44f8feca187c85b879229573b8acc1fff9a7045480370ac8da3b907d5d60e064

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 3.6MB
Sample260820-l8jgdsvbkb
SHA256 44f8feca187c85b879229573b8acc1fff9a7045480370ac8da3b907d5d60e064
MD5 3b09d1a30b34cb58185079785629525c
SHA1 bc639a3fdfe07d1f4ad8c4d0ae203040ae958df8
SHA512 70bbffc44157e2cb4c7909499bfbb386b86ceef671ae2591b1ebafd3c539b097f94ae9c98ca61cde1755d9940b313187d301a98586c8a579587a0717b572b059
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7:pbm71OxRR9Sl1x
TLSH
T182064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d64becf1-011d-46db-a1ba-f1822f17cfe9.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4392_13431694346189280_4392.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\18aafb6f-0539-4012-b0f1-bfb3ebf7431d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1848_13431694346322445_1848.pma	setup.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_2086897231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1099349637\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1099349637\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1889844841\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_2086897231\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1889844841\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1889844841\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1693047827\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_2143197507\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1099349637\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1099349637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1889844841\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_2143197507\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316943462842546"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1EB77DB4-8CE3-41BC-ACDB-BDCE01204FA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3592	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4996	2388	2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	89
PID 2388 wrote to memory of 3592	2388	2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe	90
PID 3592 wrote to memory of 4124	3592	msedge.exe	91
PID 3592 wrote to memory of 5240	3592	msedge.exe	92
PID 3592 wrote to memory of 2344	3592	msedge.exe	93
PID 3592 wrote to memory of 552	3592	msedge.exe	94
PID 3592 wrote to memory of 2344	3592	msedge.exe	93
PID 3592 wrote to memory of 552	3592	msedge.exe	94
PID 3592 wrote to memory of 552	3592	msedge.exe	94
PID 3592 wrote to memory of 3636	3592	msedge.exe	97
PID 3592 wrote to memory of 4840	3592	msedge.exe	96
PID 3592 wrote to memory of 3636	3592	msedge.exe	97
PID 3592 wrote to memory of 3636	3592	msedge.exe	97
PID 3592 wrote to memory of 4840	3592	msedge.exe	96
PID 3592 wrote to memory of 4840	3592	msedge.exe	96
PID 3592 wrote to memory of 3356	3592	msedge.exe	98
PID 3592 wrote to memory of 3024	3592	msedge.exe	99
PID 3592 wrote to memory of 2252	3592	msedge.exe	100
PID 3592 wrote to memory of 4924	3592	msedge.exe	101
PID 3592 wrote to memory of 4924	3592	msedge.exe	101
PID 3592 wrote to memory of 4924	3592	msedge.exe	101
PID 3592 wrote to memory of 2020	3592	msedge.exe	102
PID 3592 wrote to memory of 2020	3592	msedge.exe	102
PID 3592 wrote to memory of 2020	3592	msedge.exe	102
PID 3592 wrote to memory of 5632	3592	msedge.exe	103
PID 3592 wrote to memory of 5632	3592	msedge.exe	103
PID 3592 wrote to memory of 3616	3592	msedge.exe	105
PID 3592 wrote to memory of 4768	3592	msedge.exe	106
PID 3592 wrote to memory of 3616	3592	msedge.exe	105
PID 3592 wrote to memory of 4768	3592	msedge.exe	106
PID 3592 wrote to memory of 2708	3592	msedge.exe	108
PID 3592 wrote to memory of 3280	3592	msedge.exe	110
PID 3592 wrote to memory of 3280	3592	msedge.exe	110
PID 3592 wrote to memory of 1848	3592	msedge.exe	112
PID 1848 wrote to memory of 2620	1848	setup.exe	113
PID 1848 wrote to memory of 4392	1848	setup.exe	114
PID 4392 wrote to memory of 564	4392	setup.exe	115
PID 3592 wrote to memory of 3148	3592	msedge.exe	116
PID 3592 wrote to memory of 3148	3592	msedge.exe	116
PID 3592 wrote to memory of 2380	3592	msedge.exe	118
PID 3592 wrote to memory of 2380	3592	msedge.exe	118
PID 3592 wrote to memory of 3764	3592	msedge.exe	122
PID 3592 wrote to memory of 3764	3592	msedge.exe	122
PID 3592 wrote to memory of 2560	3592	msedge.exe	123
PID 3592 wrote to memory of 2560	3592	msedge.exe	123
PID 3592 wrote to memory of 3156	3592	msedge.exe	124
PID 3592 wrote to memory of 3156	3592	msedge.exe	124
PID 3592 wrote to memory of 5108	3592	msedge.exe	125
PID 3592 wrote to memory of 2112	3592	msedge.exe	126
PID 3592 wrote to memory of 2112	3592	msedge.exe	126
PID 3592 wrote to memory of 880	3592	msedge.exe	127
PID 3592 wrote to memory of 880	3592	msedge.exe	127

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2388
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-08-20_3b09d1a30b34cb58185079785629525c_akira_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7e83deb10,0x7ff7e83deb20,0x7ff7e83deb30
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,16372019644565985852,17937253348675277229,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,7507582313219142922,15786268047949205527,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
    3⤵
    PID:2344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,10356718709868541489,16452031943235302834,262144 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,8677667087768639030,8227279827114471149,2097152 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,15039866034732992377,9721956695117603787,2097152 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,10617053642107817962,15671683319167964988,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,10814367413974354574,18118621185143999908,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,12025489149760884583,14035405103138222222,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,1814138490119260784,2552573624695217889,2097152 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4252,i,8433795753555663385,6827408616587557879,2097152 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:9
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,5910715221295079536,7115005478524434806,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,2009822213552902793,2928728684009476682,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,3289934093192199734,12673140601564851036,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,9125779067630167628,17062502973320604436,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,9125779067630167628,17062502973320604436,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,4747490330233458616,15074013353965025626,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff7db0304c8,0x7ff7db0304d4,0x7ff7db0304e0
      4⤵
      Drops file in Windows directory
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7db0304c8,0x7ff7db0304d4,0x7ff7db0304e0
        5⤵
        Drops file in Windows directory
        
        PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,8711863619919251560,16324633980984319741,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,13256737058119052175,3934338857496138926,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17581048591006672423,17100556965735785164,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:14
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,6731649326465544380,2597859391836483266,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,5078057216238339538,10692455984691081713,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,8482177802805578256,15173277839958155370,262144 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11276654727910437756,4804975086333190888,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,10668778345860121421,10888731491980940252,524288 --field-trial-handle=2720,i,4962539058277940504,7473524686249277873,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1848_13431694346322445_1848.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1848_13431694346322445_1848.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4392_13431694346189280_4392.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4392_13431694346189280_4392.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 18519a9b77f9e0b5b0c0272d36e39dfe83d20e25746807c125aa0f98b3319b7f
MD5 01c412eb15cd45e87ea04aab79b0a168
SHA1 051659ac1e2cada3bccde79454299cc7544a1994
SHA512 131a416224827d81834754c85909d942d902cb1d26c2209076cf9b0b92ae70477904518ede2c2e2d6b84b4445ae53c9f2802e023dbad79dae67f17b552820d2c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1dad5c004aefb951e461c652a2ee12d28fc02c07b4be16b30b605dd76c1b3305
MD5 41b41ece2700cca45aef687b22c7fdfd
SHA1 12309972b620aab7e144705ad848ce13ebec15b9
SHA512 a708e292fd039331b27026ffd2a5c072cc312876f2070eaa20b7e53313fc0da573bec1311451afc83ed422ddea1e9d39469335845091d32b00aa0c0fe10bb2fd
TLSH
T19DD0243D57045511C411C1F704C53FF430044037F70F500034D540410CD051C0073C1C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6abb5791d1f5d3b0d794869eadd481a3dddc802212cacd10ed4aea89c5e32310
MD5 cf195d4c35c219e28cd3c808776d4b9b
SHA1 562eeaef578a644674a862793e0be505c3706638
SHA512 b16ae2b78a3a6f92d6aee16d3380bf5afe0d900b9803baece5fa0668ac2617de1bfe5bf4d4e4f98fa7c42b06b6e5c3f32840525fe28b5acc0b43de115427753f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 aef7b22bac69401d9f7540a057d5a4010e3858cfc24c911e7667696c17670620
MD5 de51c1b6ca752f6d2f912323c97a35e2
SHA1 8b029b3e736c6a54314c57265afef099bd0c0e0c
SHA512 1fd4280569b115e6b4e7c1083a31e66efe98750b11747e1769b8cc4c6ba5c9e2d6287e09a25e12f307da94fca2ed3fa9efe95415d1a28360d4514f27a9125b49
SSDEEP 48:5ylDNr+KRASxOHhi/MUa344RhNieFdIwznrlCD5VkCNazZU2qVtWoulSquk:INySxOBi/M33dJzkVV3IW2ktTZk
TLSH
T1E591258147A427C4CF600E7256917C5B22FCE8699107BB9F7605BEF9AB0BFA40AD1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5989e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5989e7.TMP
Size 2KB
SHA256 6a3d0110c5ec29ee821c3871b5ff53395d33b42be7108b24da8b424b0972172d
MD5 f2fb82ab1783dd4321ff3658a6b0d681
SHA1 0f7f14afe949bf5a271658425000e4efba7c426a
SHA512 95851ed559f915b5779ee7a011f9ef74872ac5b6058ba950d8f6ad6b0df6560d3531f79318eb346f2aee23aa3d235b0ded4151813891486c99f2b612102f8f99
TLSH
T15641A482532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7DAF05F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1947d02fb4ccdd5d5b7981b221f2f19120701131889c546a21d610d1054002f1
MD5 e5adde6d408c0176e64ab00e14dc25e6
SHA1 c2efe09be7bd7896c627863077b2758ba4ea3652
SHA512 3c2b6fd9df3d98679691be98944b7c166b49df3471c4fbc3c8e57c9dc3ec1cec83eb194d75f766c27f39c804245e938d92b67b36995e434d4faeeea56141c9a8
SSDEEP 48:YALlN2OCDDCD0CDaaVfo7CCjhhnONzsFQzsazEsaC7CnOCKC+s2lgmgCIwEs9CwO:DwOApxaVaZjh7QzWGGO59litwJG/jHWk
TLSH
T18681B9F383F5852DDA1195F0AA046F1FCF2D045243AC7D5A89E4AF1BA3F2461E141A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eaa88c324f8a92c1bf40a6cc64b2f6996e76635f4365612c82bfcb6681c8fa8c
MD5 954e1424012b01bee6f74874d4ddb8c5
SHA1 001d6cd11bf0f0acc411620a69cd4bda33e47489
SHA512 97a12a22743baa26286a55cec50f5a8c021169c741713a025c14bfcbfb667be064b8d203f6a1407c1e908b06a97721c3d055d9a274a2e29b7b68b50815c87565
SSDEEP 192:sxRyR1xs/fysI7Dde5lSIqRbr/oD8pJPU/g6+WNPWpG/YCPzuOOGeIgVhJ:sxRyNs/fysI7c5leZzO/5x/LoR
TLSH
T15452D8069D285C3B5CC7E2A9BB15BF53E7F81032A5945E48EAFC8A1C14E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1c068144d0b21f751b57bb7c98169c24895eac6f5292b2e9f79c86ea9dc4307
MD5 830e35a375cd86b91d08fa8b7def659a
SHA1 f817d789533f8c445fe700e0b29c6525c104ad88
SHA512 1c4d245c0a05cf86763e1146bdf3f81bf96666d9270954fb6d8dd322667c43b9cff47a6c5e2799e34da310070c5c54d3b66c47e11ecf4e441c4bf7facfdf4da2
SSDEEP 192:sxR1R1xs/fysXBCZe75qRbr/oD8pJPU/g6+WNPWpG/YCIBuOOGeIgDEhJ:sxR1Ns/fysXBEfZzO/5x/4oC
TLSH
T13C52E8169D285C3B9CC7E2ADBB15BF53E7F95032A4945E48AAFC8A1C14F76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aad32a000af6af770068d18150887cfe3e72d34c44fac8561ad41bde52d8c142
MD5 bd8d9a5fbef5a95891500956c8f9fe6c
SHA1 aa42b2ee04edee836925bb38e5057bc5d23a29b7
SHA512 a916db9e5d066218b37835b482eda2b382a37170074dddadbe14afdd896596e3cf5d73358bd385fbd3b864f9f4d678430d164e56dcc368ae3713ec4cb75f2338
SSDEEP 192:sxR1R1xs/fysX7CZe75qRbr/oD8pJPU/g6+WNPWpG/YCPzuOOGeIgDehJ:sxR1Ns/fysX7EfZzO/5x/Lo8
TLSH
T1B952D8169D28583B9CC7E2ADBB15BF53E7F91032A4D45E48AAFC9A1C14F76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ceb3e88d80d6022ac9dbf5dda211e810351f5927e6c77f7a588eec1507b2be9b
MD5 32fdce5194c095bfbfb60539ea020814
SHA1 1c655df3c091a94f32bd6e6c3d6084b8ec39f800
SHA512 b82acdc785a2a4a265f7ed7762e2e48d482d52db8d12232b3a235962491bce424c4678bbc804267f689d7110af2e134a7d95b4de08bd002faf388e0fec589a12
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEQqcYroZW:jC+vf7E7JQWgQ+f4+u1ja3Vcj0
TLSH
T114C2EA7B640CCB7F4F804ADDED197E9B6DA802CB5698CD8047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8429f823-d194-4616-845e-b2b1be05f88d\index-dir\the-real-index
Size 3KB
SHA256 e5aa22d50c665fbda344d260d33477109cfd04bd8875f5b9d802f7fd7e97eee9
MD5 046d1e57304eef1b7935b464fb684fcd
SHA1 d02072fe52585567c51d045f39c58ac8c363f32a
SHA512 e5544523c7ff902d0d3064d1ec78409dd394b192918b2fc4a36f62e103c4e45d021ed43e58c3867492e84492eb02a746d967a91c2d99ade1b61a14f3a309eea5
TLSH
T19751E74F5C4B0F9BD9AC327248FA004033B568EE57688E07685CE6757CC322A2C5899A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8429f823-d194-4616-845e-b2b1be05f88d\index-dir\the-real-index
Size 264B
SHA256 5956bd5aae3605b6b06920172ccbe749bce227bf279f98f9d918b013c3b985ec
MD5 e67b68d7e911b0cac747ec0b60d00333
SHA1 fe704fb4962ef933b95663b2c285d2fa55517e0f
SHA512 2dccff97db40aeafb047365c05c9a09207dad25a7c920f69e6d98ea306ac59e80fed1f495bba0a0773b6caffaa3a36a1d8690010e353ba66d466d3a771dd3134
TLSH
T1CDD022DA8C62D993CF2E683944733825373F06FC3102BE3D10FD282E9956A7CA086949
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591090.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8429f823-d194-4616-845e-b2b1be05f88d\index-dir\the-real-index~RFe591090.TMP
Size 264B
SHA256 c37c30722fd84bfe1de8ba0edacd24a8b2343bf2533afa52edf8a9723b4e64a3
MD5 a96ac497b35e6f60e573ae529d31a4bf
SHA1 1db6c4216a7b8945b2e59e69d82eaa581b3e88b8
SHA512 70db015430a7f5cff3b52b4a32be3f75c55bffc2c0dde04780f2b03bbc1035dad3a911f431855548bc549e74ecaa0562ed284dc495ff7603b341224204606ce6
TLSH
T1B5D022CA45A1A9E2DE1B1D782003291E33BB08283016AA3510ED142F4C316AC588360A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a113e637-d23c-49b0-8005-4422d7b42f0b\index-dir\the-real-index
Size 72B
SHA256 973b3fcf337a8bbe9108696ddbce78b098e6eb481cf0b7ca177a771db1fe6284
MD5 2d73d145708717cca82f295fea316711
SHA1 fc7f016a8bfb39c9123880a4d7296c164971d302
SHA512 7c8bdf96f66549c3a0ea46ad99f9488f7b87c0db64fb3fca0bfbc4c5da45e1b4210586b30578a983da66953591b2889ce04ab936f4a9f8ca2d8f621ed6c3b204
TLSH
T1EEA0021C13E40246D10A12B029A791C13362CA104A5B233782904498CC61F674DA290D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a113e637-d23c-49b0-8005-4422d7b42f0b\index-dir\the-real-index
Size 72B
SHA256 34818db759bf9c4fd40a16d4c8f3b2ffdb93b28bc617b4707e21ad899c8b06a2
MD5 36533e24c64d0b6abaa59911c774a9fd
SHA1 4cd6a987a4eb2431d41440c452419c827b0c7e9e
SHA512 18c732b1d7be0edb8033399b24974d91eb3193607d742397c927679394e87652077c10669807221d308bfd82e0f1384d3d6e99ac330e2a9360c318f3b00ef48a
TLSH
T1F3A0022007A90467D01725B5155206859394DCA12180225648920886CC51888C5C610F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 78ce5703a24e18524faefa9c0c29e823e22828a8b4d60e50ceebaa75d4fa8a7e
MD5 82ab7c20a9805c830d46249ffb631e04
SHA1 a71ce3f5f65b0362120a01b25e66f35dd5fdc716
SHA512 675acd9b3ea81ccd02e645d1fb42920c07bff2ac9d25de79e3caefe4ef9447bc9d95cfd0b7e273328c89c7d5f8e27bef87ea28d10340111c5bfaab34ad660c2a
TLSH
T1CBE0C0FB2DEB6810FC5FC3D5243254E0010E7449DA06BC8F0515E6C314B23813446C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3190eb4da943b9eb911530e04a2af11d2e3cddbfe05e0d9ba8b5be39a4b27f64
MD5 9ed0f005e27924c7c77525b8bb1455aa
SHA1 40ef0c301f6c560d6e3e3efbd06bf649aef4178f
SHA512 5ebc0a4d4a6ae86371c7d8096efc6dbf428a9c621e6d86c3dc4e7ce959ffe054100839b8ffd7196d7ff3b402bd75c07349643496738794192613e6b657969a8c
TLSH
T191A002A0C9479401C07152B2217912866268CEA885A53331E0B8018BCA6FF4045D1500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596c7c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596c7c.TMP
Size 48B
SHA256 0aa2628b5271a15fb270c574a9a2310273374be94a46e79847e23d135d2e7494
MD5 e01e62dcdb71b34089f38b359b047fd4
SHA1 053d3a74c16108949fabd9fc8ab4dccb6eace41c
SHA512 a711b9d3e8ba5f6517ce7e834d016f5f9d37a11854aa51a3c7d2de28a8d0eb97e8131d636b5e8e4005c255ec1410ab518fed97e37597c43ef3fd3909b100190d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e8686eb5cb0dfd68e26e24fce50f4f81e4286c918e5832ab0eda2e212ede0b0f
MD5 0c5b6e4ec5ec87d3be7f559c8f69b0e5
SHA1 0d130a7f364d455055d3fd4f3b2ca5f1fc562980
SHA512 e1ce0d9d9ce2f06833a0bbe70517e60f93dbefe170037402843cfa781a3662e8d90687c76c76cc8caf41b9e4917a9ae3d4ac25d941d40bcb9b139b0efeb8a42d
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8A:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEd
TLSH
T1C2914600313B02C0383DBA4CC1B99C6E86C574727416E56B3FA946AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb3bde0f-ad6a-4ad3-be74-9419eb5a0a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb3bde0f-ad6a-4ad3-be74-9419eb5a0a2b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ef77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ef77.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 59e5834e01e055106ae3a311ae78e060f566f50b581b16043515c811eb12662c
MD5 442dedb24c4ff1505059e77af63f2888
SHA1 b125313eee3b1338210cacff8ec82903bebdd603
SHA512 67d785fa0f22cb4c976a320bf82ca33b8603e64b970641fd2ff3e802c8c88196bf6786ca1f3ff3fd41750137c0e3f824b664825893e78e32ff525a74914ad794
SSDEEP 768:br3Pr4UKp8+p3bd66j+4BRv86aLIWhgAc:br3P08+p3Z6n4yfgAc
TLSH
T1E2F2AEB2ECA89D374CF5C785B7463B036FF4811396C41E9498DD6B1D149B1AE230B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0299f630d90617f2caeaa2ae681f836fc1244d3b9880a44ed88d23a70604ee10
MD5 daddbccdc71b49360b453318377fd8af
SHA1 e3c42e99875f4e5c611cf57d5ddad4b2a7fb59fd
SHA512 dbacf030dd5e9c7bae87ca6831aeac9a3ac6b386768cd86ec558527a417858b36234024da1fb30942e9266ca2993add6f436009c1421c3fc82749251ec1e2f4d
SSDEEP 384:nBZcIr38NtXJry38QZfyb7MKf7fEipi9+As3bW466x9ejDn4HCwjEYCGRvl2XYHb:Jr31r41p8+p3bd66j+4BRv86aLIWhgAc
TLSH
T17FF2AEB2ECA89D374CF5C785B3463B036FF4811396C41E9498DD6B2D149B1AE170B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 97add59e8ae9ef0b421f8e9b2b5f995cff59844c4fe58cbc12a49b343deb0a50
MD5 938cdef6642298948c67187a54693973
SHA1 7cfa1d7e44bfcd09d163e8f68b260792fa8ecf56
SHA512 59c5f95c99ae49cd0f88e07833a089cf3486fd7af1ba3215b8badfebb927d2fab63173652dda3de9b1de74d9d1cb63d77e7e8b2e14d9b2a06d3788148ac4a48c
SSDEEP 768:Irv+4UNbdD3lcONp8+p3bd66j+4BRv86aLIin2bwCl1:Ibsbp3lL8+p3Z6n4yp0ww
TLSH
T1E103BE73F9A899339CF6C64472467B437FF851A396C10AC4D8DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b02943d638779bdf97c464c9b2ce2d3a21fd1a5d1e4ca3d57c9af75b0bf1902
MD5 3d1a64abdcbacc144b63b80344ffdbf3
SHA1 7998c3584bf05bb7ad7550d15fa97efe34232d92
SHA512 8a7d8e114a9feb038f81aacb9e438582237caadfaf590011c5842d58cd17764e2dc5567113faa36a3de731ea441ac661d5344223b03a3e42b3f3502ff17d8718
SSDEEP 768:Trv+4UNbdE3Kr4TTp8+p3bd66j+4BRv86aLIWh13D:Tbsba3Ll8+p3Z6n4yfZ
TLSH
T1E803AF72E868D9339CF2C684B28A3B437FF8515396C01E94D8DD6B5D459B1AE230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 98942c33922b17e0a7de67f69f9b3f2c0607d9261a22445100989b925f6fafff
MD5 33f6e1fa0cc1aae163e73b856138288e
SHA1 bc5c59fc4ed97e72ffbb4c4ffafb5cc3de554137
SHA512 14139dc6f96ec332baa200aedcdcde83b99c871b31fc5e52f1d32ccb2f16b8724264cfc783516d34b1c3d8b08fad49ed6f72ed70714435d5d90f00d58f715ba3
SSDEEP 768:XFQ13MwgCptUKp8+p3bd66j+4BRv86aLIWhgAc:q13C08+p3Z6n4yfgAc
TLSH
T147037C72DCA4DA3BACF6CBC5B7497A079EF4416386C85DD4D8C86E1D109B1AE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ae2b7b979745987755ac48e45aa20f039746e46626bd8d2c9860238a30a5d415
MD5 53d40105da4094d1b3bac404b6d7cb21
SHA1 b53ab9b9ad58ad28ea69ecd529ce7efb184a2b63
SHA512 936edbbd12bf5ce8c8daf309d2400db331d3220f0e172f8944debd429a9e3e28bd8bd0e6fb86bc71db525af825978c6d8da6fef7ba05884482937ddc867b2078
SSDEEP 768:Jrv+4UNbdD3RF4TNp8+p3bd66j+4BRv86aLITh2bwCl1:Jbsbp3AL8+p3Z6n4y00ww
TLSH
T12103BF73E96899379CF2C64472467B437FF8525396C10AD0D8DD2B4E40AB19E630BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

44395217-acaa-4af2-a8da-ce7fca450c3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44395217-acaa-4af2-a8da-ce7fca450c3c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3592_533646403\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 6f0ec7ae0fcf8e61f7af56d5d03859e8a96d8639b43de8bfc120b41dc7e39e76
MD5 5752dc9aef3ba2ad87317527b29f86f8
SHA1 95da33eb63f0806b89c4d229f23fdc13e7d74f62
SHA512 ce3020411d63a039d3ff7c4d244dd38f3f2bc9300192e3afc484d7e0a3449bfed193fac21ac2f128b2b9fbdee37512147ee1232d9ec2fa80d5491f3f1fd7ce6c
TLSH
T1E241D000DFE60A25F3F6ED7199B36721BA37F505D5148B5E0086420D1C63E05996DFAB
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 7b6af642e24413e1e72330f5483f85ca008ecea361ba2bb55e2a9b50987967a1
MD5 fc88b0a6ec6386d155d6de90d491a13b
SHA1 bb64b133f9de75b6be24c173e78511ee865d77b6
SHA512 52c90af4cfb72d112bf2986e079107e67f14f48ca056e27b80a1eb95c33f8f10783b8dd07014ec0995786ac2c4e42ef7dffa003e37db995fd78f52f9641f5f71
SSDEEP 3072:LmuL2nbbwlKNxbEfDcwHAgKAY13jiF3+e:LmuL2nbbwlKNxgfDcwHAgKAY13jiF3+e
TLSH
T151C384616F0701E37B806EEB24433A25B5EE2287D1C446F676A9B419B1D7E7A011F0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download