b76af94da133c9f5280dabd9866c438d2764e7ad28db052844ca77d83b1d5a40

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HackTool.Win32.Agent.afrq.exe
Size 76KB
Sample261011-1kldeahd89
SHA256 b76af94da133c9f5280dabd9866c438d2764e7ad28db052844ca77d83b1d5a40
MD5 80017ae6c03f3c1bdd796f02479b73e9
SHA1 9d1e27152e281d6e3029ff9ae2bde4fda10c5efb
SHA512 60959bfa320e37356b39dd4c7acabfd5baca023c41693046f549a444db05cced6d2432e0364c78575c2379a6d49fac98d2ac8950a9991c21f08af2fe9c3bc0d5
SSDEEP 1536:2UYbZYbfb+F+/BFNYnd0xwEAf6uxq9QCtmVd:FUm+ETNSpEALV
TLSH
T110736D2369A80A62EBD80AF10C35D7642A267C311911CD1F2205FEA87E75F63BDF9717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2732	msedge.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\P:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\B:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\E:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\G:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\H:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\I:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\L:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\S:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\N:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\Q:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\R:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\W:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\Y:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\Z:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\J:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\K:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\U:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\A:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\M:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\O:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\T:	jaffacakes118_HackTool.Win32.Agent.afrq.exe
File opened (read-only)	\??\V:	jaffacakes118_HackTool.Win32.Agent.afrq.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1941445348\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1941445348\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_652467836\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_620036738\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_620036738\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2732_652467836\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HackTool.Win32.Agent.afrq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{D0A6E0A4-12FD-4E01-ACC7-42B7246894AE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe
2732	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5092	jaffacakes118_HackTool.Win32.Agent.afrq.exe
Token: SeCreatePagefilePrivilege	5092	jaffacakes118_HackTool.Win32.Agent.afrq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	jaffacakes118_HackTool.Win32.Agent.afrq.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2732	5092	jaffacakes118_HackTool.Win32.Agent.afrq.exe	97
PID 2732 wrote to memory of 3676	2732	msedge.exe	98
PID 2732 wrote to memory of 5836	2732	msedge.exe	100
PID 2732 wrote to memory of 960	2732	msedge.exe	101
PID 2732 wrote to memory of 960	2732	msedge.exe	101
PID 2732 wrote to memory of 960	2732	msedge.exe	101
PID 2732 wrote to memory of 4628	2732	msedge.exe	102
PID 2732 wrote to memory of 4628	2732	msedge.exe	102
PID 2732 wrote to memory of 5876	2732	msedge.exe	103
PID 2732 wrote to memory of 3244	2732	msedge.exe	104
PID 2732 wrote to memory of 5876	2732	msedge.exe	103
PID 2732 wrote to memory of 5876	2732	msedge.exe	103
PID 2732 wrote to memory of 3244	2732	msedge.exe	104
PID 2732 wrote to memory of 3244	2732	msedge.exe	104
PID 2732 wrote to memory of 1032	2732	msedge.exe	110
PID 2732 wrote to memory of 1032	2732	msedge.exe	110
PID 2732 wrote to memory of 1032	2732	msedge.exe	110
PID 2732 wrote to memory of 4424	2732	msedge.exe	112
PID 2732 wrote to memory of 4424	2732	msedge.exe	112
PID 2732 wrote to memory of 3744	2732	msedge.exe	111
PID 2732 wrote to memory of 3744	2732	msedge.exe	111
PID 2732 wrote to memory of 4132	2732	msedge.exe	114
PID 2732 wrote to memory of 1960	2732	msedge.exe	121
PID 2732 wrote to memory of 5496	2732	msedge.exe	122
PID 2732 wrote to memory of 3280	2732	msedge.exe	123
PID 2732 wrote to memory of 4352	2732	msedge.exe	124
PID 2732 wrote to memory of 4352	2732	msedge.exe	124
PID 2732 wrote to memory of 736	2732	msedge.exe	126
PID 2732 wrote to memory of 736	2732	msedge.exe	126
PID 2732 wrote to memory of 5524	2732	msedge.exe	127
PID 2732 wrote to memory of 5524	2732	msedge.exe	127
PID 2732 wrote to memory of 2312	2732	msedge.exe	128
PID 2732 wrote to memory of 2312	2732	msedge.exe	128
PID 2732 wrote to memory of 1772	2732	msedge.exe	129
PID 2732 wrote to memory of 1772	2732	msedge.exe	129
PID 2732 wrote to memory of 2972	2732	msedge.exe	131
PID 2732 wrote to memory of 2972	2732	msedge.exe	131
PID 2732 wrote to memory of 5516	2732	msedge.exe	132
PID 2732 wrote to memory of 5516	2732	msedge.exe	132
PID 2732 wrote to memory of 3428	2732	msedge.exe	133
PID 2732 wrote to memory of 4660	2732	msedge.exe	134
PID 2732 wrote to memory of 4660	2732	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HackTool.Win32.Agent.afrq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HackTool.Win32.Agent.afrq.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bombcheater.blogspot.com/
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff955d1c188,0x7ff955d1c194,0x7ff955d1c1a0
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,17914424568867605147,11325517442740169725,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,14132000871225044532,11872811250024854733,262144 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:2
    3⤵
    PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,10365432862105351445,3060264446712264827,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12938085482651549611,5833277232386912399,2097152 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17034887205478878648,17414285997561025866,2097152 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,8008081181644884423,17344043993210730723,2097152 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,9108162569114662314,18190225412692574243,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,6109335870046460129,1425905235350616179,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9251732141929797163,15863691865902996944,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9251732141929797163,15863691865902996944,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9153727489483744487,15752088947995219685,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11745737674895176439,2928159410248791204,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,13299770462867745591,2501394938719552094,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,11122887806191713356,9615566605775976637,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,9366621339979391529,18338594181865668237,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15872722045288397345,3057307611777145464,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8094754545000877583,14850981710922814232,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16262439617372708934,16727272283494151067,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14841880872323117173,18089583222938513151,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,16387864290775026285,5951437042884850714,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5168,i,15507870162684745344,2439545064232777009,262144 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,14538558928947882788,12103500955090306002,524288 --field-trial-handle=2752,i,12924189749175027471,8282077593527171011,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\deny_etld1_domains.list
Size 6KB
SHA256 2a9b59ec22bbd49e4475d2d350d496023551953c8b5ebe97266aefe51a0c5c36
MD5 3ca9dab6be71da08f51aede14b0e900c
SHA1 2ca6be97955e3c31a0f3f3cef0182fca93db171e
SHA512 16c2e3694f48b8695eb725969d89669bbb1b7b01cf5fe1fa4e69aa919050ad6d60ce47e8fc18b030c94b15d171543420338700226dfd13bf226b74aa85de5539
SSDEEP 192:7y+Ncyo37Cu1+F8/fi3E6Cfr/z+lhLg3ZRfceMBjcvXmgqqE7:7Tc3bqUB/z+l1g3ZmeTfmf7
TLSH
T15FD19FE4B7F1C94D5DE027C9DE7E204B3B9286A7D228F86022319C27023F33C194A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\deny_full_domains.list
Size 12KB
SHA256 f154d0bc65cd130b16d1b6471df8ed2841b2f2f6d90e9912b73b37985062e623
MD5 d46f0f6333abf9bbb92ea260bd257b20
SHA1 5da02d8b3d87b5bb18b36f969efdbf8645e7977c
SHA512 9da29f3a8e7d2681666bdee5436e9a95b1c840d0d4906c85fd71725b041f5a1fb0ed30f6151a5737eb08ec42b8ee3e9ab2beced4c8b57785abfd55186bcf16ba
SSDEEP 192:xQDXUZT4QcnYNTprtSa625Tf7wykvSYJ5cGuVeeg4+YxujfKg6VFvfItXlS0GcZK:x604Qcncg25lkj5cvkY8jKLnvgtxLEV
TLSH
T1C642BF8CB2479A85C491BF97F1082614888DDF3BF95327942C693CEAC59F40F5197283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1618049251\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_metadata\verified_contents.json
Size 1KB
SHA256 afc120295fd54e5dbe43fb66c87f3239a03fed4b3653617039b79172862de61b
MD5 2176df460d874e462da56abd20c25c70
SHA1 a5f783e8a38579d484095fde897bc6479b45db7c
SHA512 f04994acbc1142d1ce06ebab3f90c1fcc3b1295409cc2b7d105f9c4e0a561a0a9010f38e01ae9af5768af4b5470996cc5b05f01a78c19624ba9b7d4f5854f2fc
TLSH
T18831DA92CC09B31D600D22345AEA6B928F5ED0919254465DF8C5A40CE0FD60BCFE7C8D
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_platform_specific\win_x64\widevinecdm.dll
Size 21.6MB
SHA256 fbb1e66a39c6f502a97a55188b25d3b102341ff6bc49c4c37ab6ef48305650ed
MD5 7e131636ead898275d2ac7841a3d94fd
SHA1 5fe13b2a84160094cfc2bbc56d8788c097bcd819
SHA512 6f00e7f8e07c9c78fefef7e31fb02b0c7da5cb7efde6d50da54ba26048a8dc7f6dbacff1d9a14a80ce8e6ed02005c5887d491a832c1e9618886949e920b38161
SSDEEP 393216:NYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoH4:EmghF5QDwWCm/2YU8Ivq9u5B
TLSH
T1F437F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_1998237943\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 c32e213f245cb61ce319f97713fe00cae2cd8376b223bff752335d14af27d226
MD5 fa2c3d66c781ef241b032d993b7032f1
SHA1 192098353f7b96db877ada61aa227867b62ccc59
SHA512 2a0e2386c2ed3aa2cfbe26e82687f9827159e8d4bf83aae39365a06080d5ede11359be328fd9a3696efa62a64bab3f57ae377f1686f5cec90811d7ef997e8c04
TLSH
T11021B3F0D022780A2B504081063EE91FEE3959D22D128DA6008FC1B69899BD20F8AA3C
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_620036738\data.txt
Size 152KB
SHA256 bf2c0a94df6f6a32ea1072e61ed3767c23fb8b3e864b0f6144f65c4b8e477338
MD5 6dd40551f20e2c6ad5dc991e60a7d4cb
SHA1 1147d32c228d4def80fb6415d1f58c1edad29055
SHA512 0d654ba49f9c53349b90cd2ce15424477b9c06ae3ae7bcfa09f61e12607f94750cc065d85458e985632f7c316e79d3b9ff279248fa1e6e4181f16e37ab31023c
SSDEEP 3072:GPAgDcCHaLHl65aynyosxb3+BLvf5yTewIjNq/eq:6X1aI5aZoKzMD4Ajy
TLSH
T19FE3F2608EC45F99CFE4292C90BF1F1A63E18BCD811A698EDB63FD066FA7A0415271D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2732_652467836\typosquatting_list.pb
Size 1.3MB
SHA256 04672ded43f6bdec8e338f29007b2ae3781810e0cc5316b1e9f95d282e520644
MD5 5eec5d09d648a9e89b7c2dd0c5ca6390
SHA1 e4983ad7e593c178ead8db893659b2a8df0265b1
SHA512 3b3ff57777ab1dad1ae13c6079d92f05ef6845aeea80105a60be437a97f4739776babe34a5aa73e22dff6b8a6fadeef17e01e936b744c4b54eb2796e89a4f839
SSDEEP 6144:8jDtBXxsq8gmjr2+8KjXOkujb+XYIshDdI0+6xsB5CL/LsBjeLXgJG1NpTrNVgeF:2t9xsUGe/DIsxTEdt0MdgNtbW8N1Q+
TLSH
T1A255B5B9DFC00154DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1235d768-bcd9-4329-8125-0cf1ba89c646.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1235d768-bcd9-4329-8125-0cf1ba89c646.tmp
Size 26KB
SHA256 b1fac594e4a614810d303083795dcb94c6cf407ed3df48a984cae374d5f379b3
MD5 9e4197446fce8e4da4259d75cab44c13
SHA1 b4b1dc2e6a5dea79c8f98afe06bfa6528501d1c8
SHA512 cc59cc484d3572823ae2333d7bc512289727cdc018d4394da2a9575a076dde640be75f2984f7e8e8f0e0b7ca6cdcc23194f1da7102836818731ea813936c1573
SSDEEP 384:n6iFiZcI63sNw8TUNTUlIm2aKMcG8/wzWfLBCUz5o+RYoFuHicsa+VY68gL/7IzR:xFQ63twgcyKEBCUy+RYoFuichgGP
TLSH
T1C3C24A36EC98DAABECFA4FD5AB4A7603DEF41163959C9AC4CAD85D0C00875DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

04060d70-379c-475d-8c52-54e438d82bc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04060d70-379c-475d-8c52-54e438d82bc9.tmp
Size 13KB
SHA256 84e36253db1069aef21ec8936cecc84ff31d6b076c6a3dc17c7ec0d78207cf53
MD5 1ab8f996277fe402b176280b9d7b4a81
SHA1 2c34442e53eaf14d4e580d45df88a3b42edef0cb
SHA512 ab425cbb27422065de7a3b769279d01aab2a389bf2fa0cdb332544c9f35e175df223cd4d3cff2fc87bd6eb9d74bac606d2568676b13583d8e6e13f29a08291fc
SSDEEP 192:sxZLRzjt/fPsWQZLjd8vzodpsCHW6+WNh/4/XysoskgSAmIg5KXtGJ:sxZLpt/fPsWOPCkTHbW/rSDgtS
TLSH
T11352E915AE24AA7B4CCBE219FB95BF53D3F9103291941E84AAFC8A1C14E76DD230341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05edc0f0-6036-4402-bc06-207d0ae8ac2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05edc0f0-6036-4402-bc06-207d0ae8ac2c.tmp
Size 12KB
SHA256 86715dc0e82c035f70e13ba11e9e2c8c5cd0792cb41d90779b8fe63a20321b9c
MD5 9f8cdd1b038d9a257d1068c7eb29a3a1
SHA1 eac84179d3d25818caaf86d9f25f7832957c14c3
SHA512 5c64ee570dfe19ba10fe38b5586e0819fb29cdf527ec844d7a0b891296fb96fc0471487625d5c3d14ccbd0183a31a74482292fc5cb717a115e5ab397d3020b4d
SSDEEP 192:sxZLRzjt/fPs2aQZLjd8vzodpsCHW6+WNh/4/XysoekgSAmIgjteJ:sxZLpt/fPsPOPCkTHbW/NSDjtq
TLSH
T1F352D815AD28AA3B4CCBE219FB557F53D3F9103391941E84AAFC8A2C14E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df3f2a2-241f-427d-821f-fa483306a2cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5df3f2a2-241f-427d-821f-fa483306a2cc.tmp
Size 32KB
SHA256 c692ccbf58b41a51a1ba014ffd681e7ac21855b0c33588cad6a7360aa4b63b75
MD5 690511d6f49df2a3f08440ae0a2ef580
SHA1 eb58a29b190cb55fd5675bdab82c3c0ae135a30b
SHA512 09e4830903370823be070f2eabf77959ba2ad091e217d74920cf89e6cadd91c809c5f42b18de83194fc3d7a979314f37e809a4ec50a3006b573cd501fbb602c4
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/1qpLlvVajYrop:Px6r8s2EbG+WviyUKu1jai1qpLd4jjog
TLSH
T121E2E97B780CCF7E4FC04A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 475643baec5763f6c24b691bf91104c040df6f25adc22ace1a7ff7605f2e106a
MD5 af775b482cc578a5ea537fa38639ffe8
SHA1 f9291843ed3fdb1c892b6236ca3dec0cd6d56128
SHA512 8d41b6f604e7f35f40286d1b653a44d3fa453e7390c600e4771adfdeab431c56775906995fb79f9a98c235a713486d851af487823253a580cba4b449c1dbf796
TLSH
T199E0268504C8C72EA30868CB12F8534CCB843A1A92C269DE1B40C9C5B006A48B68F7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cd6bae7355d7ab39cb3439eed0da0a18dbabe991d4eb65e71c8ff3d63ee1aa4f
MD5 e50113bb86ce6006cea2fa8e6dea30e9
SHA1 a6faf3f3dcb897d80b65d55f4c0b71c90611b0a7
SHA512 5532c9f40d1465fcd628fccb09bf36e8fe149a33990e5930f585cd8fae8e372f397916256e6fce5f569cdfc52f32392d2997130e4b15182bc55cc6cb807c3b7f
TLSH
T1DAE026F414CCC32EAB5C688B51B8570CDBC8262A9BC279CE1701C9C97005A88A2AF7E0
MD5 SHA1 SHA512 TLSH

Submit Download

1d26adb6-fccc-40e3-82f5-7ec5b45b9a40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1d26adb6-fccc-40e3-82f5-7ec5b45b9a40.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2ba5f620-6c95-4654-9b5e-0512e7ca3f60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ba5f620-6c95-4654-9b5e-0512e7ca3f60.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

368f5df5-7b09-4d28-b142-1528f4d15d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\368f5df5-7b09-4d28-b142-1528f4d15d13.tmp
Size 4KB
SHA256 0848eac2b40bd82e55772edf43e255ece0ac214ad05cb227fba69f599fd67122
MD5 6950f3eb9ea3f23314af3e165dbe34c5
SHA1 d189eea4643bd1537a068c55d5b141188d135271
SHA512 dae077e3046540d528271f74319e07b1f8202c3fdb922c9c91e2535e0ba4c90b54788a087ace68a1c6353048758eb3c43ee0e21acff1bf3b0d27c27dd3a57271
SSDEEP 48:YALlgyDPNrhOtVZtVQtVEafo7gmzsZzEskt5sAtJshtMspYftwzswtpsPtn23Ksd:D1BhOtcYaaSzQlY0fgqsJm4TwQ
TLSH
T17B918EF3C6E4862DD9115AF4EB657E1BCE2D0525933C3C4AC8E49F1B93E2571E140A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd116efb-c032-4435-817e-73d11f936a5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd116efb-c032-4435-817e-73d11f936a5b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2a9f71dc1a3953510e68aeff701daec17cbb4094531d31b248ac4a09d9c210ce
MD5 b9ad6e6806c4db3a486c1f9c6d8593c1
SHA1 a3c8a143a16c5c71965bf126b611f6e1380720b0
SHA512 5414435813864f422aaa3f7c8c7cb3d954d5c96178ac14904a33095a0d09fac74063bec419c601bf73f18640564769cd218c1e5198dc1d19755c2b38510050de
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgg:ST/2dXOJhJlpfnpp3tNXVrN3mFDh
TLSH
T18FB2305571BB421039FE291892B5872E028231B33159E66F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef8e9455-58e4-4db1-b522-174a3c183806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef8e9455-58e4-4db1-b522-174a3c183806.tmp
Size 414B
SHA256 a9b87bd8c282ade43b2f1fe68c5a7efcbbb4671dcd0ad6a0679a2a446588e799
MD5 4404150e62d666b0096b735424342c50
SHA1 aeb62832df58dd1b560eefe7beefb86f8aebf4b0
SHA512 2b24943cff0017b870d279f492c074e6e9cd8ba3f35bb4b5abc513b64920be0d2387f4ea7419cbc93e0cf9a0f124bf2285f2bb6b5896c64d6b6b03c78bde19f1
TLSH
T19AE02B6AC821ED3B08FD1B7D6094034AE70013672A51995B3B3D80088FB057B418586C
MD5 SHA1 SHA512 TLSH

Submit Download

f8d29414-f5e6-453b-8bbe-b4b6f6adc3fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d29414-f5e6-453b-8bbe-b4b6f6adc3fd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fe999967-a868-493d-82db-21c34fc93c95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe999967-a868-493d-82db-21c34fc93c95.tmp
Size 13KB
SHA256 ae774438745374d85fdba47de74f87323ed4fd22b0c304999885ef4d49eec9b4
MD5 def63e0b6b212028dac678746a24b64f
SHA1 79e1bd7c577a00545009b70d923b364003a5b07d
SHA512 c8ef7c4d9aea757d90f044804a8e64c03cb6b5ba1093cb9b6e02a33fdcfe9280906cd84f5e82f80ddc020f799708f4537b54e8722db9098fdfa7f7313a68fd0a
SSDEEP 192:sxZLRzjt/fPssaQZLjd8vzodpsCHW6+WNh/4/XysoekgSAmIg5OteJ:sxZLpt/fPslOPCkTHbW/NSD4tq
TLSH
T1C552D815AD246A7B4CCBE219FB557F53D3F9103391941E84AAFC8A2C14E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.26\manifest.json
Size 53B
SHA256 e1cd8395b2a987ed86c356bfae0952ae09f0cb012030690d6e23615698478f77
MD5 231f4c6814bd04e1dff159c333e99a8f
SHA1 e7a5e431643eb7e17b88cd2bc6d76be5be95edf2
SHA512 10edf632be82534001690da65ece25b5c0882a44afd68b54ba078676f06cc19183c50e64b771f36b1d5a52ce2e885dc34ca4f4c049eb517770ee33c03ae06d21
TLSH
T1A29002600814921716C14E506570B882A391661955950D1D04455558029586CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.10.11.1\manifest.json
Size 119B
SHA256 602c605420f4e5da16eb2471e65d37cc36fefc4ada2f2b4e150dfa391911d3db
MD5 bca97f2ac53f73ce2e92d674af736b0d
SHA1 c4ef64aa3397b2887458acffbc895b28f09fce3d
SHA512 610be8574d2328f25ef5f62f824b3429d53a9d14ed718f5754597e95f761657865d5f2056be3f1f7d9574970b324cae9f2229fefed577b800bd1213cd59d4b0d
TLSH
T1D2B092B00C1AA03B22C09320EDA1668283F80228E8021B1E18C076881F8827980362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.153\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm\4.10.3050.1\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

a1592b06-9433-4a51-92e3-01e20fbeaa8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1592b06-9433-4a51-92e3-01e20fbeaa8b.tmp
Size 25KB
SHA256 dc2aabcd9667f11e0938eda707ee30c575bcc3426db337a6ceeff037da65559c
MD5 be8272248d5f30ae9e658f376fba7711
SHA1 cced4b8ec79fddf8d6721d24ec1d4aed11f637e4
SHA512 52d5276c578523d6dae8d3414511abe982d920b4742de86994fda92d371ee41efec20000af9bdec873689071d77c6e26c1d76d8a7043da61b9c6986f978ce7a6
SSDEEP 384:nJiFiZcI93sN08TUNTUlI4AaKMYV7tOwzWfLBCUz5o+RYoFupicXegL/7Izyoq:gFQ93dwgGY1EBCUy+RYoFuicX59
TLSH
T160C24A36ECA8DAB7ECFA4F95A74A3A03DEE41163D59C9AC4D9D85D1C00835ED1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b708912e-d885-4522-8be1-282fe3a3f173.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b708912e-d885-4522-8be1-282fe3a3f173.tmp
Size 27KB
SHA256 87f8dca51889ba25bde045207d17e3bac5508cd56a4fc0b49de0ff1057ce5d6a
MD5 ea66226c1fc2c6d11ff5b6ff12221bc6
SHA1 bba6f672eead85a7d6b7f35f53e89cb26735136e
SHA512 2d9bec85ff482d08abb25634acfed334d2eb6334e9b7d6c77468d505673b4d12342299dbefe98f68e78634aba66b94eb74886c3c9ac11301c555fb0b31dd2a3d
SSDEEP 384:nDiFiZcIGL3sN08TUNTUlI4AaKMYY7tOwzWfcBCUz5o+RYoFu5mcMTUgL/7Iz4:uFQg3dwgGV1jBCUy+RYoFkmcMTX
TLSH
T1BFC25B36ECA4DAB7EDEB5E99B74A3603DEE45123999C9AC8D9D85D0C00831DD1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0a6422b-698c-4549-bd64-0552bdd07cc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c0a6422b-698c-4549-bd64-0552bdd07cc8.tmp
Size 25KB
SHA256 49fa32b602a6bdbcc74df1be4e9dcc3a6e6d739cf4b4ecc31617e1d67a0e6bd7
MD5 431482b20613e48e8f5b4f6e237478f9
SHA1 ebef75ca00e566a1d9246c71c0b03762903aa0f7
SHA512 ebca467e3f87e8ace773872002c76185a009889e4dbe5e798c69f4fd1f60e5b9f40da0715a45eafd9ab33d8cfc1849f80f5b4a47bf1f417988b36511fb3e08a3
SSDEEP 384:nWiFiZcI63sNB8TUNTUlIm2aKMiJ4wzWfLBCUz5o+RY9F2sa+VY68gL/7IzVoA:9FQ63AwgcMHEBCUy+RY9F2hgGP
TLSH
T1D4C24936EC98DAABECFA4FD5AB4A7603DEF40163959C9AC4DAD85D1C008359D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0756fa73-8a2a-4811-8e21-569719b9a153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0756fa73-8a2a-4811-8e21-569719b9a153.tmp
Size 2KB
SHA256 532d0f0478e494585b2c1fd2f4a5871db515be75795abd3585659c5694f55cd1
MD5 f4a12c2a63dae855ef940a4441c98a69
SHA1 982a567be5b349aedd21c7813e95f9c5be2cae81
SHA512 482734f9d536322352dde1db072d644470ee8798131fc1c688f22c31a9de8e625e7d1fef831f12818a9c5f6e2ea7ebe1e6faa2962545c705509c147b86b23632
TLSH
T1A15140D08C385AD1D0FD0E7EB09735FC85ECD611B8A434792868E9984A7AA2C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

a7f374f2-6ef6-43f7-a66d-3e1120cdcab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a7f374f2-6ef6-43f7-a66d-3e1120cdcab7.tmp
Size 2KB
SHA256 deb5b099969f1c9228a8186afa475582b592002ceb50010b75dfd6d7f14f5c70
MD5 e6a145e377a08a5d5875f417f0ff7cbf
SHA1 171330c3082bf209563a5801779b1085ce4c3f20
SHA512 9cf9f9d43cb0d1acaad72b2f54d1e3fcad682381a5d99920d10a94f2a061966d214afe6d4fed1f4174d54532c80fb246667e23333129a7f42c488fd356091613
TLSH
T1A0513FE08C3C5AD1D1FD0E7EA49735FC95E89611B8A4347D2818E958897AA1D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

b4c7b0f1-58da-4d41-8ff6-3c8dd8e36e38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b4c7b0f1-58da-4d41-8ff6-3c8dd8e36e38.tmp
Size 2KB
SHA256 a2d390d12a967106b011281c622b49c280d7e92470079c8144c2efdfdcfc4462
MD5 5e52b46c95ac77a44474ddd5ac7e8136
SHA1 fc4bdd97ed850ea79609d78a98236f9ccd6b4c90
SHA512 70f80fe2249c329685092f88490d8f02c14b9bba6d1e5fcfe37048a9c2e5c7bc9972514c13ce7dd5dface3f696fbf5faf3e2e9a4156cb3d94c9c3ffe62e4f063
TLSH
T19C5130E19C3C5AD1D0FD0E7EB49735FC85EC9611B8A4347D2818E959897AA1D3484C3F
MD5 SHA1 SHA512 TLSH

Submit Download

e707cfbe-d724-42ee-8031-d86497adfbe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e707cfbe-d724-42ee-8031-d86497adfbe2.tmp
Size 2KB
SHA256 60ceb52e738ab27cae7e5ccea8345ef235469ca93da8ba5eafbf157466b10148
MD5 b00e7d2c2e3e23aedbd5a1d0860688b4
SHA1 28658bb0ac53601bf61971b26ec4b42a0a390cb3
SHA512 341f2db01ac7460d97c71eb0326b90e54a511d59490d1f7796699118b6a0ec72e7cb507cf2fb1fdb785497d7be0ab0b14e0327b4cfcf3480d134af5f10bd600c
TLSH
T11E5141E04C785AD1D0FD0E7EB09739FC84EDD211F9A4347D2868E9584A7AA2D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

d498b294-64da-4f65-ac2d-4bd54df0729e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d498b294-64da-4f65-ac2d-4bd54df0729e.tmp
Size 26KB
SHA256 46612ac45c3b005cfc1f688cd0726cc604e7656e1f32c8563c477afcd1eef140
MD5 d6cdc6c4ee9799cd45ea3ea678b6895d
SHA1 3cefcd329b5a33c2e5618130ed57ed6dd239ff39
SHA512 61a7b2c5e144681bffbd5205ba2ef13345869ab6109129df44553a16c183db44e4525590c5dcece274b4b537f6f981817199ad117c1807586c14dc33fcef15c6
SSDEEP 384:nSiFiZcI93sN08TUNTUlI4AaKMYY7tOwzWfLBCUz5o+RYoFu8icMTUgL/7Iz4:ZFQ93dwgGV1EBCUy+RYoFVicMTX
TLSH
T1FAC25A36ECA4DAB7EDEB5F99A74A3603DEE44123999C9AC8D9D85D0C00835DD1307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 64KB
SHA256 de2c3637a82558effcf23eaacf63bd6b5589f7a3358f245b508fe45847406ceb
MD5 a45bab8d756a82719968b8f16249dea3
SHA1 4e33d816caec1b2b4b162a3c9fdadf55e3ba0b81
SHA512 bf4156be7772922a7add70832c2de478ccb8c55f92e2a04180ccdf6b65ecf2b2731c614f5027771bea9688bc42ee7b3ede3f5c2c227cf9b4ea69599d3f1d5f0a
SSDEEP 6:7+1E3+ejXplskkouJM3TS+IlzcYR9LolPwY8+I10cAe:y1E3+ejXwkkQ1YwEh44Y8H0
TLSH
T13B53A918DA50A033C664C27BE8E21703F360A8100A10EF1A0013A33A0C622B26CA4CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db8504f702af400e6c2335c70ec6434eb5cb46defabf6a2ae76b1add19706a9b
MD5 82120a9b39c623284cff06e7d2cda91c
SHA1 7a112595387580f6977ef8a99fe3e56441afcac0
SHA512 6a45735b70cf2f3aac704af90b01a0981c8134cd8cf651bd366bf669a6d026e3473ebb09451c6af1524bd27519bda3fe815c7f97ff73d5b220baf0c5bf0468ef
TLSH
T1B1410458A6F91148B3B77F5AAFF6A86D487BBC372F4AD05E10110D4E0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4132-169-0x00000179ABEE0000-0x00000179ACEE0000-memory.dmp

Download