ac03ec637a4d4e0ddcb10e6021e9416bf47f1488f5c92607d159dc757a190368

Resubmissions

20/08/2026, 20:23

260820-y6htasvcmg3

20/08/2026, 20:21

20/08/2026, 20:16

20/08/2026, 19:55

20/08/2026, 19:29

Analysis

user interaction
yes
max time kernel
623s
max time network
620s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mystigrecia-1.21.1-1.0.jar
Size 1.5MB
Sample260820-x69fkstgrf
SHA256 ac03ec637a4d4e0ddcb10e6021e9416bf47f1488f5c92607d159dc757a190368
MD5 94fc12d98b102635ed18636d7bc4e488
SHA1 1a0048fdbd91e07867cbf736ddcda85ecbad4e41
SHA512 0cdbe496e051c275c985ef9d05bfd074bdcd5d9f0d46ec1c4b6783137044936dc0ab8136343219322d92d0654296b6021ac7df81c3ad8775962496425a869433
SSDEEP 24576:Jv1JzTyXSEDIKvCW1U6dv5PWGJxKkxWuoWKBhjG/+IpWgX+0Vr8:JzzmCcaWK6tLJxvxWuoWqIggXBO
TLSH
T18475E02079ED5224F62F8379E8A604235E3C2E5EBF473AFBF1508F056DB24E05251AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1051562936\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1834444460\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1051562936\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1051562936\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1260881036\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1355819040\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1355819040\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1260881036\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_55303016\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1355819040\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_55303016\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1260881036\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1355819040\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_629515916\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_1232673142\_locales\tr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317279511404604"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	javaw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{C754AAA2-AA84-43EF-8C8D-310D4117C365}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	javaw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	javaw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
240	javaw.exe
240	javaw.exe
240	javaw.exe
240	javaw.exe
240	javaw.exe
240	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe
6908	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 3828	2584	msedge.exe	96
PID 2584 wrote to memory of 1156	2584	msedge.exe	97
PID 2584 wrote to memory of 3888	2584	msedge.exe	98
PID 2584 wrote to memory of 3888	2584	msedge.exe	98
PID 2584 wrote to memory of 3888	2584	msedge.exe	98
PID 2584 wrote to memory of 4932	2584	msedge.exe	100
PID 2584 wrote to memory of 4932	2584	msedge.exe	100
PID 2584 wrote to memory of 4932	2584	msedge.exe	100
PID 2584 wrote to memory of 5192	2584	msedge.exe	103
PID 2584 wrote to memory of 5192	2584	msedge.exe	103
PID 2584 wrote to memory of 5192	2584	msedge.exe	103
PID 2584 wrote to memory of 4640	2584	msedge.exe	102
PID 2584 wrote to memory of 4612	2584	msedge.exe	99
PID 2584 wrote to memory of 4640	2584	msedge.exe	102
PID 2584 wrote to memory of 4640	2584	msedge.exe	102
PID 2584 wrote to memory of 4612	2584	msedge.exe	99
PID 2584 wrote to memory of 2040	2584	msedge.exe	101
PID 2584 wrote to memory of 2040	2584	msedge.exe	101
PID 2584 wrote to memory of 2040	2584	msedge.exe	101
PID 2584 wrote to memory of 2484	2584	msedge.exe	105
PID 2584 wrote to memory of 2484	2584	msedge.exe	105
PID 2584 wrote to memory of 4556	2584	msedge.exe	106
PID 2584 wrote to memory of 4556	2584	msedge.exe	106
PID 2584 wrote to memory of 4556	2584	msedge.exe	106
PID 2584 wrote to memory of 4200	2584	msedge.exe	107
PID 2584 wrote to memory of 4200	2584	msedge.exe	107
PID 2584 wrote to memory of 1568	2584	msedge.exe	108
PID 2584 wrote to memory of 1568	2584	msedge.exe	108
PID 2584 wrote to memory of 4592	2584	msedge.exe	109
PID 2584 wrote to memory of 4592	2584	msedge.exe	109
PID 2584 wrote to memory of 4592	2584	msedge.exe	109
PID 2584 wrote to memory of 4852	2584	msedge.exe	110
PID 2584 wrote to memory of 4852	2584	msedge.exe	110
PID 2584 wrote to memory of 1560	2584	msedge.exe	111
PID 2584 wrote to memory of 1560	2584	msedge.exe	111
PID 2584 wrote to memory of 5580	2584	msedge.exe	112
PID 2584 wrote to memory of 1560	2584	msedge.exe	111
PID 2584 wrote to memory of 5580	2584	msedge.exe	112
PID 2584 wrote to memory of 5580	2584	msedge.exe	112
PID 2584 wrote to memory of 3148	2584	msedge.exe	113
PID 2584 wrote to memory of 5532	2584	msedge.exe	114
PID 2584 wrote to memory of 932	2584	msedge.exe	127
PID 2584 wrote to memory of 3344	2584	msedge.exe	116
PID 2584 wrote to memory of 3344	2584	msedge.exe	116
PID 2584 wrote to memory of 3344	2584	msedge.exe	116
PID 2584 wrote to memory of 2888	2584	msedge.exe	117
PID 2584 wrote to memory of 4244	2584	msedge.exe	120
PID 2584 wrote to memory of 2888	2584	msedge.exe	117
PID 2584 wrote to memory of 2888	2584	msedge.exe	117
PID 2584 wrote to memory of 5332	2584	msedge.exe	122
PID 2584 wrote to memory of 1848	2584	msedge.exe	124
PID 2584 wrote to memory of 1848	2584	msedge.exe	124
PID 2584 wrote to memory of 1848	2584	msedge.exe	124
PID 2584 wrote to memory of 4892	2584	msedge.exe	123
PID 2584 wrote to memory of 4892	2584	msedge.exe	123
PID 2584 wrote to memory of 5132	2584	msedge.exe	126
PID 2584 wrote to memory of 5132	2584	msedge.exe	126
PID 2584 wrote to memory of 6092	2584	msedge.exe	128
PID 2584 wrote to memory of 6092	2584	msedge.exe	128
PID 2584 wrote to memory of 4876	2584	msedge.exe	129
PID 2584 wrote to memory of 4876	2584	msedge.exe	129
PID 2584 wrote to memory of 240	2584	msedge.exe	130
PID 2584 wrote to memory of 4328	2584	msedge.exe	131
PID 2584 wrote to memory of 4328	2584	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\mystigrecia-1.21.1-1.0.jar
1⤵
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SearchShow.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff92b6c188,0x7fff92b6c194,0x7fff92b6c1a0
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,15504499694531269754,10485093241438772350,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,15390119190996713346,2507446938056195957,262144 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,12430986630007186770,6219302234790055530,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:13
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3304,i,8789627864523915632,2647053486213185601,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3308,i,16219877801029577225,5245986706235258563,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3744,i,10735683281600983060,7574927861278444184,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3756,i,770116876672279166,4927680098621004079,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:9
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7238263291243145532,4133311072386910868,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5472,i,11155347849871883014,13566256006825559433,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11319833530258930813,5931543631110094754,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,15374965001241137343,7354271320462169699,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5340,i,18418952646812497806,2473067002703665967,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,616908971190484629,15162365723146098203,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6768,i,8175511050901678755,15410904098483745415,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6708,i,15073332489272892498,5804453444932694623,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,5570502346971521947,1865419514355801049,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,8284738888493932050,4167310332907969765,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1476,i,7570773946572095029,6702547130336492376,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7404,i,7206627313072185278,13428023485323897189,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5764,i,1328114968818132119,16343244510645385235,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,9885660062089255078,11370492596215751805,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,9885660062089255078,11370492596215751805,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,15856322254337731583,298744683328629918,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,227927243587730094,9944186451051931023,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7792,i,2869269362734701446,12850281606391658203,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,1523691106024188625,2532981498426737809,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8452,i,9097217536809358220,7217887285311814043,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8652,i,15578253314875334255,14950205027498801231,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:14
  2⤵
  PID:4876
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\jd-gui-1.6.6.jar"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8576,i,15768955048800022024,1395104421593628122,2097152 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,12604586444641989515,13587029224362304979,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14708792929060005948,4577762684648738091,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:6508
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\jd-gui-1.6.6.jar"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,16940526259558175956,11803642481854848403,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8128,i,10486117274314843725,18167979450929435368,262144 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,696281601513431364,12666810763772761189,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5513997068322252536,11776259832424722842,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,505809613825573986,17793964708731556066,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=8168 /prefetch:14
  2⤵
  PID:6284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,14954443861662101107,3569748889571071562,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:6348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1596,i,2672836419811112962,6343519660708112580,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:14
  2⤵
  PID:7012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,3577679784697134492,10689815220312043889,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,1615348471380585079,14542701675895944911,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10220470448598121304,12111801102071515711,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:6940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3216,i,9231701983009963007,7986507483668519545,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,1969395482108023288,4002484860555160850,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7534540130396848760,17384350761913027384,524288 --field-trial-handle=2744,i,8966423353671978831,15197933021178800046,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6548

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\mystigrecia-1.21.1-1.0.jar"
1⤵
PID:6560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6640

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 72adac778ef48f4b3cee2ec22f8f0d61b3904c07bf585d62b8b5dd1a154f9538
MD5 3a93c192afb8d1fbe132f14b9d859e6a
SHA1 396a0594752117d0174b0226d26d6f81e3ce05e2
SHA512 33af60430aa8e366007ab5c5056119ceadddcc4441e755be6bc8f233eb636b329ee4dc419ffc9906d3f97dccbf29cddd7e6a940998c5fabcdcae8f89b9811fe3
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 1334f7807f69c23b5f7db22e36645036d1d299fd7945f8cfa98108a7634960cc
MD5 a3ab9d30c69720f7023e5f757401516e
SHA1 5344674075adecdafd467fa0eb69ba77a559e0d7
SHA512 b70a3835c4cc6bb9f5c69ebad21e4065b4be86af25d11a39757fc5b7aa2d1d23c1370e222e4c8a0a3fd68290b66b9b861b71c9bba6b1a5e6a49c1b75d4cd8d40
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 692cf89404216a478c8ec9490d20578907bf6146855432d00e66d6072845cb16
MD5 23548c6dfc61016863bd7568e74fa97b
SHA1 338828d9aea3cc524bb9a427e8d9e890332bd00c
SHA512 cc0b02bdb7451f5837e6bfc2c09c55660a858ed92a12b7b5e4f8dbe09de86c30c7006da7f709d2aa0679c634e86b3620be31596a001340f9091399d11bca0495
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

23ecaa58-b2a1-4c58-97e6-75069a703c2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23ecaa58-b2a1-4c58-97e6-75069a703c2e.tmp
Size 14KB
SHA256 560e1be7cab19470edccc71ab39b6b4e8150b5e35b1dddbd3959e57302293d85
MD5 0eb497275226717a90df574b1661ddbd
SHA1 a6885e34c1c7c4d683debb33286ac2457269cac7
SHA512 090d96d3e4aed2ee7af2039638dab8700d5553786d1d5994f9eab6afb39e6a37eb5b0dd2c7052f463a3e52190477f5546b6c9740600681a8373b053713ff1adc
SSDEEP 192:sxROrx3/fnsgMS3AtxRHoA8pJAA/g6+WNPyU/YZFLIvGApIgVeh0+EA:sxRON3/fnsgMS/L/5f/SG2l
TLSH
T17762C6166924D9378CC7D61CAF357F53D7F91022A8915E4CAAFCCA1C04EB6ED222781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 eed4e4ba9bad84524458e6c7e5d20e43b0aaf2bec2827789ff4dc1d877ebe8fa
MD5 b7ebbf9e99d6124d7e4342f45fde1b63
SHA1 e6a70755c58bfac927384e023b08c8c2273925d8
SHA512 62a5ff21a3bc79bfa465caf626ab4d8291764f9b4fdb0d5ce5a858bad51d3075c8ba93e16834f286b5cb1487b80596b87eff409fc36db3d6c122cebb9689db39
TLSH
T180E07DE509CCC32EEA10674B916C470C92C0370FD2C8E99A9F0089A47B83244F3C26B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6e6e9391d29298eeb9f50272fdc82b3d32796c3e421ee29da4048fac7d2837f8
MD5 6811a6089f966d3dfbd5666e32cf1267
SHA1 81b8beff7f0d7e017a4e66417f575cb74c770d08
SHA512 ce9f28d71a1ffd0c4f5a425f0b114179f36464f8046d6ab18adacad206fbde686acc95af1089a0ba3854b6738a5f2d133e095450da519563d2e2a7e1b57618f6
TLSH
T1BBE0268806CEC32FEA20A74751A8434CE281360AD6C8FA1E1B00E8A57702040E2826F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 99b39e9fa9c016aba6c4cff1862bd8531a3616f7b21d74213d3ffb6d34323f36
MD5 59bca25932d267260ae301b2b8eabf78
SHA1 544ea5fc50cbc4f0d3279d21b67f00fd5b90e466
SHA512 dfd96c03f5d7002a44c941ef94b0672a1676173839d76e6d7216d54e904c2c7e7f9af2fdf98a56d566c9b88c5d844d0d782f41a33625a1289aedf1bfa50d84b0
TLSH
T14BE026F855CDD32EEA00674791AC930CD2803A1BD2C8FA1A2F008CA47B020C8A6826B8
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 204KB
SHA256 2c49d43cd1dac1d2343ccb2cafdd48b4d866745e90a5047c1e420f4a0d0a815b
MD5 2255f2d36c4a3124a960413f23d46c42
SHA1 7071ee06c9a3939d456d9e7214eb39be667582ef
SHA512 caf3a65eacdc819bed97958b0cc46ab6075aa305d3d8bc28303d9f79a5d74c1d0d87777f332fa9181ba98c467ff27e11efe6ddb2e66150610e954c8642b1e0a1
SSDEEP 6144:7iKVNgDVa4zePW9LQN9T60aTPtTVkx7qCB/ukzsx9:TV6pWPp9aTPlVkxkQ2
TLSH
T1C2242326005B52D56F4F0108E2AB7597B17892ABBD6C51F8398F372D7DAC21162B09FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 58ff5e4439d9657bb1a4fc28d53b2595d6951c67f71a1f2017930adb235707e5
MD5 970826e54463042c5385ae098075f522
SHA1 3932beb28f3d2160544ef6b0baf6d52ddaa8df9e
SHA512 c2e8f78f49e4dccf6baa1d2f3ab76b9b0b2151d388214117a29a3258c53ff1df4d44b76be9efa3a92dbfe9894550edd3d73bf5bec9f69d81cff656e2cbcfb5a5
SSDEEP 192:BMIHjE6jYOkeLguBgfKsUDBZTRPGVQDExopQpEtEpS78VCi+D021fnIDnH:BMIHjE6jYOkiguBgfKsUFfPGVZxopQpV
TLSH
T1C8D1DB14A1AD868EDB683DB111FAAC883BF8C0EA41CBBF9E95009E358A53FE104D0457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 539f4cf2903fac0588b9e81c9118a8564c93bfab9cc73883155e7959d43f4112
MD5 4e3e8a7208c0da3b860ea4321a0dd0e2
SHA1 27382c7b68fd537b459a214824ad0f2464d39d68
SHA512 000f8e5c15e3154aa03b9673e15c0d96509f849eea225dccddfc507c84bcb7a72675e916e199ec4ee11a2b271dd027f9d602d9ae10e959e75973accda1448e11
SSDEEP 96:i0IiOvpgRaUzSH9f9JToatBHwgv0dUcxLKp8CeWFsXybhRySMDBjRDzh18QmiSiX:i0IiOvpLU+H9fbToatBHwgcWcxjCeWFM
TLSH
T1BCB1CA14A26D898EC7B47CB111FEADD937FCC4EA80CBBF9D56009E368A52FA255D0007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5c38ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c38ab.TMP
Size 3KB
SHA256 2858033c7ca1ad06084a1a8e2f1395dc967e56f17bccbaa4f2a892e1401cfff1
MD5 61909d7be636c012aa0f413f97e3b403
SHA1 947498cc0610512838d3091034da2d0e291b8884
SHA512 158c2a52144ee36262e1a530764cb83869e7ba9e6b64326d523f73ced8f4c2597f2e9b516c2f11977c01627676e248596a408d6560256e4bb567467c3c2a08f3
TLSH
T186615E15332E1AC3D724B8B265FBD68837FCC8B792CFEE6455106E764A06F16A4E1017
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0f36b60683394a6354ff23c4cd07757f7b79bb525227d8cd5d11837686e86b9f
MD5 cda5fadc585da16e37611053ab41426d
SHA1 d34387ac9c7972d8d2d4cf7b60484a8613bd983e
SHA512 2c297cb5bc9b0ee9bd24c1023caf0470614a46addae5766407ceeea8962d5c2f3134a983027d28a8c01fd5a23b3729d089d142bf064ce8d1c2a69ef224bdbd94
SSDEEP 96:D3ijpQ+bmVajhnYlajAYiEqvv2xbmt0wMfix1GcncyGk:D3iVJbmVajhnYlajAYijvvobmt0hfixz
TLSH
T119C1BBF783E5862DD91152F0AA186F1BCF1D0855836C7C5A84E4AF1BA3F2471E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 31d510382f0db235913eb08deac0e49ba13e3261d063976ecb419b37e629cc28
MD5 e5e9b3fbfc9086ed15fea9d8a3dffc90
SHA1 1bdceec00bc31e11fc57020a794396613a5e3fe5
SHA512 9ab836d8d6c3172187a76282d236c8076dab8f9ca06aa259cdc469e44eb7c0e31cbc5e0226e92fecbb30c6541a45e68e2904e76b3d851039946d97f52643e7ad
SSDEEP 96:D3ijpQWVaijhnYlaj5uYiEqvv2xbmt0wBc+x:D3iVRVaijhnYlaj5uYijvvobmt0kc+x
TLSH
T1FBA1BCF787F5462DDA1192F0AA086F1BCF2D0455836C7C5A85E0AE1BA3F2471E181B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 43ad4e367e5f0e7366592d3e20f95016a2df60d7f46c559b006c2d74195ac751
MD5 4ef7f41ebf1777c45a3d177fa00727b1
SHA1 ed56fa337f45cc3a429f1066d23ac63b17dfd0af
SHA512 dfe406ee23339b229cb3045e906d1e5af61b6bf0a83dc68dd09f89431de68a673f4baed5133bb431963decfc510a62cc2421f03e9a9d83364875729a5ec6b47f
SSDEEP 192:D3iVJbOSVajhnYlajAYijvvobmt0hfix11ncw/+x:D3iVJbOSVa5YlajAYijvvobmt0tix11q
TLSH
T11AD1AAF783E5862DD91152F0AA186F1BCF1D0855836C3C5A84E4AE1BA3F2471E191B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2d81a7b7b415b720389101e2079678b833839d1126a4c3aee01ba2015ffa87db
MD5 1c0fabbba2c81fcb8c4e86cbcc412f05
SHA1 d9c4a30531c2bee87535bcfa5768d1d57f7437a3
SHA512 1e3b779ccdd876edc5459c0b7f664b67ccb192994feb2041591703d3b33702181281b4fe05b1111626161bd821e71f85a7256975a4bf58e41788d069526d82f4
SSDEEP 96:DkljMZ+bOSVajhnYlaj5YiEBvI2xbmt0wMfix11ncw/tGj4/3:DklQ4bOSVajhnYlaj5YigvIobmt0hfin
TLSH
T1EAC1ABF783F5462DDA1192F0EA186F1BCF1D0456836C385A85E0AE1BA3F2471E191B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 949aa88718194eaf06aa85eeb35aa2803c1c8067bf3ea33a7b1a5677a9f9c274
MD5 361b86e676743220da6421f856e9265a
SHA1 9c4e3705ba5d6e18a1c423525a21ae2b50dd1fdc
SHA512 2fe06cae376bd0e284177629288674cae50ef21e105807e2e2c5431750cb201a598b49abbf607d8e2e36b86108322d43fb984ec2cc4334fe3da98a4d1272592b
TLSH
T14AD02223A240B4B6EAEC3E8181AAFDCFC32700240842DDE665D0AC9C29365ED1907641
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6f9c522fbe7d404a93ba63f77cd566ca566d1a5bdef6521e8f05773583b19988
MD5 9ff6c953d80d338dc1d14238c003f648
SHA1 86fa1e07964a4e27c1ab04189b9f75e95e2e221f
SHA512 99831549d0575abe75dd1df94405c055b9375000ca6d7077e66943402197a86dee867aa5b855f76598a9be3f1b165ef444b80c9b64688c3a9e7b690c94084d7a
SSDEEP 192:sxRtrScB13/fnsuMS3AtE9EY2oA8pJp9Hbc/g6+WN+oyUH0y/AgZFLWvGApIgDcX:sxRtGm13/fnsuMSVDJw/5bN/vILpSgC
TLSH
T12782C5525924D8778CCB9618AE357F52D7F900229C925E8CAAFCC90C04DF6FE262781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 0cbcaf5542b26fec196e873608eaa387d97a82e65a837bd477501b85720668fd
MD5 f57037bf4b0c5533e93ea349412e3be5
SHA1 c92ce928a62919d1b3f8382892b440da4153fbdd
SHA512 d658eb30e81975631b3b352d4bedd6e2c2bcaf558e14e85718627f6a28bc8ffc5f5183978e8b089f78b6d5349318b3cb3b5d96e47648624961cd356bc6ea355d
SSDEEP 192:sxRtrScB43/fnsuM73AtR9EY2oA8pJpJb3lg/g6+WN+Ny5qyUH0y/lERgZFLu2v0:sxRtGm43/fnsuM7YDU/55UN/t9TpSgC
TLSH
T11882D5526924C9778CCB9618BE357F16D7F90022DC925E8CABFCC90C04DB6FE2626817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 33KB
SHA256 a7da22908a4739fd1e4b84bfe580da468e82670036f3851c05b8f8f597f79c2e
MD5 5e2dd6fb361b9f87b0185002bd10340a
SHA1 589ac3716c2d1563a340ddbc918a7aff28a403e3
SHA512 3aaa19b4680647af310f7529d7777ad15e49ff14ac4117016ce9456addaf05d0f663221024165f226f5dfb60bdb5a912cd2d98c0046681282109ef142d418c1b
SSDEEP 384:sxRtGm43/fnsuM166s8qMpRiYnazAW8pZS15posJWeT+QAl1sE+/55UN/CM4pSgC:sxGm43/fjM14Mnc7WeT+QosD/5CClpxC
TLSH
T17AE207469810C8778AC35D18A93D7E33DBEC40625986DEDE6AECC91C009E5FDAF17863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8feed45af939a7deb351f4cd333adf446e9b30072fec512e44b7bd47aba224f4
MD5 98ae3b209ae764cb81fdeab7f58c143f
SHA1 c8dfa723060b72751a1a917dc3f39a0df1333d83
SHA512 984661ad6b592e9c75312789ad54951c2f533b0b6f92137934e4854d8256d55e0aeec3e7b6616a051b7e3f9ea89f6382e6cb97109946a03a7b6b82669a9a4915
SSDEEP 192:sxRtrScB13/fnsuM73AtR9EY2oA8pJpJb3lg/g6+WN+oyUH0y/lERgZFLyvGApIL:sxRtGm13/fnsuM7YDU/5bN/tULpSgC
TLSH
T1C782C5526924D8778CCB9618BE357F12D7F900229C925E8CABFCC91C04DF6FE2626817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7595db80136d12ceef99eff4e4bb830d6671101c2cc11539425a16c4d10b6210
MD5 0da6b5823f040f45563c28ac5acd4fab
SHA1 2d7bf2b30588f4c970a6432e6c0a176f62e543aa
SHA512 3beff3eb122261d21f3e1c15d759adb39a0a480a4190f89064a36c9bf8dc2b3bb2d306dd305b629852cb2476b50669610cac257c5b3d3d7a5c39abf6a1c08904
SSDEEP 384:sxRtGm43/fnsuM7Al1sY+/55UN/CM4pSgC:sxGm43/fjM7os3/5CClpxC
TLSH
T14792C652A924C9778CC7D518BE357F56D7E900239C915E8CABFCC90C04DB6FE2626817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 de3164eec318d0fdf415e6dfa5c7f8b0db6899ce877d7f691a2e53675d99cc37
MD5 7ffbb77e86a326a816ab142504e9c008
SHA1 86d9a7fc5cdb973d10409e0bb4594922403481e9
SHA512 fc04357a8dc787fde3385f8cbf93c58982463c4d2818e46cc381f392c8cc0ad228d2ea62d2d4b9a2bfc2abdcc561a7145a67a715c3b4402ceca372a53762d628
SSDEEP 768:K80E+67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTwLWAroLuUY:K80E+SE7FwWgNhfVNu1jaUgWLLuUY
TLSH
T106C2D97B740CCE7E4F804ADDAC197E9B6DA802CB96D8CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9679dbb1-8bf1-41e0-af44-2c2f2e0bd4b1\index-dir\the-real-index
Size 3KB
SHA256 2eabc42f175e203e2441289e3cf45161aa56a30796bc95a3f9040fb9c6d6166f
MD5 fcf43b2e231333f70c62ff35545f4e27
SHA1 00a54e1a5948fab19618491d4bcefeebe27dc8bb
SHA512 c318cb4d412d03ab87f6aaa4198f2b9fa64337be92174d5d300ea08c5b8a19fbae41fbf293ee2d07d946a27df35b51aa8e7181d7356c2241d5ad96a6465d2104
TLSH
T19F51C74E8C8E0E9FE96D12729CF70411337466EF17B88E03189CA379BD8322F2C48956
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9679dbb1-8bf1-41e0-af44-2c2f2e0bd4b1\index-dir\the-real-index
Size 360B
SHA256 8a83382d06e4e231f58981df687c5d8eb5c17e20d448a5e606c1781529e1479e
MD5 96e3bc71d7a5b8a2e1fab906aa27956b
SHA1 37581e603f55cafcc1fa2815b23521bd785418c5
SHA512 c0b63c75af469e011baa7ac9dfd7b959e0ad2dce057571c75556e464111190b15f92762c41fdac582cd5e7ad3343478981effcc3035ac2489cc3225955fa65b6
TLSH
T1C3E02B8F4C925513CA25AD360A37652E333B0AFD3501EE1B10BD141DAA5277C8981A08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b8375.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9679dbb1-8bf1-41e0-af44-2c2f2e0bd4b1\index-dir\the-real-index~RFe5b8375.TMP
Size 360B
SHA256 2c99464a8bee398285e15dedffb5a5ea03788f7dbbc42cb8e794e526baf26480
MD5 8ec7d1a2b9e90da1da091f9379a840b1
SHA1 36e8af9c05e58d478b8b682536959e73f61e913e
SHA512 75eb5101f4ca5f15b094a3cc89703051840151011a084ea27913237778ce36ed992e486a69fd9a638336186e9beedf695e96b494cac91a04d0c5fade3b905340
TLSH
T126E095CF40D15D53DD2A59351553511E333F0C342505EE1B10DE945F55217FCC94570E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a943b9a4ee98e53b7da6a796825cd72412d6571c5f7a7ae9bc3bd28ee353054d
MD5 f8bab33a0f6753ff8897a5e212d34ee6
SHA1 ee802b521233db9294b2e9b5b7ddcb4d70a8cced
SHA512 505e77987f4f5dde511f8cf5ce36d3978d2857896af3a72f09902b30dfb56abb016e460504c87baec0c7241341d1dcb956a37f0a58d8468cdddac98286b5ced3
TLSH
T1F9E0DFF73DEB1828FD6B93FB587168A54406B848CA95ED4F201B92C761B2365281ED32
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 126cd6bb05cea0a2f1e4f926f3803445bd23c18457010fdc127858052a55825b
MD5 66603926a68dc3f106d25167f65c5338
SHA1 e55f99f12143af22d9310b45876d1ae85a707ea5
SHA512 4974038082233f002193ad5ee57d4c3436e16662a0bbf6d73e218a661abb679bc47609a059d07a6aeb2782b1ef88b3bd6e9f84dba091ebea505739134bafed3b
TLSH
T10FE0DFB73DE71824FD6B93FB58B058A54906B848CA95ED4F101B92C761F2365281ED32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bcc0d3dd41d96d7caab5fc9d36751511f673b8acbb426aee1ec35cf631b5701d
MD5 68bafa4dff0bfcc199bca072f75502de
SHA1 b04b61d8557f962a8426c1a1cdb0a2a146c7b17d
SHA512 e24a1090482e6bdb5556a981fc0249ba3694b0068eb2c7cb4f0472ec94b08890f6fc290efb58c33b14c3ca90e09c7b5f7a91309be551362b1fd6579538127518
TLSH
T1FCA002B08E69D201D5255771117D51847FA04DFA01A5276569ACD4AC8FB9F8455C5101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d375e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d375e.TMP
Size 48B
SHA256 d76f0428f2941065cfbd01d806e8726837ade631cc0ae2b78aeccb78a928db10
MD5 31010ad8e58ed8d20b4f86e649078fa9
SHA1 4c0665d20073a6727875119f5c00e9df0437eb9e
SHA512 438d2ae33a6db03b335d5baac13fdcb4636961c06d42535b8b1eb9f234db39facaa390ccadf9115e1082f066eecbe1d5d381f00c0321adc5aa74d49fa0526a81
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 fca52f4d4e78d246f22b3d969ef8115539967a3ecf3993f7e26e742a07f40873
MD5 edb425cde0d42a38c03a0a9fa20ce53c
SHA1 4827510cec97d63968f03ce1a381d3826382eb27
SHA512 379f0bf26a20040d2db0f2fd11c4fbce2134a5a47e5cc339d579b95ab90b0bef6c139116cbca2f636504e0b3ddd98dca09b85d3107850d03109c61ac1defd606
TLSH
T1F041A61132B942913C7E690DC369CC6F738234957258E42B375511A61FEBE136DFC6C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 54056d632ac21d5343eb5c66cb0ff99a21273ee1ace51460bd79382ea9b21187
MD5 e21e87e90cf0ba5a304a12a8d5b25c11
SHA1 af4df70c9039d814dfa94e761723b8e926ae1338
SHA512 05951af4c974caefaab873b6dc5006f00fba38df95f33ea516aa137cf3b489c78c59e8aba2d102c952e80a004ad0790a2bcab7010c0bee5bcf61062e817a0f25
TLSH
T14C61C11132BE43903C7E690D9265D86E638334A57258E42B37A950B61EEBF126CFC7C9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5c51a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c51a2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 cd6b6a53a9597c0f2e59a8db9f94ff4bb528456264e9a89bb643ef504ddd281a
MD5 cbda90d0c7bdad4e22628b047427dcc3
SHA1 70a8b560f42c29a2e68ece4232719be950ba41f6
SHA512 fc4ef76664e293305def068122e636fbc7057ee2b941cefd08f953e71435c5d571e87193617c28f5ec906035cf48461c538083b5305bfeabb68f7b6e3a31a8e9
SSDEEP 768:gF8m3NwgvhkDF1OUehEX4fouOToPvB2thtA9VAgMfn8:Zm3Th8snnwthttxfn8
TLSH
T144037C72ECA8CD67ECE6D784B30976469FE0516389D89EC4DED85E5C00876DE0B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d3cbc558d020555216f28a6515a5d0d8770ae0ca881a04e9a2797eb843eea520
MD5 8458744d2bd8043c8d865b0bafee97ee
SHA1 ac57b851a35a0559f68f89089ef6966171fb1a84
SHA512 bd355000c3316db9fdf6ff1c1547becc37790d803694e3fb47529159d5a8274e2f2b110ab6e73bb31b0f28b7d1a0198d2b5250dc9733baa6d78dfab18f5312b6
SSDEEP 768:grv+4UNbdH3Dl+LeSFOUehvX4fouOToPvB2thtA9VAweeVH1SlX:gbsbh3xsnnwthttzEH1Y
TLSH
T12003BF32A8A88A33DDE6D398720B75533FF4812396900FC49DDD1B4D069B9DE070BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fa12735d07fb97d0bfff41b46a4454f384a13b3cc34103698110193ce886ba12
MD5 959a11ddb4fee3b59ce6091b28d6c3be
SHA1 774610afb89e4d866d7e45b6d3eb01ffeec02f53
SHA512 b669b4f98ba217e3248eca3893621fc3bec300937cc256907ec56255725750191f3224912926ee7c567d5c5757d2d1d0e32f98f13191e91b341a157a63f23e9a
SSDEEP 768:rrv+4UNbdH3RhIa7+LeSFOUehqX4fouOToPvB2thtA9VAgMy33d:rbsbh3RhWsnnwthttxwd
TLSH
T17603BF71A8698D33DCEAE298B20A76933FF4116358C10F949ED92B4D058B9DE1B1FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4895d098f4ff76574462ae06c96eb3a56917911480c3333c255f3b08970edcbe
MD5 6f2e5fc11b8bfc5875eb20227b66fe53
SHA1 13a69c1c29f67aaf37b97ea77f22f2c19ac6217d
SHA512 57f5595e96ed6dd33b3ddfa2655adc83163c22ca9dc24cda4cd69d5c00b626b9e0342a028d2141b98cd55a0b3dc10972cd38dd0ccbf36aa0aaafc10028b9c9e7
SSDEEP 768:Yrv+4UNbdH3tk+LeSFOUehqX4fouOToPvB2thtA9VABMeVH1SlX:Ybsbh3RsnnwthttSEH1Y
TLSH
T17503BE72A4A88933DDD6D298720B76932FF4616359C00FC4DED92B4D068799E1B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 e1b5a4ee811f141405263f5a4ceb74699de4738a395efe950fa318d2ae83a753
MD5 8c9f9fdb45dcdecfaeb39d7405738900
SHA1 355a6a1456ddbb2680e1849310c9e01191e62816
SHA512 e884d178332dcb67a5e03bb1a7dd13e4a8a66d8374acea83f10f906ea8d2f90c14d7b7fe5f758ba613824ea66f76f942a3feaffa517e08bee99d3f98fad693d8
SSDEEP 768:gFRrv+4UNbd73Nwg/h1Dc1OUeh+X4fouOToPvB2thtA9VAgMfI:Ubsbx3zhisnnwthttxfI
TLSH
T158139E72E8A8CA37ECE6D784B30A7687AFF0116349C95ED4DED91E9800875DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c969f811f34a4c59162933fa81b46c7d533da2c1b7275acd1533e8c8c1b98c2a
MD5 1a7c37777eb4ca20804107a43d683fc7
SHA1 cea14f2e383256cddf4818a7f5d94bbf842e1779
SHA512 8111d195c4e140b05d410ed5d82ca6a1f10ad8e350ab888f6766e8a20822721ba15288721c5ed51714a25d66d35745de1143772a3f2776abd83680e1f13c7bde
SSDEEP 768:gFjy3Nwg/h7Dc1OUeh+X4fouOToPvB2thtA9VAgMfn8:Oy3zhAsnnwthttxfn8
TLSH
T188038D72ECA9CD67ECE6D384B30976869FE0516389D89EC4DED85E5C00876DE0B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 107e3b2ef9e5a08681baeff7cc64a21e5edb5719fa88265a7b8e3f3aa1b73bdc
MD5 033f8cb7e58c2281d31afa815b3bf1f6
SHA1 1621090154588c8885e8a95175bbbe6a1dbe8fe3
SHA512 3e205082b66254bfacda2c3e48a5933b9b2d2278dc417aa14d6186f7dc64ea024dd0b1c6baa620c7dc03507249a738c8ca3d8704b07df87c370fcdf0eef97eda
SSDEEP 768:Mrv+4UNbdH3Fhq6+LeSFOUehIX4fouOToPvB2thtA9VAgMy33d:Mbsbh3Fhisnnwthttxwd
TLSH
T1EB03BF71A86C9D33DCEAE298B20A76937FF0116358C00F949ED92B4D058799E1B1FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

0a8e12b3-2bb0-466a-8128-ba659ab76c9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0a8e12b3-2bb0-466a-8128-ba659ab76c9e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a8712d0-86ac-41c1-b08d-1fa350c91da2.tmp

Path C:\Users\Admin\AppData\Local\Temp\5a8712d0-86ac-41c1-b08d-1fa350c91da2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

jd-gui.tmp.3622597923105293924.1787254455373.0.skilltreereference.zip

Path C:\Users\Admin\AppData\Local\Temp\jd-gui.tmp.3622597923105293924.1787254455373.0.skilltreereference.zip
Size 3KB
SHA256 5784e88d37870e4147d4ff9cc6116af16ad277ca549462fd161785740562c0f1
MD5 178cc76afd1c197f7bd26d6438227ba4
SHA1 2682a0d45cd6e3ac66d6bf17333e7107d09824c7
SHA512 655be53acf25fa52f649f7928b514784a264d7e82b917a0e123556debd4c8a70bb451698109545b89565039bbef1de30d2518dc2de2c7080797c98b80c2e9bb0
TLSH
T14681EA31DE17D423DB5F31F4126A235A1E8E494EA8520C8A1804D776AD7DE42BA36FC9
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2584_1058119256\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jd-gui.cfg

Path C:\Users\Admin\AppData\Roaming\jd-gui.cfg
Size 657B
SHA256 5fdd6c4565b2ed537b35b208efdfd891b80213bd56a8da0d7a7cbee4e3bfb8aa
MD5 dd3d15e05b0f32a0529bacea71d5a080
SHA1 3b6f5ac6dd77982554b8f22928b91587a99dcce1
SHA512 81af8b85a9d8f753014b0d98e2ca27e2ea4de74a24aad9e2fa3cb81e65e6ea25562d972328939d670ebe366537d864123a639752b0f0102231e08f2fa515bade
TLSH
T10C0199590506CF65432C07FB4A53334F0FBF067F96390108964A34BAF80AEB8218B42F
MD5 SHA1 SHA512 TLSH

Submit Download

jd-gui-1.6.6.jar.crdownload

Path C:\Users\Admin\Downloads\jd-gui-1.6.6.jar.crdownload
Size 3.1MB
SHA256 2c9d3efa8b06438a7284139f68f6efcbfb2a11e0b9d20a3370d50189685afc0b
MD5 5b1e5dfb3f38d089a092e2079289155f
SHA1 bd4fc400c2e41e31a8b516f4d15be726eb44b386
SHA512 ac05eade3bc70ac72fe92d52f178a4a8a028f00430fa709bcbd4e43564589339e731eb2111c9ef64c0bed26f2edbb510afafc73a4891d0bd018e813539ac1227
SSDEEP 98304:1YlBqmrhnVP8jGMTgFtti6zrG241v2Bxp:qBBr9YwoQxp
TLSH
T1F5E5F12DE1C51033F5AB4132A6A75D233E3F15D9E08B205339F413D2E9BAD492A57F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-602-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-656-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-601-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-607-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-863-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-862-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-868-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-865-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-875-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-879-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-914-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-915-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-916-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-609-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-903-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-901-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-898-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-894-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-615-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-881-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-882-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-925-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-933-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-942-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-955-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-621-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-558-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-554-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-563-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-574-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-581-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-622-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-650-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-777-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-841-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-805-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-728-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-631-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-638-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-617-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-1191-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-1192-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-1200-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-842-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-843-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-844-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-637-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-639-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-641-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-724-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-687-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-688-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/240-704-0x000001BD68740000-0x000001BD68741000-memory.dmp

Download

memory/1128-2-0x000001778FDA0000-0x0000017790010000-memory.dmp

Download

memory/1128-11-0x000001778FD50000-0x000001778FD51000-memory.dmp

Download

memory/1128-12-0x000001778FDA0000-0x0000017790010000-memory.dmp

Download

memory/6560-1014-0x0000003351400000-0x0000003351500000-memory.dmp

Download

memory/6560-1011-0x0000003351300000-0x0000003351400000-memory.dmp

Download

memory/6560-1013-0x0000003351200000-0x0000003351300000-memory.dmp

Download

memory/6560-1012-0x0000003351100000-0x0000003351200000-memory.dmp

Download

memory/6560-1017-0x0000003351500000-0x0000003351600000-memory.dmp

Download

memory/6560-1008-0x000001E1E8EC0000-0x000001E1E9EC0000-memory.dmp

Download

memory/6560-1009-0x0000003350F00000-0x0000003351000000-memory.dmp

Download

memory/6560-1010-0x0000003351000000-0x0000003351100000-memory.dmp

Download

memory/6560-1007-0x0000003350A00000-0x0000003350B00000-memory.dmp

Download

memory/6560-1018-0x000001E1E8E90000-0x000001E1E8E91000-memory.dmp

Download