66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2

Analysis

max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rename.exe
Size 4.5MB
Sample260831-bvs4kack4v
SHA256 66a1f6ccc9f869945bec8149f1af5ce5bb587d3d25c8008cfdc0bf3c0cebf9c2
MD5 42fe4a56c232d4f65bfa7ad9eab99812
SHA1 ff382fff460371f167ae09d2f2cf54d7d6264a0b
SHA512 3694acd3980705493876209de679cd316f596f5255be2a0eb23971dbef18a8c54adb08f7dad42217ca855768910bba8d6f1d9d69f74429f2a64af9f9fc29c1c6
SSDEEP 98304:+bwdaDFrhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1Y:+bUEFHGpELcoR1Y
TLSH
T131269DC6BF88F5E0C4A48834B916D5BDC6737C7A8A11468732D7FB1F2A37180552B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	ImsVwbCJXTAp

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7878df06-e62d-498b-908a-3d47b161c8c5.tmp	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3492_359168334\manifest.json	msedge.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\edbab8f1-a0e3-485d-ba35-5935ba61a71f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3288_13432613333289172_3288.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2668_13432613333347554_2668.pma	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
3148	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wct8D5B.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3696	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ImsVwbCJXTAp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	ImsVwbCJXTAp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ImsVwbCJXTAp

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326133335669508"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{C0DB6108-9463-4CFE-8A9B-FE98D44470A6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2980	wct8D5B.tmp
2980	wct8D5B.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe
3492	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	3528	ImsVwbCJXTAp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1696	1140	rename.exe	85
PID 1140 wrote to memory of 3528	1140	rename.exe	86
PID 1140 wrote to memory of 2988	1140	rename.exe	87
PID 1140 wrote to memory of 2980	1140	rename.exe	88
PID 2988 wrote to memory of 3148	2988	BITC5E0.tmp	89
PID 3148 wrote to memory of 3492	3148	setup.exe	90
PID 3492 wrote to memory of 2688	3492	msedge.exe	91
PID 3492 wrote to memory of 3696	3492	msedge.exe	93
PID 3492 wrote to memory of 4996	3492	msedge.exe	94
PID 3492 wrote to memory of 4996	3492	msedge.exe	94
PID 3492 wrote to memory of 4996	3492	msedge.exe	94
PID 3492 wrote to memory of 4524	3492	msedge.exe	95
PID 3492 wrote to memory of 4524	3492	msedge.exe	95
PID 3492 wrote to memory of 4460	3492	msedge.exe	97
PID 3492 wrote to memory of 4460	3492	msedge.exe	97
PID 3492 wrote to memory of 4460	3492	msedge.exe	97
PID 3492 wrote to memory of 460	3492	msedge.exe	98
PID 3492 wrote to memory of 460	3492	msedge.exe	98
PID 3492 wrote to memory of 460	3492	msedge.exe	98
PID 3492 wrote to memory of 1144	3492	msedge.exe	99
PID 3492 wrote to memory of 3112	3492	msedge.exe	100
PID 3492 wrote to memory of 3052	3492	msedge.exe	101
PID 3492 wrote to memory of 3780	3492	msedge.exe	102
PID 3492 wrote to memory of 3780	3492	msedge.exe	102
PID 3492 wrote to memory of 3780	3492	msedge.exe	102
PID 3492 wrote to memory of 2796	3492	msedge.exe	103
PID 3492 wrote to memory of 2796	3492	msedge.exe	103
PID 3492 wrote to memory of 2796	3492	msedge.exe	103
PID 3492 wrote to memory of 1752	3492	msedge.exe	106
PID 3492 wrote to memory of 1752	3492	msedge.exe	106
PID 3492 wrote to memory of 764	3492	msedge.exe	109
PID 3492 wrote to memory of 764	3492	msedge.exe	109
PID 3492 wrote to memory of 4924	3492	msedge.exe	110
PID 3492 wrote to memory of 4680	3492	msedge.exe	111
PID 3492 wrote to memory of 4924	3492	msedge.exe	110
PID 3492 wrote to memory of 4680	3492	msedge.exe	111
PID 3492 wrote to memory of 764	3492	msedge.exe	114
PID 3492 wrote to memory of 1788	3492	msedge.exe	115
PID 3492 wrote to memory of 1788	3492	msedge.exe	115
PID 3492 wrote to memory of 2668	3492	msedge.exe	116
PID 2668 wrote to memory of 608	2668	setup.exe	117
PID 2668 wrote to memory of 3288	2668	setup.exe	118
PID 3288 wrote to memory of 2388	3288	setup.exe	119
PID 3492 wrote to memory of 1848	3492	msedge.exe	121
PID 3492 wrote to memory of 1848	3492	msedge.exe	121
PID 2988 wrote to memory of 2588	2988	BITC5E0.tmp	124
PID 3492 wrote to memory of 1256	3492	msedge.exe	128
PID 3492 wrote to memory of 1256	3492	msedge.exe	128
PID 3492 wrote to memory of 4004	3492	msedge.exe	129
PID 3492 wrote to memory of 4004	3492	msedge.exe	129
PID 3492 wrote to memory of 5372	3492	msedge.exe	130
PID 3492 wrote to memory of 5372	3492	msedge.exe	130
PID 3492 wrote to memory of 5424	3492	msedge.exe	136
PID 3492 wrote to memory of 5424	3492	msedge.exe	136
PID 3492 wrote to memory of 5256	3492	msedge.exe	137
PID 3492 wrote to memory of 5256	3492	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\rename.exe
"C:\Users\Admin\AppData\Local\Temp\rename.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\1988867390\zmstage.exe
  "C:\Users\Admin\AppData\Local\Temp\1988867390\zmstage.exe"
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp
  "C:\Users\Admin\AppData\Local\Temp\auth\ImsVwbCJXTAp"
  2⤵
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\BITC5E0.tmp
  "C:\Users\Admin\AppData\Local\Temp\BITC5E0.tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_A69A6.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_A69A6.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\BITC5E0.tmp"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7154628610574241252,909377329672012833,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,3214294238570945562,2193057617797287927,262144 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,1495744845014548112,10481361740650104879,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
        5⤵
        
        PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15684755830428043738,9624885295606346099,2097152 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14919208078081794472,7332233395217796390,2097152 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,10942069165377323268,8682957899004343461,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
        5⤵
        
        PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,6631193272796777045,17679968819325876361,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
        5⤵
        
        PID:3112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,11439422949891449043,2282239172134418540,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
        5⤵
        
        PID:3052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,15630056928965994483,13003116056850006875,2097152 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:3780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4232,i,4884849373250957577,125998256900238473,2097152 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,12616061067127138688,6089933180747611801,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
        5⤵
        
        PID:1752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5351693849287578442,15960177920798685925,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
        5⤵
        
        PID:764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,1490708555868438126,10404853198635397604,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,6689988307385708516,15354130182486046778,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12781620894762600710,5192258036334491740,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
        5⤵
        
        PID:1028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,12781620894762600710,5192258036334491740,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
        5⤵
        
        PID:764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,10202385981914941600,18207550868200318323,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff785b604c8,0x7ff785b604d4,0x7ff785b604e0
        6⤵
        Drops file in Program Files directory
        
        PID:608
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff785b604c8,0x7ff785b604d4,0x7ff785b604e0
        7⤵
        Drops file in Program Files directory
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,14219150661375322310,13912401322599499849,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
        5⤵
        
        PID:1848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,5174769125867242727,4594221129471803329,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        
        PID:1256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,5087119382279329178,5291828214755173094,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
        5⤵
        
        PID:4004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,17639167767477426468,15202222698649269233,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
        5⤵
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,11723538766798786556,337772837840697263,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,4156413161726842759,15474627504715808507,524288 --field-trial-handle=2288,i,14425532355577114307,13336950546954855747,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
        5⤵
        
        PID:5256
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2988" "692" "524" "688" "0" "0" "0" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2588
- C:\Users\Admin\AppData\Local\Temp\wct8D5B.tmp
  "C:\Users\Admin\AppData\Local\Temp\wct8D5B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2668_13432613333347554_2668.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2668_13432613333347554_2668.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3288_13432613333289172_3288.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3288_13432613333289172_3288.pma
Size 944B
SHA256 77b4f7a56226dac723e75967c9932bdbb93d57796bd00730b75d96408e00fd55
MD5 275c4b2adfbc66c86da785e53cc8dd97
SHA1 1f376d1be6e80c6ac9602be5b5383f93c429d9e7
SHA512 e50bd3a9e27bfac5177608e704e51051da32aedffc334900b89ad192204e8d7b3af474273ef292c82aae671f2ce18d94e3cf71e1d1395d78e1ec88c031c2558d
TLSH
T1CB11478577685A17D8038B31C4FA03563FB6F9E42B424B6B1545B60F0E132C88E8A080
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3492_359168334\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 120KB
SHA256 27758cb62281190b8d90ee1368ef9fd764e15cd70176f61b462eff20edd9666e
MD5 9f8cfe73e36815c9d9cf2d2e7112210b
SHA1 13a88eeee225c6c5870b79256c93a448355423d6
SHA512 afdc086a9f3781e969926e8ef2320cff406f87b5ae7b895bca41c7fc4225cf97e3995786cafe649fd10cbf3d4f676ac651dd50029b22c79cb580950206cd449c
SSDEEP 3072:02pjpeOk3M58GN65dKLkyAxHKOf1l7rpZptm:02pjFN6mkyARKOf1l7rpA
TLSH
T1E5C3453D6B5601BB7B48AEAB2903763D25A92283E1C417E57E64EC04B0CB997105F1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 122KB
SHA256 a8d51447cf2dd8909cc6ba7de74bc52adc72f70967faf51d5fbbc4a89f985efc
MD5 c5daa05ad4ffbe715191fa0627d6b7b8
SHA1 757c7174663b49bdb0e39b38266fd8fa10208a1b
SHA512 39874780cc63b45a2387470bc47a15a607d6c26482453b3cf7591fa075912989d71c1e0ea0ab7337607b67449c02f2fb05c430aabbd70074637e74c766824415
SSDEEP 3072:02pjpeOk3M58GN65dKLkyAxHKOf1l7rpZptu:02pjFN6mkyARKOf1l7rpU
TLSH
T18BC3453D6B5601BB7B48AEAF2903763D25A92283E1C417E57E64E804B0CB997105F1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0090e17db373c113856950c0202552505c4ef3f4785450b37a9dd924efcf308d
MD5 91da05d685551c6cc347eb374314f026
SHA1 3d46464247bce5cf55f3da24dc91df0e256dee9b
SHA512 a239112b09a5284a3902c115bc915960d4566200a86aca56b73736a6fc43cc3aecb30c3fecdf79c0a5e7cd013fdb62d87f5de230ddfdabc3995fde148c8fa791
SSDEEP 96:vFxlIMZMWc5LPP2/+9c1Y+zB4eSlxe3clv:vF/hMWS6/ouYYB4eqVlv
TLSH
T1A3C1CB3466A0D159DB8FD330BC958EF6A43319F9F40F1F2200985E342E66BD65B1D2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5bb441b1cdc891d46511544fb1e0f5e17630f04ec59cab9346941a50914df447
MD5 fe3f01817b2df84819a6e67a8ccfa595
SHA1 92f682ce16033d5073b6fbb9440b2dd7e579513a
SHA512 2c62d9bf87e289f0d1903bfd41a4b2ad41b64f95946c4dcdc8c44fb09289438d11b0741b05f77bb322bfd52a9df2629ef624c3b8775e6e14b31e7f75509a3a32
SSDEEP 192:sxZ2QUnWRscyM/jK1Ml8MEc/fGsxsE8bU1/iTdpmtHW6+WNBb5/ov7IIVWRIgyJ:sxZInW5cc/fGsxsYRmGHbX/omO
TLSH
T16A62F812AA34593BCCD7C229F9057B63D6F85863E5940E4896FC9A1C04F6AEE2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 33a752324258c478b29137cbfc975c817ee9a9fa415353c89a2d0e1bcf5751f6
MD5 10fa67d7f92098f12e6db4131e0d818f
SHA1 6c25f306447aca717a7b51bc66e6c052ac995321
SHA512 eba761e329264b986e68cc1aa4faaae9cd307121cf4b1c9c9e9f08882f710cd460f3eded6a31d7987cdf8fe01e49398424e6500d263e44c25ba2c782b5c5a640
SSDEEP 192:sxZ2QUnWRscyM/jK1Ml8M3c/fGsFSsE8bU1/i1dpmtHW6+WNBb5/ov7IIHKYRIgI:sxZInW5/c/fGsFSsYRuGHbX/o7I
TLSH
T14C62F812AA34993BCCE7C219F9467B63D6F84872E5940E4895FCDA1C04E6ADE2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 60d0c4987d162e3c205b6f3c01dbf07e24af1cac75ce9d4674e0425bab4efc89
MD5 58dbfdcdac6cf3f29381712d8aea7efe
SHA1 f356443871d5a9311a1197c1aed04a8ced32d2eb
SHA512 dbf2e4beef2cd4060782072c40e15b358fca97165a5c47361dc0214b4cbd471663468331a51d57d85e2e4360e86688b0c3b956ae0a353b8c90f2d8747de0998a
SSDEEP 768:hBsqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVg4Ll6AR9aro4AuG:hBsqxAlWvJD6Tu1ja/4LAs9R4AN
TLSH
T17EE20B3B694CC77E4F840E6DEC2A6FD76ED801CB56988D5447FA880C02CB2EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 3282cf0a9dd7febc7c24ed99217a5b58dfbd5c3988aa2697334e9f9a2e0c0216
MD5 9a808cdcf31b39afbc2f034eb1c274f0
SHA1 b607e569ac045cbfa200054f40c4774ce88893cb
SHA512 3a9d7f41d2e09179cf644bcaa131e27d0c4fe050030964b179b75c961af79d880c8549097ba8e1fe7b206892aade7d58cba5138c2475cf5220a7122dfe4446dc
TLSH
T193A0021422F44013C10652B235A731C12755D9601341532742A10344FE5074F5E8100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 ae4728457ba9ef88b82ac8218cc79d3e4e35fe4c998f275a56449456f257ee02
MD5 2a182ea53894945cee3fc8a7edfb21b3
SHA1 263cda74fa99c6a22e788ade287f16454ef279e7
SHA512 c2fffa8bacbea244adfa6c3a845003f960d4d93f9b39cdb24f00ebca84ed9b766e507847c1604d1e9eba4840916648389fa26e88677c4c8dc5118dd3f982b304
TLSH
T111A0026003998005D05211B2AED202953B41C9E56150130780990454DC905A05DC121E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 45764ec00dfba6fdd37323c7eb063e5e4c7cc6aaf103f67a606b5e0bfc782049
MD5 5de691bcaec006f7820ff5bf05aae734
SHA1 2a3fdccd94b745efd0cbd78ba91cbaf185b5b45e
SHA512 5325e76115416a7c700c51d0ea4388f4b537a33dc3215895ed10d7c3b609e860b458234c196c7efce704c93954bcffeda855fa6d4d9dff616206bb89e5989cb6
TLSH
T18C51A55E4D830B37FDAC567218B60885337865DC03586E27AAED9135E8D3358AC9CA58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 b007900823dd0ca32eb7cca80db2b39a3dba42a4da676191f02900ef9713e857
MD5 f275c050a6738596befc8a3c3a1510fe
SHA1 ffb14f152c82b28639b57dbf603474f4bbc8f796
SHA512 08129b244c30f6d7604d50a03072e1f6c73cd5a0120333615c5761025afbf73ab377fbe84510636e792b04196acd18b5e67ea5710a2d83781dd4198158d6e16d
TLSH
T1032121CD4E91554FE9A589B20036B0E03370D9CC6B15E7530C3C72772C223992A0B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe581b82.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe581b82.TMP
Size 1KB
SHA256 a67f33cf66e52b86dd391349d2bec4bccaa6b55a4c5605693375836a4a8effd2
MD5 ff7726add3f7c803b3780aedea66480d
SHA1 0c6f2b6ea9318ef432e13d56a955323d5a147864
SHA512 0db36b2b31ef58c016e19c23007cf96def35d223e4d75f72d8323691020f53ae66ec6422697fde3b9aed7d74caf7bb70a3bbd81739e87e2abec82e242598bc07
TLSH
T17B21408A46924A0FECD040B60143A4F43374C900A322B3C39939273E5C3479D5E4B1C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9f4fbc4abbd140363f8854d8fc7a441900ffbf28f5791852e872a3f2d762dbd1
MD5 efb4b28ae1a426aeaec091abd7b3b465
SHA1 a38a18cf865b7b63564dc907274e2ccb4826cf59
SHA512 bf02007b9374853c6fac10fbf4fb4356b4295e167fcd23b0a9dafd3e5fa64dfd674779a9a45d246a7e5bb97e0f49d2b6c1792df375e04cb645a2d5da2b17007b
TLSH
T106E06FBA2AE70C00A8EBD3EE087244A60401F828C891EC4F002A928310723A12826C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 90096155d97242ece8f24e3a903a3b3e4253b8712f13c3bb1dcf839979194327
MD5 a09226d477f82b28f51045676076d619
SHA1 e4bbf257fc39955c2178a2692dc412ed10a4659a
SHA512 ee6cf39c8a1ba62b8eaaa163d218a3cc176dc0c56474898601f885e0d691d7a41f4a107c0ed303b6fbe0d63b46d38ea2277787c2d921ad06c49fd33e25226a2b
TLSH
T176A002228D59A112D5C51BF43066918033904ABD0205168345ACD9E89F91B9493D1331
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5873c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5873c4.TMP
Size 48B
SHA256 adc16be5c9a0f3f59781661219516db29c4b7c20d91e342bf0199e398516206b
MD5 85f87f628d15c7a6a89ba50a05e83ce8
SHA1 f5783403f8de62fffb5b030e75641f9ad4cac3a8
SHA512 f521f5a5269be319b2004d0dc11a149c5b8eebfba0eaaf9bfd3cbb96ad646cb39e970e831b5369aa2d46882f2332aee45c7c9e6fd1e52161cb022606747b2b31
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 280420e2a34587bf0a9c09a7646394ea92e15c8cd1c01cae76bfa159f7d55c0b
MD5 8a794590a37d51ec397da64ee5c4d51a
SHA1 73474beaeeeadd3a003d5a66f13011ae8717b7d0
SHA512 0882bb7ad3c215be6665dc8d73f7066c8277df64aa0fcdda2be04c7dfe892091f6d558bade8176c2524216dfa8ed2072a7ed063b814d033b30e593c2c43869b4
SSDEEP 96:KYbaKYIKRktgESKK+Ea7lCk+KqLCe+mckDO0f6KQK/6u6ucKnqe:ExV9/7Pl
TLSH
T157C1131A31760A1339BD3988B6A6C6361F4136733118B46F7FB840614E6BE225DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ccc1803-48a1-4303-8743-f5e27bffe7b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1ccc1803-48a1-4303-8743-f5e27bffe7b7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9b2dce5e02f84d9cdf6e5e2328d3674e54f0b9cf165ca4e1ad70a082e09cf98f
MD5 31dd815261914357c0f56cf058b50de3
SHA1 9976940d22da07bf5439fd4c93b422c8ee0f2018
SHA512 81e2067f8ee1e655e65d0e4f857390f484a41b1adacb3741c01761b1869dd319ea0f83c162a8a94dbf549b6c5972ddae40a30292e9d6270b003c3c730fe74acc
SSDEEP 192:zmsNqtQeykRbAjHmiU1rQ2ZVRNW+Fd102o1U2tSJrirVRITqJJPCURX1+:zmsNqtD9bvyMVRN5dc5sJrIIkCgs
TLSH
T16A423935AC745C3B8EE7A546F84B31134FB8906BAA893F94D5ED6F0C01DB5AC031B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 da163c13e7c54040f62f32221fd900e23e3431992ec877b40dc90ecee0fe9673
MD5 f6be684eefecd712c977e23e956f9fe4
SHA1 ea47158efe5a99c9fca5cbd76b76383c2a4b0f47
SHA512 42012dce98b1f3b504edcb9830b3af7024060d7e53fe006cbebdceac6daf57f97828cd1be31b257877500cb3bc9669a0fe7ad428432576583d6b37b6e3b2970e
SSDEEP 384:nSiFPZcIqsNy8TUNTUlIlhD9bhiZZDfxZRN5dc5sJroeIkSQziQJe3:ZFHq7wgytZH5CmhoeIkg
TLSH
T151B22972DCA4DA6BADF75782FA0772479EE4816386CC69C4D9DD6E0C00C75EE030AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1de4278dbb028fa4babdc474ef76d50a2ae3a86fb031bee4b84dd8238d6469f5
MD5 119a97afc1ce908a68a2980499f5f2a1
SHA1 ac8850c8a7f854774686951fe84bd1a8aaf6a95f
SHA512 1492852ac208263733ee71266b4ba4c081244d3774791156649cfda08d9350e926c12d42e16acec8413267b0d740539cb25a4f097c982e6a60ba7e377723063d
SSDEEP 384:n1ZcI3sNqhD9bhiZVRN5dc5sJroeIkSQziQJe3:N3+/H5CmhoeIkg
TLSH
T1B4927D719C646C7B4AF7A506F84731179FB8C46766C82F80D1EDAF0D00DAAA9131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8cedbe95e908d1d5bcf468a43b949322b19ce1185326514ea7a77972711b4ce
MD5 52c712e14b62959cf7cb683f0804d749
SHA1 c69a40b211f42f8077e1e1e62e025258381a31cc
SHA512 c30c6c45a8ed73cb3ad2a090513648491a091efa9d81df7a0fac4a9bcb7d5d851e8c21dc11aec0d3f4de3c2c7dda0cf426dd1c3db151d69465d3eccada49277a
SSDEEP 192:tONnm6JkRtQmiUyPYW+RNW+Fd102owh3InRJ7U6:tONm6UrfW+RN5dcQIz7U6
TLSH
T1BC02C735AD386CBB8EF26D0AF48727175FA4217BB99A2B80D6E81F1C01D765C1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 98a42d8d51cf7f634988248fbdab6c9e272c30cf21d4f9ed995cb082e261d5ac
MD5 614d4126923ac961a66ddc624f4e23a8
SHA1 864d9bc61d571bcbc225228a80f873c7e63dbb5d
SHA512 6c554a1ad7e138a4e364e38eb485b31876793b6fd0699114b6b88c3748ff10ebdcc81fd5458494b04d939b3a7657ef7c6e84d1922961e2543c1d0e5caae8c7ee
SSDEEP 384:nWZcI3sNqyD9bhiZVRN5dc5sJrgIkSQziQJe3:E3l/H5CmhgIkg
TLSH
T1C6927D319C746C7B4EF7A506F84731179FB8C46766C82E84D1EDAF0D00DAAA9131AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3594b6c96d083a5a299b9f5958f26a6bbc3c621aee80009e491770a26b09b6c6
MD5 2126f7f2365ca45d2ac38fe068b408ac
SHA1 1a7fed588e5fbf4529b92c5222ae4f807cb0e2da
SHA512 c0d74103a025bbd0a7d13effc599cf894d3119a26cffe40bf738c592f8987315d51e4a6a7d841ce0f2bd3f0fc78f7e89ad066e0c01eac7c1f8267c99fa807b61
SSDEEP 192:aONb6JkRuQmiUycYb+RNW+Fd102o1U2tSJri9VcITqJJPU6:aONb6Uqub+RN5dc5sJrdIkU6
TLSH
T10A120B35AC345C7B5EE26446F48731175FA49167EE8A3F80E1ED6F0C01EBAAC131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3bcbdf7-3bbd-447f-af71-69240efdc3be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3bcbdf7-3bbd-447f-af71-69240efdc3be.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 478993270df046b3607223b600c6b96411aed66e8d1e3aedc6f51041826b705c
MD5 870fff2f8259edce457b90b8f0e44860
SHA1 1ce9029284746457df6d32cee9c7c83b3f8154d4
SHA512 3cbbb159edd4a5a0ab4dcf45dad868de307acc58ce36ddd66441ec15bd97484ffad0c6fb79b8e23dfa80969423c32503c7a00dd375dd0f453f308b7b4300d268
TLSH
T1CC412858BAEA1148B3B76E1A5BF6696D447A7D372F0AD49E10010E4F0A62B40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\EDGEMITMP_A69A6.tmp\setup.exe
Size 5.1MB
SHA256 ad093420d74775b92dd46648719a6431120633df39e59625232310c7864a04ce
MD5 51383590860a9644071556323f269dc4
SHA1 14f2e770c069ed7057ec6e8f6670b4e3866f7132
SHA512 6e09d2d30cc08dc684072b23fbff5305bdf7a3914a36876840be71edf3c7711839bec292d9404f641a4a7a31b186ccc9b6fc1fa646fe806a230ce56ecb861a34
SSDEEP 49152:4joKNjGYa4PZILcDYqM4eeqnoV8H9ZRidDSvEHLa0mRYcUxgRZe7xQwaL/gu2Ps8:fKe8SzeyaEIaSJL
TLSH
T1F5365C03F2EA41D8E0BAE6758BA55232E976BC454B34A2DF075136191E35FE09F3C722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e019a87b-f92f-4c13-9e66-cd0a7fe8ce52.tmp

Path C:\Users\Admin\AppData\Local\Temp\e019a87b-f92f-4c13-9e66-cd0a7fe8ce52.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f31cfe80-08c8-425b-8747-be9710352048.tmp

Path C:\Users\Admin\AppData\Local\Temp\f31cfe80-08c8-425b-8747-be9710352048.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

847f0d3a-76c6-414a-b2e3-b9ad6dfb055e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3492_141122234\847f0d3a-76c6-414a-b2e3-b9ad6dfb055e.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3492_81294562\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 fdb2ecb351fc9bfbb91b41e033117151068c1c9492f9b9ea7fff750dd8b2472e
MD5 40afafe35acc165df2d828c93eb15235
SHA1 81402adf2dd8aa506ec7eb4ae604a57fa72670cc
SHA512 f4c1cad7872ba950011007cd5e333d9f709eda791a1ee8163fb03f58b80ff208d5f12f589b253bd6b643e4fa53829483d2fc5c18c67a6699e7e5063fff2ce3c5
TLSH
T1BD41C2185FE6172AF3F6ED72A9B37621AA3BB819ED144B1E408143480C23A05C57DFA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3528-1-0x0000018441400000-0x0000018441401000-memory.dmp

Download

memory/3528-0-0x0000018441400000-0x0000018441401000-memory.dmp

Download