remus_stealer | 42ff13593789df2270a7ff8be221c0e2dbf6e0fc777a143cf9a9d42fa049a61b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PC_Cleaner_setup.exe
Size 4.1MB
Sample260820-tq96dsed83
SHA256 42ff13593789df2270a7ff8be221c0e2dbf6e0fc777a143cf9a9d42fa049a61b
MD5 17445af51031ffc5a7eb10a1d411d586
SHA1 5e3cc4d9cb9b3152fb225260c89576a9ef83b42e
SHA512 9ea3ff20d4c7eda9bec093ac8bd6af3d5e7e183043d5b2eb5af06069ec23af5aad8e9176c6a8f8402ca1ed7ff88fff14cd2a562528d54104aec3ae390464f87b
SSDEEP 98304:D8rJUzu5TjafenPUYiQGho1ObPnlliWCfpNVl:gKZ9mW3bPKW4V
TLSH
T11B16E088F636548CC08112F2932AB639D6BCBDE285C415DB1DAD3F32D532D2BDD462B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery remus_stealer link pdf spyware stealer

Malware Config

Extracted

Family

remus_stealer

http://vexdico.shop:8539/attachments
http://zakuiru.shop:9048/notifications
http://kupzovo.shop:7567/invoices

Signatures

Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer

Loads dropped DLL 1 IoCs

pid	Process
6640	msedge.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_444181963\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_501993334\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_501993334\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_1700544093\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6640_995704934\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_1700544093\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_501993334\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6640_733627529\_locales\cs\messages.json	msedge.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
behavioral2/files/0x000d00000001c618-4.dat	pdf_with_link_action

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317162242187038"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{1F8B2AF1-2007-4C26-9435-CF5CD51F9BC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6856	PC_Cleaner_setup.exe
6784	msedge.exe
6784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6640	msedge.exe
6640	msedge.exe
6640	msedge.exe
6640	msedge.exe
6640	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6640	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 6640	6856	PC_Cleaner_setup.exe	90
PID 6640 wrote to memory of 4532	6640	msedge.exe	91
PID 6640 wrote to memory of 1832	6640	msedge.exe	94
PID 6640 wrote to memory of 4588	6640	msedge.exe	93
PID 6640 wrote to memory of 1832	6640	msedge.exe	94
PID 6640 wrote to memory of 1832	6640	msedge.exe	94
PID 6640 wrote to memory of 6092	6640	msedge.exe	95
PID 6640 wrote to memory of 6092	6640	msedge.exe	95
PID 6640 wrote to memory of 4144	6640	msedge.exe	97
PID 6640 wrote to memory of 4144	6640	msedge.exe	97
PID 6640 wrote to memory of 4144	6640	msedge.exe	97
PID 6640 wrote to memory of 1928	6640	msedge.exe	98
PID 6640 wrote to memory of 1928	6640	msedge.exe	98
PID 6640 wrote to memory of 1928	6640	msedge.exe	98
PID 6640 wrote to memory of 4776	6640	msedge.exe	99
PID 6640 wrote to memory of 4776	6640	msedge.exe	99
PID 6640 wrote to memory of 4776	6640	msedge.exe	99
PID 6640 wrote to memory of 6924	6640	msedge.exe	100
PID 6640 wrote to memory of 6924	6640	msedge.exe	100
PID 6640 wrote to memory of 6924	6640	msedge.exe	100
PID 6640 wrote to memory of 936	6640	msedge.exe	102
PID 6640 wrote to memory of 1064	6640	msedge.exe	101
PID 6640 wrote to memory of 936	6640	msedge.exe	102
PID 6640 wrote to memory of 1064	6640	msedge.exe	101
PID 6640 wrote to memory of 6248	6640	msedge.exe	104
PID 6640 wrote to memory of 4720	6640	msedge.exe	108
PID 6640 wrote to memory of 5396	6640	msedge.exe	109
PID 6640 wrote to memory of 5408	6640	msedge.exe	110
PID 6640 wrote to memory of 5108	6640	msedge.exe	111
PID 6640 wrote to memory of 5108	6640	msedge.exe	111
PID 6640 wrote to memory of 7040	6640	msedge.exe	112
PID 6640 wrote to memory of 7040	6640	msedge.exe	112
PID 6640 wrote to memory of 6768	6640	msedge.exe	113
PID 6640 wrote to memory of 6768	6640	msedge.exe	113
PID 6640 wrote to memory of 6844	6640	msedge.exe	116
PID 6640 wrote to memory of 6844	6640	msedge.exe	116
PID 6640 wrote to memory of 6344	6640	msedge.exe	117
PID 6640 wrote to memory of 6344	6640	msedge.exe	117
PID 6640 wrote to memory of 1332	6640	msedge.exe	118
PID 6640 wrote to memory of 1332	6640	msedge.exe	118
PID 6640 wrote to memory of 6784	6640	msedge.exe	119
PID 6640 wrote to memory of 5364	6640	msedge.exe	120
PID 6640 wrote to memory of 5364	6640	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\PC_Cleaner_setup.exe
"C:\Users\Admin\AppData\Local\Temp\PC_Cleaner_setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\iVYQxMDU.pdf
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe35d7c188,0x7ffe35d7c194,0x7ffe35d7c1a0
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13626179029183810557,14500851826885600486,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7720594340676609028,15668595610572859679,262144 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,14798858669836403579,1945954372472421938,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3240,i,11066143142426692626,6495176935102665371,2097152 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7759818709671584317,12756410322274972524,2097152 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4956,i,3303510119591312931,5684068846324631602,2097152 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:9
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5160,i,5528619746281526057,7671886844033188551,2097152 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:15
    3⤵
    PID:6924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,2573222028422712113,16320052985603881717,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5191267810190679321,15508162867314344305,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,7486400590824319124,1206260502855917636,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,7486400590824319124,1206260502855917636,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13154508846395688998,14487505529490025116,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,11139020758208073233,1484551465949837706,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,17643479745811324539,1225281849578661692,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3316,i,2834411169513995941,16663966185668110402,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8559238510951143930,16854089995908698660,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,13379946211753221730,15623382975753673347,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,3598345860697976046,17907016526081452880,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5215552698042509568,11623498466594420610,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
    3⤵
    PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9805869642510795643,3408062721537819458,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5472,i,9785865568251728269,15890117628843570408,262144 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,15806007194004051384,7340495931123121704,524288 --field-trial-handle=2148,i,13967890624371807753,14561550682987579352,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
    3⤵
    PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 06cf38532030e418948002a77b9a44f4a11fd27a5f62cdc1e17e9c553cb7e7f0
MD5 6268425f2df60f1c9d081d3fc034232d
SHA1 fbd1734306d3a4474f307a6c7b96856b3d8b4280
SHA512 6cda58c59a3b6702d7303c0cddb0b2727c4498f5b4412cbdc5a27ed13cda3d1212c91b1e3805aa8a931dc1e95d39f4a6b3d95bdba14e5167227875076b3af510
TLSH
T16BE0E555D861BC371DF81B28A1550687E750135B3A40880B7B3CC26C4FB063B428685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a18a3680d84d3026deed304b1a44118caaf261b14881adbbeeee9f9b7c0f4d2
MD5 464b669fb677f520b00dd6c11dd49d36
SHA1 41f4168e2fa82318a13afc4770f687314860ef71
SHA512 8ed4165bad105e8d1467ce5c53a4e0aed3747f151ad65de1329bb35164c9d2a152f9268374d19c9c0cc093a15e1dc8f82fc106992240468c35f8107101f63a64
TLSH
T11D615D9C4B982BE3F726A8F650E5488F36F494E52607BE1D03407EFC9846F1920E18E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59afce.TMP
Size 3KB
SHA256 8ce9ab88c2e4bba95ba3d6f6c3e0e7bd0d77ba7cab79f65cb341114343c3305b
MD5 53beb7eff802f25cda9a23dcbc799e50
SHA1 ed2d7061a118a74e1a59c98fa9be8edb46500a4f
SHA512 e7963bbbd8dc54c185c75349b64d1dc5a163939f8518aaf3220667ffe7929537368e566540bd254ba31d4db36bcd52e0976a6dd259428eb065db755f5ae8cc39
TLSH
T10C614B9D4B992BE3F72198F290E5448F36F494E9260BBE1D43417EFC9806F1920E18E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 122464387811e74c17452c4f897f5e3d278a9d300997147dd292fb85008f750c
MD5 011fec3a7bf2c00375c5cc3973afa958
SHA1 b85c4f117493c1978ef1fef0eec955bfb0994b68
SHA512 9d4529e5f242d00f7f31ae9e07dbe8e934042f87ae3cce27ce3aa88497049d5b030eb42c0f23fb7517665244a06691a77325ef8b4222fcd09fe7c3418751177f
SSDEEP 96:rNThaFQtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/FjXJbbEOVpZf24JkMfXSFs:rDCPH+bF+UI3iWGVoWN3qL/FVVVV63
TLSH
T10F24000E5F253722CDBD913669E744A35C7DF03F8B5326DA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 068424501c49a39be81cb8ec67c130fd79be3e557a8755b7929390dda6a3bf8c
MD5 83d83943a36c16601fbabf83ce11b34f
SHA1 3bd96d004636b0991cb457c45faa4a1bfede1d75
SHA512 dcbe0a78d27bbf29e7eaf4bd2e254128ec2c9de7b77b6ad02f2b30bd96ea5ba3d4c5f61fe0cf7b80374884a2d2ca6d94d868ba2616d7ac029d3206b81f0b3a77
TLSH
T170E026A044CDC16EA64C209B923DF74CC3B13446E788BF221B059888F003808A7862C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c26f526ad54d2cdcec1de4f45c166f45d4a154e16bc23de636d5960fc4f575d
MD5 d083fc3362af9bc73d711b82e4dbda28
SHA1 73c168ffaf802a4947aedc7f3f8dd394ee5df414
SHA512 755249525eb50fbecc2218029b2ac6e8753745b3fc0cba1c1db7fdae6aa9eb6b416c4d02c0f813260777184dad3022fe5c3eb9d0007b857a0d71a9266ea457a3
TLSH
T10941BEF783F4856E8A1196F0AA187E2FCE1D0515432C7D9AC9E0AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6cc9ddabf53de9d6cf3ce9c5b018adc1a482399314920acaa267f6ab6a167e7b
MD5 f3e5dbfe8d7705ae3e345585c43d218b
SHA1 8fab0d951d753170ef4323df0e15cb0b68379ec8
SHA512 f4d597650c16b3142bd0906aa00dd1c6b422ea5cc4eb0f1b879a1b68b490016da1e96bb951b50421baf764b5d7c1c2dd1dc17b81f963da587c9418ad0b95360a
SSDEEP 384:sxRdgqfX/fys+hN/RIO97/5IW4IOSsGQuvI:sZHfX/fYzWg/5IW4UsGQ5
TLSH
T19672D715AA74993B8CDBE219FA95BF53D3F8117391505E44AAFC8A0C00E7AED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e15fd0954f48f20cd4a802813b75782d51a482f2390e3ee9b3d37a00dca80ae2
MD5 fd7b8918b7e3230017d5c63f0d09fddf
SHA1 77794e3aad637ea63c6e0eb3a78702905c08ba1f
SHA512 56a5440ea71d307729d1db0bc50f3c5307b79ac03d48bc42d08ed24378f5f837839fc1f9799093178e147c2e0a2761c16aa817f7d7bd3eaf26e8babbca3c7821
SSDEEP 384:sxRdg8X/fyss0N/RIO97/5IW4mONsGQuj5:sZFX/fC+Wg/5IW41sGQ2
TLSH
T18272C715AA6499378CDBD219FA957F53D6F81173A1505E44AAFC8A0C04E6BED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
MD5 b651419624a950ed2880d6c0991782d8
SHA1 9e6c6e119afb67c5b40d9abdb2b081e4b8a5f845
SHA512 a0314ab4d2295e444700cb3256fa65183c44e3069cf0d8fabfa367b297bec9e94dd6911fc42da29395f6cb69b74ec86282bda9bb38e1317aba27dfddba978f95
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEobbDwzro24u:Ob4YZnE7yTWg1NfwBu1jajobHwARu
TLSH
T170E2EB3B280CCB7E4F804ADDEC29BD9A6DA8018F5AD8C95447FA450C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b10dcbb75f07637fdcb7935928512dcdceab3c905490b494401655202334cd3c
MD5 20e5a06eff600cc77b716919d2b22cea
SHA1 9e97db8e8ab4035087956728ae0cff0085a5f492
SHA512 38314bda4b319432f697288b330044fcd37473b21b0c89d8f095574a3b032418b6a701dc50007984562930dff85255fbd26bc9d3a940157b9bb9c310b9d0b1a5
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9R3W:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRl
TLSH
T1E9B25D11713F4690387EB90C81B8981F86C2B4A37519F52F7B6802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 5630272d3b45620ab6e3b6501b06a8605b768017ef243e8183d61aa4d7a76b2a
MD5 33ab2a7ee20aee58a9f54abde646016f
SHA1 ffd528b396995289aac8ac3b141d31f051ace42d
SHA512 3c25cf60188fdab9e120b6633cbe1a0d9497eb87decf715daef27aa6aaca50abd86453c28055b41f1737c890fb691ab63edebb43a8ab2090a52d83b13681a383
SSDEEP 384:DNrRZyCSDnxTICeMEhIKyll7svbFKfk7:xFZJSDniCyI1l7svbF9
TLSH
T13F44750A7B747001EDE6DD725CB080771E3C716D8F22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bc9be79f12356058d1b54c55b0281952e8229425c134d8c4acd0166df0dc250c
MD5 928d729235ff2266e8eeae2180873774
SHA1 09019ea0d52f26e8e86a0ed9f7f8b5e25f3ba0b3
SHA512 3045a0f98bd4e0441734f7e16025767a2f93482c66c6560c818019439354a0b83e182fba77ca21f1401e7805870d642f7ad69d09e88462c42e4c0ba9bc79a02e
SSDEEP 384:n7iFiZcIe8NLK8TUNTUlIRqPvuTL1IEqfbYGTQR9XQjWELyy8ivPS8LEEIz2o7:WFQeQKwgsu1XGUIWELf8i39w
TLSH
T1F8C25B32D8A5CDB7ACEA4FD8A7497647EFF410A3858C8AD4DAD84E0C00876DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 698c2ea3a31e98c610f3bffa7529c7c162378b68479be73a3b806495faab48aa
MD5 9203b386a32b074068da1e215b054ad3
SHA1 5dc4c13944f9733709909af26f3d4a0719640009
SHA512 bbf49ad11b11e7bccace784173d44219a85e583592e3208a4b12958fc00d1fd5761471abcd199eb415a72c115b448baace8fd65b7c084482d57158356b38b09b
SSDEEP 384:nCiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTu/REqfbYGTQR9XQpL0OObjI9G6w7ia6:JF1j+9SXswgUuCUGUa029Mi
TLSH
T1F4C25B36EC59CEB7ECE64FD8B34A7A5ADEE012A385D85AC8DAD85D0C00C719D4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5c7231d7b0c236be3ae5d551e5b69ffe8d1b031f835de16dea2de559c2c6fdec
MD5 daf9512e88e96a642286425a2ce7f5a2
SHA1 b46b922ff652f19e5d4cbca818d94fa4db18a4f9
SHA512 e8162f23068fd554753e7ca96dcff9f384d13d1e2c7d815c81e6b17c8d82c03d94fc72f168d7dff63db74b4417141aee5ffba02ccfacd0f0ce1648bc7a4758e3
SSDEEP 384:naiFiZcIF8NLK8TUNTUlIRqPvuTL1IEqfbYGTQR9XQjWEL8S8ivPS8LEEIz2o7:RFQFQKwgsu1XGUIWEL98i39w
TLSH
T15CC25B36D8A5CDB7ACEA4FD8A7497647EFF411A3858C8AD4DAD84E0C00876DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8b415dcdde46ccea41fc5e7acc6f0170b45529cbca979bf5fe817c60f1f20d0c
MD5 c56e6d649930367b3fc44b617dddc562
SHA1 41d4a960ff1e40e27ab3892267c5607965f769cb
SHA512 0fec0431929c0867e852e9f786dfa45c51cb91f73b2e3932434a3f93a6147509c8ec217e1ecda5434c371b7a9abe3d53ea1d027487bc3057250169826f5a6321
SSDEEP 384:naiF1tNn/s3n9S78NLK8TUNTUlIRFPvuTE1IEqfbYGTQR9XQjWEL8k8OObjI9G6C:RF1j+9uQKwgHu2XGUIWEL1829Mb
TLSH
T137D25C36E855CEB7ECE64FD8B34A7A96DEE411A3858C8AC8E6D85D4C00C729D470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 36a39576b7632b6fe9a801c44a677b14329370119845670f01ea05b99461fb63
MD5 203f21b86c068e3536ac0e669af31a6b
SHA1 b0b20b1c1f49e30dfb285612fa01a3b1e8a7f11b
SHA512 43adea5238f3f1187098c5b0978c6ea8c08657621585cfa4ab1f1ae91bfe99a54e227315529e766eb6eaeff7165ed9c7b9e8500550159c403642b4fa853456d4
SSDEEP 384:ndiFiZcIF8NLK8TUNTUlIRqPvuTL1IEqfbYGTQR9XQjWEL8S8ivPS8LEEIz2o7:UFQFQKwgsu1XGUIWEL98i39w
TLSH
T189C25B32D8A5CDB7ACEA4FD8A7497647EFF410A3858C8AD4DAD84E0C00872DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fb8e4c1de19e93b0110bba992e28095a5788daa3bd0d5d7725286ce71b0276b4
MD5 d1cc235782c8ee84d2a1e31ebe089715
SHA1 8dd0726c752fcde2669a0349c3ee65bafdd0111c
SHA512 1b29f5c06c5ee6d91c7ee6cc0223bb00bf8785243df5fa74b53b9e83661bd5420fa0b33eb242a20260724e71562082642582234a6327491d9ac5474233c7ca8f
SSDEEP 384:naiF1tNn/s3n9Sn8NgK8TUNTUlIRiPvuTm2IEqfbYGTQR9XQjWEL8k8OObjI9G67:RF1j+9SXKwgUu3XGUIWEL1829Mi
TLSH
T177D25D36E855CEB7ECE64FD8B34A7696DEE411A3898C8AC8E6D85D4C00C729D4707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 26b91053fa5665c7f9dfbb70dfa8cf3e30ff195b27be968ac53fffddc337337e
MD5 f36fd20686b0cd08c1cc0cc0d1748528
SHA1 40bbca940bb397d8fef4133608ca78249c95c275
SHA512 4fa2c486c992eca274f7376f10e9a676e97bac60efdc8a18b36871bcfed51fe128d520e6e1742bd6698b2073c0305ec0e71c7ef1aa6c873a54118b55d6f8a219
TLSH
T1D85150E04C3C16D1D4BD0E3EB08739FC81EC9725F890343C6859EA585A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2f114d75a9cc6c7f1c466c3950e9951b03f0c375ccd0b1955072417997d5a019
MD5 d01a5c504c32e07b1caa569c652a6a20
SHA1 f0df32d4e03c5f5399edd122a28295f326be6681
SHA512 58ebbc60aa6b17453e7f1bd87854bbbb6fb7f93dace233f7934e151af24314152cd57aff649b8dc556e4f8a84be30f2250fbc5e5e6a0876ad737e935561b9ce0
TLSH
T1FF512EE04C382AD5D5FD0E7EB08739FC81EC9726F8A434786858EA5859BA21D249083F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

iVYQxMDU.pdf

Path C:\Users\Admin\AppData\Local\Temp\iVYQxMDU.pdf
Size 350KB
SHA256 5d1de062b8912e9736150b419d35e0fefea317e11f3edbb6b2dff23188b0f97c
MD5 afe483c276c43e4e8d9f910854d163e4
SHA1 59c9c0997dd6b86251965173101a27fd63e22fbb
SHA512 a4ddba0aeb0816ffc3b40555e25554de9dd68838906d4106908a1dafce917180de73a1fb35ae3111de9db9a0b8712cf4a1c19b2ea08b1111242f309bc0185f07
SSDEEP 3072:Q5J4osKiKiV5OmGmkgeR+OEq1pzgev321O7924ToD8ytE5wfZ09VvbQ1n9HRFULn:mJ4osfuzmwUHZY0tDFQKvI
TLSH
T1BD74D758D91D9C9CCC815285912B7E2D579DF077B8CC28DA3EAD8F415300F2EEA439EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6856-5-0x0000000140000000-0x000000014003B000-memory.dmp

Download