bbe2b864546bda1ae8c9f270a16cea69fdd01edb256b3bcc8ad8baf79f0f766c

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe
Size 18KB
Sample261014-msyf2sttcs
SHA256 bbe2b864546bda1ae8c9f270a16cea69fdd01edb256b3bcc8ad8baf79f0f766c
MD5 135d76fac1a5607b728fcdcb16861fb6
SHA1 08648dcfd58640195bd3f8211293d70c66be69b9
SHA512 bcd286fcc89e4ebd9194fe3189e8bb1ed87efd12c8a30fcd6838db7150f883f209bf449a15467e6795a091b4c1288c3b71b07ca4c58c24696ad3ee05c5a8c250
SSDEEP 384:FKVF9dkF9/hGDaU38GcBibHEl4wCxnMR03qS6mG07W:kVlkF9/oD78Cgl4wCxnVqS3Y
TLSH
T15482BFA266AC6E5BDDD3047687B7EF9A3A192CBC491673C303DCAB3D5835E500D12811
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5092-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/5092-631-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1317952255\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1587077481\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1504458756\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1504458756\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1317952255\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2412	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{CD2D985D-3593-4060-B8AC-4ACBA2BF1E6B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{FD476EB4-86D5-4497-89A4-CC52FC1768CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 1672	5092	jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe	86
PID 4708 wrote to memory of 3020	4708	explorer.exe	89
PID 3020 wrote to memory of 4524	3020	msedge.exe	91
PID 4524 wrote to memory of 4504	4524	msedge.exe	92
PID 4524 wrote to memory of 2412	4524	msedge.exe	93
PID 4524 wrote to memory of 3388	4524	msedge.exe	94
PID 4524 wrote to memory of 3388	4524	msedge.exe	94
PID 4524 wrote to memory of 3388	4524	msedge.exe	94
PID 4524 wrote to memory of 2876	4524	msedge.exe	95
PID 4524 wrote to memory of 2876	4524	msedge.exe	95
PID 4524 wrote to memory of 1728	4524	msedge.exe	97
PID 4524 wrote to memory of 1728	4524	msedge.exe	97
PID 4524 wrote to memory of 1728	4524	msedge.exe	97
PID 4524 wrote to memory of 4020	4524	msedge.exe	116
PID 4524 wrote to memory of 4020	4524	msedge.exe	116
PID 4524 wrote to memory of 4020	4524	msedge.exe	116
PID 4524 wrote to memory of 5060	4524	msedge.exe	99
PID 4524 wrote to memory of 5060	4524	msedge.exe	99
PID 4524 wrote to memory of 5060	4524	msedge.exe	99
PID 4524 wrote to memory of 1596	4524	msedge.exe	100
PID 4524 wrote to memory of 1596	4524	msedge.exe	100
PID 4524 wrote to memory of 1596	4524	msedge.exe	100
PID 4524 wrote to memory of 2060	4524	msedge.exe	101
PID 4524 wrote to memory of 2060	4524	msedge.exe	101
PID 4524 wrote to memory of 3964	4524	msedge.exe	103
PID 4524 wrote to memory of 3964	4524	msedge.exe	103
PID 4524 wrote to memory of 4652	4524	msedge.exe	105
PID 4524 wrote to memory of 4652	4524	msedge.exe	105
PID 4524 wrote to memory of 4652	4524	msedge.exe	105
PID 4524 wrote to memory of 464	4524	msedge.exe	106
PID 4524 wrote to memory of 464	4524	msedge.exe	106
PID 4524 wrote to memory of 464	4524	msedge.exe	106
PID 4524 wrote to memory of 3864	4524	msedge.exe	107
PID 4524 wrote to memory of 2852	4524	msedge.exe	108
PID 4524 wrote to memory of 3864	4524	msedge.exe	107
PID 4524 wrote to memory of 2852	4524	msedge.exe	108
PID 4524 wrote to memory of 4864	4524	msedge.exe	109
PID 4524 wrote to memory of 4584	4524	msedge.exe	110
PID 4524 wrote to memory of 4584	4524	msedge.exe	110
PID 4524 wrote to memory of 3792	4524	msedge.exe	114
PID 4524 wrote to memory of 4392	4524	msedge.exe	115
PID 4524 wrote to memory of 4392	4524	msedge.exe	115
PID 4524 wrote to memory of 4020	4524	msedge.exe	116
PID 4524 wrote to memory of 4020	4524	msedge.exe	116
PID 4524 wrote to memory of 1000	4524	msedge.exe	119
PID 4524 wrote to memory of 776	4524	msedge.exe	120
PID 4524 wrote to memory of 1000	4524	msedge.exe	119
PID 4524 wrote to memory of 776	4524	msedge.exe	120
PID 4524 wrote to memory of 3688	4524	msedge.exe	122
PID 4524 wrote to memory of 3688	4524	msedge.exe	122
PID 4524 wrote to memory of 5844	4524	msedge.exe	130
PID 4524 wrote to memory of 5860	4524	msedge.exe	131
PID 4524 wrote to memory of 5868	4524	msedge.exe	132
PID 4524 wrote to memory of 4016	4524	msedge.exe	135
PID 4524 wrote to memory of 4016	4524	msedge.exe	135
PID 4524 wrote to memory of 3772	4524	msedge.exe	137
PID 4524 wrote to memory of 3772	4524	msedge.exe	137
PID 4524 wrote to memory of 4936	4524	msedge.exe	140
PID 4524 wrote to memory of 4936	4524	msedge.exe	140
PID 4524 wrote to memory of 6004	4524	msedge.exe	141
PID 4524 wrote to memory of 6004	4524	msedge.exe	141
PID 4524 wrote to memory of 2348	4524	msedge.exe	143
PID 4524 wrote to memory of 5796	4524	msedge.exe	144
PID 4524 wrote to memory of 5796	4524	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.VBKrypt.tglw.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe http://www.youtube.com/watch
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://www.youtube.com/watch
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffe2593c188,0x7ffe2593c194,0x7ffe2593c1a0
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,18410663659796243703,6759727928958877731,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
      4⤵
      System Time Discovery
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,8815854736354051423,5693367905361603448,262144 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,12492276290225846843,8093662411451452206,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9071300939858895574,11196835678791007293,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,10968434003419333394,2479325235687469770,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,11944595381703117882,8107235438901249558,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,13900706630253280940,8215004998166546470,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,17015514162071093590,9690099626622717096,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,10863643597825574989,15908603943178243175,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5400,i,14681748663490709277,9890497249050002281,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5592,i,5073542126679854315,257244415474550482,2097152 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,7259501155217828345,14549790635220993333,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,14925212766863926395,14259840016040829219,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17220023842566105577,10742662602742101955,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
      4⤵
      Modifies registry class
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4332409341657995777,8031945806958874848,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15438430337904589978,7954492472665245306,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15438430337904589978,7954492472665245306,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,9297439997399555921,10148272032686268944,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,18071725681443132158,8825452503766305479,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,2973255289282534487,787682954196045671,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17589943052207962890,2970269754936745038,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,7885638633615777195,835076366374351927,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,9482386883138149494,18115916058247714250,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,5556604716616778412,2570321627611825555,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,12560993978228040706,8947310482748711968,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,10814839094518243398,8050191964910972488,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2457508070725542242,451005233841215159,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,187025452957113412,15865335239054682878,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,7219202471101379170,11488991406098675400,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7008,i,13941921919252075624,3407481584981240739,262144 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10145365482011525069,5637091025621038515,524288 --field-trial-handle=2364,i,15463008207737192893,1700455836020557395,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
      4⤵
      PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1504458756\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4524_1839461336\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

5201abe2-b2f1-4c56-b4f9-b5e7c3918aa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5201abe2-b2f1-4c56-b4f9-b5e7c3918aa1.tmp
Size 18KB
SHA256 539b5bf572f780dc9f286ca3bf799f2776f431c32f7c596681c7907dc1283d20
MD5 96df0c82c67a9749604d6f2c75703e4b
SHA1 8f3898d0299e970dd02ea272a0651d776e2765fb
SHA512 cc6917aec203b8d90daa0cdc4ac19b4c54e5ac18f838761002e4cb65c6035b4448fe56337828e43078a4ffc53a88e7230c561958032cc1b6444f93625654dd0c
SSDEEP 384:nDQkUSvGsNsUJMZRw2nzHX58EV8GAqXHJrYPPJAxJ4CIIlv:tGTXba2HhYPPkJ4CLl
TLSH
T1B8826C35A8B8AE3B49E3A544F15B39039FB4A117EAC51F94C6ED6F2C01CA29D2307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87f0f8ae-3e6e-483b-a54c-374c3f257658.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87f0f8ae-3e6e-483b-a54c-374c3f257658.tmp
Size 18KB
SHA256 a1075445fa1f815c04fa29239b53dc063d808cdadb533c15d1ec1c44cb6094bb
MD5 d1c9e68ee8248827f8527acd0fde1424
SHA1 18563bbe80e735fad39d6838119bc6a6474e5c41
SHA512 4bd8db3f6018e3d64aa387de3bd240163ef90c6b6b41765621d3db9eebe2ccf43139f624c39fdffdc7c18985331e96205893f61d3794a4c9a14554d4402f9d84
SSDEEP 384:nHQkUSvGsNsUiMZRw2nzHX58EV8GAqXHJrYPPJAxJ4CIIlv:ZG2Xba2HhYPPkJ4CLl
TLSH
T139826D35A8B8AE3B49E3A544F15B35039FB4A117E6C91F94C6ED6F2C00CA29D2307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

575eedfb-45e8-4482-8c29-8af969a14845.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\575eedfb-45e8-4482-8c29-8af969a14845.tmp
Size 11KB
SHA256 ef79ebd7f5af9c5be857c688a5dd120736a234d4c944c9daa328e6804587a114
MD5 c689299ddca1ae9009920c98150dd310
SHA1 1a813d9f6a81a6500a3122c9119bd6a6bef324b6
SHA512 03b258fd3727f4be1726bc98c3eff6e8647f208f34d81953688c5bfca826c2a073d2789d4749feca727347862d6db0bafd148247d517dbe15b3f82e80de40bf1
SSDEEP 192:sxZXR3ZS/fBslM+tjIdp049JHW6+WNnUd/B5rdRF+5Ig1J:sxZXbS/fBslBt8/Hb8/VOf
TLSH
T1A042D952AD24A57F8CC7D21DBA55BF53D2FA1031A4C54E94EAFC862C04EBADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58e3484e-9659-4141-b67f-241e57eebc94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58e3484e-9659-4141-b67f-241e57eebc94.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6bac10e3-4163-4297-b039-d1544863ae3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6bac10e3-4163-4297-b039-d1544863ae3b.tmp
Size 32KB
SHA256 1398da84578930ad124971657b4c096c6b67fe5b4344fec683dc56e1d0a050a1
MD5 b13e70e10f1760e218676de86a0ebd67
SHA1 ace5a6a628db76345ce36379f0cd099357fd9d01
SHA512 1e4f0c310db814c4057395f7c29b56ea431471d566f9d4255651431876c574955dba8ca827ee9a765c2e67023d2cf90d9962f2270b5876400dd9accb02b8d188
SSDEEP 768:dCy4JUL7pLuLj/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVl7jiLlc2Tb2roc:dCy4JUdEj/DWvbtBhu1ja47jiLm0bNAB
TLSH
T166E2E93B680CCA7E4F800A9DED5E7F9B6EA8028B95D8C95047FA945C02C77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8311e16b-1c62-46f2-bbf6-5579148b310d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8311e16b-1c62-46f2-bbf6-5579148b310d.tmp
Size 12KB
SHA256 ea97e84fa878382cc12f00beceeaae1374544a3d039c82ebe6291d11b34e113f
MD5 1d6f27b58c824bd2796baf5312467063
SHA1 b62a9121bc5a1c4d34d8916e45ce3e9d71c81944
SHA512 4f5ca20cba85b8159dd4d167260ec8ca6d35b23124c1c6b3d2e56e08edbe5300a953ecb7c3a1a124789f8c7fea7e43440230933462c1820969030e40483911bc
SSDEEP 192:sxZXR3ZS/fBsIM+tjIdp049JHW6+WNnUd/B5rdRF+5Ig5xJ:sxZXbS/fBsIBt8/Hb8/VOl
TLSH
T1E542D952AD24A57F8CC7D21DBA56BF53D2FA1031A4C50E84EAFC862C04EBADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d3e80e539c6fea2c50e688176165f6c26d699f112a712dc767fb7a724ede5301
MD5 dd28949dbdc4bb04ec028be3c3c43c3b
SHA1 5c23c47c27be370714a2ff63b7f24a7435679156
SHA512 b1901692c031dda713fcabd42f7cb2ff6acd7130791135f1b4cfb001bf9e6f4258950bddda02568bf1fc41d678d0ada85f557d8890c9de71710b41bbbdbe9c1c
TLSH
T11951F950C28593D9FBE852786BE12F5336347284B5877E424097FDBB980A70DB603674
MD5 SHA1 SHA512 TLSH

Submit Download

b1c44f24-79e6-4cca-a07a-9d058d5e0e15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b1c44f24-79e6-4cca-a07a-9d058d5e0e15.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 117KB
SHA256 05364cce586f33d91b06defb1c293e707b69b4283661a01fa387e77e0dcc8e3a
MD5 d2f7c0dda91c48019babeb96bdc8655c
SHA1 36f91be5798907d3aaf450b05486659847cddd23
SHA512 e371ba38b91cc9a01e9c8acd15f5d8eb9314758b536bda0804fbae189f9c376a8e93c9d09e63f7d8a7fa0a6c1bf9434cf4d898c76d31832a267c82d885837673
SSDEEP 1536:7VEkx+yPJvxESu5+OTid5abETxo8oU5xwP7r99:7VEI+yBv4ZTid5abETxo8oU7wP7r99
TLSH
T1ABC3C55E15D876E7C24881B588514FE25BF92E0A28CC709FE4D53A5CFBB6E852334E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 3e6a1e2682de535e791cb182b5a1a000ac4628397f3d55b1d3ad1cf4cc1f1b04
MD5 16463d2e50c4e18dd622aeac028dd848
SHA1 f8de9078619fd17bb2e35270c901ee3ad2237bf4
SHA512 25916dac9bba35d5061dd4ac0ee91676779a2bf83be4caf0b0821bc430bba0b421f06548a0e5a744ea5c8e5da70400242c7654e830bc9283d17092414329cac7
TLSH
T19EE0C038C8ECC23FD22465D71235BB0DD79B511ED7CCBD560F45CC04B48E18890AE190
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

186b0e4f-2dfb-4ef7-94ac-147a80947333.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\186b0e4f-2dfb-4ef7-94ac-147a80947333.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

246cfd9b-7f33-4328-b843-af0515b07ac1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\246cfd9b-7f33-4328-b843-af0515b07ac1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

debfbc28-170d-4e91-ba4c-5c84519b07f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\debfbc28-170d-4e91-ba4c-5c84519b07f6.tmp
Size 4KB
SHA256 7cd4e83077f942e3544208764cfca153b1435beed5838f01b41ae5a7c22e7c08
MD5 99f99451fdea5e7ba6ad15589e800063
SHA1 f9c4db7fcc91ce1de60a0497e8161bff28cd1292
SHA512 37a9f2e794202139c6faee68fb13812bbadb14c486bc8e906e76502b6b8779b4b5c90940abb074c7c546ad05f196ebf75dbde64be66e68b93108e2d40d0b4d59
SSDEEP 96:DYOu6VuGuGuQuwEFQZzyuzuYuMupufugOu5jufiwRuP6x:DDrNFjQFQZ+sptws6AEi0dx
TLSH
T10DA19EB7C3E4C26DC81156F4AB183D1ADE2D0D2883283C6AC9D5AF5B93E5471E240A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fffa76a2-2f8d-4dab-b2f2-84142e50548f\index-dir\temp-index
Size 2KB
SHA256 efdfdcb5da611e3922fea97eb2dae9cb9fe9607942fbe9f7216d608d23120237
MD5 4de07a747560133d6bc1d274d59328db
SHA1 4e3d582b52503fd018a43633980c7006e3ffb120
SHA512 a1263578a368481a975f0e01ad3e7fdd7dd25b78813d85c4e0f96fe1290e2c78f47e83b8e16397e90fd781fb153c3e141b6f9081972796fdb0c4452e95b57b06
TLSH
T1B941444CC890A7ADDC7551FD2D9819F253711D29FC58C76240A4B2B23403AB81B4B9FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fffa76a2-2f8d-4dab-b2f2-84142e50548f\index-dir\the-real-index
Size 48B
SHA256 c7442b838133d3741d50c69ffbcbd968b9c2620de177ad52c6cbd6546f65fc3c
MD5 8bd786eb84c9f42ee00aab4a188b485f
SHA1 361b1f7862c0312ed06426d2df0acaa445093e0c
SHA512 be0b9a7af0167571dc46f53db65c53da04f1fa9958fb7c5caa90f0d34a74b4bf03ec5b37a2ebf9fdfd603a105eeacda75393723c795abaca1abf0253761e4f11
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 9a611e7a5c3a40b329a2eb36289bb6ffcc6e126f59d45a639a91b5c02e3d602e
MD5 c9de634ec1aedc05015a32adc62a556b
SHA1 59b266b330a5dfe0eb7d59e611f24f1678d5cf81
SHA512 5c2dd4252538f8696f1c366ecc4c17da64cf4b97c36168afd990fe1f356900aa870bd763b41084a4c637076e8db153b27c18b2b9e86751b801a83c797f4335ad
TLSH
T1B4C09BF24531459F0B7459C630387B5F951F4C49D8C0CDE45809718370749138C65677
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 b8f869031ca935605005b7d8844a317315c3a31527f6b8f81d2c43220f5878d2
MD5 a4bee7fed547c707d35875e9543fbb8d
SHA1 cddff2addeb74142a1c7897ba7b071e3d3a9fc53
SHA512 90d4c4bee5684ba46a280ea2622747a401a2ba62a1235b1808fc8c1bc29d541e28ee10b359b3f2722221d39195e46eca2a802994990153dd8e18a68e4fed1c66
TLSH
T194D023F54631546A36F09F463034365F54368C09DC80C8945C06729370FC603C857A77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 a7ab49d8dd49b3b4889a19586a9cc8aeef7c75073bab43654ba66c5ada3b443a
MD5 a37b59dc67c10c82f70f8f3cfaa06c94
SHA1 f2c825dfd4b8da6b81838de68e83747c3d9b5f6d
SHA512 dbed0cb254fef0a0cb472e75e38adbb027f982bb4897181761168b270592be1768b51f230518246481303961a952955fb08ec7119941a3e6280da062698d439d
TLSH
T18BC09BF24521459F0A749ED930347B5F951B4549D4D0CDF45804618374749134C67677
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 132B
SHA256 738e0d65c9954598f71896d0825d89ec974b2c1beb8acc74ff5f9def7428ce99
MD5 409719ea6079e9e9de97968565a72dc1
SHA1 a423f6ebae89addd916d8b829468658975ad9492
SHA512 7122b04ca4c25d184bb1917ea2ae7ddeb43b135a0722b878c4b9e42e8ad543cc8ecf5d8bfaeeb3b7ce223333ecc7169b7efba38644565c0eac9c9933ee531938
TLSH
T1D7C09BF24D2145DF0AB09ADA30347F5F951B8589D4D0CDF85C04658376B49134C66677
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 885b3d135fbdf2b1ba8852186e0412a6cd88cd3f97fe5bb7826d2098c7287409
MD5 751982fa77f60509c1fe50765a41bee6
SHA1 cbc1a83698a9827875114dbbf9ac8cc60c6f40d5
SHA512 d20a19f152201ac5e74aa2c8b279e75bc422620b30015b6d5449253fa2600bfbb69119c66bc8db623a540d63d4515f1e4b6052886d7f4f7f99ff6e76e710eb16
TLSH
T1C3A002A0C54310C1C58906F4296913443221CE748B4A1321C8BC5485CA707644243000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 3a9458bf93b6fadce6e29b3eba4e3ef52f9033a53efc4135f3608d5e2b730f7f
MD5 2fce6682ef3707e5747f299a093e6790
SHA1 d0dabf02dce83bc3f1b892848870df825b0db65a
SHA512 91e5b178d5bcfda4a4bf7dd28d33bf4debda0aebdfa7114db3a376037c607e961b372bf5ee031f0196ae568d3c744ae1b216fac7ef1458e2b26cf1fd8f438763
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 851a675e412328058d595210fd00c257a2b795a6004ffc37fc9b05ffef5440ad
MD5 e336e3f1c3080d848e7e9de05da27e29
SHA1 3f7c69487c9828c5245611cb629086ab83d3b9d4
SHA512 8957f8d71de64a5c31de813a861680095d7c3d4bb5035fb3cdd4c26cbb3fbe8f33bdff7a98398005d425bcd3bc39778cfe38b52b4ff60b8f218c1f1e0d11dade
SSDEEP 48:KIDI1Ks04jyLbef70DCOcey7bCxKISm7K9C1Q8xhsYarhhyLEzy+suCLbyB6ISW8:KIDCKs0+r7GKIXq+T2Kg05
TLSH
T1F291324535BB065138BD258C82B5C71FA28236737118EA2B7FBC50A69E6FE040DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf5f5890-86c4-414f-ba67-2f848e7e246c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf5f5890-86c4-414f-ba67-2f848e7e246c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8568b85-c637-411a-9894-bdf53f683d91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8568b85-c637-411a-9894-bdf53f683d91.tmp
Size 12KB
SHA256 f0987cdd33de914eff6f5ebc77144306973331fb35599c67b14c58de02362796
MD5 05086f07a5a38aca2d137cb1df2a2c98
SHA1 cc0cc7933e2e5a4c73a284117d217df2c7c3a8c2
SHA512 5c042a0137e3ec39d11b154aff3138ff351bd3e935a5c1d5e5a661eecb63f79474916f3e175ccda34536c2171886afcd3ba343c2ed849064318ba118a6bd8d4a
SSDEEP 192:sxZXR3ZS/fBsFM+tjIdp049JHW6+WNnUd/B5rAbF+5Ig5nJ:sxZXbS/fBsFBt8/Hb8/OOf
TLSH
T12542DA56AD24A57F8CC7D21DB656BF53E2FA1031A4C50E84EAFC861C04EBADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e7fb59ce-207d-4abc-afc2-40534951b1f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e7fb59ce-207d-4abc-afc2-40534951b1f8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

29fe48f8-8460-47de-90d4-eef968128ab3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\29fe48f8-8460-47de-90d4-eef968128ab3.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

8609bd87-6e80-4e89-916c-f9cf5de2cfe8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8609bd87-6e80-4e89-916c-f9cf5de2cfe8.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

bef5943a-2b2d-4719-b160-f51914419641.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bef5943a-2b2d-4719-b160-f51914419641.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ff35c1e5-3d9e-4b9e-958c-aa9c5a460c9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ff35c1e5-3d9e-4b9e-958c-aa9c5a460c9e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d5be3c6a-b491-4051-8a03-eba4c65b1e2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5be3c6a-b491-4051-8a03-eba4c65b1e2f.tmp
Size 8KB
SHA256 5fb78044d5a10f1d7705fd77b4081dbc52601236f2ecee7ccab507a03bb18785
MD5 44dec52917c159f1de0dbbbb6145992d
SHA1 8687dc1e637370bfc9ab1d4309d1a30fe72c500a
SHA512 56d1fc2ee8504671b976c4814d066f1a2b154d7b24e92e3d70e7efa2b086d16448ea3015f1748d8764df83a29588e13cb0567c3abb342eda388a4296ee0f8c5a
SSDEEP 192:1ONCq6wlDgQmiUyp7W4X58gZ5jzorGArDlY0U6:1ONp6kgyW4X58EV8GAN1U6
TLSH
T18902E835F8686C7B8EF3AE49B58A26139FE5212BE6952F40CAEC1B1D00D765C1347922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3cba4d2-dbdc-4d00-8683-7098445fc581.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3cba4d2-dbdc-4d00-8683-7098445fc581.tmp
Size 28KB
SHA256 56f03ca425279ff33fa3d9f5b3b28b92f9bf42b7e79b6623b3181c27596b3b62
MD5 c2d0791d3ba5b3e8e20590da203a3e34
SHA1 fce758f8da08a80ae6e4c356f02fcbf5ff9e55ac
SHA512 8ab40a27ecd6bce422cadfa0557035a3b168a6a9b575343f28e4a3b6e0f6adb39d48a3d04fdea38719c1576c12da2b5c2065f1734d2d2b9fdf4c9ab5b4d965cd
SSDEEP 384:nhiFgQkUSvyJsNt8TUNTUlIliMZRw2szXDf4VX58EV8GAqXHJrJPPJAxJ4CIIlv:IFIo8wgrcQ1a2HhJPPkJ4CLl
TLSH
T19ED2A3F598D79A3BD9AE4783A33E2D429EBCD153B5885980B7C81D1CCC862BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c36c91b3-2549-44ae-9b07-5049899259bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c36c91b3-2549-44ae-9b07-5049899259bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fed2c2f3-ca8d-4cba-a873-8eb1cd398262.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fed2c2f3-ca8d-4cba-a873-8eb1cd398262.tmp
Size 8KB
SHA256 5aa8624638e4b9daae67be5925b52225b38e3dde5b315eb8b4c43ee853c314c8
MD5 56d7c2d84b68de94c66e6f9e1fc0ac45
SHA1 e977a1379be2d448b0a819f248bb42f576a0a483
SHA512 1855e83d4605046b69148476827e7059357ca92e4306af83c076617845771937746cf2680834f3183b454df7ad604c0ef678e6c15250d6d50c06a6eeb7ec8557
SSDEEP 192:uON+6wlD/QmiUy8k7h4X58gZ5jzorGAqXgSJrOvesqBU6:uON+6kBXEh4X58EV8GAqXHJrhPU6
TLSH
T1F1120935F568AC2B4DE3A588B48B35039FE55117EA896F90C6EC2B2C00DF66C534AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4c7a6173b66fa28343776ff72ce8858c52f0866c9d01c7cd90f62896b3b8c09d
MD5 55265fad386c94dc3e3a3175e0424c7d
SHA1 ba66eb92e8a642bc9c6e5eefa18898a3fa07a251
SHA512 874000c3df56227cc9b3d4050f02aa47aefae96f3133688fe0057d230863b9d3dd1dc8fb5b7dbea10d878ba3c75f6dc9005db5e9d1b5da05ba6a6d96a5651954
TLSH
T15B415E58B6F91108B3B76F56ABF7A9AD447EBD372F06D55E00110E8F0622A04C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

870737cc-cae8-4a58-9003-0ed7ef3a70a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\870737cc-cae8-4a58-9003-0ed7ef3a70a9.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e87c00c8-9a6d-40ad-8d60-662315e4c6bc.tmp

Path C:\Users\Admin\AppData\Local\Temp\e87c00c8-9a6d-40ad-8d60-662315e4c6bc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4524_150135623\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e77d3b81-8b6f-4cc7-b3bf-d30993c44e14.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4524_150135623\e77d3b81-8b6f-4cc7-b3bf-d30993c44e14.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4524_733373996\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5092-631-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5092-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download