cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
Size 732KB
Sample260930-qb52caxt9p
SHA256 cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193
MD5 d898e19a1621885375a4d45b8be6c1c1
SHA1 6a543424f0922a620528f04c364c7716cd77670e
SHA512 403a93a84aa1604c7256659b5093620fdd1ef69c3a8a1eaf4b5f2f31352389414645f7021dd66704f4eaf2c18aa06598343897591570d4151ae677083d458d01
SSDEEP 12288:DcblQCktRABVJCgs32TrEStRHwa8NQtI1Q+T8zqDQc+dxA+Ps3Jvt2:DcxtkfkJCp32TZtRQRh+d2+PIt2
TLSH
T107F47D22B6E1C437D5732E749C1F82F99836BE106E28B8863BE52D0C6F3865179253D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_685178574\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_1128532567\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_74199567\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_74199567\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_1954009042\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_685178574\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_1128532567\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_74199567\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1696_74199567\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{79CCB7E3-DABA-4619-94B6-D0AEF3E43E34}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1696	4008	jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe	101
PID 1696 wrote to memory of 3676	1696	msedge.exe	102
PID 1696 wrote to memory of 1852	1696	msedge.exe	106
PID 1696 wrote to memory of 4220	1696	msedge.exe	107
PID 1696 wrote to memory of 5116	1696	msedge.exe	108
PID 1696 wrote to memory of 4220	1696	msedge.exe	107
PID 1696 wrote to memory of 4220	1696	msedge.exe	107
PID 1696 wrote to memory of 5116	1696	msedge.exe	108
PID 1696 wrote to memory of 752	1696	msedge.exe	109
PID 1696 wrote to memory of 1668	1696	msedge.exe	110
PID 1696 wrote to memory of 752	1696	msedge.exe	109
PID 1696 wrote to memory of 752	1696	msedge.exe	109
PID 1696 wrote to memory of 1668	1696	msedge.exe	110
PID 1696 wrote to memory of 1668	1696	msedge.exe	110
PID 1696 wrote to memory of 4464	1696	msedge.exe	111
PID 1696 wrote to memory of 2012	1696	msedge.exe	112
PID 1696 wrote to memory of 4464	1696	msedge.exe	111
PID 1696 wrote to memory of 4464	1696	msedge.exe	111
PID 1696 wrote to memory of 2012	1696	msedge.exe	112
PID 1696 wrote to memory of 2012	1696	msedge.exe	112
PID 1696 wrote to memory of 1896	1696	msedge.exe	115
PID 1696 wrote to memory of 1896	1696	msedge.exe	115
PID 1696 wrote to memory of 3244	1696	msedge.exe	116
PID 1696 wrote to memory of 3244	1696	msedge.exe	116
PID 1696 wrote to memory of 3244	1696	msedge.exe	116
PID 1696 wrote to memory of 4136	1696	msedge.exe	117
PID 1696 wrote to memory of 5020	1696	msedge.exe	118
PID 1696 wrote to memory of 4136	1696	msedge.exe	117
PID 1696 wrote to memory of 5020	1696	msedge.exe	118
PID 1696 wrote to memory of 760	1696	msedge.exe	120
PID 1696 wrote to memory of 3988	1696	msedge.exe	121
PID 1696 wrote to memory of 3988	1696	msedge.exe	121
PID 1696 wrote to memory of 3436	1696	msedge.exe	122
PID 1696 wrote to memory of 3436	1696	msedge.exe	122
PID 1696 wrote to memory of 3464	1696	msedge.exe	123
PID 1696 wrote to memory of 3464	1696	msedge.exe	123
PID 1696 wrote to memory of 1896	1696	msedge.exe	124
PID 1696 wrote to memory of 1896	1696	msedge.exe	124
PID 1696 wrote to memory of 1280	1696	msedge.exe	125
PID 1696 wrote to memory of 1280	1696	msedge.exe	125
PID 1696 wrote to memory of 3908	1696	msedge.exe	129
PID 1696 wrote to memory of 3836	1696	msedge.exe	130
PID 1696 wrote to memory of 4432	1696	msedge.exe	131
PID 1696 wrote to memory of 2292	1696	msedge.exe	132
PID 1696 wrote to memory of 2292	1696	msedge.exe	132
PID 1696 wrote to memory of 2664	1696	msedge.exe	136
PID 1696 wrote to memory of 2664	1696	msedge.exe	136
PID 1696 wrote to memory of 4376	1696	msedge.exe	137
PID 1696 wrote to memory of 4376	1696	msedge.exe	137
PID 1696 wrote to memory of 1572	1696	msedge.exe	139
PID 1696 wrote to memory of 1572	1696	msedge.exe	139
PID 1696 wrote to memory of 3756	1696	msedge.exe	140
PID 1696 wrote to memory of 4504	1696	msedge.exe	141
PID 1696 wrote to memory of 4504	1696	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cb440d0b845ef3955ecfab199ca6c5ba802827651b6e9b70c9ac6e2441644193.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://cs-wh.ru/downloads/100_wh_www.cs-wh.ru.rar
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffe2340c188,0x7ffe2340c194,0x7ffe2340c1a0
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,13598274083967740183,4317175431480184915,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13611869804456121539,12132723207777938952,262144 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,5418764517319948186,8593443454338468633,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,5368784745096596959,6147125158597501609,2097152 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,10778027979773148701,9495546284391129453,2097152 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,6782772850968780667,11480155658257706417,2097152 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7825027239594301759,1911010426472908712,2097152 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:2
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,1373696842155325168,5112056566095397866,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5272,i,4315486126401555091,6941374030490669319,2097152 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,15253491190163613995,16187881992985382508,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,1783556033266182927,14232319865267039010,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3930386037704444776,13907416057746469712,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3930386037704444776,13907416057746469712,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14075585018033385355,16168558433932678575,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,7223193072702858581,8210089692882025158,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,16125346853286699465,751327459702223950,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,7766150693889990917,2462205567611115351,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,1490847349163618462,170585799795604947,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,15118015878975837626,7246728964830911364,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,14563329628203723381,1337310261699441203,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,15365775321277736014,528792471428124719,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,7754342147592832733,1273728273882355546,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,4749449045130045201,3693243126438048188,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,3869414781021967790,12469513141974729156,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,2345730893699274879,15020262992022016249,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,8703399815024510815,9356386901474679643,262144 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13771139139669982933,347922957716329578,524288 --field-trial-handle=2888,i,2772860867755846702,14470185766913851206,262144 --variations-seed-version --mojo-platform-channel-handle=1148 /prefetch:8
    3⤵
    PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 85c98acc5854d3e969c5d7bdcf06b6c718ab6ed1136b29538b110aba6a5d3811
MD5 be64903a52d97e519facd13cde6f5894
SHA1 52ccf9b1ff4954e716d3d53e2ce4ef61bbcdd775
SHA512 bb25472e4dfa42898c49ac9f9559f2e84eec56b32a564d689c2cebce1ffc9e8f3be57a8928302521344eb71ee45bf07f1924d527c23b53349d1a192f58954e3a
TLSH
T1255172A5C64193DDFBE5137867C52F973638B494A5873E4200A7FDBB580A71CB143474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 829f913159ce070871d4ccb8d7b1744cb871547541d025bf666f175145d7b06d
MD5 26d650ab1b9cbcdff86f5cefd6d1bcab
SHA1 5c98c8d10394d47a5bf4dce0c0394be3552a7c2c
SHA512 a5c63f54cf993dfedee7d99dbb6e993acfa73883b1868ae557f2ead7f9f7689e8bef8bf841ef1c37dc7faf6257881e62e0714b46e5e6ea09eceaa276ed3bed1b
TLSH
T12F51BDF7C3E8C66DC90156F0AA18BE5BCE1E0A19831C3D5AC4D4EF5B93E2471E14155E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dceea02ea3389d3a5a8a24e94e3072547d4437a71e8691c0c0c9fedb66f78232
MD5 b9c8689e79716b4c707954d75e3287a8
SHA1 a2e2e317396e0320a07c2bceaacf7b4364d53671
SHA512 42078d11a2543d7ac2a34a6160963b941415937cc79e554ad09b2f044ae6c795044131e23bd5d91c8ff186520eff50b7a15b542e07e925526f2d2c2e29fccf96
SSDEEP 192:sxZoRRsa/fvsvk6NNPvIdpuGHW6+WN9Mi/Yrls4Ig4J:sxZoca/fvsvkE6dHb3/Mc
TLSH
T16922C8966E38A97B8CC7D209BB19BB13D6F5503295C11E48ABFDD61C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1fcabfad89c558c462cb32309e23eeaf7acee16f5643c1a16cdce4b727ea1b82
MD5 0301e8485bb3659f726df23e47cc1ec8
SHA1 4b89d3baa8cfef0b6c509df3c6876908337ba236
SHA512 5ebe98859f20beb85ec4b984b7f4a4bf212c8416c9f173209721e86e5f035fe43bf5f5f7e5ed14776030f9b72e273647fe78e594575e16b7980d453fe1f3dbcb
SSDEEP 192:sxZoRRsa/fvsGk6NNPvIdpuGHW6+WN9Mi/Yrls4Ig58J:sxZoca/fvsGkE6dHb3/M2
TLSH
T1C132D8966E38A97B8CC7D209BB19BB13D6F5503295C11E48ABFDD61C04E7ACD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d808bf0fdc019e93233692a18650821b1b6e0ed576604923a84b71b1cfc954d9
MD5 d060be9609e23dee16cf35a9d690472b
SHA1 f13bfe5c0b9f2a50f5b16e50bd42b12b03e9af8f
SHA512 08948b2a90d8b5f50ddb99fc03eddb5a76ba26070d4ecba19c3f87cbeffdd40d313da01f259160cc7c3df0951e0dfd1e5391c487ad8ccda3a061889647e8ebcd
SSDEEP 192:sxZoRRsa/fvsmk6NNPvIdpuGHW6+WN9Mi/Yras4Ig5SJ:sxZoca/fvsmkE6dHb3/9A
TLSH
T12A32D9966D38A97B8CC7D209BB15BF13E6F5503295C11E48ABFDC61C05E7ACD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72f1c4d6c4a50483a821ddfb5e84e6b7435d6816e5db3d11258d39144931c902
MD5 f235177953fd3ba039612e569b21b5db
SHA1 5a33f7e007036cbcda75f09f13e51538d8508fc3
SHA512 62325150e43269d3d5788e832f4f7ede775d65a450221f8cd817a6cb2b67752812a73a3502de31cf3ddc97cbd3be015d8253e03e1a997331283910d1b4d8bbce
SSDEEP 768:xCy4JZF7pLuLb/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVywjiLlc2Tb2roV:xCy4JZTEb/DWvbtBhu1jarwjiLm0bN0U
TLSH
T141E2FB7B780CCA7E4F800A9DED1E7F9F6EA8028B95D8C94047FA945C02D77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4848a0a0b0dc54c0f49c33e0885e6728f244677c6aea59277a7db2c79f1d8e1f
MD5 b8f05e3323cca1c8bd92163cf520dbb7
SHA1 11ac0343d519ddfb791745d508d9e5e1fe09cbc5
SHA512 5d61fb58f1967c823187b0f9fa941bb27d4b77cfed5011e84b853bd3e1e4d5c61d15b8389d7a35756cf64b955db0b0d4df9663f2157a3bad8a4de90a0c5e53ee
SSDEEP 48:KIDI1Ks04jyLbef70DCOcey7bCxKISm7K9C1Q8xhsYarhhyLEzy+suCLbyB6ISWF:KIDCKs0+r7GKIXq+T2Kg0o
TLSH
T16091344535BB065138BE258C82B5871FA28132737118EA2B7FBC50A69E6BE040DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ce74e6c-7914-4d3d-a773-df57900e8113.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ce74e6c-7914-4d3d-a773-df57900e8113.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b35884f872e4415f2f85b985412d000bb04d91a772cb1e138df1fe883e84d916
MD5 4c48b39c5a255a2222f3f1a08059f243
SHA1 e2314181cf6b0c9c5bedc559b501f8bc16b8f5b2
SHA512 e94f918079220f074721be28a908de655bb1a2bbd51c00d531d1af167a9a7640c2b7b12b4bbfcc18037f7726f33ce4407815c553848ffb58abcda44937a3a520
SSDEEP 384:niZcIhsNsX3BJZ5ddHX58EV8GAqXHJrNNtgOIwZOyGL9oa:QhXBJ1pa2HhNNXs1R9
TLSH
T1FB827C7199BCAC7B18FBA148F48A22039FB42077D6C69F84C5FD9B1D00966A9230BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bffac4c68e047e47eb3a80df8ea9f07acf56445ceb8d0ab864d7e3a80699957f
MD5 f7c0b46fb52673c880f156b4c2e42006
SHA1 f6b99723f8c295938e365ff3b1ed59af80f41431
SHA512 cb542fa9dfd9b7f783ad338033f7f36cfb6ee090d6f7e093332cd05471722f5425ef9c78d9963d0957d152259dd2095d74aba71790c036ba32dcd81afb24e831
SSDEEP 384:nKiFiZcILzsNk8TUNTUlIlm3BJZ5odXDfwVX58EV8GAqXHJrkNtgOIwZOyGL9oa:BFQfpwgABJw21a2HhkNXs1R9
TLSH
T189D2A4F194D79937D8AE5387A73E2D429EBCC063B5899984F7995D0CCC821BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 51de1a69dfb4b9694544199aee6834360598c9300cdb01c27f76875b7c6bc26a
MD5 2543b51254cf250873e51779274f9c90
SHA1 815b9764ecb8c7902b26272ec677026b39df3d4c
SHA512 9427a2e480ad48f5bb8b7c1226a2407351e334bc6c458f3d87540d963c7b2acc4fec37be20a2076a4bad9e5cba127520e59ac3dce79ce2e4359632b8dc5b8f7b
SSDEEP 384:n5ZcIhsNsm3BJZ5ddHX58EV8GAqXHJrNNtgOIwZOyGL9oa:RhaBJ1pa2HhNNXs1R9
TLSH
T13A827C7199BCAC7B18FBE148F58A22039FB42077D6C69F44C5FD9B1D0096699230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b501d54c5e49ae7540b323a7304e2e1f9bdbdb755c0c62eb5ce315e89c7d488c
MD5 b9d954d52bd325bc9e997f70c8e82f30
SHA1 4ed10d5a12786fa92e98854e2929932fbaa70b23
SHA512 482dfad423433b9043647341b2420f85d7d3dc90fb0689be6366e5e0864472059ea07417323b08a8e7bdc5ce01a9c881baec8bda995d48ca4d6616fa61bef0a0
SSDEEP 192:1ONCq6wlDgQmiUyZrW4X58gZ5jzorGArDll0U6:1ONp6kgiW4X58EV8GANmU6
TLSH
T16A02F935F9687C7B8EF3AE49B48B26139FE5112BE6952F40CAEC1A2C00D765C1347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e7559bb75196fe43dff262f0b7a42f2200feefdbaca9365ca0b56d4f6e03667
MD5 17c36e5d649f2e1393f1090ded9aecbe
SHA1 7ed044d5ce1d30acaac4246c98a6c3fd2057549f
SHA512 7f1fafee66698830377d75a2d8d60ef0a0a99a89ec9ccf6e22c31da0b343f2800fe9ed52bdb2fa09d73858ed498f60be1d7e7824b97a569de465c1819a5ca039
SSDEEP 192:1ON96wlDEQmiUy/r/4X58gZ5jzorGAqXgSJrUvelqWlU6:1ON96kUe/4X58EV8GAqXHJr/NU6
TLSH
T1C1120834A56CAC2B4DE3B049B48B22539FE42077E986AF80D6E81A2C00D775D274BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

79732bf2-191e-4232-9e53-b01af10a630b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79732bf2-191e-4232-9e53-b01af10a630b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1111835f6f2c9e5eccaf9a8d6190cb12a4908a6412f0855901dbb7ebe9085c94
MD5 6e7f61206d0460d2a2733ae785c49fd4
SHA1 78f172df92428fef1bc90d1f419804d015165e67
SHA512 66774e84dfc092ff54ea2c3528c508eca720fec8996b9f1d3a1ef8280300b5e275fa0b04565b6a8b8bf21d78a99ab9d667265a9b386cf5186a1245101735f32a
TLSH
T1B7411658B6EA1148B3B77E1AABF6686D857B7D772F06D5AD00110E4F0A72B00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

e02d07e0-9495-4bd7-9f7b-94302f02f8f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\e02d07e0-9495-4bd7-9f7b-94302f02f8f7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e47756e0-8f00-41e9-9c37-b46b6686d0c9.tmp

Path C:\Users\Admin\AppData\Local\Temp\e47756e0-8f00-41e9-9c37-b46b6686d0c9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_1446163051\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

527bb436-9276-42e7-9893-f1d39a0c66b1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_2140437784\527bb436-9276-42e7-9893-f1d39a0c66b1.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

100_wh_www.cs-wh.ru.rar

Path C:\Users\Admin\Desktop\100_wh_www.cs-wh.ru.rar
Size 4KB
SHA256 99dc3b0806e09666dc1a1fbcae493415b4f31eabf0a92118af0003a1937831e3
MD5 6d78920af26dbe6fee7ef3722f1cc89c
SHA1 5b77435cf2b0218621104912f9bbdd40a32e0a5d
SHA512 8c32221af622547ad2dfeeff6f13f10956dea5e142adf4ddc3a4ef6ecb31a5f141125007ebc2db65d9eea33d1031c287be73314c427c1eb99d4c28a7ccc17008
SSDEEP 96:1j9jwIjYj5jDK/D5DMFWC8NZqXKHvpIkdlp7RplvaQxvbK:1j9jhjYj9K/VoWneaHvFdlp7/lCejK
TLSH
T1BD917226BAFD217E10A381A266FC63487EA0C513D6A705A076ACC1391F9FF59FE171C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4008-4-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/4008-0-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/4008-1-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/4008-461-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4008-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Download