hxxps://github[.]com/ask3lad/wt-testdrive3/releases/download/v3[.]0[.]0-alpha[.]21[.]1/TestDrive3-Setup-3[.]0[.]0-alpha[.]21[.]1[.]exe

Analysis

user interaction
yes
max time kernel
116s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/10/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ask3lad/wt-testdrive3/releases/download/v3.0.0-alpha.21.1/TestDrive3-Setup-3.0.0-alpha.21.1.exe
Sample261012-v8eb4sec88

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	2360	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
4604	ask3lad-testdrive3.exe

Loads dropped DLL 6 IoCs

pid	Process
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
4604	ask3lad-testdrive3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ask3lad-testdrive3.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\manifest.json	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ask3lad-testdrive3.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ask3lad-testdrive3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ask3lad-testdrive3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TestDrive3-Setup-3.0.0-alpha.21.1.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2360	msedge.exe
2080	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ask3lad-testdrive3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ask3lad-testdrive3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ask3lad-testdrive3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ask3lad-testdrive3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{ED014CD9-D219-4E34-B9F5-D4856A81A0C6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1570888168-524493533-3242721904-1000\{AAF73762-B9F3-4174-8CC6-2435029122C0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ask3lad-testdrive3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ask3lad-testdrive3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	ask3lad-testdrive3.exe
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ask3lad-testdrive3.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ask3lad-testdrive3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ask3lad-testdrive3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	ask3lad-testdrive3.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
1940	TestDrive3-Setup-3.0.0-alpha.21.1.exe
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4604	ask3lad-testdrive3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
5252	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4604	ask3lad-testdrive3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5016	4440	msedge.exe	82
PID 4440 wrote to memory of 2360	4440	msedge.exe	83
PID 4440 wrote to memory of 5540	4440	msedge.exe	84
PID 4440 wrote to memory of 5540	4440	msedge.exe	84
PID 4440 wrote to memory of 5540	4440	msedge.exe	84
PID 4440 wrote to memory of 5436	4440	msedge.exe	85
PID 4440 wrote to memory of 5436	4440	msedge.exe	85
PID 4440 wrote to memory of 4816	4440	msedge.exe	86
PID 4440 wrote to memory of 4816	4440	msedge.exe	86
PID 4440 wrote to memory of 4816	4440	msedge.exe	86
PID 4440 wrote to memory of 5564	4440	msedge.exe	87
PID 4440 wrote to memory of 5564	4440	msedge.exe	87
PID 4440 wrote to memory of 5564	4440	msedge.exe	87
PID 4440 wrote to memory of 2752	4440	msedge.exe	91
PID 4440 wrote to memory of 3024	4440	msedge.exe	92
PID 4440 wrote to memory of 2752	4440	msedge.exe	91
PID 4440 wrote to memory of 3024	4440	msedge.exe	92
PID 4440 wrote to memory of 5128	4440	msedge.exe	93
PID 4440 wrote to memory of 5880	4440	msedge.exe	94
PID 4440 wrote to memory of 5128	4440	msedge.exe	93
PID 4440 wrote to memory of 5128	4440	msedge.exe	93
PID 4440 wrote to memory of 5880	4440	msedge.exe	94
PID 4440 wrote to memory of 5744	4440	msedge.exe	95
PID 4440 wrote to memory of 788	4440	msedge.exe	97
PID 5744 wrote to memory of 452	5744	msedge.exe	98
PID 4440 wrote to memory of 2320	4440	msedge.exe	100
PID 4440 wrote to memory of 5316	4440	msedge.exe	102
PID 4440 wrote to memory of 5316	4440	msedge.exe	102
PID 4440 wrote to memory of 5316	4440	msedge.exe	102
PID 4440 wrote to memory of 4088	4440	msedge.exe	103
PID 4088 wrote to memory of 5652	4088	msedge.exe	104
PID 4088 wrote to memory of 2080	4088	msedge.exe	105
PID 4088 wrote to memory of 1788	4088	msedge.exe	106
PID 4088 wrote to memory of 1788	4088	msedge.exe	106
PID 4088 wrote to memory of 1788	4088	msedge.exe	106
PID 4088 wrote to memory of 972	4088	msedge.exe	108
PID 4088 wrote to memory of 972	4088	msedge.exe	108
PID 4088 wrote to memory of 808	4088	msedge.exe	110
PID 4088 wrote to memory of 2116	4088	msedge.exe	111
PID 4088 wrote to memory of 2116	4088	msedge.exe	111
PID 4088 wrote to memory of 5432	4088	msedge.exe	112
PID 4088 wrote to memory of 5432	4088	msedge.exe	112
PID 4088 wrote to memory of 720	4088	msedge.exe	113
PID 4088 wrote to memory of 720	4088	msedge.exe	113
PID 4088 wrote to memory of 2752	4088	msedge.exe	114
PID 4088 wrote to memory of 2752	4088	msedge.exe	114
PID 4088 wrote to memory of 2376	4088	msedge.exe	115
PID 4088 wrote to memory of 2376	4088	msedge.exe	115
PID 4088 wrote to memory of 4008	4088	msedge.exe	116
PID 4088 wrote to memory of 4008	4088	msedge.exe	116
PID 4088 wrote to memory of 2204	4088	msedge.exe	121
PID 4088 wrote to memory of 4940	4088	msedge.exe	122
PID 4088 wrote to memory of 3988	4088	msedge.exe	123
PID 4604 wrote to memory of 5252	4604	ask3lad-testdrive3.exe	125
PID 5252 wrote to memory of 1556	5252	msedgewebview2.exe	126
PID 5252 wrote to memory of 3476	5252	msedgewebview2.exe	127
PID 5252 wrote to memory of 3476	5252	msedgewebview2.exe	127
PID 5252 wrote to memory of 3476	5252	msedgewebview2.exe	127
PID 5252 wrote to memory of 1644	5252	msedgewebview2.exe	128
PID 5252 wrote to memory of 4420	5252	msedgewebview2.exe	129
PID 5252 wrote to memory of 4420	5252	msedgewebview2.exe	129
PID 5252 wrote to memory of 848	5252	msedgewebview2.exe	130
PID 5252 wrote to memory of 848	5252	msedgewebview2.exe	130
PID 5252 wrote to memory of 848	5252	msedgewebview2.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ask3lad/wt-testdrive3/releases/download/v3.0.0-alpha.21.1/TestDrive3-Setup-3.0.0-alpha.21.1.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff9b071c188,0x7ff9b071c194,0x7ff9b071c1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,16685005687957339275,4764962809460027655,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,2972600741820314460,7644345062661607611,262144 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,11356399153145657039,12429254290809585189,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3708,i,4449232456157184674,3060119576584424413,2097152 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3756,i,2129504296328954584,3882765634703002788,2097152 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,2506914895885830359,10978772022773602360,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,12330738712558980472,11289754675889296036,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5548,i,23437201590975670,13782836458323321033,2097152 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,11386565859506668221,16925774194748588215,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5515842185674403486,17583952701898438503,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2451040748913012841,18024135192949631313,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2451040748913012841,18024135192949631313,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,4514530702735400669,14632219232398929226,524288 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3860,i,5692359510128358919,4206191714031443442,2097152 --field-trial-handle=2572,i,16378164953111022373,8962426470246210262,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f0,0x7ff9b071c188,0x7ff9b071c194,0x7ff9b071c1a0
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,487925977580451991,14525055849282256991,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,7716060651755771482,4197246501684184608,262144 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,11853600194094764934,12756503802913705041,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:13
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,12085643599642991244,928734445162267259,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,12085643599642991244,928734445162267259,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,5465689004439437848,16305699936863122700,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,14435746847510943577,7757378428024023192,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,6486214077483125981,11855065313754098793,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,15448041407097170964,9290146980353041453,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5102134090680899363,6691027062144291383,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,96874300264845141,9724410176305960026,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,6965779458337336512,18094669062514694000,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13090180925401990971,7578272607368492962,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,8917653705639224509,10234295311852469868,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,7174375982535243340,17076026230982190763,524288 --field-trial-handle=2680,i,9338887344437906137,3427248617531880034,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3020

C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe
"C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1940

C:\Users\Admin\AppData\Local\Ask3lad Test Drive 3.0\ask3lad-testdrive3.exe
"C:\Users\Admin\AppData\Local\Ask3lad Test Drive 3.0\ask3lad-testdrive3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ask3lad-testdrive3.exe --webview-exe-version=3.0.0-alpha.21.1 --user-data-dir="C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4604.5176.855780703911866362
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff99c54b078,0x7ff99c54b084,0x7ff99c54b090
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView" --webview-exe-name=ask3lad-testdrive3.exe --webview-exe-version=3.0.0-alpha.21.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,8773226257909847422,10674425860551930670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView" --webview-exe-name=ask3lad-testdrive3.exe --webview-exe-version=3.0.0-alpha.21.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,8773226257909847422,10674425860551930670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView" --webview-exe-name=ask3lad-testdrive3.exe --webview-exe-version=3.0.0-alpha.21.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2296,i,8773226257909847422,10674425860551930670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:13
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView" --webview-exe-name=ask3lad-testdrive3.exe --webview-exe-version=3.0.0-alpha.21.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3604,i,8773226257909847422,10674425860551930670,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ask3lad-testdrive3.exe

Path C:\Users\Admin\AppData\Local\Ask3lad Test Drive 3.0\ask3lad-testdrive3.exe
Size 7.1MB
SHA256 90017109152a8f031a1087ae57b55ff2b80d2862b71fc7e7f9b076fcff51eeb6
MD5 022aabb335cf851a4567a6bab7a879d3
SHA1 315b96702ef255b7cff26acbdf8fca30c8564122
SHA512 0ee31dea4c09a1cff98f64fa17e873f92c4997ad0ab2a099eb6fe4524e6c2fe913e5e1a23a3bb992edcac9e90f4e5d044ed33042eb5a9ce601f81f09b5e308ca
SSDEEP 98304:RH/tZ06bphSM+OUlGTznXnacMZN7n1I2oi9+b:50o/UCXnacMZN7erE
TLSH
T17F766C53F26181E8C46BC1B8835AA633E775BCCE493076BB6BD45B322E29F505B0D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1574f10a-c65d-4034-acd9-8f79acd1b65d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1574f10a-c65d-4034-acd9-8f79acd1b65d.tmp
Size 25KB
SHA256 618bf533c899b2950da67f08fd40055a3bab0dc276a6c930dc675b16e21c70e0
MD5 b8a4398d17d866ca15f43a7e71fe78e7
SHA1 29946882af690f60878d4d839edae7edc94455ef
SHA512 b02a7779bb63ac94f2d7578bcbdce9c50c6a3ceb0c428c9e9b78d4ddb51f8e2d9c63984e329cd36511de318eac8f949afcc2a0d1aac214d9726b2ba85f9c2e0b
SSDEEP 384:nPiFiZcIV38NN8TUNTUlIRpwqdM3OxbzWfg9AyHD2Y/bTRk4XnpgL/7IztoD:aFQV3SwgA6Nx9/Hm43HM
TLSH
T1DAC25B32EC64D9B7ECFB8F95AA4A7602DEF04163D59C9AD8D5D82D1D00971AE030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23b373e7-4b98-4ff9-9836-a1e55cbe1cbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23b373e7-4b98-4ff9-9836-a1e55cbe1cbb.tmp
Size 27KB
SHA256 b5c3b51885386eef7049aa3d56957bfd1bd1547ba2756e7d39ef5fae9328bc2a
MD5 2af89ed6dbe03bc80f0ad2a0fe9d4ef7
SHA1 cd6c96c83e02e7ef0537ff683004c6bc80067e39
SHA512 d78513cb8a52c643f01d7cd6fe40a7dac0a2bbdef33599b48017891dea746f637b7c3989f1cfc5ec1dc06e1fc5c42ef4def400138ad500b42e94b2c0bd60a503
SSDEEP 384:nbiFyZcI58NL8TUNTUlIR1wqdsr6xbzWfg9AyHD2Y/begAi4/uANEbEeUUIU/7IL:2FA5swgA+Nx9/CjLJCbETh
TLSH
T16FC26B72ECA4D9B7ECEB8E85EA8A7653DEF01063D88C8AD8E5D85D1D009719D030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

603cbea9-85b6-4ebd-a084-61098f9b8c4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\603cbea9-85b6-4ebd-a084-61098f9b8c4c.tmp
Size 31KB
SHA256 e89ef6d490b44c829a4a43ae08297bf28a7de508f4b708654628b7366116abdf
MD5 1fd487c87d94971ff9900f7b6d82460c
SHA1 d4453d2ad2a5dd8eaf3244195a8e1f60f4f0a0f3
SHA512 d7b1813e4662cc1f08f3c0d0b9c3aba07a78346281d6b844285092e22cada84d2d2b30546fd2784132cf82fa6e7c4baa77d029e103af3441c058ea365ac1ba41
SSDEEP 384:nPiFyZcI58NN8TUNTUlIR1wqdsCXxbzWfg9AyHD2Y/b2qa2xs+lDi4/uANEbEeUx:aFA5SwgAkNx9/6oq+lDLJCbETx
TLSH
T1DAE2273DEC60D9BF98EEBF85AA4D6A269DE41237D4B845D8D7C84F0D807309DA307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9499eda2-a493-4057-ba6f-f27cae7a86c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9499eda2-a493-4057-ba6f-f27cae7a86c9.tmp
Size 25KB
SHA256 446acbc7818c06f6349f85fd23bd85af7a166d9c7b2d61188916fd5a980df7b9
MD5 5396f9b5e1e7964d19964cf62cd893cd
SHA1 d277b4588e259e4edc1d6f6e63b183dcbed110d7
SHA512 533bd22e7cc9f8adffc998527026d4f97d42fda63d33beebe43e06cfdcfb804a95a1c92fcbdbb6b0375a1122b36ad88efcd4f9bb9dd9d648ac00b25dbee48199
SSDEEP 384:nWiFiZcI638NB8TUNTUlIxBwqB8mgbzWfg9AyHD2Y9Cv4EW1XoU1eWgL/7IzsJoQ:9FQ63mwgwzmEx9/9CIoUAz
TLSH
T183C24B36ECA9D9BBECFB8FD9974A7602DEE00163D4AC9AC4D9D85D1D008719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 721b08b4b688c2d5b497b211c9e6bbfe487d31b6b64a94fd4577d75f86dd0656
MD5 b8ba646bbb457a579422de017e05f70e
SHA1 b93060f8eaccc2d9a7491c2f9eeaf4fb63134330
SHA512 d62f2134e2da1ebfa019f821cddecaef89acd6bcd66ca99eb29e6d14dbb819b43de1963443108ea0330c3de6e0502c7b1bd8b46ecb57218b335a6654265bc675
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCbco8XfgYJ0zFqpP0KLsyW1Lj6:fRqxosfxWMk8xzo84YWm0otWj
TLSH
T12B257D49B34494FFC883197589BE17902334F6DE5F02C35B6A376A0E2E671D44B45224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee8f775247a998ec6d5050cfb3f178a515f5082455093a3e77da38f02cb05fcd
MD5 c759415be793bb2eaf498d742273e146
SHA1 406689bc27b8b0df8240b43c8cbe4c907eaaa83e
SHA512 88d76463290c5fda33f7847d773f3281a2e758f1033475e5af3fa40704c5deca0872b62b7e355654caf6fd52bed2321bc28d77cdc5b25ace71e0655f945254a0
TLSH
T16ED0C07BF53A03F0D23C71390533000001108662061203A800504C15A9F008044EBCF4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68c57d3d8e68bc1a0def1c3134136eae6573be3d69e4476b7639601f53d93cac
MD5 289874132287440a56300547ca0392aa
SHA1 6b3b2cbc375c06813bbcdf5cc0f0fb6b1e44d34a
SHA512 23d383ea0172c741c9a460ae8e0a161f7bfa4bd6d86a7114f766c2a4ed76537663103d08a88b4aa5aff2816a203638d6a4ce530675c8a964384ee1211201df08
TLSH
T1B7D0C0FFF6BB1220CF087070072B12000200D020101301BC4058410D70D054050DADFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9a92cbd849eecadff108aa705c8bffeefa88b48debb99ebb0a61da60d1ea55d
MD5 3eab7477df5ca8aedeabf1695c6ec99e
SHA1 47e45efb75000cd4d9e036210864e45f420f2323
SHA512 0465738c688cb93e5238241731fb0a05395e81c567aa2fffc33a9f478454ed7814c50cbc62e962000f8c572df3a8f4d2780caaf1956dec8d990b4097d0125ee8
TLSH
T11ED02B1FBAAD12A0E12331390637420030C4E540480310188450032228C268100E44F0
MD5 SHA1 SHA512 TLSH

Submit Download

28bfc201-7e29-4f7b-a4b2-0d5f2bf4c69b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28bfc201-7e29-4f7b-a4b2-0d5f2bf4c69b.tmp
Size 12KB
SHA256 b54cfe426738b7d8a4f1317a121659e33fa84a279174ddc218cfe25571de253e
MD5 3ce3ae2c5876fb148e4121be8515daa0
SHA1 68758167d2a42192f3a3371cf475f44767d04909
SHA512 a91a4f7bccf747c004d2b4dca8583a4ca80f248f1c2711269c4b839138c9f34df3cd491629f1e207542bbec471a5f2b9f47eacd547058c6a00cea23a5f88fda7
SSDEEP 192:sxZ0Rcoc/fpsPeWpVhqMzodpW/W6+WNGY0YFeQ1riIgbz4AJ:sxZ0lc/fps2WvhWW/bG5U7+H4k
TLSH
T1FA42E7156D28A93B8CD7E21DFB59BF53E2F95032A0911E48A6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54a7c47a-bcdd-4862-a8df-d4623617e91a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54a7c47a-bcdd-4862-a8df-d4623617e91a.tmp
Size 12KB
SHA256 eeacaf7385d3779e2af088e3c8ae102bd74d2ef84139754c5c1d5dce4a2804a7
MD5 d34b5ad3d9ded56d64dcff179345fc91
SHA1 584972ed69898ef47d7cded35b8b32d8532f8ba1
SHA512 330bf6937ceadea068a81b8e5c6f97a7ee535adc753387db9eb7382ebf12cf81eba5d198f0e545fdcf41cdbb3338e3a8c1b43decbda260332cac387a4af9ab53
SSDEEP 192:sxZ0Rcoc/fps0WpVfFZPH6nzodpW/W6+WNGY0YFeQ1GUIgbz4AJ:sxZ0lc/fps0WvfrysW/bG5U7RH4k
TLSH
T18442E8156D28A93B8CD7D21DFB59BF53D6F91033A4912E48AAFC8A1C05E76DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ce2f979-f51e-4d5a-9822-f21723716657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ce2f979-f51e-4d5a-9822-f21723716657.tmp
Size 28KB
SHA256 7e5c0efbe62817fc26e7111fa924548ed0c54e74db7ffb89f5210c999d5de653
MD5 741caa4e5283e663de2f3e3453954f46
SHA1 3b6324cfed1d6ce1c5d6ac02126b58c0901742fd
SHA512 ac00c1db14fb285d5f4f4c3e11378b36cdcc5d34b4526b93e60f071dd1fe86400d4d6051a59d9c5674b0ee3bc06730c08c986f9e67854a3eed2a96cde8ecc0ca
SSDEEP 768:SPcas8Tw23fWRmLJQt18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VOLl/hf0+7Yroq/:SPcas8Tw23fWRmLJQt1u1jaKVOLph8+s
TLSH
T107D2093F640CCB7E4FC01A99DC16AF976EA802C7A6688D4447FE994C02C77EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79548838-262a-49f5-82bd-6cacde09c5ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79548838-262a-49f5-82bd-6cacde09c5ce.tmp
Size 12KB
SHA256 0d1037c53d48e36c253c5e3d9b01cca8c58ca0d14e6f86632e2f28abb99e270b
MD5 6c2df51f43df375aaa4df826c4717b27
SHA1 e007379013c24ce104fba359a81b4a081f0d8b0e
SHA512 b2f3411580a934a2d404c6d96db88eeb27225651ff62418cf8dbfec52a8c43dabd3dc078347d03b4be449c5deedacbe593c98d4b1ba8085f33f82fa314010b43
SSDEEP 192:sxZ0Rcoc/fps0WpVMFZPH6nzodpW/W6+WNGY0YF6Q1GUIgbz4AJ:sxZ0lc/fps0WvMrysW/bG5UvRH4k
TLSH
T14E42E8156D28AA3B8CC7D21DFB59BF53D6F91033A4952E48A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d97063e-44a4-457b-9160-2ab2a060b838.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d97063e-44a4-457b-9160-2ab2a060b838.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8d597fc26a1c9f765bac53b95a38d6933dfeb78d5348ad263a398dc9f975c543
MD5 ab7b5813607aba53da4360cfe09c8072
SHA1 4d50903648759a0137b0a9e8083c59f582524954
SHA512 41b292571502f4de551153d80c6b6012d54a14090b6baff2884e5325605239f4c201a63d3138e6cfa5ee2bc2639f7360424a362fe98722a36a9e08cb44b0af20
SSDEEP 96:1yLdnXQ7dm10ZTeDGO7X3fvCodkG3zrEZ/p9Y3dQknvK1Y12hTCyfDHrYK5zXWG1:1KKJLlodkG3zS5N2ctUK5zyqzXv2Yi+
TLSH
T18F135E7E92004D06DFD7267F024BAF38C33A9145F1D8844BD1B5FEEA41597A82E2E257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6ca3ce3d4defd396764e428ee74c6548b4c7bf410cf300ac4b2cc7e97f29001c
MD5 709a6103d67bde52356145b5c72e819a
SHA1 b23af4c96c7e698a242eaeec289847414c76d569
SHA512 073e45a5f54285b4ad54fbd463a375ee1633f40dbfbb12d00f49f2240b8baec3982ee977f1af1abe86589b1d0144b3fd9cfbeee434d4964ef4953b9a31a478a0
SSDEEP 768:y7Xr+TvW8ybL/KW5bL//OvUwribhvlEnuQHMgvLxDJBncRQZAQfpeS:TeL/KyL//LlguQHhDxoRQZASpL
TLSH
T14C441FF74951A01ACFA852F5D6033E3EC17B015E7CD6E8A9E1789CC52825F71B2BCA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 fb6d8d1560dbf2229f41238aa5fdab7fe1f2d95af084ecf5f0d2c59aa16e1ba7
MD5 e16d59348d58d924ac7f604492aabcbc
SHA1 19f3fc3ede170723646f68f33d5015d267d64732
SHA512 7d5ac2c1ac5c37e24b9ee18ff3a7f69913acacc792fef664bc0bf1061c2fad6511115dbc8e99513f484c731f5fa68ad0e9ae7751c2968afa224524175f0a4566
SSDEEP 3072:BWr5C9XzcFDEbfouoy5YYw6ex+czMVsE:UC9iDED55YjB++MV
TLSH
T10F2519EEC7681C82DF6B8770B0E0D9077E702182B65DD0D39944C9D897D2B857AE92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 acbd01b4b5ba3650f8af9ab71f08231bf86e133d81bde26e92f38887bc37d984
MD5 c01ef80e05a7c80b2a82041323057031
SHA1 41447dfb4ec49c853b2e158cc14def5a09f84988
SHA512 83105c382d6e9af877ca817eb95a92e3b738ad2384b826784ed2b631f250102136b244312ed4f67505bbbcf2ba29eac189c275632839efa03faa6c43794c888c
SSDEEP 12288:YFN9snpLzMAsUZMlfkq/5Z/PvGLZq496UwDOKXwM7WHYDc0eJh66hV9Gpa7FVn5d:9wnG97NzSb7frSBKEqS1MoZj
TLSH
T1A1167CEDCA7858C3CD63AA30B4F0E9477C7413C3F955D1D68898C584026BBC5BBAA729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e976502a-37c8-453d-846a-c5ad306b61da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e976502a-37c8-453d-846a-c5ad306b61da.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 0258500002ff295910b1c1e50645bc7c070375642a05ddbb36fcef9dbb29ecba
MD5 bcd6ccff639b1141b220681a57c3d73e
SHA1 db0f9599a8ebc6ff0eb1883695c3c0c1814db061
SHA512 643042e77f09c0bc870b13f0c4967b2a06b60011fc7eba8046bf103357df58e011801b117c607a8e10a982d5f89f08dea7286d9a56b2729ef31cab3a07824a83
TLSH
T1E2E092D495C6C12F7A29358702656B08929C24A7E6C5AD07178CC8C07E86615A352546
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5e8d8a82b30d209537f3365aee79b77fca2a466f7f468ff467b77bb47d45b0bf
MD5 3465ed8e23b368ee966027ae95d5512e
SHA1 3fc4048371dba7d1735e5dc18a79546e7a6e150a
SHA512 8880b33948f291e9cdfeb5d76ceb5214e93b103f1dae9b90896538fbe8ca1d55bbcef904cfec4882eef791d8ab5890cbfa55ba63e5984581a4847d8880bd29a2
TLSH
T1D6E0268414C8C12FB61C7A97037D730CCBD03423A2C03A0A6B8EC9446241F82E3B73C0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 b9db99782639289f50cf3c1d362e120462d70cdd2cec55789237eb71c5d40bcb
MD5 aee44b23d2a352e6c2f4e150574d7262
SHA1 4f646059faaf385769b125239918d4cef59decc8
SHA512 655768df382f9152409606c0e4ea6a3cd16bede3f100cd9dcf09a3c9c8788724d98535b87ee3954b8a86504155a5663ef873b77a5cc03c94c0a9ab759ef6618f
SSDEEP 192:xupbCtq8oN0+G83uxXBBK31GkSJEWoEJH7DNspUW:xkCtq8oNa83uFBBQ1GkSp97DNspUW
TLSH
T14314864F5F353212CD7D803629EB44A75DBEF03F8B53668978A11461CEE3662605C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 ac76a67435c9b25cf82bd022889429c580e3401d1a341f816dd5c68efa6697ec
MD5 d39c9766fc015fe1886dd91c7fc837af
SHA1 845381a51922d53bf7ba96512cfafdc2b59843a0
SHA512 f0a9a8dd86dbcfd3b5955a00366a8bbcbf937a75fa0bed00a9fa776d588a18f026baeb92aa85104c2a52203f58f6d65d15291dc57a15e85fe22b634a17f75e18
TLSH
T1DBE0D8B054EDC11A7608318B4335B708C7A0642BD6C4BA063F88D980B8C7504E7A52C2
MD5 SHA1 SHA512 TLSH

Submit Download

1adaae2c-4d1c-43bc-af37-62df5ce26099.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1adaae2c-4d1c-43bc-af37-62df5ce26099.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

37b3e59b-8811-49b2-b069-c04faab4b6c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\37b3e59b-8811-49b2-b069-c04faab4b6c2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

459415e9-8b63-498c-8326-99657f8a5afb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\459415e9-8b63-498c-8326-99657f8a5afb.tmp
Size 2KB
SHA256 ad0e8ba19a99577bbb2467962d1da06c647959e4b875788cfe943e2387f2b99c
MD5 6a12fcdaf46394753ace7bf018985fb9
SHA1 83a08067f9dbe37dafedce9501f4b6ef41582474
SHA512 1f28f22be7b83f28bf38d79d94bcbe571c04c8a38cdace4b610d9c4a20d761ec682f6a2433cba597bb78b7292d14c0ea9907b633d70834e6c829be016d6dfd6c
TLSH
T15941D1F7C3F4866D890156F0AA187E2BCE2D0914932C3D9AC8E4AF2B93E3471E18155F
MD5 SHA1 SHA512 TLSH

Submit Download

9bcb00b3-ec2f-499f-8326-3f5cb25c416c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9bcb00b3-ec2f-499f-8326-3f5cb25c416c.tmp
Size 1KB
SHA256 2d904aaeec5fcc0e9d0736c6c3fc4834cdd431b54dfededf652da66f513985bb
MD5 86c14b0fb4208bddec7292a408724169
SHA1 80771eee98e9a2ac32ead8211ac0213f7242f445
SHA512 263719a164ed18950be1a2c9459ea1732ccb22dd9d6371779316a73c26dc747ad11f71d49adab1d8c8009211b60e47326ef53ea21bc88e376a51e385dc34276b
TLSH
T1E631E2F787B4856E8A0196F0EA18BE2FCF2D0515931C7CA984E0AE27D3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 01b6f040f67a3f16d231aa1c736e37b70c78645f451bac9d8c0ff5e9545c3eb2
MD5 71ae89785a22e0524956c4e3645b13d0
SHA1 3cd112667a0236e990521150ad9607f2a18d63d7
SHA512 9c770f5852dcdec8b3fcfd23f5bf4385cb79204c5bb9f12f24f9924c94aea99e4870cc25f2642956284c1a2aa16ad6d8e333312e761be54d4287d396b247a7f6
SSDEEP 48:TNLopFMatSaw/auUOt8BMoBwrBOa1nvyjjAwH:deMatUaAKzyRvyjjAA
TLSH
T15D922E4E0F306112D1F08B76EDD584262F7C211CD3A37699D91424F38DA246FF6160AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 5b926f2568c3450de8807ffbaf508f2bb83889804657680025929b32ad12a54b
MD5 84cb931e6dbb93576ea4a2704cf34571
SHA1 bdbb9d1c705ede73c8ea653aec6120e3c519d992
SHA512 1aae78994b9a75a4abd62e18df107f4f3a8e3ca0d34e24c1dc80c0b84f711d43da77c293658db4f10b9cdf8491286f7711a8169c48da86882ab4b609f4112bb4
SSDEEP 96:OIEumQv8m1ccnvS6Xx5JeSt9f5nFX8qL94g:OIEumQv8m1ccnvS6Bfht
TLSH
T1FAF2DDFB07236605D98444F0E4005F8EAF16404B47B2B2EC76D447E3F7A20E2B6B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e95f7d59-a387-4144-8334-e987cd0d6dea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e95f7d59-a387-4144-8334-e987cd0d6dea.tmp
Size 355B
SHA256 b001aa32e62f8448bc2473095e8151a4f716c6b57e088091fb719160c1792024
MD5 7f1ca7c8a6e68dd36bcf15eea3bd964c
SHA1 2bc5fc78e9536d31175a6f56476eeec1496ec9a7
SHA512 08ca0fd0718cedf6a753cbb8ce5a56a6de341d72e93d28cd82fc9ccdaf754ca4a771601e107ec8e09e1a7468d9147d75845108d290d0aeb503b5f926df96e32f
TLSH
T19FE0D8D284B9E43B10374D762D98BC856A79943AD00198F4CADD47FC61902F36B2202E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 86040df8035578ac07adfa320a86bd3499889123b334def58b8cd88adc9701ab
MD5 e53e1960ff1aa57fcad686de80da351c
SHA1 591011314b7e82ad8e1345ec6cfd74b1f996a477
SHA512 2b196bcf0185e35a3a1ce9020e4243d85b2f9f348e9f9f886764067236f90dc52116c955bda3702f2f8f940cb1a2347077d9078df2ae1d56c381c5e8ffbb6257
TLSH
T107E086D409C9C57E771A32430369A30CDBE8B43BD6C4BD0A3FECCA497587A45B2A2581
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 22aaf9f6a7e2e658b85188d5a3708f88de1d6cf2bffa1e008ab4e6724561d61b
MD5 da46e257e1e47bdc1537e638724c6bc3
SHA1 98e2b776c9461a9605fecf135c9487b34a84aef8
SHA512 3fa9ee7f64c3e966fef73f80aa3b6f85a786c7d413416c25db3996ea9522b7aa39f1615651daf03ddddf83f05db5c525ee2af077de1d6c21a65b4da259f94230
TLSH
T176E0927015CDC32B724D318A4316F348C2A2A427D6C5AA153F48D584678A7807252550
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 3263c1366567db65309f35493d858f07766c0210e77dc26c7b23062cb254c8f4
MD5 b87f0ab2e907508e32d59e1f3aeb028e
SHA1 db89cce8198d39fec89b26a452d51e47035b6e86
SHA512 7da80d7a62d23f7f29093786fb0265de7c51279fce321b5a5500b8475f7cb97009de0d6207146b762ac41e7e328a6ef742eac9e057d85d442dd1c714eeaedaba
TLSH
T104E026F449C8C63A770871834368B70DCBF0A82BD3C0BE0E675C8448B542601B3B6980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 7136bcf5dd258129ccdf867d45bfb1aa5320a8c053acfe6475ce33fa70f47602
MD5 89c7e3732995645a7824dd20352e93a6
SHA1 fbfba1d0a42a4a3d99b2835fb91748f6d61eaeee
SHA512 d4f035947d511182148b1baf1f5636147f55737e4644fd5f63f717211d445e14b3228da160351130ba071387dd0648efafded3d0afc2447f5ddf7b2b9259fca3
SSDEEP 192:ir/+SvIrlfrljh9DdgslV9rnUSTOywIItYJCSSLgs5KSxcif/WJLRrg:ij+UIZf5jPDasb9riVW9RU
TLSH
T144C2715531BA12553CBE290881B5972F528235B33119EA3B3FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 8c4e2b33bfc16bc6bb69d0d3b44e1687f49ea30d4bb3ea5d0193b38c13cc34fa
MD5 c299ad59f4923f4409efe15feef90ede
SHA1 9a35c38d094058b35e9876321fc5a1686876b85e
SHA512 6c3a4fb98978c25378f69b959c8c40e32d0a6fc6aaf3d79f78389b34a7cbdbef983f27eafbd8f568627f970f85435a1e2b758f04496df13d70bbd42f05255752
SSDEEP 192:ir/+SvIrlfrljh9DdgslV9rnUSTOywIItYJCSSLgs5KSxcif/WJg:ij+UIZf5jPDasb9riVW6
TLSH
T1F7B2651571BA12453CBE291881B5972F128235B33119EA3B7FFD44A68E6BE085DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 7d7b6d16024dc70a2b27813f46d4bf6c8af16155292df0139e45db00a4c930dc
MD5 a7a2a6bffd72c650fd1d3a2250216422
SHA1 8064fa05f38539f7e6971a6486ce19294eda5f97
SHA512 8413620ba927b826ea660dc443e83b459843893117e043f1e3ee392d4b2b30d46cea8231ad99bab8a5f2e0c8154cfa704ad89ccd7bcf5d33fc0a27b30c6e5ba6
SSDEEP 192:FvoW0gaOfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aXufQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T19224540A7B747001EDE7D9725CB080771E3CB16DCF22A6915DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a584fbaf-b3ed-4044-8bdf-b5dd61bfb3fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a584fbaf-b3ed-4044-8bdf-b5dd61bfb3fd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a8d402f5-e878-4eae-b2ca-646e77903d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8d402f5-e878-4eae-b2ca-646e77903d13.tmp
Size 11KB
SHA256 bad98673075d97ea37a0da9c81f340136fefb378dd1f1402427c28fd92be533c
MD5 e8278d84fcb412845b66596209b627b2
SHA1 6ca90c4369b8e0755e69203d309e6f36f79726ec
SHA512 22774d4f4c13f34fc88f3c166dba7f786931397492fffb894e87eab07da2fbfdf25919f0eda5576cc122f690e960d906e39ab991b84ee92ffd2755c1b64b004c
SSDEEP 192:sxZ0R2oc/fpsF9qMzodpW/W6+WNGY0Yxej5UIgj4AJ:sxZ0Lc/fps/WW/bG5EVj4k
TLSH
T10F32D7556E28A93B8CD7E209FB55BF53E2F95033A4911E48E6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6383ebb-9bda-4cfe-a8cb-eaa63b2137ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6383ebb-9bda-4cfe-a8cb-eaa63b2137ea.tmp
Size 414B
SHA256 2cf8fef9d52c7802e1629fa05ad55d54b75773c57498ef2ac40d73ed8f4efd5d
MD5 4431b061430466eda2b97acd6afa9886
SHA1 e0b85bacd951c26353f622fa7ee0f5f2d7a0b98b
SHA512 eacf06c772da562d9323b3b291003cf7313b7d7f49ab5c2675f4307a5b6ac6f726b9fc66635e37807e628ae666561b4861ffa3404e8ed040ea00d508abe59ca3
TLSH
T19BE02BAAC921ED370DFD0F2CA0905786D751139F3A42890F3A3C910D8FB262A069EC1C
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 f3d23cc262098195dc4f7609f09269c446a05f266353d96139f4019e322c15a7
MD5 81349f37aa78db91ba7dff1a599ea17a
SHA1 0b4358acb3e2ecd57a0d3f5a0f84ba357ab77bbd
SHA512 8809310312bf3d3e0be92b249dbc20efa56d1ec802f79cb2fcce7e274bba701e64a6501077f0253b287db69bc57bcf30e138a65be1a551ade2e88561f66e56c9
TLSH
T1D25197C0B395609A7FCDAA45C22EA503A1F13E76260EA871376D84F44F48C194F3EE61
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 20KB
SHA256 5946f2582ada6cde553722d02ce608b20c3c6dd18fce22d9b44e4ca005c3e8ac
MD5 136d9715940259ffcaf092bb78c42e55
SHA1 f0ca0fd888905257c4e16d00f8efd95d3b8bce25
SHA512 9f51bc9730f28485c44d11e62644a475fe1a63a2790badfd67ccf180a9350af0dc7ffc30dbd73390f13e59e6dbe3558f8bfdf771692bf2a58ee70af92a7b226d
SSDEEP 384:lRYDsQCsOxbu8bu5mbudbuvQ0IIILbPMIMuB1:fhQbOF7f0MQR
TLSH
T10092F8BD6A050B33E96F6FB7022E4E4817E6C8428552525C31A1744EDCF0BAB82D75FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 7d1d05972534f14723b23a588d2dc6a9c34ec5bedcea1e05dd294a23b88242fb
MD5 e4dfa8c96aacaea076e92e6ec42f6b9f
SHA1 bf48af25e2d0839813cb722dc12e48c0f3f6da16
SHA512 93b07d9c91489bdf53a5d5835afbc968816a678d370aaea7e80d72d45e27b89d5036cf3a4418b3c0e0a4fa36545fc787e611483773c9f519086b286af8be3094
TLSH
T109E026D0B8C8C22FFA1822DB02B9670C83E42923EAC0390A1F48C444A485701B3AB5C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 379ca00ab2ade22f9b55db0671949489003b7c08b59eeec9b5a1f03101f0e2eb
MD5 6ddbe21becb6af6c3882074e075139ed
SHA1 20a090155de060a528ecdfaadc2731fea0feb350
SHA512 2f221d1955e8daf8ec28ed9e5307afde475fda4c28926ea7b8c56daa646d72e13f5b6ae51f307d4532fd1e1ec6e66da9fafdd2e368ef1291f53796d44098ef80
TLSH
T15E21B256F320C158E24A867DA16B97351338E8069FFCEC0F407A74356EB2E111E8B6F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 8c2ccda4f530e884fee7ea6a1716a24b90c03f2b9ee0db771497b936a9564d47
MD5 068988539c226fc90910714cd3619413
SHA1 9b090142891162d2608f3e35a609c68933e159e2
SHA512 b68f3f311c653772e54d114960d96cbbfdbba895ca8fe47883493357d0bf8a5004d8feda4fa42fc512e989c14fbfef01b54225d68817887f88de53aa915d2b2d
TLSH
T1ACE0209074C8C22F751C21C70275B78C83AA7827EAC03E061F48CD4496456427B57141
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 09693452089e38eeca4a35ef90fba804134d8732105faf03d934ea61b61eb828
MD5 699e71c77d72cf97cc813361e8e28e98
SHA1 b104373ebce3b2717a2632d72c1d7cd153e4f99b
SHA512 85cfefd744b492b15274a416a8c2da0f3f8881fcfd70b695b8ee8d6a48a79b0728a4ae280b708b8623ffbd988e07c0a97d30af83b91e08154a97e45551be53f2
SSDEEP 3:MsEllllkEthXllkl2zEflOJc+/l:/M/xT02zhJc+/l
TLSH
T103440404FFD14C05D50010345051F3501375D41015117F4334D14C735DCF5440C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 cadb2ca82338f1d056268be1a0bbeda6d19d3b23e597fae09c0a74f52d1cfb06
MD5 edd0074e2c2a48b8fe9d8a8f5d7c629d
SHA1 215939761652f5c5aa2c8be334e4313f77e35b6d
SHA512 92a61c57a6c54b6afdb0d7faee39c13d85e2ec8a26e17fab47393402a3e8bb070e2292f490b96d16323494928b6af788692b5a8c9e24614fc1610e4b3f7cabd2
SSDEEP 384:nPiFyZcI58NN8TUNTUlIR1wqdsrXxbzWfg9AyHD2Y/b2qa2xs+lDi4/uANEbEeUx:aFA5SwgADNx9/6oq+lDLJCbETx
TLSH
T145E2273DEC60D9BF98EEBF85A64D6A269DE41237D4B845D8D7C84F0D807309DA307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8142769f66f3f634f77affa91ed9634afa0c8d7d00c3b2d22abae379c3851669
MD5 b4cc73220adbdd6faa2d9056efb13c6d
SHA1 8a386e7e7e5e4dc991adcd712bda11858d12e26e
SHA512 ee5b01780c4763e3427506663a42385be5d3c28710ccd99d0592f1185f4cd5acb73ba6d638d1128af18f8c6da8514c5e3c5c4181ffda16bc1c0e912fb3cd9ca3
SSDEEP 3:MsEllllkEthXllkl2zEflmzl:/M/xT02zpzl
TLSH
T1F74404447FD14405C510103040D3C75013F4DC105D11574335D344735CCF7400C00400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.153\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

bde65ec6-88ab-4a97-8ac6-fc4dfd93abc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bde65ec6-88ab-4a97-8ac6-fc4dfd93abc8.tmp
Size 26KB
SHA256 5b1dde367c55cced2558728776b65991c6f825e0fb380a33c4cc918a5d2dd412
MD5 98de472625aeeefba626cbe6b62a0de1
SHA1 e4b026196004e4de3f2897c7dee8303117167c83
SHA512 f3e0100f445029307f086b3b031abf998144a4741c39cc98fdac43e670f74c0176b592dbd91cd4ba5d70fa9a2417f4e19bfe84a08c9d4089af250b237bda6772
SSDEEP 384:nkiFiZcI638Nx8TUNTUlIxBwqmgBybzWfg9AyHD2Y/bNRkv4EW1XoU1eWgL/7IzU:/FQ63iwgwESx9/BmIoUAz
TLSH
T11AC24B36EC58C9ABFCEB8ED5A78A7602DEF04263D59C9AC4D5D86D1D009B19D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2aa222b5-088a-428f-a3c1-2546d5243439.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2aa222b5-088a-428f-a3c1-2546d5243439.tmp
Size 2KB
SHA256 215efc5cc591a66f0fa4616ca593c5602a09d5d947ef358bb1e8c36149ffeadb
MD5 c8415718045e90dc25288194f0f68679
SHA1 6070cb86b5799b1af46eb4c19a8f4868bd6475d1
SHA512 b4fc1f45ea311e7e443a6e93143931e7d8ba60ebce6e1be4883ac9532107d225aa3ed75d7448c0c0cc63fa08efb3778f44d85ecd5434101f1703e8b98caf7f55
TLSH
T120512FE05C7D5AC5D0FD0E7EA49739EC84ECA211F894347D6858E998897A62D3080C3F
MD5 SHA1 SHA512 TLSH

Submit Download

d1a6060c-d9ea-4c01-b132-b24501e73a2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1a6060c-d9ea-4c01-b132-b24501e73a2a.tmp
Size 29KB
SHA256 e4d4d65781879309132dacf7ccc8cfc1d19404b7b13ff72d8ae0fdc0be90ef53
MD5 35d2fd816714100aa4dfa3aea7397cb7
SHA1 1866ce7c45b10f340b26ebc109ae560ef5a13da2
SHA512 96f8716564430fbafc6f69053a590e6f979b781cb7d548053f00af7619a397ce69b74b46dc93b79ddd2a592abbee219589110201e14abb5498cb28e1c4fe20cc
SSDEEP 384:nliFyZcI58NL8TUNTUlIR1wqdsr6xbzWfg9AyHD2YmiSun9WM4/uANEbEeUUIU/Y:sFA5swgA+Nx9/mDC9WdJCbETh
TLSH
T1D8D26B36EC64D9BBE8FFAF84A74E7912DDE40237D4A899D8D6D85E0C00A319D6307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e53d65dc-df65-469f-b8fc-052d40e6a0a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e53d65dc-df65-469f-b8fc-052d40e6a0a1.tmp
Size 27KB
SHA256 0e7c426167767a888b8bb42d5c0b537014f2fe43b7f45a74725cc9e28910e8fc
MD5 dbda29e871ca4632a953b414129757fd
SHA1 78addad918b3b862a8ac06464ee47236f0a1f392
SHA512 bfb9e1e7de41dcd7c8cc346cfa37c521b28ae8240d5eb39cd69b4bab63d2f376b4be02b9a793c67edc732dda144ffa3d2def2243e094f71a4ff39711773c55ab
SSDEEP 384:nPiFPZcIG8NN8TUNTUlIR1wqd23OxbzWfg9AyHD2Y/b2Rki4/uANEbEeUUgL/7Ii:aFHGSwgAQNx9/6mLJCbETx
TLSH
T174C26C32ECA4D9BBECFB8E85EA4A7612DEF04123D59C9AD8D5D85D1D00971AD030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 074da71e9d9f7c8cba190a732d1ca1177b53cb76a1baefa083103daf6e759464
MD5 e7fafff3335569df42d5004be843e699
SHA1 ddc7017c883159406941068bf116b40277173bfc
SHA512 4b1947a2180d9131bd4bbc4189b454b85933549f684aa5e7acd77591363cf71da9a5a94cb60045ba2fb6d00415b5c0ad894517be6c408fb46d001232bc489cb9
SSDEEP 768:lQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:qLhaqLI1WcxKgdfHJHH
TLSH
T19B63D9FB495B02D0FB9D41F4924B76CCC35B299C8CF8E792F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dfa3ce6-14e7-45bb-bc3e-919da861882c.tmp

Path C:\Users\Admin\AppData\Local\Temp\0dfa3ce6-14e7-45bb-bc3e-919da861882c.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 37aabec885aacaf3d337e8e96635512367af77709c985bae9b1f8fff7a524840
MD5 5bd7737d561484bfba9acce48c1e06ff
SHA1 824c5151f6682a09e5a8ad770799ca2463d1dc86
SHA512 1e3b953ddb72c53f9fed79abd10cfd1da148dcff27164616481510b3f133de95a37ce7de6994365069eef7066e27e07310efda0a5078e982e0eaac43514a4633
TLSH
T1A3412AD13935A63F4B874BD460660CC53970F181132E6A1CEE466474BD9CEE26B2E7C9
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscEED2.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nscEED2.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nscEED2.tmp\nsDialogs.dll
Size 14KB
SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
MD5 2726673c720a296442c8ed134b41d169
SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
TLSH
T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nscEED2.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4088_575352746\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f28fb187-6356-4971-97ca-6bac2b98afdb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4088_575352746\f28fb187-6356-4971-97ca-6bac2b98afdb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4088_684842157\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

491aaba3-1353-4d51-ae6d-b221cf99e7ab.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\491aaba3-1353-4d51-ae6d-b221cf99e7ab.tmp
Size 3KB
SHA256 dfa852bd1ed6195f481a01f6b7145ac19058f9f1402ed425278ace9f5ba636b1
MD5 cfd3bbafec9e1a887e94ec4755f6be12
SHA1 f50315f82b64f22a18110b33cb40d95ee1437940
SHA512 c830d248a685d03e2a7c6a319011e79b0dbb1a7d0adfd98563b5e94d264b625f3707ae38e2d5238f5beee50bbcd62f4a4606b74bddfa4a7a2bb49da0dcc16230
TLSH
T1B471A672E9A4A6375DE39905B8852F16B6656236E1853F98DAEC0F0C01D72D81382C17
MD5 SHA1 SHA512 TLSH

Submit Download

9a8942b4-ee77-4332-b6ff-ef9e978f8e2a.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\9a8942b4-ee77-4332-b6ff-ef9e978f8e2a.tmp
Size 16KB
SHA256 7c7a58ebec69fe3e78bce9f0b27c9560ce1c2dd1349d9195ea4646aee862ed6b
MD5 f904fb46e46eeb2e06839289e8f57249
SHA1 ede11e826aff0c81eec28ec9f5e911cf97902851
SHA512 dfedeeb910dd6eab09d4e7e627da722804b261da712901967dd549439d7c2a5b69360e61f043fc80d32172a7eeda4798a48b2a9155846bd6077b385d694a253b
SSDEEP 384:z9+aQikB+z/xvxjg/qhEnNbCGCwmWICGsDI9zP:M/UxvxjgC+bfICGUIFP
TLSH
T19E729D3695787F3394F7E904795D0F9BEBB994B290C15AA84AEE1F0906CB3D81342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3e07b8c613fa98c0fbbe106771c31e9fd76949d0ca2f116db4646d6c81ff43f
MD5 71c26d3d0ad2b2a9f9427e10032f8542
SHA1 58b98c9ab6d15adb2cdb5ea47823ff75851f5318
SHA512 8d0e9bc20f513084afa438db500299b0eb4a89f4dbc70bf5afd1e62ee08c06106a427fa20e587ec03e7de998cb1e722c46ca8a8fd062f070e8af38f677a9bc5e
TLSH
T115D012163611437DC4102C330002660D4C05C12B80054204542A965D7B040601A03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24eb1176006e9dd5fa9056f250d5c6ce4b644a6d4c098f0b890afe15e4361a27
MD5 22caca7e769806aeb90bcb54c09a14e5
SHA1 e945dda20879df4cd95cee776af84e67e18ae922
SHA512 daf8e0b79153970d637e48fe03b56e45059bf243bbd5a7d7cc48b6e020d084b88c11d27a188dc8378d00c33344fe14f2e8d9aca7e1bea698b510f5896f1ddfc0
TLSH
T1A9D02B662225077AC61039374081E65C9805C13F400646041E37FA5C6B410F10D82841
MD5 SHA1 SHA512 TLSH

Submit Download

0615e67b-77fe-4b42-8525-027b6f157980.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\0615e67b-77fe-4b42-8525-027b6f157980.tmp
Size 6KB
SHA256 2cd58156bcedd41dd9e24deb390891072ceeda7ecfff85e774beb16202799e9d
MD5 6189b4cd18cd8b84187081bd73d126c1
SHA1 3f1b9112daf8c81770647f92990b6f796cac2352
SHA512 824fd38d480d8dc740b6b154379fb678f64ec2eca5bc5135beead53e05496dfc0934fc66337e646ef989b606c7819ffc33a95a71a0286b87be6249cd50805e6b
SSDEEP 192:stX0C0fpZ8pacJ/S+WiTdDwYewP0ejBM8:stEC0kN/Vlw9eS8
TLSH
T12CD1A7026E6869774CC7E21DBA35BF16E2F6206275D40E58EBFD861C08D66CC6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 aab01980bec715b2ec65eb0cdb50fb67b01dde0c4e6a0af1169dfb37d91e0d96
MD5 835abb1c5459e2985fa023ebef42f81b
SHA1 d380efaf16dab20d5f61a48a629f25360d024350
SHA512 556d7599cdaf38892faee5959dc6003c339375f83d37ec813ae2032fd530e7bbdc841e3683f425fbcb10719b8218c312dd2522b45be6b8d45598d7c61d71a54d
TLSH
T189A0025287828406C1D557F212C906813A355951070B4701AD9516A99DB13886B1121A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 de7293202f83a25b5bac57829e6a69fc7c381953c9805e58b8823594d05944a3
MD5 549184bd090a176f81ab2e1d382bce41
SHA1 9c2a14636ed1c0b629c57c1a1b3c6b9c8260df1a
SHA512 db41ec59dec11f6ecb7d23c0139319c837090eeee255b93613ce76bc291ed5b56c11a35d83c8f95c8391971a698999a07ea87c1378c1473c6d8af6e08ac5d806
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c3833be2dbea0aafd77f79a00d42027dcda0f0f267963d8af799950aa84b9dcf
MD5 880fb95f95f5d7e854801f051e67fd70
SHA1 721d22ca63d12bd99d632cfbef10049d1f7f429f
SHA512 93ec2f98269c09b1d446a8553496da4b8ae8e77159088923fbe12c23a8009cd25f736c357379463496ebc84e5ce6240f75578b984aff8135cb190e4667f4e763
SSDEEP 3:LstlNllkll/l79+lt:LsX3lEtxat
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

265b6997-1c0c-4bba-8976-406e1ac9e966.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\Network\265b6997-1c0c-4bba-8976-406e1ac9e966.tmp
Size 821B
SHA256 872c833ac2e39d7bd6b43ad05b67d6bccb0ba4ab9611caa69b8f58e9913009b4
MD5 17f91840fb328cf1372e07698ae6535c
SHA1 29b0bf22c63227af8e9f594bd5ac53dd3d914d26
SHA512 67cd3fda65938d8f2ce8ae40e5e72d7877d4d5510a75d20633f8c3783c3bc207fe3abcfe70214a7f6a0d72cd26dc5552478764e3596df2b34ee29a191c9b229a
TLSH
T135018EA2C3E4C67D8A4116E027347817CD3E051AA2283E2BDDEAEFDA57E2071D21060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\Preferences
Size 6KB
SHA256 a99e63b35b361481360476ce45056fb3a8f71f729452b0b4d4259db373f855ec
MD5 0ee1703454b934918369c5fb42b48c03
SHA1 09f2fa541e58d5cc51b98e1f28451869d79a4e2d
SHA512 bdbdb0749bcbbb7c350cd55a8c7cae40c79b35d0cc484589f7f805c658539c6dd73026058f505f7e88a7e582f403e6621cd5fb9b276bb705b81d61c1365415e6
SSDEEP 96:rX05k217mb9VtqhfftdZ8i0vhE9ktwm/7qx+WVHMSm+uecJdD1iYeVQj/P+gKejP:rX0C0fvZ8pacJ/S+WiTdDwYewP0ejBM8
TLSH
T1DDD1A702AE6869774CCBE21DBA35BF16D2F6202275D40E58EBFD861C08D66CC6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4b3b25e-6f16-4b35-a86b-197faf8519fe.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\a4b3b25e-6f16-4b35-a86b-197faf8519fe.tmp
Size 7KB
SHA256 c63965b4a7d97d06262eca82c6184b30c6e28a2cc1250a00f4580c73b870e47a
MD5 25c8e20e2597ff875c2f94184cc241ce
SHA1 aad09df8b93c658952a889b6bea317d45d47369f
SHA512 d8086f291908517829e7a79f88a4941ef1c0ea42f77a2e66e10a8d9175bdeb36e81738c8dc4ac8c1b066e911eb779aa2dcc54598254a261efae99f7f31aa0b3a
SSDEEP 192:stX0C/fBZ8pacJ/S+WiT0M4eqYewPQ5j5WKC:stEC/sN/VNqp7C
TLSH
T1B6E1A802AE246A7B4CC7E61D7A75BF12E2F6206271C51E48ABFC861C05D76CD6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be73c544-b863-46cc-a821-89fc36321865.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Default\be73c544-b863-46cc-a821-89fc36321865.tmp
Size 6KB
SHA256 ac8ef27e1df279f90bd440ba2c70888195fe15ee014df50092bece3a67367880
MD5 96bb1e06e84f8a0af88bc51a9ce7876d
SHA1 2bac220b717e6813dd2b4df94f8ebd0d48cdd1e1
SHA512 625a1c665c3b3cd3fd4233e5bbb2108dc6a3ca60297fd332f7b49d45faf0e0598bf7ec8c74c44cf7268ec00e313ca16ff6d671eda532a7e9b8f3bcc1cb32b3f1
SSDEEP 96:stX05k217mb9VGqhffxZ8i0vhE9ktwm/7qx+WVHMSm+uecJQ2jMYeVQj/P+gKjBL:stX0C/fpZ8pacJ/S+WiTQ2oYewPMjBMC
TLSH
T166E1A7025E6869778CC7F61D7A35BF12E2F6202261C50E58ABFC861C05E66CD6247D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Local State
Size 1KB
SHA256 27284af001a7c8756a79433dd3f92ed6000e4e1839aa923045abbb87583eb0de
MD5 f3850b1965561329af4cb19e5f9dbc2f
SHA1 071e3cda9b77533ef384c05a0cf4eb6af0e0939f
SHA512 acf9dcb78fe3aa4e3cdaa16abe84f105bb16243b65e60e558a02859ab7edc61aaaa069567124e3b45568f30d304a825d37c7b3400efa73151ebdf470992f1f53
TLSH
T1C62184B3C8907B7679869859F147BF8B2E607279A3108E48F1CE060D06DB5DC82A7C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\Local State
Size 1KB
SHA256 3ed0268dc26d17e15e4c72c49fb00737b8291d9bf31ca2e2585f83a25eaf4433
MD5 8048afd6e1c846310e42ecc06d95224a
SHA1 94ddcd9a6962be4363e428e74c568e267bc0c428
SHA512 d1488dff838d83c04744352c417860b8ee12d6b7adf055f83d04fee142f7d91bda1b249e81ebefada95f6e79fae3c5278d588c2651a51df553531534a184ae70
TLSH
T1B43185B3D9903B327886954AB146AF576E306279D2514E84B2DE0A0C02E71DC9297C37
MD5 SHA1 SHA512 TLSH

Submit Download

b5fa14b4-42b0-4d06-8b70-aa41c08a10ec.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\b5fa14b4-42b0-4d06-8b70-aa41c08a10ec.tmp
Size 4KB
SHA256 3d94270d22300755a21770465dd835bfc8206f5ff28476984a01297814296b32
MD5 2f73685b273427b7224efa80c23a95c3
SHA1 71c6d61c8dc36f15f8df76a8059057ceac454ae7
SHA512 cf0276446c161cfc063e5dfe64768706dd7a494cb40f343fc21ad1ed53ae6296a58363da12ed46032cdd6ac2b33ca6cca3e612cb70c9d66b1a7f6cc574111667
SSDEEP 96:zuJbNkCEVfMYUyoL8Frh/cInURoDoto+5ZN6DbB/eM6b/ZyfZqT/lOa:zAbNbFBkooDUhn8l/eWRy7
TLSH
T12A91A622E9A4AA375DF3D945B8863F03B6A46166E1956FD8DAEC0F0C01DB2DC1383C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc803fa4-7405-4d11-9fd8-511537e30094.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\bc803fa4-7405-4d11-9fd8-511537e30094.tmp
Size 16KB
SHA256 34909d87e1ee59d1e8c94e3f0bd09cd4c5e1d962efde625de865dbd5798da716
MD5 6124fc3db6dadf7bf890355c7f18ad7a
SHA1 bf78c105d722ee398c8b1af4f6eefc8e7954022e
SHA512 b0510e03221d96596166d7c3cc00ddd4d6529f9a0fbf094fb3d242f267156cac3e88a0b13799727c04b988a398f2c5141a49309e769209799c1192010eade9d1
SSDEEP 384:zX+aQikB+z/xvxjg/qhE13NbCG3bmWIgGsDI9zP:q/UxvxjgC+1RfIgGUIFP
TLSH
T1D6729D3695B87E3394F7E904795D0F9BDBB8947290C15AA84AEE5F0D06CB3D81342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c67deac7-9c50-4b4f-9652-2f7016adde8d.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\c67deac7-9c50-4b4f-9652-2f7016adde8d.tmp
Size 16KB
SHA256 b99e01b686a6c65c4f15246edccfd6f5b23d2d314a3a00fcb804134f1f83fdf9
MD5 f4186ca33867c383d1e059a05b8e7fe4
SHA1 3a03aec701c9ece9f998c97177ee807e124005ba
SHA512 455973e1bcbdc409f50cca946d1495d76acc4a5eb1d1222babea87f2d77f34da7e51ab4d130f2d703664c723bdeb52aa6b0a0508917cb5470b77553b6a8bb3fe
SSDEEP 384:zo+aQikB+z/xvxjg/qhEwNbLCCwmWICGsDI9zP:j/UxvxjgC+RfICGUIFP
TLSH
T15C729E3695787E3394F7E904795D0F9BDBB994B290C16AB84AEE1F0906CB3D41342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f47ba7d0-b3a0-41a4-a5a9-58b82a87b1b6.tmp

Path C:\Users\Admin\AppData\Local\ask3lad.testdrive3\EBWebView\f47ba7d0-b3a0-41a4-a5a9-58b82a87b1b6.tmp
Size 2KB
SHA256 8fecb9061280cfae9e79478a989792fd18303bf26926db49e2db865fddc7f556
MD5 115bc386704316a2863c61a8685f7575
SHA1 3413c8e988630a7dc93bea326368ca21bbee0bb5
SHA512 33977de2c64fddf840e771bb488a6f6b18f9e3eb7c67ed26bb7721bc7e0b93a05041f6ab0d84cc6f4a267624438cee0bd9dc00b13adee26b1053587f229f5c31
TLSH
T12B51A773ED54AB3759E34948B94A7F13EA356265E6511F84AADD0B0C01DB19C2343C3B
MD5 SHA1 SHA512 TLSH

Submit Download

default.png

Path C:\Users\Admin\AppData\Roaming\ask3lad.testdrive3\previews\naval\default.png
Size 83KB
SHA256 eb1bb98fee835efaa7b6d402a175a21b926061c691bf6b8120979d43a955513f
MD5 ddf721ef614c44da3c8ade807defb106
SHA1 8a43ce7b59a3b9d23a7c0a29c646c6221d2f1551
SHA512 9dbfbfb9393148d2936ef51e982f632e3a05c68075915681b0d6c95943e050f9e1dae48390846cd7ec6affdefcd9dd281a8c50e1ab1ccaf9dddd5f479bc3f4fc
SSDEEP 1536:iHmff0uCZ064Q4GIwlcq031xbzt3yfo/ZhdFSVc5Q7JE7EyPX7nR8pyOj2R:zD7Q4GIwlcq03LtdjdkVcKWZP18pyOM
TLSH
T1DC831231653ED6CF4DCF9E726008DD7C7A756E83622B8451E31933A81A5CE2B2D58B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestDrive3-Setup-3.0.0-alpha.21.1.exe

Path C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe
Size 45.1MB
SHA256 880005913ef2d67a2fe9e9807dd4857394de48d4b256c5d7ac7e46b83d194ac9
MD5 119275b98fa13e903f1e4b25f67dc15f
SHA1 6cf4b99025cfd4112c3a414aaee3e26c2d3d1737
SHA512 038423cba6ba0e0f9ce88a13ee2fa151f925ce1fc7890ff05bb4ac807624e40e5b27d715b2da48cead291aac8489c2797b1d45d8f9ec276724c10beab7099b80
SSDEEP 786432:0o9iiiZZLixUrF3HOSjDaPXjdxyaXTqnfwZRDLDxQCSOgEbH8RzC2VxGHaE9I8mG:0oB4Z2GB3HOSjDiykTqnoCCOEbcRLVMJ
TLSH
T1F8A73399D5BE93ADD00B5831BD12FBCADCC001B647069603A78455DB3E28BCA9ED2F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestDrive3-Setup-3.0.0-alpha.21.1.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\TestDrive3-Setup-3.0.0-alpha.21.1.exe:Zone.Identifier
Size 989B
SHA256 5ee423142a5a7e9cc33361316137397e62e176a8b67a9691e2625b1621a39137
MD5 6c6f4e19118278670ee9475d3d520250
SHA1 3233d68b9d8b0f019b6ab6e2cd17beabb260188f
SHA512 08311fe927317af4517824b2806233848e3feac1a26d52046bf7964b3086f8b493d03f8ecaac9a50ba5103a9caf63477abcd7ce2e3d7ff2c4ef1a44f8249c532
TLSH
T1521125EAD409895B5E1BF6865A4D4C5D983BE0A74507415963DAC289C0C82FE21E383F
MD5 SHA1 SHA512 TLSH

Submit Download

e7b0d63a-1bff-4d03-9bef-dc4bef0d5bfc.tmp

Path C:\Users\Admin\Downloads\e7b0d63a-1bff-4d03-9bef-dc4bef0d5bfc.tmp
Size 2KB
SHA256 25823c28c362129753a36eaf63aa9572b8b07a0c002cdaabf0cefcf7c85b7297
MD5 2e186996401df9d61bad73978c397c16
SHA1 732da1eba78350360a75c98b4999b7747bed0c37
SHA512 19df5a94dafe360e6e4c7cfc4a571dca968c627cc0b8f381d15138e1ec1a3e6289aa1261b811d72b0b8057377ee9f2f2d3d4b68a599f65a8c20f13a020b09f22
TLSH
T12851676BAF7CCDB2CD2541B01207E2EA1B35137468925A4ACBE05C5EC9778257B8131E
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_etld1_domains.list
Size 6KB
SHA256 2a9b59ec22bbd49e4475d2d350d496023551953c8b5ebe97266aefe51a0c5c36
MD5 3ca9dab6be71da08f51aede14b0e900c
SHA1 2ca6be97955e3c31a0f3f3cef0182fca93db171e
SHA512 16c2e3694f48b8695eb725969d89669bbb1b7b01cf5fe1fa4e69aa919050ad6d60ce47e8fc18b030c94b15d171543420338700226dfd13bf226b74aa85de5539
SSDEEP 192:7y+Ncyo37Cu1+F8/fi3E6Cfr/z+lhLg3ZRfceMBjcvXmgqqE7:7Tc3bqUB/z+l1g3ZmeTfmf7
TLSH
T15FD19FE4B7F1C94D5DE027C9DE7E204B3B9286A7D228F86022319C27023F33C194A651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_833390211\deny_full_domains.list
Size 12KB
SHA256 f154d0bc65cd130b16d1b6471df8ed2841b2f2f6d90e9912b73b37985062e623
MD5 d46f0f6333abf9bbb92ea260bd257b20
SHA1 5da02d8b3d87b5bb18b36f969efdbf8645e7977c
SHA512 9da29f3a8e7d2681666bdee5436e9a95b1c840d0d4906c85fd71725b041f5a1fb0ed30f6151a5737eb08ec42b8ee3e9ab2beced4c8b57785abfd55186bcf16ba
SSDEEP 192:xQDXUZT4QcnYNTprtSa625Tf7wykvSYJ5cGuVeeg4+YxujfKg6VFvfItXlS0GcZK:x604Qcncg25lkj5cvkY8jKLnvgtxLEV
TLSH
T1C642BF8CB2479A85C491BF97F1082614888DDF3BF95327942C693CEAC59F40F5197283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-194-0x0000019FA00E0000-0x0000019FA10E0000-memory.dmp

Download

memory/808-761-0x0000022401410000-0x0000022402410000-memory.dmp

Download

memory/848-1482-0x00007FF9CF520000-0x00007FF9CF521000-memory.dmp

Download

memory/1940-1302-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1940-1303-0x0000000073F10000-0x0000000073F1F000-memory.dmp

Download

memory/1940-1314-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1940-1304-0x0000000073D30000-0x0000000073D3C000-memory.dmp

Download

memory/1940-1316-0x0000000073D30000-0x0000000073D3C000-memory.dmp

Download

memory/1940-1315-0x0000000073F10000-0x0000000073F1F000-memory.dmp

Download

memory/1940-1328-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3476-1353-0x00007FF9CF520000-0x00007FF9CF521000-memory.dmp

Download

memory/3476-1566-0x000001B4E6150000-0x000001B4E61FF000-memory.dmp

Download

memory/4604-5008-0x00007FF613370000-0x00007FF613A8D000-memory.dmp

Download

memory/4604-1565-0x00007FF613370000-0x00007FF613A8D000-memory.dmp

Download

memory/4604-5042-0x00007FF613370000-0x00007FF613A8D000-memory.dmp

Download

memory/4604-4972-0x00007FF613370000-0x00007FF613A8D000-memory.dmp

Download