d589815cfdcfb276b8fc9238b776e95f9efe
TLSH
T1D771C3653352A4B1EFE5493CEDD24AD979B0B0890A139EAA00706B3D2BDEB5F0C201CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9692708ff4b8bb195dc72012e4fbd255dcd9ef773431201bd6327485d1de4d89
MD5 40178b91124ad2f4bda83452d71ea3dd
SHA1 ed6accea7b373dbc20534390e9c6ccacf47dca5b
SHA512 6c042f79f50d0b2e5728fb12ab774aee8f40ec5d6d3b2abe042ac779aebb6a7bdc5f164383d0aa2a4f9b553a010188158818e0a12c6b600ebd5f5cefc560fb39
TLSH
T16171E5253351A4B5EFE5093CEDD24AC579B0B0880A639EBA01706B3D2BCEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596c6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596c6c.TMP
Size 3KB
SHA256 e2cf3a2fcdb672084c84f713bfcb05ed4939f7d348fe1c7fafcda948e011df5d
MD5 e86d75ae9da9560271b0f7f2124bb405
SHA1 781ca4172d5d21634a060632ff7196f213b4cfd6
SHA512 33b7f458621393ae78ae9b38a58677cc03d994cb119e4ea771a8bb56186aefc3617b5a918832e51e2b8e9f89b14d890195d20aa432be1e3270c30f814c536819
TLSH
T14971C3653352A4B1EFE5493CEDD24AD979B0B0880A13AEBA00705B3D2BDEB5F0C211CD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 b0fabe2949129b652125ab3a6bacfce8530db4784da88611a88adb0dc58bd9c7
MD5 ba67a602548a80b07a2b19ed9c46b128
SHA1 88be6bb2add08641e2142d30abe2650e007d0cbf
SHA512 26f2325303b3e27e8ffab05688ea52ec8ffa388946b115d23e3d182b546194ac11553686f96e26087a077492a197b256543fa169204b9a0dbacd3cc69a50c560
SSDEEP 48:YALlN8Om8gywPhVmlmHPm0mYmvmNsgRs9zEssVsMmCKskAfoKswgmzs+NwEskusK:D2OzufIgzFmAKzoPm+jVNwoAoXyjCq
TLSH
T1A1B19DF3C7D8852ECC5256F49B257F1FCE1D0918422C3E1AC9E9AE5B93E2871D20564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a3b1828dfedc477b65760491a6a1f55d33895d4a6f99386966badc7e33f8233e
MD5 1797301a645c5afe2c8aac7be7b474e6
SHA1 47592ffbb2bfaf89d3a99ed137485628f9ff7db9
SHA512 67ad7e869bc3d8d27de7ab6bc35ea1a7e23b4b4d77661db55742d63235e93e226cc2ccd990ee9943b7346c29b94a020619aeea8a4f5056c8d83f299390ff763c
SSDEEP 192:sxZURIyM/jK1Ml8MiOZ/fu4sIL5SMIdpJH7XpA26+WNGY4klZDGIg4J:sxZUGqC/ftsIL58JHDG7GGKc
TLSH
T1D442D715AA346977CCDBE20DFA54BF53D6F91573A2900D4899FCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 518d01bb4f7e3c98d8c3d17e8d6e434646354ae6ad36b89bc97ce1b893843b29
MD5 6d41675961f059be51c610055e971656
SHA1 fe82ef9d4447cb9590fcdb1628d7f26177a20ccc
SHA512 e86932d74607be7eab0eed7c500c333c986c3d5977e9c89fedf0b1d659e04e3ed8df1e6b9c4cf54c4cceab84239a87e3e416877f4ef20295e34287e7ff79a83e
SSDEEP 192:sxZURIyM/jK1Ml8MiOZ/fu4skLw6WBMIdpVFxKH7j6+WNsEJGfYMY0tVZDGIg5EJ:sxZUeqC/ftskLwb7QHUKfA4KS
TLSH
T17062E846AA345A77DCD7E20DB944BF53D7F5157291900E489AFCCA1C00E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 16f36047e30034b9a1a02e886262869f6951b17d5d531175bb7eeeda773182ec
MD5 2f7d1efd1f4d81c2707399f24cf8c650
SHA1 f8479fc3b560605dc05c233abb4086ce375dc686
SHA512 4ec19c6b52fecb63e357311ae3eebde6f9a618f90fe88a7a73efed52c75c42169c102741d8e72aecf1d8fff2680063bf557b45f0f1d6d65587a57c0e93eb514c
SSDEEP 768:vb8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdgroVkaUnu:vb8iJPNWvx76ru1jahALocdr/Uu
TLSH
T13CD20B3B680CCB7E4F844E9CEC266F966ED801CB5B948D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 60686ed46d3dbf11d929ae46e1a1e556a2e06b4761f7f88bfda529c471d4638e
MD5 d3863cde23a9fb6349afaa6ec18e76e8
SHA1 0ccf9b7d28515eb76b672574bd4e002c35e415e7
SHA512 28e98367c16ea35642bfe4619726cc88899d0d352505a0cd0840b7ea04b891722983b42c325220fc60c3dbecd494247fa53c4e43898abb795125bc652a2366bd
TLSH
T14CA00212594048A1C24D5A74608511602B308F222781831345D406558954A8542B1E11
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 56c3e28ca0a77188cba62243ccac703bb715dfb554d6c2feddaf3d364ca7777f
MD5 651f11e8dda0723dd080838fc00ffb32
SHA1 e854b8a708fc10713ad9b9105ae9fb7dc7387921
SHA512 72ebf2a04b6eca53a0aaf4496025b5978e68ad853b0405a2ff7713ccabcbeafe19f436e90e2dd6af62ce969f1cc7e01310ca82ea3bb9abbb6aec5af38185274b
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYtfo7Sa3df7z4Lv+CIjn/:KoZIhKy00DyxCI/KnqIbQIbK9ScDyC
TLSH
T18791748135BB12562D7F2A0CD1998F67DA8233B33005E42B7B6D01A24EA7E210DFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc27d303-16c2-42b1-9370-620a2a166ff7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bc27d303-16c2-42b1-9370-620a2a166ff7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bd855a35dcc2791a663dbc98394b7b7660037af4b146801e6feedfb1d992c2a3
MD5 d5ab567ac9598a4c8c0c3d632c1ca9d7
SHA1 deff8b6df887889830b78adb5f2b3ac6ca56eb00
SHA512 cde025161b7ad3d4ce71b2aaa93cf5444bfb49998bc282148fcebe861116833a530813c8e8a54919e340ac509458539fb19d961097d33ac61fea0cc55441b1ff
SSDEEP 192:uuxzLsNFzMQ2xzmIQQmiU16TR4k03YHHNKLIqq1UxPU:ndsNFQfxqlSekVHtXdUxPU
TLSH
T179423B31A8B87C3AADA3A545B04B36179FB895ABD7C42F94D5ED670C00DE29C2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e2a8756755ba76fe0dd3faa5fee794d5d3eabff30ad14ea38c2989260149e1e
MD5 7d490bbad890ce5c8dd101fdac1c78cb
SHA1 53dff6e89362c8daa15a2f2fa9c21232e35fd57b
SHA512 6b4bbcc418d7db6e5c2b3ad81f097a06ae4ff850d27e6663a1dbd518f1fdebb9c8b693ef28feeffb878abfa1764925e7cac44c15eecd75fd10f029b88e483052
SSDEEP 96:ZqONkmGQsjpfmUTmDK5ih/cIPURHl8h4otop5k5DmBhPwivh50xy0SFYKRAxcbs6:gONp6kDfQmiUyW2Z903YRQieQU6
TLSH
T15602E93568783CBB9EB3AE49B48737275FE9113BEA952F84D9E81A1C40D725C1303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6883e1a140c001370724b607ee3e06e27babfeb4d4c0eb77d1ca1975eac6b787
MD5 47b77dfcfdf193040c496060adb1f631
SHA1 08825457c273522b58575441a9ba5441f9bcb264
SHA512 3d946a62ccab538c48ac9cefd6cb176e18521b23cc1c8935104d5755110e99b5b9203b02691d56ffbb16207619443c37f52f4ab67804ac716cb3dbfb7db6433c
SSDEEP 96:QyqONkMQsjpfmUTXK5ih/cIPURHl8h4otop5koDmBoPwivh50xy0SFYKRAxcbsan:QJONg6kCQmiUyX2a903YHHNwcRqq1U6
TLSH
T187121A3568B87C7B5DA3A445B48736179FA58227EBC97F80D5EC161C00EF26C130B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 0f43f4233d29104edf4ddef25acd407321836b03dddffb97845f9e751deceecf
MD5 fefff5a43956e11b22d40013784d5a8a
SHA1 d6b8fdcfee51759d5b304fda8bbc1784c6b3bb72
SHA512 db8a5c39060e7bdeaa6b950a82a44e7f951fefb40da53296302cc1655bb72f2cb671fe5fa41820cecb3fe37eb3af4384538e0350edf3fc0ea301f46d327cc4d9
SSDEEP 384:nTZcIhsNFwfxql5/2kVHtXdOOPrXLpe8C/iBh:LhzxK/LdOi9P5h
TLSH
T102928D71A8B86C2A7DF3E941F58732079FF89567F3C42B9494EC970C04DA6A81317927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3e8161fc4a26c63bfbc2d7becc44da3829d13b508b3da4eae213803cf98a444b
MD5 6d8a5b648e2dcb1082d2469a681efb35
SHA1 a11e77cfc83e0f0d20205783ffd86aaee7431663
SHA512 d85bfa2d2ac8b215a2aa28cbe606412e7c7cc7ab4196136d405345790939096295aad475338511c6b8b3363f5a3337d570f903aa70c05b27af20e3f00ae488ad
SSDEEP 384:n7iFiZcIcsNf8TUNTUlIlwfxqlkS0Df4dVHtGdOOPrXLpe8C/iBh:WFQcewgKx7ggdOi9P5h
TLSH
T1E3C23972D8A8DA2BBDF39BC1B68676079FF451A3D6C85AC4D9D85E0C00D72AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8218ab685548d2c6f67b644d29c434f06cd696021d082bf8ceb2667557ea2d1e
MD5 20edb7c7458c5fe105858dfabb80b082
SHA1 f500a37ad56a70c742795c2edb8e001d35d0a45f
SHA512 50c96e14c8615cc06e9f7523fa48e9fcc600b66614e2923779e3a1e1e7870a7a5741ac5bd0a9e640464f8e94d8a9fa27670d01c8479fffcb4be38b348dc99eca
SSDEEP 384:nCZcIhsNF5fxqlSekVHtXdOOPrXLpe8C/iBh:whsxxTdOi9P5h
TLSH
T154928C71A8B86C2A7DF3E941B58722079FF89567F3C42B8494ECA70C04DA6A81317926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 79720407d9482c7dde2c1e4226e473e9e7524ed5f8a270505a361dfc966831c9
MD5 95c799b00d9060e32b582a7f5fed04db
SHA1 44b6c960535c3a8b9715337221081d786210b4a5
SHA512 f5aa200bef844337c1063cfe4b2bf9d5179d6b66d4714021e4853c14808acdea95f01a4539e9641587c9ca6fb66bdad39ceeeb76128f0f0232b61df6a930b322
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59fd81.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59fd81.TMP
Size 392B
SHA256 43e8d2893dfdae7f4cf9edd96949d47e3b29ffc00173f447d05e0702d83efff9
MD5 bfd72fb3a9d34f5d558405599ad650e8
SHA1 77179f6aefaab9a462e6938e786f0d255e75784c
SHA512 e1b3d6cf3319db6b415c6799158e0197652ea2e01c0b0984771fe9d765cfb742cff3ab23dde5f467933407e7ee284c7293e3e1a6cc3f6f9e9fc3145eddab8c66
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a36b8e32-ba50-4d83-b68c-f8f1ea22b08a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a36b8e32-ba50-4d83-b68c-f8f1ea22b08a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9123e5d8068d25c88ac9721eb788e2478c50906929e09620fbcc152f4e59f9e9
MD5 228c59ffc1dde2ce087ae6db8ab6ba1d
SHA1 4a0c4acac49bdac1b58b455169420a314a31b90d
SHA512 f8bb1bb2c17ab8e534b26a69b216811f72b73df2a4bbfc1298c607dac8e7efec796fa45e32b9c421f833eccb9cd9fcda7ebf807d607612e2212bdef138120e2b
TLSH
T1D541285CA6F91148B3B76E5A9BF3A86D487EB9772E0AD56E10110D4F0A22A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

1b7fd6f7-bef1-4b0e-b441-5dad193be4d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b7fd6f7-bef1-4b0e-b441-5dad193be4d7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f23e41f9-cb00-47d7-9856-2a2078303a08.tmp

Path C:\Users\Admin\AppData\Local\Temp\f23e41f9-cb00-47d7-9856-2a2078303a08.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3204_1212628722\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b57b3646-f92e-48cf-badb-6251471aeb75.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3204_1243718144\b57b3646-f92e-48cf-badb-6251471aeb75.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download