1799389b7c45a2b27bfa9c67bfdb8a460e9dd4c135f6e60d3e9f7e8e228dad32

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Size 1.3MB
Sample261014-ntcreatzbz
SHA256 1799389b7c45a2b27bfa9c67bfdb8a460e9dd4c135f6e60d3e9f7e8e228dad32
MD5 6f1f391d9c621ba4c01bfcb9563e0401
SHA1 3d501e641bc6b638a77a1d3ac92ba9424f0b92c6
SHA512 8f9d461518f6f13b8362515f60bf70fd1c527d1fcffd4b5053433f5ad36d44c0c756588337f957cc60b67eb46c9a7444026ba84c900bc38e404916bea2992edd
SSDEEP 24576:hcYvfUtFbY3CAvmUBeW1AZRPJuKi/ZwRVoeJ+j9d:hDvESsUQIZwUg+Z
TLSH
T10355125E4AB14E03F1E24CB85DBA1E9DD1A82F775B3918BF502076443C782EBE97D00A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4896	msedge.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1168976548\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1168976548\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_884406160\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_884406160\well_known_domains.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
888	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{1C4B4D0C-A16C-4C44-B366-8D22653F9E27}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4896	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4580	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
4580	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
4580	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
4580	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4896	4580	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe	92
PID 4896 wrote to memory of 6024	4896	msedge.exe	93
PID 4896 wrote to memory of 888	4896	msedge.exe	97
PID 4896 wrote to memory of 5368	4896	msedge.exe	98
PID 4896 wrote to memory of 5368	4896	msedge.exe	98
PID 4896 wrote to memory of 5368	4896	msedge.exe	98
PID 4896 wrote to memory of 552	4896	msedge.exe	99
PID 4896 wrote to memory of 552	4896	msedge.exe	99
PID 4896 wrote to memory of 2852	4896	msedge.exe	100
PID 4896 wrote to memory of 2852	4896	msedge.exe	100
PID 4896 wrote to memory of 2852	4896	msedge.exe	100
PID 4896 wrote to memory of 3220	4896	msedge.exe	101
PID 4896 wrote to memory of 3220	4896	msedge.exe	101
PID 4896 wrote to memory of 3220	4896	msedge.exe	101
PID 4896 wrote to memory of 2040	4896	msedge.exe	105
PID 4896 wrote to memory of 2040	4896	msedge.exe	105
PID 4896 wrote to memory of 2040	4896	msedge.exe	105
PID 4896 wrote to memory of 4832	4896	msedge.exe	106
PID 4896 wrote to memory of 4832	4896	msedge.exe	106
PID 4896 wrote to memory of 4832	4896	msedge.exe	106
PID 4896 wrote to memory of 5848	4896	msedge.exe	107
PID 4896 wrote to memory of 5848	4896	msedge.exe	107
PID 4896 wrote to memory of 5848	4896	msedge.exe	107
PID 4896 wrote to memory of 2092	4896	msedge.exe	108
PID 4896 wrote to memory of 4112	4896	msedge.exe	109
PID 4896 wrote to memory of 2092	4896	msedge.exe	108
PID 4896 wrote to memory of 4112	4896	msedge.exe	109
PID 4896 wrote to memory of 5364	4896	msedge.exe	111
PID 4896 wrote to memory of 4708	4896	msedge.exe	125
PID 4896 wrote to memory of 4356	4896	msedge.exe	126
PID 4896 wrote to memory of 4268	4896	msedge.exe	127
PID 4896 wrote to memory of 5228	4896	msedge.exe	128
PID 4896 wrote to memory of 5228	4896	msedge.exe	128
PID 4896 wrote to memory of 2944	4896	msedge.exe	132
PID 4896 wrote to memory of 2944	4896	msedge.exe	132
PID 4896 wrote to memory of 4836	4896	msedge.exe	133
PID 4896 wrote to memory of 4836	4896	msedge.exe	133
PID 4896 wrote to memory of 5560	4896	msedge.exe	134
PID 4896 wrote to memory of 5560	4896	msedge.exe	134
PID 4896 wrote to memory of 2972	4896	msedge.exe	140
PID 4896 wrote to memory of 1052	4896	msedge.exe	141
PID 4896 wrote to memory of 1052	4896	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.3gri.com/
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffc6911c188,0x7ffc6911c194,0x7ffc6911c1a0
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,6515324772157449329,7285377477787012430,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10112647178364020797,5838988464090349994,262144 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,11725848328521626680,9596943227022897449,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3559634243922152907,15793716566990544550,2097152 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,15029420281173563408,11972019106897458926,2097152 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,10112057476365684525,12051719855948300657,2097152 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3844,i,4574565927662729886,6580208455631200720,2097152 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5160,i,7139247238298090826,16021711135409487220,2097152 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10820133539204850751,14856079596627199183,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1906874345169151343,7870226272025096010,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,12564075855175299536,5754145098233511139,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,12564075855175299536,5754145098233511139,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,15688313765706830067,16760589982999842810,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,13619149885331785645,5456216093921515683,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,9876816953632107717,6214012807542226476,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,2084747602013946034,12560853548676515956,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1584796435622224961,2090077445677963207,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,11857391249626662167,8997696060577227619,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1838757861541048455,10354950348862439875,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6700,i,5433506906334770450,12152752073977013030,262144 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6902587954194057388,2890548214852123632,524288 --field-trial-handle=2284,i,1832934790555219980,568493509057006180,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
    3⤵
    PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_etld1_domains.list
Size 6KB
SHA256 8babf90cf0c44b6e36537a8535a0e3d89e04001ae8b08a7fb50a51419c88a2e9
MD5 412aad0c01696dda21dfd839dc7ae2c7
SHA1 28a3a41d4d8dfee7fcda638c4373aeb2b384cad9
SHA512 944d8cb2340ba8fe3dfb84dcaf2b600f33f5e944e488be0bcade0787a73d3f6fa4255f005d230d74e0d8d13a7ccd4d3e2144626d6ea4ea3beb078f3cdcf71e31
SSDEEP 192:6D8dUysbBX9GyjW7xeU1ypJ5cz626OpqRiaFDBGUPJ:I8dUystXqsU16J5lvoEFlFB
TLSH
T1C7E1BFECF4C887F13BF43727C47F2A431A0EA119BD5A5229C91E6F00311D748182553D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_115249277\manifest.json
Size 177B
SHA256 77a882c1ca9977c89f8e67a15ec1854a8eb84e1e79bf7009808ae9eaf5193b65
MD5 b9662cf1a01e6a1e875d12cf69862abf
SHA1 8644cbd5900e21cf6422e12dcd8b12c203f32504
SHA512 840e37081ac9b9974a0c9c151d17c04544be2b70810a0a2d5baf30f0decfa927596df9282a8b9728f9588a6da051962b45b3198328c1df05bec31c2a7b9b0858
TLSH
T109C012EFDC509DB115EB4323156D43C4E733CF0B1546450935FB66082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1168976548\data.txt
Size 152KB
SHA256 bf2c0a94df6f6a32ea1072e61ed3767c23fb8b3e864b0f6144f65c4b8e477338
MD5 6dd40551f20e2c6ad5dc991e60a7d4cb
SHA1 1147d32c228d4def80fb6415d1f58c1edad29055
SHA512 0d654ba49f9c53349b90cd2ce15424477b9c06ae3ae7bcfa09f61e12607f94750cc065d85458e985632f7c316e79d3b9ff279248fa1e6e4181f16e37ab31023c
SSDEEP 3072:GPAgDcCHaLHl65aynyosxb3+BLvf5yTewIjNq/eq:6X1aI5aZoKzMD4Ajy
TLSH
T19FE3F2608EC45F99CFE4292C90BF1F1A63E18BCD811A698EDB63FD066FA7A0415271D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_1524316230\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

well_known_domains.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4896_884406160\well_known_domains.dll
Size 86KB
SHA256 f63a806e2b89ed1db25687026abff5df4675a82a13882cdb2a47d1b08d2c996e
MD5 94e3e395b95eed4fe8857e0258d62491
SHA1 0e9bb0173cb2df4be5eea77cef5a09bb5b3116b3
SHA512 b680ece7a8b72a6f78a1643ee52a606fe7a094fe058bac041c25b775dd472834a1df349d45594a11fe6eb4c41d083bdb9809e944d9ff254d795f04e177ac19d7
SSDEEP 1536:HJxEzwtlOEMkVXvopF0BYDfBny/nXi7IruMPzEVWHxgeBz4:HA2DMggpuusPXBuEuaxgEc
TLSH
T17583F14A7AAC149BE9EB8674E2645E17BB72775B071893EF1342D0040DF73C1AE35A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3df6b73d-9c27-4e13-ae03-2792e58ae17c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3df6b73d-9c27-4e13-ae03-2792e58ae17c.tmp
Size 32KB
SHA256 763f3748f112c11b598ab0f63574f74417b903e8caa8d550315cf872dcf10275
MD5 254e2068b6e48298559810188c20c14c
SHA1 490cf8f0ac64104ad694ee88221fef0ac15b412f
SHA512 a45848c8f6677a437cd42d96e85a37f01c62db61a1db61bc962db386118184555893e2b61fa222be296bb5825e8d005bb3f67274eb985c400aa95a856f740818
SSDEEP 384:nwiFzQkUSvz43sNo8TUNTUlI4LaKM3OaAxuwzWf/BC2uZneCUOcuwGmnPJAxJC0n:LFds3Nwg9g74BCnnr/cbGmnPkJCnLQ
TLSH
T1AAE291F598D799B7D9AE4B97A33D2D029ABCD113B4884694F7C51C1CCC821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fb77e17-8173-4fc8-bae2-d55ea723f2db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fb77e17-8173-4fc8-bae2-d55ea723f2db.tmp
Size 26KB
SHA256 9181cd29143335c49fac6bdb73682b08255430c24a7163561bf7622c229657ee
MD5 ceef5a55ed7ebc2050497f2499ea2d48
SHA1 e84be63b33b915f6b0059b7f315840f0169caa75
SHA512 a6852937405f3c20fa297a1878764f0a080ccda98b1135d5918d66af6c67ccf37505237017b6370eda4ddcb3238e046ffa17c4cb391fb88e67097d4d780698f7
SSDEEP 384:n6iFzQkUSv13sNo8TUNTUlI4LaKM3Oa1xuwzWf/BC2uZneCUOcuwtinPJAxJC0g4:xFd13Nwg9V74BCnnr/cbtinPkJCnLQ
TLSH
T12EC25B36EC99DABBEDE64F95A74E3A43DEE01223D9884AD4DAC95C5C00C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

031c03bd-813e-46bc-a616-8032a215ae72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\031c03bd-813e-46bc-a616-8032a215ae72.tmp
Size 13KB
SHA256 919dda9f99f7f70e299b1296a1757faf1553c29f7bf1128951c89d03f50ccf5f
MD5 9c67cec2c00b5e5f1c6a462bdd710480
SHA1 462e67f78d2eb67328a0912771c0dfdbb650930a
SHA512 8db4df3af482c07ac0c941d5a241a5fdbf55504c9c2275d131345723bcf8b709d3f88ce2b1ebe373b2baf0a6c050251df284ee2fcc15aa4c7127c4b5317d321a
SSDEEP 192:sxZVRMiO/fssbaQZLjh8NzodpeBHW6+WNuUj/e32k2gsoFtpS8MIgjtSJ:sxZVHO/fsseOPmGqHbd/e9Shjtu
TLSH
T11D52D855AD24A97B8CC7D619FA55BF53D3F9113294C10F84AAFC8A2C14EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0d9be1-922c-4c7b-9199-54c3bcdccd9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d0d9be1-922c-4c7b-9199-54c3bcdccd9d.tmp
Size 32KB
SHA256 560aa7c819f7edf1642c4cf71c12fa8799b73e56db85971671d24d68de3d77b7
MD5 a679997b232cf833a2c42a8022201c17
SHA1 b276b31f07d9736a216bdb2d31629ca0516cff5c
SHA512 90d5cfc1923f7880fbb9f061237c6ebbf473299a502d92db05dbeaf216b5170fcfc2e6189b0dbdcef4b49cf194319d7836efff24a54a807759f69674bddf2421
SSDEEP 768:Px6r8sW7pLuLbG+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OV51qpLlvVajYrof:Px6r8s2EbG+Wviy8Ku1jas1qpLd4jjo+
TLSH
T1E2E2E97B780CCE7E4FC05A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21e63af9-c146-4be3-91da-84886b55aa8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21e63af9-c146-4be3-91da-84886b55aa8f.tmp
Size 13KB
SHA256 d3e8651e1ffb0d8a6145ec9661a135b4f3e587b58e633bf2e37ec255134a00f0
MD5 c403b2bf21b84c6f8617838085543f23
SHA1 9a3e904844b785e6f3c3ce53e4247d03de6adc6b
SHA512 900551de00f828e0b8af5ec523a633e9938a2dc0a7075431acc4bcc0ea57d653545bfb1362771f4eb3f2fb80753422de66ab0abd6f26222719f6bfa2fcc6b097
SSDEEP 192:sxZVRMiO/fssZQZLjh8NzodpeBHW6+WNuUj/e32k2gsoktpS8MIg5u+t/J:sxZVHO/fssZOPmGqHbd/eCSh9tB
TLSH
T17352D955A924997B8CC7D619FB55BF53D3F91132A4810F84AAFC8A2C04E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d6da70b-af05-4e21-8f40-c3fc470c9ea8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d6da70b-af05-4e21-8f40-c3fc470c9ea8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4c2da93e-9338-4c85-9c8b-2e1b4b8c5dbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c2da93e-9338-4c85-9c8b-2e1b4b8c5dbf.tmp
Size 414B
SHA256 2e402ea1e52f7c8f787fe5548cde1482a514c7222aa93f6fda6d7eccd89691f7
MD5 8991d7f70a008bc8d37b59b7b447a572
SHA1 fdf9d85910e37f29f02f33408b6f55f9f372bf3c
SHA512 759c55390f8512660d6d15b9a9ccd14cb637b6cb62a5090375ff33187ddd3fc213333af1c2fa14f800115743cb0eae99f248ba7ec1047e24d412292ca0316ba4
TLSH
T141E02B6AC811EC3B08FD0B7960940645E710132B2A509D4F7B3D80088FF16364195C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0982f1d937ad17d45ef22a1c008f6d0f794dfc33976d490e5ddf19130e7081b4
MD5 749dd29c9968636d21ad88bc2958fcef
SHA1 30552af4a4b30fc6ed279335a4f32e56239751ff
SHA512 fce163d701cef65e28d3a7cd4806ceff6353cbef3e4ff302db90018bea032e6d770b393fe02116393a1ffeddb9965b4853ed5d00c0c042ad2acb7b8725cb8c5e
TLSH
T1CA611D884BD175A0EB789236CAE8F9F7F57072FA56C77E0201A6E9FB5F47B901148004
MD5 SHA1 SHA512 TLSH

Submit Download

65f09e3b-7ade-48fb-b9ff-8cc9ba3c81a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\65f09e3b-7ade-48fb-b9ff-8cc9ba3c81a4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4ca662a9-a0f2-4205-822a-fafb5a638055.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ca662a9-a0f2-4205-822a-fafb5a638055.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6b2cede4-86b9-475c-a8ef-adf8de6e84c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b2cede4-86b9-475c-a8ef-adf8de6e84c4.tmp
Size 6KB
SHA256 0cd2735cfca435c0314b505f8467bf31ee3593c22eb16e6a3f4e16ad689c7f0f
MD5 b51884231aab08f6591e82d041378478
SHA1 11dea7b036112e1a4e41e720c1116d6a7411f4c1
SHA512 d27f7a73a313de7f672ab06922ecff89dee557d5db037fe336aeba218ba1e3528884ac573650266e4270a1be4dbf970c4bd475e4a85ce68c1b6927812771e876
SSDEEP 192:DW1BoBnBcBUBaBJaaY1iBrBhIBBNB8BkBQB3BuBYB0B1Bh+BzB0BmBuVcTT:DW1BoBnBcBUBaBJaaY1iBrBhIBBNB8BT
TLSH
T17DD17DF7C2E4CAADD80595F1B718BE1FCE2D0518532C3D1A88E5AF9797E2861D201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

718247e5-89f5-4700-b884-f982d6db874e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\718247e5-89f5-4700-b884-f982d6db874e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 58695acad057fc93375968affcdfd31204f1ddd6d614103cb325b974a59fe6f7
MD5 7b4f12e9b159bea45da2ac0fa912ca52
SHA1 651556200ac582c446f5d8ecbf211d1d60e449d0
SHA512 9437183df8081932d2aa7ea3f0de95b48912f91192fb4fb390024748bf6b939240329d3f7206db509e24c85a3f135d4ff04c0bd922d020f0ea71bc351cf3d6eb
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgT:ST/2dXOJhJlpfnpp3tNXVrN3Glne
TLSH
T111B2231571BB421039FE391892B6972E164231B33119E66B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6844945-5c61-43f2-a419-9d50c8c42205.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6844945-5c61-43f2-a419-9d50c8c42205.tmp
Size 13KB
SHA256 4179d6cfdd56804d59890063aba80dcbe6ab237f749274116c11c6a73a063b27
MD5 e71763ba84b6fedec3d003094cd4a443
SHA1 7b9927bdae2bb16c3a561f257650f1c13c02e819
SHA512 d54cbc305486e1544983ae93a095580bd3fb27c1919e5dcd831cadcc53a18b756c379d6a6ec534bb8eaa0db46deb1c6e9456506bc0ed7ef3dd960ffea9c36f8a
SSDEEP 192:sxZVRMiO/fsslaQZLjh8NzodpeBHW6+WNuUj/e32k2gsoFtpS8MIg5StSJ:sxZVHO/fssYOPmGqHbd/e9ShAtu
TLSH
T17152D955AD24697B8CC7D619FB55BF53E3F90132A4810F84AAFC8A2C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.26\manifest.json
Size 53B
SHA256 e1cd8395b2a987ed86c356bfae0952ae09f0cb012030690d6e23615698478f77
MD5 231f4c6814bd04e1dff159c333e99a8f
SHA1 e7a5e431643eb7e17b88cd2bc6d76be5be95edf2
SHA512 10edf632be82534001690da65ece25b5c0882a44afd68b54ba078676f06cc19183c50e64b771f36b1d5a52ce2e885dc34ca4f4c049eb517770ee33c03ae06d21
TLSH
T1A29002600814921716C14E506570B882A391661955950D1D04455558029586CE0502A9
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.3\manifest.json
Size 141B
SHA256 fe8c5046a79693a9b7f32bfc3ed7c8fdf84c5d186f5326a527ac508345a44009
MD5 3a5a48cc06d7f5cf2ec6e467e34915dd
SHA1 b6c3679e8961f0af7b5a56704992d5561ebaf6c1
SHA512 ae2de2b1827831eaeae6c9d00d081aa7be570fb050368eabc6b549469b14d7409b55e3726d4ac8ceb6cf75e48b3a88604345cb56a53f0686dd84cf8cb262125a
TLSH
T130C04C5585005D71509D87781D6C97054B12CF5618946509DDC68309EC1DCCB64B234F
MD5 SHA1 SHA512 TLSH

Submit Download

a13f805b-39b0-465e-a7b1-5d744b3af8a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a13f805b-39b0-465e-a7b1-5d744b3af8a8.tmp
Size 26KB
SHA256 f471549f482906f2c3b218221f491d2abe645d60ef1d6f10a96dabd3648d9831
MD5 c737e3356e5facce64630aa778c1a4fb
SHA1 953fd2db9b4ad0acfacf2e88ba6a349bf8ae0d32
SHA512 385957941c8297634a7200f6682e7c5ad81606f9187a280923917a0beb2e5d2d2859272c551f00c5422c9ef54410985bea5cbabc8ab21153cacfe70b3383dee3
SSDEEP 384:neiFzQkUSv13sNo8TUNTUlI4LaKM3Oa1xuwzWf/BC2uZneCUOcuwtinPJAxJC0g4:1Fd13Nwg9V74BCnnr/cbtinPkJCnLQ
TLSH
T135C25B36EC99DAABEDE64F95A34E3603DEE01213D9884AD4DAC95D5C00C71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a24cb3ff-62b1-489c-846e-78cfe7911187.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a24cb3ff-62b1-489c-846e-78cfe7911187.tmp
Size 25KB
SHA256 b5e728ce517a523b95f7b4c0e09a985c4169ac1fff27df9bc499491180edfa03
MD5 0fc14b015e4d13f9dea053ee2e60b757
SHA1 095fd6a0c96ea14259d234d6324218fb482ab78e
SHA512 fdbd2512cf461ce360a4d9c24871bf3f0e65faea32f046b03ffc1e72af3f75f04e0b39f1dce4b8f9ba249b55c94f515b67d7db91ceef187faabf13ee4833b4d0
SSDEEP 384:nWiFiZcI63sNu8TUNTUlIm2aKMiv4wzWf/BC2uZneCUOCFM+7O6R2Feo3IgL/7Im:9FQ633wgc+H4BCnnr/CFv7TRyx1
TLSH
T166C25C32ECA4DAABE9FA8FD9A74A7A03DEF01153958C86C0D9D85D1D00975DD070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

018d0c1a-5c32-4226-a6de-344d5299f079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\018d0c1a-5c32-4226-a6de-344d5299f079.tmp
Size 2KB
SHA256 efdeab5f884e82118395a519971483387178b73c81707410d907a69a9688cc49
MD5 d6c024e0d8b11f24829e15215fb74e26
SHA1 4cb32f824a329a13318364409c76c18c59b453a0
SHA512 2dfde1af493fd5208872bcedf5cd376b8b038daa1d8e7ce5f1a4b154eefcf4caa918d3a2543842ab75c12466fa670c36a88a85ae4737906591ed3fefa6d1ebd9
TLSH
T1D4510DE058785AD1D0BD0E6EA49738EC94EC9221F494387E7858E9984E7A61A7085C3F
MD5 SHA1 SHA512 TLSH

Submit Download

540d99c9-ca38-4abe-aa52-b54e57f93eba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\540d99c9-ca38-4abe-aa52-b54e57f93eba.tmp
Size 2KB
SHA256 94566376ab97270304831ccb67b930339f70d58cac8966fa3398c9a02a0d647a
MD5 8696d70963034f85e5205ea4e4d26bcd
SHA1 7f1d8d99c47f195abb1cbd910c95fd4d65dc87b1
SHA512 2f178368ea3c939c9fa19ec0a8eebcc643328fbf966d217ad772d302994d4fcb2c0f84b08c5daef9748f18f462ee6307127c6fd10853211df472893d2e697993
TLSH
T1295112E05C7D5AD1D0FD0E7EA49B39FC94DC9211F4A4347D2868E998497AA1D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

8fde3f6d-c13e-42d8-a8e5-de06103e1052.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8fde3f6d-c13e-42d8-a8e5-de06103e1052.tmp
Size 2KB
SHA256 2e7e33493b1bc84ec44471e3ae72a1577e0200d0aa91a5e370c46992947bf307
MD5 dda4167981d7e3d7ab776b3c6de020a5
SHA1 5d4bf9a84895ac357d98309833a2c0e1ddadc49a
SHA512 ea10aa733737a01107e86be6d023380278ec885af42c9bd652f21dede6683aeda1c8dd2e466595fe23e85e5bdfcbe5c221795376b4ace7410f9021c27d1e012a
TLSH
T1B75110E05C785AD1D0BD0E7EA49B38EC94ECD211F4A4347D3858E998497A61E7085C3F
MD5 SHA1 SHA512 TLSH

Submit Download

ec1f5676-f768-41ea-8b7d-ff02ef62fb2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec1f5676-f768-41ea-8b7d-ff02ef62fb2d.tmp
Size 26KB
SHA256 5fd68483bae48a8238184dcdb2de4264189ed3381c49157887b01fc055d3b3eb
MD5 c6a9587d17c3558bd5563934875ad095
SHA1 789dbff496a8a54dc986a3afd2ae9d78ec687b2f
SHA512 e750bb92037622df52e6f02482f49403d564af2b0e5e6a1ff88e3bd16b1c8d01f2a2b6c0c277729903df51c4b65b51a63ac46beb3877fe67a2d7ff0aae5203ae
SSDEEP 384:ndiFiZcI63sN88TUNTUlIm2aKM37EpwzWf/BC2uZneCUOcuwCin7O6R2Feo3IgL/:UFQ63dwgcqs4BCnnr/cbCin7TRyx1
TLSH
T117C25B32EC99DAABEDF68FD9A74A3A03DEE01153998C8AC0D9D81D1D00975DD130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cb48ffa21fd106346731963abeeb95b3f6385b9577cadcf02e08947e1062da0a
MD5 7e6051ffe1418304428e1668e100864f
SHA1 b35e7178452ee24c9e002c6b7f3f893c2df97268
SHA512 c0bd34ad35aefdd20860d69b5aab85a25159c2245c52b95d93bc44f80da65965193e676d942988ae672636fedd976f117bcc6e99ea4aaa1c1f9044fa6b416ba0
TLSH
T1D4410B58ABEE1158B3B76F56ABF7A8AD487EB9772E07D45D00010E4F4623A00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-12-0x0000000000400000-0x0000000000758000-memory.dmp

Download

memory/4580-2-0x0000000000400000-0x0000000000758000-memory.dmp

Download

memory/4580-14-0x0000000000400000-0x0000000000758000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x0000000000758000-memory.dmp

Download

memory/4580-1-0x000000000060E000-0x000000000060F000-memory.dmp

Download

memory/5364-225-0x000001A58E9B0000-0x000001A58F9B0000-memory.dmp

Download