74704eab9241f57a02807da4b67ac9de49a806d2c968d30eeb32b488ea82df5a

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cx-programmer 9.1 free download full.exe
Size 877.7MB
Sample260919-s8fttssgla
SHA256 74704eab9241f57a02807da4b67ac9de49a806d2c968d30eeb32b488ea82df5a
MD5 a7d8414c99e0b68a074f0703230c39a6
SHA1 feae03f2438d5a5c9269689ca086e0597541b0c7
SHA512 902a372fdd9e3621eb15a136a79c5a2037930e7c32c51cd26624daf510f701c55dab9112505e828e215abd336c1a6170db117081360d0319845cf3d306640bec
SSDEEP 393216:ehHJs7LkBafQSn/9iwnT0Yb2/8zpdHir3kBZL1nLHUUGEeVV+IZzCi9:nLkBafQWtRu8f43kBO
TLSH
T15DA9CE02B7E80066F5FB563499B78A12EA36BD611B21C3DF1294A26D1E737C09F34727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3248 set thread context of 5924	3248	Explorer.EXE	86
PID 3248 set thread context of 5924	3248	Explorer.EXE	86

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\qiouwnety	cx-programmer 9.1 free download full.exe
File opened for modification	C:\Program Files\hygiene\draioziesly.pdf	Explorer.EXE
File opened for modification	C:\Program Files (x86)\shapeliest\cronsoctsarts.inf	Explorer.EXE
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1403460883\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1085014825\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1085014825\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1403460883\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5428	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343065476135403"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{80CDF86C-C654-4013-B98E-1541CD500ABA}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3248	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2224	cx-programmer 9.1 free download full.exe
3248	Explorer.EXE
5924	msedge.exe
3248	Explorer.EXE
3248	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3248	Explorer.EXE
3248	Explorer.EXE
3248	Explorer.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3248	2224	cx-programmer 9.1 free download full.exe	56
PID 5924 wrote to memory of 4224	5924	msedge.exe	87
PID 5924 wrote to memory of 5428	5924	msedge.exe	88
PID 5924 wrote to memory of 4892	5924	msedge.exe	89
PID 5924 wrote to memory of 2428	5924	msedge.exe	90
PID 5924 wrote to memory of 4892	5924	msedge.exe	89
PID 5924 wrote to memory of 4892	5924	msedge.exe	89
PID 5924 wrote to memory of 2428	5924	msedge.exe	90
PID 5924 wrote to memory of 5516	5924	msedge.exe	91
PID 5924 wrote to memory of 3176	5924	msedge.exe	92
PID 5924 wrote to memory of 5516	5924	msedge.exe	91
PID 5924 wrote to memory of 5516	5924	msedge.exe	91
PID 5924 wrote to memory of 3176	5924	msedge.exe	92
PID 5924 wrote to memory of 3176	5924	msedge.exe	92
PID 5924 wrote to memory of 540	5924	msedge.exe	97
PID 5924 wrote to memory of 4416	5924	msedge.exe	98
PID 5924 wrote to memory of 540	5924	msedge.exe	97
PID 5924 wrote to memory of 4416	5924	msedge.exe	98
PID 5924 wrote to memory of 648	5924	msedge.exe	101
PID 3248 wrote to memory of 2604	3248	Explorer.EXE
PID 5924 wrote to memory of 5232	5924	msedge.exe	118
PID 5924 wrote to memory of 4588	5924	msedge.exe	119
PID 5924 wrote to memory of 5396	5924	msedge.exe	120
PID 5924 wrote to memory of 5612	5924	msedge.exe	122
PID 5924 wrote to memory of 5612	5924	msedge.exe	122
PID 5924 wrote to memory of 4324	5924	msedge.exe	125
PID 5924 wrote to memory of 4324	5924	msedge.exe	125
PID 5924 wrote to memory of 2508	5924	msedge.exe	126
PID 5924 wrote to memory of 2508	5924	msedge.exe	126
PID 5924 wrote to memory of 2000	5924	msedge.exe	129
PID 5924 wrote to memory of 3780	5924	msedge.exe	130
PID 5924 wrote to memory of 3780	5924	msedge.exe	130

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\cx-programmer 9.1 free download full.exe
  "C:\Users\Admin\AppData\Local\Temp\cx-programmer 9.1 free download full.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffdb43dc188,0x7ffdb43dc194,0x7ffdb43dc1a0
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,5538235408818884706,5623487524817884709,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,12629724431384976540,12366502140422437513,262144 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:2
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,1405346523438798157,6991031001425163988,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:8
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14568605634394855722,16398041367641185839,2097152 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15602287779378918445,3988499545524408981,2097152 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7463596041520030476,6333418505574274271,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,17484445460048258198,18438472270164356142,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3983325433352986723,9978650996009072941,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,3983325433352986723,9978650996009072941,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,982433432197084507,3110053376266228509,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,6691324280666955669,1728658545626052359,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,2650207800774662788,2308434651397292227,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,2175211704209768375,10932535115143559595,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,16011438824879904819,393238975230804565,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,17504518674658525749,5872715450740668892,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5116,i,2677665909370725104,5269883133849179336,262144 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,5067345464834277066,9636159096458630421,524288 --field-trial-handle=2872,i,4469058719070811432,4255075625445200821,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1085014825\manifest.json
Size 118B
SHA256 a5e0ef69ef1cf1ca9e3b6d53a0caaf6a711b0e5b71c9199c220c5cf176cec760
MD5 e742e590b22754841dd779e3439c16c3
SHA1 ec775f58ce04e2a7693fc5c64c790fc237135bec
SHA512 3730a73c5a21bb5d4e035b2d17813b4968cbfbf068bdbd2e87a748694607b5140e5f029da990aefad5b9676e14961dc7ae892811a2d203a0a731442fd0ab02cf
TLSH
T18CB092B00C1AA03B22C09320ECA166C283F80229E8022B1A088036481F8817881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5924_1403460883\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5924_998890700\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

218c99f0-aa47-4141-8e56-147623352959.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\218c99f0-aa47-4141-8e56-147623352959.tmp
Size 13KB
SHA256 eb12774f1cc63cdab0f976eb408956c51980dba6e8087333bea3bddd5e02bad4
MD5 cc81315b33bdc7c20b6f9d91d1ec5b76
SHA1 94b93fb1de82a160d42244ac7fbf744eb0caa127
SHA512 66219547247ecf27ff695e1710bfe86e5dafdfb8d564b759990b6f0be8ada3c0cd65e63fe551f49a2c5362377226b9fc1b57fdfd61a61b69f68d539798639304
SSDEEP 192:sxZMRiEf/fMsKQZZNIN/m1pbDDodp42HW6+WNBL7/YbIjyFYD++Ig54SJ:sxZMhf/fMsKOZN0e8LHb9/F0YDRSu
TLSH
T177520915AD24693B9CC7D219FA15BF52E3F9243394C45E58A6FCCA2C18E7ACD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e994035113436e15680e4dd0281feb30744fa2f7e350099c9437010a9a3296a5
MD5 7128de324eccb6367efb2a244712db99
SHA1 5fe0086da5b87910e57c6a8c6fe7ea4bc2463390
SHA512 d43fe143bf2ff2eb05e620679b2a1e806decd0a7e70487dbbd4844e1b516371a4f20ece9ba0bc426bca91c781db0d0dda6bac52c78ec02848fc7ca0314d1a717
TLSH
T1A8F02DB5CC25FC3B08FD5B2910A50A46E75113572B80895B3B3D911D8FF163B8546C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b506d74bdf4cdacdb85ab03cfdee1514e6d1296db2c40488afc58258a62fdf38
MD5 f03a689811a2513a25f08909e055812f
SHA1 09f0edbf0652625defe7cd2e07b5205567389a81
SHA512 8fcfa932a59ef6316303866f68acf1c4bf1719c03f82c7ce9c8b0be5562c7ce4838e8e9e99deec810f8b79cfa204f2f1d7343fd703595a99fabe288b0fd24eca
SSDEEP 96:lq45282DNYOKj+RCORzmFhQcEAk3/O0LwoUOI:zINYDjKCWG0qOI
TLSH
T19281EBAC54EF3410EF6FFAB044F85D0DF87606FCA1A21783B2D6C4666717AB6429C044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595c10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595c10.TMP
Size 3KB
SHA256 3489583a1f1858ce43bb5f8ac8241fb06de92a3e62c4f572cd5d36797621c64c
MD5 84bc26e4b31b5d12b7a75263a253a3a2
SHA1 aa2c7b487765b2954ad1b4d1667f7a3f312535ab
SHA512 20ec52b7fffc2d8c204c7c12b07656db63388170cb93f55d54ed638cfe3b10694e0165543b55fdac4d92fadf040546a0536301f8f63993dddd59a89e8185a7f7
TLSH
T11D61A68D186FB094DBAFCE3086D9A99FFA780BF0A6835E63B3D6C4B8672B7145114054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 06e756f64895a189fbaf881fa2479d954493d98328ae577ef0bd9a9484feecb9
MD5 55b6b28585d45ca341157dcbf37aba7e
SHA1 47cca20fb5c16b3a64d678c4a4ff5a682269c3de
SHA512 a4c50b3ee4bb55a5c4231028f6145b204fffd342436ef16202d588556fce802d9a596cef6220f6d5fe8cd29c90a96242828c8b66a0ea1ee3f672c2e7066a4584
TLSH
T1B371CDF7C3E5822DCA0195F0AA14AF1BCF1D0552436C3D4A85E4AF5BA3F24B1E152B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 300a7143f3069d2a1e28ea2f11bd2bcb25dec700ab30801347206af777e23539
MD5 657123999e8091e9bd145cd2d7906c20
SHA1 72c21e4f65e45361229cb151b63a41345ac01c68
SHA512 c2562cf655be25897305c745c43dde8d36eb5cded90d45f8454b8e13f4f7779a7b8191f24bf8762e0983331a57323b7e2e643ef9113ec233ad85df5cae213260
SSDEEP 192:sxZMRiEf/fMsAQZZNIN/m1pbDDodp42HW6+WNBL7/YbIlFYD++Ig54JJ:sxZMhf/fMsAOZN0e8LHb9/FrYDRSz
TLSH
T182520915AD24693B9CC7D219FA15BF52E3F9243394845E58E6FCCA2C18E76CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ec2f3db4e0692feb585eae920f1bd8a64dbba8f8c33d0d12af4756e5ecffc27e
MD5 588f27145312915750f92f948bb2876e
SHA1 1f18872afadfa85019920def24ca5e7ce410c3ce
SHA512 0d9717d6b0c7749a572c00094185d9e795295f5c5796eb78949d6e1b8fc266ca53e00cbbc8299e2ce77e36231ba8e3372a2f01a13ba31d817fb6bde8cefbb2d2
SSDEEP 192:sxZMRiEf/fMsfQZZNIN/m1pbDDodp42HW6+WNBL7/YbIlFYD++IgjJJ:sxZMhf/fMsfOZN0e8LHb9/FrYDRjz
TLSH
T1D152F815AD24693B9CC7D219FA15BF52E3F9243394845E58A6FCCA2C18E7ACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 81a59063470f7a0973b343f14e682f3b3160306aacc684651d012de9049f33e7
MD5 f142770b1d67dd8cd1e76d5192dd995a
SHA1 f959a0f48f9e5455d08f34da6eb985bdf06d8c16
SHA512 cc0ba6c9c4fa0b596b2ecf7890685fe11533c238b2e6b764d31337673e7eb14b2f643cb17ea1212eecc402e1bd82db62a9ef24906fd916351c3d2d8a988ba8d4
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvwLWLlMC7fnro4:0RyktjYEbvnWvDBltu1jaywLWLywf0LE
TLSH
T11BE2EB3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\27fc7d84-4ad7-479e-9847-86d237b94c5d\index-dir\the-real-index
Size 1KB
SHA256 cb6316a7a8fcda2a012909bb90c19efb0189823a8de8b9265440990ddafb64c7
MD5 9296d681b2b6488c02d8bd004b027c5e
SHA1 8274bf2e43692081ec80af0a309e38be6c7f0afb
SHA512 4cb8fa9076ce62c5c3bc76d4b0c359139898096e61fdbb3faf10af0270c4115a3abf1a6633b2ac110a9e959fdbf0aaff0c0b7bb73a0904e2809850895d7aa108
TLSH
T18231A3868E439EEBEDA85274007C244A733486CC23947A1B42FDE12ABCA7744AD46858
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\27fc7d84-4ad7-479e-9847-86d237b94c5d\index-dir\the-real-index
Size 3KB
SHA256 547be59a2ecbd4ba8fd15caa152ce71985b31bc4c0255c44eea5d8e7fe98a7c8
MD5 492a55c730c57740cf30f8ba18a51279
SHA1 8c1c93842cdc3b61d51c657f08eb9d8b4f1d6995
SHA512 451d8078afbf2e4818d9e0068255cfaa531c91a28367cc550133a434841debe30e42f2fcdad48123c56560a07fa7f3226693ba71309b429aafdc11d0c35398de
TLSH
T11751C98E5D43ABAADDBC51B214B00441337416CC23A40E2B55FE4238F8C3E6D1D9DB69
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ec5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\27fc7d84-4ad7-479e-9847-86d237b94c5d\index-dir\the-real-index~RFe58ec5f.TMP
Size 1KB
SHA256 84af08af8ed22437c89a75506c84ed0bdfebe86e1b71f7d2ea9f78baa71ef1d2
MD5 39e4be026871e194b33a402aab768540
SHA1 b77613ff52d615c98da3b9a4e562f6e5fd0b59cb
SHA512 282202c11955853374e3e8a36b2b8476d48e97aa13218ab3355dce04a047b395275cc5b404c12bfe5626269891b720bb0a77b423a5863d445f6f6001c641d62e
TLSH
T16E31861744534B67E8841276096D68A73339D58803443B0F92EAE139EC91B44AD9ADE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3271ae9-2f52-4f27-8a1c-89f6b0735933\index-dir\the-real-index
Size 72B
SHA256 97e11bc55e9d9c5e73d8b7ec60ac41cf381e97b09cc3113a3c8545162f27fc81
MD5 ef2fdaae51c236595b8c51ca2613f247
SHA1 433b7b3b201a4aa6f97631dc4a69aae80d7f60b7
SHA512 7debaec84a960627ad523e3960753bda196cbcb7f564ec06b61e7c62af7d33ea04ebe1f47931217eb90704aa93eaf573f3ee74e2f8bf6766b61ae9da5abad6fc
TLSH
T160A0021C12CC7012C14236B166F615493320DA5842C5131BA19002D5EC50A478DC600F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3271ae9-2f52-4f27-8a1c-89f6b0735933\index-dir\the-real-index
Size 72B
SHA256 87b245b7799ed1bffb2f5ed6bff6b7351cd02aa9460fad8f20b9e3c516ad7bfd
MD5 3309f24cb2af0c78771e99142ff55da8
SHA1 e7f955240e4719560a87a80c5b1e0b3bd2e0d3c8
SHA512 57898373575960382fee30920597e477026a65a3cada11f0ee8faac85e022712ae119d24a527e42cb194d55bdab6af49aa4ce9f5f230d95b0ff6142c918fca69
TLSH
T15AA002181388700DC51659B1156222595340E8601111136B61A14348DE508474EC194E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 59ecf0e8151d37ab2ad4e8f093f6fe77827135f39a5eaf606e41d40b134775dc
MD5 a5968ac387898678561502faef04f62d
SHA1 89eebe53406005f7faf51dd82ae16dca60ad5872
SHA512 67f75abef1974c8ce567bf0a376d61bfd42e5ccbe34e40ebb17439046bccbef5203247fbef0da62e9f62e9f774fbe1c8cb399582c2da8950cfb7d9aaa2010618
TLSH
T182E0C0B72EE32850FD2FDBDD103100B0000AB954C451FCDF8056A2E35071311381AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e1cccf64c982854959c7673b85ae3b321dd77598dbcb03d3e41d6cc545ebbc1c
MD5 6f6ac7820bafcbc85ff8e7328db0c330
SHA1 029a02b56ab949f9f94fa16ce540289bbde521e0
SHA512 7c82972a38d736177e6c7e9c45d0500a2ce531b754fc8aa042a80b406a8f77a90f661f1cc57b46185d582a85c178911ddce5ef28ef67ed07e9281c518ca3ba13
TLSH
T1AEA00212CB9EA102D401167A52F55244B3A44C9D0A26131785D8F0D8DD91548F5C62C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594358.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594358.TMP
Size 48B
SHA256 00dca8bcfa67034b2492b7c6e119f259c731252ed9766e8b9676cc786c8ef6c6
MD5 13282de0854e1a31623c12cb27af8c3a
SHA1 edf3203d1b725bcf91af6e457d08375c6c3eb0b8
SHA512 de16447e5cdc15907fc2fa7a29bd320c41d97d191309e6fe1f55a7dce8c9ac775920f92972fa9fd9b83081681ce52beba5a0b657d355720f21d46626ae426116
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1bbd529b1aafc31b67b2a4d4dc160c06807259160fa250d3b62e92a9d2901bc1
MD5 e6529d748ca5a6a3547e3f4fd41b06a0
SHA1 86a44026bfad18638cf3b7d6e3cb114b5835d2bb
SHA512 1721517cc18b0465e60d5b7a2ab99f7cfadf77502d9cfd9ef340be1a1a566f0864d393dd0ac80445624f635a27b184f94e8d8d06e47e6bad8c67e661daac041b
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXwPjC:OtfFvpopPxrB4RhfwrC
TLSH
T1B1B2451471BA021138FE690C81B5972E464232B33259E72B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 aff1f2c20a5ec997e46ef31634c2dd08ffd9cc1cc710545527c63478d1a552ba
MD5 a327c7cbbf21349617e45852eb34c310
SHA1 014b691c7b49f4a5e37936c5a4c7bb5ed530b61c
SHA512 e2c15f885405500b12009d8cc082772d29c713bde7aa8c94aac038f072977a49faafbbda6cd82c398baf7c6d6676a723d6c6d0cb58ed165eacb91e18eb953f54
SSDEEP 384:nGiFiZcI63sNp8TUNTUlIm25mg5YnKzfMBaLXJm3w7O6R2FeoCrgL/7IzNo2:tFQ634wgSDvBEw3w7TRn5R
TLSH
T113C24B36EC94DABBECFB8F99A74A7A07DEE04163859C8AC0DAD85D1D008759D1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9a566b866a43163e270f7f1d24f90d6e91de5cb45a9d5de1fe31d629daa3d7b6
MD5 91dfcd3fdc56aa5df0d895ba13335473
SHA1 c01cc283b5c53fcbf349ac86ba7617dae37f85cd
SHA512 d2280fab822f02adac94169ff566fef735eea68081de6e7e18d1e2885cb34e9715cb246221bc192b5b84dd1a61cbd08e97960d326261dd49d01c1bfe88510e0d
SSDEEP 384:nXiFiZcI63sNh8TUNTUlI4EXTqmghOfhKzfMBaLXJIhi32sa+VYVd7UNgL/7Iza+:SFQ63YwgNR95BEf32hg4t+
TLSH
T171C23A35E894DEBBACEB4B95B74A7A43DEF0516389CC8AD4EAD84D1C008719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1af5e90df86f414da0b7f89bf4105f6884d8411111b3feb696821ffc1761b7eb
MD5 5c0a0e158f135d6f64994083f993a509
SHA1 c4235a6ec76a48d1bb356fd094db096bc83f9948
SHA512 1c1254389126d42c2c78110f563b0ec4267fa7b23519a0f5cc6b5cf4ab687133c8ae6f74b40d9dce2f4c9c5c9c226988bf9e8c08b9b786e239fc22cdf6d96260
SSDEEP 384:nYiFiZcI743sNh8TUNTUlI4EXTqmghOfhKzfMBaLXJIhY32sa+VYVd7UNgL/7Iz1:jFQU3YwgNR95BEf32hg4t+
TLSH
T191C23A35E894DEBBACEB4B95B74A7A43DEF0516389CC8AD4EAD84D1C008719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ed6335bfdf3bf8b5dd0534f7c6a83f673da6f9ba7207a8673f554adece96d978
MD5 3342fcb8ed65e9fbd9cf9f440488a46a
SHA1 c45febca235a9383a82a07be1f9cbcb82cd96196
SHA512 c08b2343e4d2f739b3dcd4eb32df025a8b80eef15e8150f575d84980d4672d60911147af3847adbe0ceba8e2ccab1ffbb8c353185a659bdb8a9409200bcca5a3
SSDEEP 384:ntiFiZcI63sNh8TUNTUlI4EXTqmghOfhKzfMBaLXJIhi32sa+VYVd7UNgL/7Iza+:kFQ63YwgNR95BEf32hg4t+
TLSH
T1D8C23A35E894DEBBACEB4B95B74A7A43DEF0516389CC8AD4EAD84D1C008719D170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.18.1\typosquatting_list.pb
Size 1.4MB
SHA256 f68ebf4f35df006cbd1c9074fec6a8fbc51a55eb056513705c9298eeb7a1ed2e
MD5 9c02e27f8bcff0a9a7d34d95f0db301e
SHA1 199a0696caa2a5399769ccce2d8855c86727f029
SHA512 39a238ac2d68857406d3fffe8d87162a109b5fb32aa010ca8dedf2ba58e9537e067ea4f16ffa225c1c85c8457cbfda2e2c3a774fdb76eefe35e03bc4094e3d09
SSDEEP 12288:8UIKHjzcldcJ9KDIyDSlypFtZPxzSsDDCVJNz:vUcJ9ODSlCFt3Sn
TLSH
T10C65B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 68ec4c492fa31dddd295ceceacb4cdfd946bef33c6f13bc80dae732a343de2a3
MD5 00abd3c1461471ae9bfca72c5357b9ec
SHA1 2cda401b67241c2f2f26c744e4b61b814a4f34c1
SHA512 a59dc03dcae95be7ba0e9ab30ea9d34288463820587b417c4941da30fa73fdebf8c8f7e7a1c95830bba1535fbf4ee5416423ebc00a86b337a7a5ea59605619ce
TLSH
T1844110E05C3D5ED1D4BD0E6EB49B35EC94E8D722F8A4347D2898E9988A7E61D344083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c1c6595db6d5420182552b71558330f3ce138fbb7d9dcc78dfae3de450da2342
MD5 c6ae84fe82c4279efef503fb89ef933f
SHA1 f4a26b575b7879655f2a7a9a57b47d1389cf7e1d
SHA512 3af2dee2a77ad99e167137b2c5fd0ca0ecdffd18bd9d365ba88c492a60e8721d28ba67cbaa0ddf60289d261f08edc04f195728d80e4c540e8dfce9d6fdac8894
TLSH
T1E14100E04C3D5AD1D4BD0E7EB49B25ED94ECD722B8A4347D2858E9988A7E51D244083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d877e0584d1fc9dbf825ea2796df60571c9505eae4b981310980927733ece8a0
MD5 78f37b8b6dfb362626e7d2731f4e495f
SHA1 1a19d9911a2270f56d422d4ed10219e73b8ea59c
SHA512 354d475b1a0d2f38705f5b6142bdd7600d7a7a35c369e26fa10e64ec03723d9013dbf66f04d11dbf422c79218715c15de457c31f9acb594c5598374f65feefe2
TLSH
T1CC4131E05C3D5ED1D0BD0E6EB49735FC94EC9722F8A4343D285CE9588A7A50E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 371cd4d9fc6190283a58f14a28d71d928b3b973b5751999608f140c740551cac
MD5 b17ca4ae9ed1e0326d88063bacf8267f
SHA1 00770104445140b52af1a1294bb95a570e75c368
SHA512 7221bbcf163de6ed9caf287be1bca2ece171249b42119ec052597260761b676dcbf161ce77d2e443f063ffd0f0760425a2974996df426926da6c59996834ceed
TLSH
T1EB41F758A6EA1148B3B76F5AABF6A86E487BB8371E0AD45E10110D4F0A67F40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3248-15-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-24-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-5-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-9-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-10-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-12-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-598-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-599-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-13-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-22-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-21-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-2-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-14-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-11-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-7-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-23-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-16-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-89-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-17-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-19-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-8-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-6-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-1-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-387-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/3248-3-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-26-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-25-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-4-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download

memory/3248-27-0x0000000008DE0000-0x0000000008E5F000-memory.dmp

Download