darksiderat | 6099b79e3460f3ea2117aba1457cc8f5e628129fecaa3dec50ecb9869b5f3a99

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe
Size 3.1MB
Sample261114-bafmqsbt3z
SHA256 6099b79e3460f3ea2117aba1457cc8f5e628129fecaa3dec50ecb9869b5f3a99
MD5 f6fde36021a9e9637c3b6b881abf7b23
SHA1 de2e94169152878037ac142f209384bbbc7713c0
SHA512 b5ca2425316b8fd17bbd7969a5fa85f9ca4172690e1a0cf3235d4b8c82bf80dfeaaa421c9b224ddbc1ea26fe16426643370a5b5feb70c52ed57abe9460a49186
SSDEEP 49152:utAiwb/WabSEqO9mui3IA89W4x8n+kKWZXqHccz4xqA1k5TrYQ:kwKbuiYA/lhcz4O
TLSH
T195E54C03A2F541ACF0FAD274CF259635AA727C494BB4A1EF225526D41E35EE07F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery darksiderat spyware stealer trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 3 IoCs

resource	yara_rule
behavioral2/memory/1832-1-0x0000000140000000-0x0000000140010000-memory.dmp	family_darksiderat
behavioral2/memory/1832-2-0x0000000140000000-0x0000000140010000-memory.dmp	family_darksiderat
behavioral2/memory/936-10-0x0000000140000000-0x0000000140010000-memory.dmp	family_darksiderat

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4824 set thread context of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1226b990-9ccf-4e06-a627-2d1b577282e7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3044_13439091391103973_3044.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\bc341057-e9a9-4ce4-b671-771e9c456b6e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5512_13439091390986153_5512.pma	setup.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_447647998\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_447647998\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1912155331\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1912155331\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_297419821\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{C4523087-760A-4FD3-A826-13E57761E4EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 1832	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	89
PID 4512 wrote to memory of 4824	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	90
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4824 wrote to memory of 936	4824	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	91
PID 4512 wrote to memory of 5796	4512	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe	92
PID 5796 wrote to memory of 4736	5796	msedge.exe	93
PID 5796 wrote to memory of 4952	5796	msedge.exe	94
PID 5796 wrote to memory of 3608	5796	msedge.exe	96
PID 5796 wrote to memory of 5248	5796	msedge.exe	95
PID 5796 wrote to memory of 3608	5796	msedge.exe	96
PID 5796 wrote to memory of 5248	5796	msedge.exe	95
PID 5796 wrote to memory of 5248	5796	msedge.exe	95
PID 5796 wrote to memory of 3484	5796	msedge.exe	98
PID 5796 wrote to memory of 3484	5796	msedge.exe	98
PID 5796 wrote to memory of 3484	5796	msedge.exe	98
PID 5796 wrote to memory of 5676	5796	msedge.exe	99
PID 5796 wrote to memory of 5676	5796	msedge.exe	99
PID 5796 wrote to memory of 5676	5796	msedge.exe	99
PID 5796 wrote to memory of 2020	5796	msedge.exe	100
PID 5796 wrote to memory of 5472	5796	msedge.exe	101
PID 5796 wrote to memory of 2732	5796	msedge.exe	102
PID 5796 wrote to memory of 3668	5796	msedge.exe	103
PID 5796 wrote to memory of 3668	5796	msedge.exe	103
PID 5796 wrote to memory of 3668	5796	msedge.exe	103
PID 5796 wrote to memory of 4644	5796	msedge.exe	104
PID 5796 wrote to memory of 4644	5796	msedge.exe	104
PID 5796 wrote to memory of 4644	5796	msedge.exe	104
PID 5796 wrote to memory of 3312	5796	msedge.exe	105
PID 5796 wrote to memory of 3312	5796	msedge.exe	105
PID 5796 wrote to memory of 6012	5796	msedge.exe	107
PID 5796 wrote to memory of 5560	5796	msedge.exe	108
PID 5796 wrote to memory of 6012	5796	msedge.exe	107
PID 5796 wrote to memory of 5560	5796	msedge.exe	108
PID 5796 wrote to memory of 688	5796	msedge.exe	110
PID 5796 wrote to memory of 2056	5796	msedge.exe	111
PID 5796 wrote to memory of 2056	5796	msedge.exe	111
PID 5796 wrote to memory of 3044	5796	msedge.exe	112
PID 3044 wrote to memory of 1080	3044	setup.exe	113
PID 3044 wrote to memory of 5512	3044	setup.exe	114
PID 5512 wrote to memory of 808	5512	setup.exe	116
PID 5796 wrote to memory of 4848	5796	msedge.exe	118
PID 5796 wrote to memory of 4848	5796	msedge.exe	118
PID 5796 wrote to memory of 4544	5796	msedge.exe	120
PID 5796 wrote to memory of 4544	5796	msedge.exe	120
PID 5796 wrote to memory of 1424	5796	msedge.exe	124
PID 5796 wrote to memory of 1424	5796	msedge.exe	124
PID 5796 wrote to memory of 4380	5796	msedge.exe	125
PID 5796 wrote to memory of 4380	5796	msedge.exe	125
PID 5796 wrote to memory of 6092	5796	msedge.exe	126
PID 5796 wrote to memory of 6092	5796	msedge.exe	126
PID 5796 wrote to memory of 1804	5796	msedge.exe	127
PID 5796 wrote to memory of 3004	5796	msedge.exe	128
PID 5796 wrote to memory of 3004	5796	msedge.exe	128

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4512
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe"
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=80.0.3987.132 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=80.0.361.66 --initial-client-data=0x224,0x228,0x22c,0x220,0x230,0x14026b840,0x14026b850,0x14026b860
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_f6fde36021a9e9637c3b6b881abf7b23_cobalt-strike_icedid_njrat_satacom_vidar.exe"
    3⤵
    PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb3e72c188,0x7ffb3e72c194,0x7ffb3e72c1a0
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15370922897978397574,12095175368304776782,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,1518406815646681806,1306288828824019137,262144 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,15237215647472792616,11015154027357614139,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17127108927038420368,16642213189956101015,2097152 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14432104569948540883,15796399537192008848,2097152 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,5493880711431556784,7091491202867142718,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,4008429600688419283,7044848348724357259,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,5513859273422494056,2500306610486745013,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,10241315806290154446,2817886841960579990,2097152 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4352,i,6238978506440959018,1424834995162658319,2097152 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:9
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,6975759976093263275,11370860592644839502,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15255033048365026991,5820316054636650246,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,8674598596248296757,3316306227933580397,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,16495754802455290584,4342590264909033039,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,16495754802455290584,4342590264909033039,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,11822758091133921505,15431446383426832355,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1e8,0x238,0x23c,0x21c,0x240,0x7ff77ea604c8,0x7ff77ea604d4,0x7ff77ea604e0
      4⤵
      Drops file in Windows directory
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff77ea604c8,0x7ff77ea604d4,0x7ff77ea604e0
        5⤵
        Drops file in Windows directory
        
        PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,7634913331166551664,16790188832858952108,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,9593424226813059014,10346123801277257584,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,3086007486211925640,6378895726061511354,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,14173747788711136342,15147320666081468991,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,13480549264456241788,12895968222045553794,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3764,i,15372630865302506946,2357994693889409441,262144 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,1244111383379887662,5605045575013382986,524288 --field-trial-handle=2360,i,534652233546761487,13114715062766537677,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3044_13439091391103973_3044.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3044_13439091391103973_3044.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5512_13439091390986153_5512.pma

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5512_13439091390986153_5512.pma
Size 1KB
SHA256 e37261d17ea74f0f7806e4080cc8874fc6b90c3befe53219c4a482a64326fe50
MD5 aaff10335fcdf392f1d871dd1f1f3c1e
SHA1 d3bcff39b76c75861d55ee7e06d66d546455ff88
SHA512 159839a9989a4a752a0dae331fb38f079d06e012552aa0b9e31509f6847cc7aa96ba7192cc0662fb27890b9778e5e153b7beb388b5d6191dc2a1b514f097bf1c
TLSH
T1BB319B44B7B89A43C8539632C4E703553BBAF6E637424BB62145A70F1E062C84ACA080
MD5 SHA1 SHA512 TLSH

Submit Download

236a62cf-b825-4704-875c-634fd88e5871.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\236a62cf-b825-4704-875c-634fd88e5871.tmp
Size 34KB
SHA256 190442b7099c7c19d665dd5d83a8f97f186dcd8c9f2eda586dcaa5259d866204
MD5 4119af4ae763916eda3d2433186f066c
SHA1 40fc543b084f26c22ecedbad41f48fd9b5ad489f
SHA512 c9ee6c80ca540b524c0455dc24a5b5ed9f18055d43847a26c6ce222662597c34346410fe8705988fb2a415b324d0978c489d26e61f74e25a62fd3312660a81b6
SSDEEP 768:2T3q36Oj0+t+/9OA9at01j0iq00+IaitZ75EW/LN:2T3qnCHq00NaSdD/Z
TLSH
T1A9F2AF71FCA19E779CE2B695B3053792AFE49213D6CD4A80C9EE2A0D004769E170BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69051896-4b5c-446b-89fb-01b4179c952b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69051896-4b5c-446b-89fb-01b4179c952b.tmp
Size 37KB
SHA256 3897c98d72a9429d30a22551727b14959353783aa71cfd00b998633812657f0b
MD5 9faa36b9bf30b416c81f5071940ed65a
SHA1 15e0639d84b2359ad5d1e46b01a413f3ef5263a6
SHA512 ff7e2e3b7763ba5f96ce10522fd9e530eafc854f862b1ae5a8bfac6aeba1012bcfa62a06ff428a957847f41a016d39c84ba82623be5c60948072a81b48dce952
SSDEEP 768:X/UxvxjgC+H3BGNOjB/9OA9at01j0iq00+Ia2GSHxRz:KZj3+H3BYCHq00NaFSTz
TLSH
T1BF03C031ECA15D739CF7B384730A63979FF44663C6C96AA04AED2E0D01876AD1307867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd69805c1003f07593304c4590d3142fb98c0f3fba3fd92a35566c41a3f74b13
MD5 447a3b615eeba043460ccffd6df32509
SHA1 6674feb077072a6016418e24100d71caa21a8d74
SHA512 2ab678cf9f3b21aefe5b8f943c72f6f9b8e1c3f112e27c1f50d1227c7110d184c0717c5ffc34a24fb5940e2b972a0ac77a624fd90e5440c3ca42a6d511bf3cd9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9c72d0f41e8a52dd9eddc102d0d40fe1fd1e5c66720bfd354a5822afba27c6df
MD5 5544fa4407680a535adf8c63a9079fa5
SHA1 05e5adbc84b5c1fa968d81b08d43eab5eea6f610
SHA512 245a753eafe1739e3927b5812013cd00c4ffd2b76b0f4c759f40b1b9b903f17c10a9a3eed16b7494c1b3b6aaff7bec95d373e8645e16a651d17566894ecb0aaf
TLSH
T1C8D0112A33200A2AC882A232E0A822A22280C882FE020288223020030AA0280002A088
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 120B
SHA256 36cbf388370bcf6f3500559d79451708027733be5dc54395f797b871e65046e1
MD5 fed76104f0653e396d34bdcb0e4be7b7
SHA1 d261de134c18ebc7c2b894a55b0140353ab3ad4d
SHA512 5211111eecdf355d0688cb4311fb3b4724210eca139a9a33bdcb25f0cc6155df18e301bd8e0c5ef5897acd0d68ff9e5d729e54cc0b7ea2f4038ebdbf7f06cce0
TLSH
T1ACB0026EC7956AA8D51A437A855807014B91CB42E77F67D3049027C5CEF304B4E60470
MD5 SHA1 SHA512 TLSH

Submit Download

20e43374-bfa4-4397-9176-08012738c7b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20e43374-bfa4-4397-9176-08012738c7b7.tmp
Size 12KB
SHA256 8fa2898ccd9b1789d12c0436bc50f56ed3cfe3965e9396ae4d5737757c398741
MD5 7d3937da31834220b728b1a7aa73a0aa
SHA1 121adf76a805f1853ce5ec11df7c4f6d59813f0c
SHA512 c2d5979f6a9793b5c412ca7007affc426ed79e2665cce02fb79d1aa14d4bea0d964533a0519455174c70e12b221ae8f27e4618af69241ef67d291b57647549c4
SSDEEP 192:sxRWRAxx/f4sNRXZYKAGZYKhoA8pJC/g6+WNPDn/YokJqGLPIIgDeYbJ:sxRWUx/f4sNRp3AwIc/5T/A868
TLSH
T19252C759BD28693B8CDBD25DFA66BF63D3F8103261941E48E6FC891C14E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bf42f91-6765-4646-a53d-f321d39913a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5bf42f91-6765-4646-a53d-f321d39913a2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f8d977-cab5-4b8a-8014-0d3975f94b02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95f8d977-cab5-4b8a-8014-0d3975f94b02.tmp
Size 29KB
SHA256 a4af00cbd7417c7caa57cd7ff815f50de23a08234e348b9ae80fb18f50fbe560
MD5 24b45c8bf5204d5b59b89082ecd897f2
SHA1 2c459b8a435c82e1a10d4a5cbf39d6c203d127dd
SHA512 58ce87d7d98a08193ba14cd4b229e1f61f86e93b323012ef54c7c39691cdf8051e0e2ca13c4be30eb2b46e23b6ebe6714cfa1d9f47211549e7683f657cee6625
SSDEEP 768:p/wWuO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjoXH3Ikro97j2:p/wWuOEbOnWg/Xf1pu1jaYoXXIv97j2
TLSH
T158D2DA7B740CCA7F4F804ADDDC197E9F6D6802CB9698CD9047FA885C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 24KB
SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
MD5 85cec2f36640165630285fcfde07831a
SHA1 680a959b7128688ec8201e5af72ab129474f7b4d
SHA512 74167696ce9516f43be0bc2a75524910e3193ae47ff75ffc339c33eb68594c09873099966a22701ec66978b5e7cfc372e257065387c0619860acfaab0da53170
SSDEEP 768:n/FWnQ1G+lImP9UJSz5TeKFMI6Nc+n820:qQ13IuSJSzFeKtU820
TLSH
T1F0B2E1346D581B27F1D251B57AE48EE8E1A31A05B4521E653F8E02002EC13EFE2E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 102KB
SHA256 1027c1fd63d1c619daae437c8583a7ed5e8c476980c0e21bd0ebdda4420a8bb8
MD5 56ffe4fd06e3cf2d199ed0267c3b686e
SHA1 024dfaa56424c0ac35df3d3801dda3c946d746fc
SHA512 df6516c028723d6c9a239ece3ec55a16c13cd47ba1a079c537eba5eaa01146235f3a04cba413bacd2b4fe5a26ec3d508e73bf00a0a357f13356030b26d55f66c
SSDEEP 1536:4FzXHrsVRQMbG7CTPZ/th5aYeOpBuUEoH3PGz7ManE6xNxN1a6dTDtZi/8s9Avpd:ebszn2+1tvaYe7E/G0+E0P1tJS8Lv8Cb
TLSH
T110A3122488525FB8EA44CF63F932ADE76FAA0713E15D2ED5193F019F58EC0E64631541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 260KB
SHA256 33afa2a565936a212e6d70e3f790672986c24bb370ea5b6ee06b3e0eb44558b6
MD5 0f974e9716dbae45f35d6b3377958b03
SHA1 72de97fef0fc44f34f3249f454de40a54058c0ce
SHA512 b9fdb1ee540e38f81f89c5b2165ca31b1fb001539b82238d201a1fd6a9dc207fdf8d4994833d2bd8e3abc8f24040497c61d8087d60770273ffa3704bdb91fb81
SSDEEP 6144:UgK3gowrgghqthopKdBRuZnYRNw4xbylzYhT:UgKWrqrop6BB44W0hT
TLSH
T10B4423FB95A072627835D82E04ADC283F3A13DCAC1CE66B644B4EE2736C495753C25B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 20KB
SHA256 fab436a127c29499e0ddbe96f33c5547b050fd49092ceaf6bad0dc1e04b36935
MD5 64d0df3dbc368144bc339f4b10141fe2
SHA1 8071f9d63f207f838ffe5521afaaa7406bf7a3b6
SHA512 4df86d13bb0d38cd3934d46b6ebb2b657c75146281524c1e94797e3aaf11c6ec05b95d19bba4cf8e5771b17774bc29bf73c44949a9980c1e09f21703754dfbcf
SSDEEP 384:501QE3bbzD7K6FGrRmOGEuKIbZb91uMqy11sPV2gERykhv2BRiWi9hrwc45BztKt:8QE3XzPrUR5GdZI3yqV2gERlvORzYMcN
TLSH
T16F92D0672DA34B6B0821302AFF816B65AA2D23419D37975775F4F5E8C8028F21A39B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 16KB
SHA256 337e833eeec5d082813ced903aa54622827f234f3dede039ff9214db457f1fd5
MD5 791aad127c501fa802bad7abfaa10c89
SHA1 6618a6123fd22e3662783402d1a4c49b26805a7a
SHA512 9b8f62e7a98e8d20b8b274c0f7cc06704717573e155c512cd2e3ae8bc0ba70fb8ed954663793c1319b2d1cdb18cc5da49aae6ea964b406b716795fd2006cfdbc
SSDEEP 384:CMGpcjgv7iP40u0b9DCTxP+OS/lkxUx3jBSsP0B6kp9P:C/pcUv7iPZdRkexzcscV9P
TLSH
T1B272C0B2499CF9581C2BF95A5A5F1ACF551CB087091C52E380264CE87E43D02F5B6EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 36KB
SHA256 b3c622445678ddc9dddfb67e7f343ce4693170f502b9410740b944195c402c24
MD5 e973a7c7cb3daed624058544bebe7ff3
SHA1 5445b16b74552e24421bba2c6819a4642792f2ae
SHA512 37400f499ae0bd2da4bce8a93c2dd60ce895d04aa86670070c96f5e4ec0fc9d8b80f3db09a1c686046e5e982a0ff398f343eb0ece37af66000715b7f995934d4
SSDEEP 768:A/RcM+ZHWVME7HScSsHoHJqr+KetePg5AcrSOsKKz:A/QuMElSUyvKtPg5LxKz
TLSH
T17503F2F0CFF7455BE588D7BB4DD8BBE58312231598279DB483822398A93CA3365C7224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 41KB
SHA256 6f32dd3791bdb95d7fa1fc7c94e24964c3588bccfe454f6b0fc579572fdafca0
MD5 b0ffc81cd8c6ee1ba19f8024aeddaba5
SHA1 0c59e4d7cc7549cf27b47a32ee053111a20114c4
SHA512 52076e5e4b263fa13e8e22afa2ea80ff63cc92a902368ac50e88e64292a5f1e92749dd36e6d17f8e020a5087c5743c22f0efa94aed8233b1a7463537147fee16
SSDEEP 768:WF51/6J1WbF9bN81hEYITTL7kEYUv20uvWkt0vXZHO/zfLq/Iv:gf6kbv1/L7CUBJvXZHOLfG/Iv
TLSH
T18C13022A97477481D3FA3489776903246A17944C77D3F9023678AAD802FBF47662E4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 3390aa7a9afb40d32147d5f2a70f33bfc2934e088db0b5fa6f9a1fdd364b662e
MD5 dcfe93b999dc618352e2e6199150e565
SHA1 6542ef0ca9cb4b17047d243430ea6ab219c9d7cd
SHA512 961eb5978cb03ec39d183a1e3c67bd6dee2ccf02bedc9fe655d2552ad68f94604753f10d74da15cbbe36c146465e3b3792126533c52977d84155587a54ff1567
SSDEEP 96:a/h+Bj+HjZ6sddRB75v0SsQ9OWoyU9rNIEmnBszry+wu5kzh5159HvF2kjZjocy8:Ye+DZm3WbYy4RtRab2S
TLSH
T18891C76486FC5240FFAA6E3397C51C822A25CD73768B8F07AD91D1E5AF273C28C6006D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e9f79a662ae934003635c66ccbd62abca09ad6490ef2ad2c4285f6fc2bd0ae3e
MD5 222c215228b72450594c1148ff63edb8
SHA1 4c08791389a537e78bf65f2890765ca5ad8cc138
SHA512 cf5587e02c80ce40157b9c662d364892d9fd24cd95fc913f2977835fe28d69afcbcdf283aa8197c5ee3945205a6dda5d0a7a79b3519e8b9136665fee2d8df76f
TLSH
T15E617E7846F06350FF7AAE7387D80C833E358580704B9F52EA94D264EE7B3A65D64078
MD5 SHA1 SHA512 TLSH

Submit Download

e6a08f9f-944e-470b-9c4e-81a35092e26f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e6a08f9f-944e-470b-9c4e-81a35092e26f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

17a2fa1f-00f0-4b54-b907-f60a16fedddd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\17a2fa1f-00f0-4b54-b907-f60a16fedddd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

aebf7a6f-e179-4114-8780-aaf71aa34ef8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aebf7a6f-e179-4114-8780-aaf71aa34ef8.tmp
Size 4KB
SHA256 9983cc9e1a4b1713ea40acece5ce5ead9c5fc53213cd9da444427a1f9cc4eb4f
MD5 d9655529ffdea10e4f55859f11a81952
SHA1 b71495ec4cbc08076ef748778f3a3e71bfb6cc49
SHA512 8f17007f92fa7fb7672de5f7510d073907e41a54dc1970ea899572b17afe0cdad49c8d38734d8bb910d34cbf486de2b25663a83a03b0ffcd90c5f2a9034aea7c
SSDEEP 48:YALlNtOCD+CDnCDOgymzVaCCfoKsLQzsezBCnOCKC+s9ClCYCsbCwCYksJCKs8C9:D7OvWJIVaZMUzBGO5UGHltj7x/itwQ
TLSH
T13681A9F3C3E9866DDA1195F0AA146E1BCF1D0552436C3D5A88E4AF1BA3F2461E142B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe312caa-0f21-4b94-ab99-8c7db44a7045.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe312caa-0f21-4b94-ab99-8c7db44a7045.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dea92bb8-a09c-4ba3-acbd-0e283fcd55fb\index-dir\temp-index
Size 2KB
SHA256 64cdddaf84a91fc4a2b1b04e693bc354ac41d12a1c8221c3f9eb4cff52d426c6
MD5 9f66f227dbbcd5dbf94dbad48f492856
SHA1 4b8f8df3b21d6847ef337d966d5b6ce1d26239ac
SHA512 7a70e0c0e0a4f4ee834a1f0254d57db74e44852d556df1b7541b6206dfc03ab0985093ad9cd3379f5b3f005ab58fc942eaaf5b78f95870395c25c5f21c8e3a01
TLSH
T1A251968D5C0B5766C82D12B125BE198023390CDC5EA90D0799ED816CE4C396D5E9A7AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dea92bb8-a09c-4ba3-acbd-0e283fcd55fb\index-dir\the-real-index
Size 48B
SHA256 631790adb49ae4918844813cb3d955abca9b4c646d0f7e081a195f48e33759fe
MD5 aedb92229a154be584d238839f876fea
SHA1 5ed02d8834b887fab0acf3e1389ced384abb1fca
SHA512 6709e8c4d71f3c3ece3e3fd6d958413152148d2dfc4d1be2f45129966ffe69128e38c6e528a9abca66ec34a512c67d67f299e7a68fae47c9ccfe6fddd88e5528
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e279c0d3-12e6-4843-ada9-df8608d03e02\index-dir\temp-index
Size 360B
SHA256 8f2c2ec60d9f12747b76ade01da3d946e7c121817a60288237e4d797ddd20f75
MD5 dfb4de0f891ae14221bc897bf362a511
SHA1 e8c35746ae85bbf6b9dd13a87eeeebf788f13e45
SHA512 ba639b38bd1534f30abe97f778b1b6efbe8996d22680748dfa6f40ae201c57b3fa8cca1ab5d9fa3f60f163f00306c4d094c5077416ed28d90662a31c5be5a1a5
TLSH
T1FAE02B8A2D275202FC5461B134B970B1B63224DCE3691E0F70FDD15E4CC4390FD47618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e279c0d3-12e6-4843-ada9-df8608d03e02\index-dir\the-real-index
Size 360B
SHA256 4e1bf1ce3dd0147a439a7055ef1d543adabb81b7258c51e0908d48ec26909214
MD5 8a19d616b0bc1ac0239486d5d797508d
SHA1 916429117a715c144fa032fdbec7de6a989a80e5
SHA512 34617fbc9c8b94944e013f69ffa739e6c1ef9793350bb2344255020d7815d385a7417a3634560ce867ffe6319c6b0bb490199fa912e88122fb6a2060c1aae755
TLSH
T1E7E02B4D16339141F91460B134796075A2721444E744360F62EA909B8CC0B44BE02719
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 95bbef1ea5bbecf7ed8d710c97b7beb994fa260b7126b85e3252aeb9eebf8d1a
MD5 5e6cf980bfa8c9f245879814e93eed5c
SHA1 097d13c49ceebad377999b35d06ab4a881e727ee
SHA512 ba6e8870f1eec68ed542a7b66c94863b58cf208c8ea6818a450a5e7f2a8b3c8480c99f4ef44145aedec8b14f14f83fca89917f8f4b2c8abe1da02800dc9fadf7
TLSH
T12CF0273A3EF36420E85BD6DA187190D912857C98CE40ACCF603B798B22B22556649C76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 484B
SHA256 27c606af8f5d4ddbb9a8dae097f2ee5eda74a6eba2d93fbe5249a3974465ae73
MD5 0ed49ec35538cca1180a529a450881af
SHA1 f913f292105402d9f2f24f38d7cf2230e0b1539d
SHA512 feac2e3b8ac52a1c8157695fe43a02af26a85a9b07fd0f4244b2cdcf5a2e2d9e0f1fabe19669593bf006ff664fdba4a55e151c6d23ed204fb2e03539fabd154e
TLSH
T14AF09E3B2EE37820E85BD7DE187080E502407858C980AC8F603AA98761B23152449C76
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 d9763a6e40067c3424dcc00ca7a0847246cdd2ba6a9a99acb0ae409d066dd1b9
MD5 bf50285970f503cb04865218de2eb732
SHA1 4db20f0f5d604ed0cbcf8d9fe3b5422ea095fb56
SHA512 18101453c2bd13d3e61620ccdd8162ed3e67064ac287ca0d5d069efb2c38ba953ef5d4f9c4c06aa49da2ea88a9663a1a56efc26cd446f76534980e35c026cbb6
TLSH
T17BA0021601A84459C0000274909B1FE66210892A5A56B76182F4E1BC9C917408323014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 41e6e1d463ac49941ff665cffe5c7efe4c950373a9731c5cce556a6ec585b5e4
MD5 1fc68747831d634a1535a502105df7bd
SHA1 8ae017e5ba9e4f752f81e0688ca72109fe6cae43
SHA512 d7f031086f2f1d974d98c6e1a96088cd608cb1fea3c15e5cd631736c53217757cdde788e341f2c7e6a5195c2ace112353ad9e80cf9a5a9449ba2c27ba791d13e
MD5 SHA1 SHA512

Submit Download

a8dc6020-a2d1-4fe0-a7d9-5d16ca193033.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8dc6020-a2d1-4fe0-a7d9-5d16ca193033.tmp
Size 13KB
SHA256 d0444980e88c29c19bf481979aa87a31558eb11764ef85bf7bca29014a8cb178
MD5 289db951a153ea3ddfb3d2f7984dce34
SHA1 9d39207341c32f3fc9a956694de0187a65c9d848
SHA512 cc422ea3a7b424509ea126ffeeba94a5630e2c0da878d3ca4424ad627f3dcfbd3ac2ded7835642d5a59ef8fd5d09f2a2f62742cca5b6e8e49100625f693c9fcb
SSDEEP 192:sxRWRAxx/f4sNmXZYKAGZYKhoA8pJC/g6+WNPDn/YoMvfqGLPIIgDe6bJ:sxRWUx/f4sNmp3AwIc/5T/gZ86q
TLSH
T1D752C959BD28593B8CDBD21DFA25BF63E3F8103260941E48E7FC8A1C14E66CD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecd49dd7-0af1-44e2-b7e7-10e18611ed71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecd49dd7-0af1-44e2-b7e7-10e18611ed71.tmp
Size 12KB
SHA256 8764cb654e70e9efce25f5446dc58433795d5918eb7bfbcdd3c72306cdd9264d
MD5 a2da47b9df689cdfcf126352c1e183b4
SHA1 23ecefb3b05148fa7adaca5730f4e32104bbc5cd
SHA512 702d9411a8745e2a735288660bb7b0cce5e154da60b13c15b6604be8897111cfe6bed95538af5a8d5a1f724af4cb463441b6c080192304c8adb7f5026b09b838
SSDEEP 192:sxRBRAxx/f4sRRXZYKAGZYKhoA8pJC/g6+WNPDn/YokJqGLPIIgVbJ:sxRBUx/f4sRRp3AwIc/5T/A8P
TLSH
T14C42B859BD28693B8CDBD25DFA25BF63D3F8103261941E48E6FC891C14E66DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fce1c8f-2439-4f8b-a79e-6829c800f061.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9fce1c8f-2439-4f8b-a79e-6829c800f061.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 57bf17859b17aef9e2986cd396a2fee69a8a49bf65732d9a18aee26087601f9a
MD5 d86e33053edb40f50918e7ec5e37544e
SHA1 18485256232ee7ba33e0d1487ded9316f1c5a5f2
SHA512 363732acb35c5e33645e9d975d24cd332328904faae32e5dafd3cf33acf4b0917e2aecdfd24cf9d89b35932dad416a9ac5f4652b194eb17fbd5829508e236f89
SSDEEP 768:ZFdG3xwgM32IOj0+t+/9OA9at01j0iq00+IaitZ75EW/LN:FG38kCHq00NaSdD/Z
TLSH
T19C037C72E8A0DE7BADE2A781F30937969FE05253C6CD99D0CAD92D0D00875DE170BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

b927df03-a00a-41e3-a875-0363b8b35f8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b927df03-a00a-41e3-a875-0363b8b35f8a.tmp
Size 34KB
SHA256 3205c1faa76787772db8829b86ebcb31ebc54933b95a35e649efe9f4d49a7209
MD5 42d425d0e8cc9251056427ec8c080b82
SHA1 f5ab6471404cf87552031d0e7199416a028848d7
SHA512 a80ccf7eb126b549fbe08708c565f9c7f1afcc3912d9dbc249788ba26bfdf683189c85bf8868c9221287ba0b2e0ce15ce69544b1a0de6ff4123aba8165315ef2
SSDEEP 768:BT3VA6Oj0+tD/9OA9at01j0iq00+IaitZ75EW/LN:BT3VPCHq00NaSdD/Z
TLSH
T190F2AF71FCA19E779CE2B695F30937926FE49213D6CD4B80C9EE2A0D004769E170BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26613704-e94c-4107-a428-54997c1fc558.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\26613704-e94c-4107-a428-54997c1fc558.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

4372a45a-5e42-4fb0-bbd7-aaef58654a66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4372a45a-5e42-4fb0-bbd7-aaef58654a66.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

eb03febb-6d33-419b-8d55-16ca1efb8694.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb03febb-6d33-419b-8d55-16ca1efb8694.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d9740087-4fc2-46f5-b9c3-c511b2df4300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9740087-4fc2-46f5-b9c3-c511b2df4300.tmp
Size 38KB
SHA256 259ec8a9dadc0eeca96e6ec0111265a29fdeee4eafe53a212506ae71f95ffa63
MD5 193949fc72f5dee6445f35b7d69a9190
SHA1 4a9e101b956fdbf2503bf03f4b9dad5886ac9e57
SHA512 7c2eacab4821557156bd3dbadd03cd7a6e92b172255664a68f5277aa77aa77e7a1d32f60425f607cf6b755457e653e77e1d2873cea5299bbd36aede1bfc1250b
SSDEEP 768:Y/UxvxjgC+H3OLsOj0+ta/9OA9at01j0iq00+IaXtSHxRz:lZj3+H3O1CHq00NadSTz
TLSH
T11903CF31ECA19D639CF2B384720A6397DFF45653C6C99AA04AED2A0D01876AD130BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f953844-ecff-48bb-9c3e-091b03a1f6ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f953844-ecff-48bb-9c3e-091b03a1f6ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e80066cf-62bd-4b3f-a081-38210d167974.tmp

Path C:\Users\Admin\AppData\Local\Temp\e80066cf-62bd-4b3f-a081-38210d167974.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

74f9fbf0-e0b0-4eb1-838a-328b9319e790.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5796_947353508\74f9fbf0-e0b0-4eb1-838a-328b9319e790.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5796_947353508\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 51f80b6d58a23ae924e353d1415f536ee7db62d1ce1aacaa2b3c2f6dec610536
MD5 fae8d21a5c8b841f5e8a5980b15f5f0a
SHA1 917add57e9df0cc40a5a5e8f86eb78010ce43059
SHA512 ba44f80563028f20383c17501ac79b3a559d2d17313df247f89e2f5b7756706d7c7119453a6bd4c70f2346b1741ad85c863f6b84ef5d96c0774435c11d8d33d1
TLSH
T10D41C2105BD54B2AF3F6AD7399B36721AA3BF819E5184F0E408602450C67F09C9BDFA7
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1912155331\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_447647998\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_668587509\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 123KB
SHA256 1e96e13c77eff7828b70537611cbd7673efb80c6417ddabdfabdf6a6864044fd
MD5 366dd1bafb78180f1eb06862d74e2875
SHA1 0af0b1b7d57e039d5540b6a0ad156409e45cf49f
SHA512 2d2a19b45c868974703cd2b5597bf6d94519e662c1b773464bcc687ec145cd5d94a82c37a232c48b83f505e0b62424c0fe1aa1b966443b158310e1fd5eaf4c94
SSDEEP 3072:zVGdA80IPW9cIwkgMjfRl5rhxvC1BfTJtyT/iZ:zVGdA80IPW9cILgMjfRl5q1BfTJtyT/2
TLSH
T128C343107B0B416B7B067EDA3503793679BE2283EAC426DD7B9E2540B0C79A6415F0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-10-0x0000000140000000-0x0000000140010000-memory.dmp

Download

memory/1832-1-0x0000000140000000-0x0000000140010000-memory.dmp

Download

memory/1832-2-0x0000000140000000-0x0000000140010000-memory.dmp

Download

memory/4512-0-0x0000000140000000-0x000000014033C000-memory.dmp

Download

memory/4512-12-0x0000000140000000-0x000000014033C000-memory.dmp

Download

memory/4824-719-0x0000000140000000-0x000000014033C000-memory.dmp

Download

memory/4824-9-0x0000000140000000-0x000000014033C000-memory.dmp

Download