a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

max time kernel
93s
max time network
89s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
16/06/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
geometry dash auto speedhack.exe
Size 14KB
Sample240616-a8a98sscnf
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
2960	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
3124	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
4180	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
2860	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe
900	geometry dash auto speedhack.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5648	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2980	geometry dash auto speedhack.exe
2432	identity_helper.exe
5576	identity_helper.exe
5648	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 3124	3016	geometry dash auto speedhack.exe	78
PID 3016 wrote to memory of 3124	3016	geometry dash auto speedhack.exe	78
PID 3016 wrote to memory of 3124	3016	geometry dash auto speedhack.exe	78
PID 3016 wrote to memory of 2860	3016	geometry dash auto speedhack.exe	79
PID 3016 wrote to memory of 2860	3016	geometry dash auto speedhack.exe	79
PID 3016 wrote to memory of 2860	3016	geometry dash auto speedhack.exe	79
PID 3016 wrote to memory of 4180	3016	geometry dash auto speedhack.exe	80
PID 3016 wrote to memory of 4180	3016	geometry dash auto speedhack.exe	80
PID 3016 wrote to memory of 4180	3016	geometry dash auto speedhack.exe	80
PID 3016 wrote to memory of 900	3016	geometry dash auto speedhack.exe	81
PID 3016 wrote to memory of 900	3016	geometry dash auto speedhack.exe	81
PID 3016 wrote to memory of 900	3016	geometry dash auto speedhack.exe	81
PID 3016 wrote to memory of 2960	3016	geometry dash auto speedhack.exe	82
PID 3016 wrote to memory of 2960	3016	geometry dash auto speedhack.exe	82
PID 3016 wrote to memory of 2960	3016	geometry dash auto speedhack.exe	82
PID 3016 wrote to memory of 2980	3016	geometry dash auto speedhack.exe	83
PID 3016 wrote to memory of 2980	3016	geometry dash auto speedhack.exe	83
PID 3016 wrote to memory of 2980	3016	geometry dash auto speedhack.exe	83
PID 2980 wrote to memory of 3296	2980	geometry dash auto speedhack.exe	86
PID 2980 wrote to memory of 3296	2980	geometry dash auto speedhack.exe	86
PID 2980 wrote to memory of 3296	2980	geometry dash auto speedhack.exe	86
PID 2980 wrote to memory of 2128	2980	geometry dash auto speedhack.exe	88
PID 2980 wrote to memory of 2128	2980	geometry dash auto speedhack.exe	88
PID 2128 wrote to memory of 2108	2128	msedge.exe	89
PID 2128 wrote to memory of 2108	2128	msedge.exe	89
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90
PID 2128 wrote to memory of 2072	2128	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3124
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc1bc03cb8,0x7ffc1bc03cc8,0x7ffc1bc03cd8
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3544 /prefetch:8
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1768,73772647859703389,5592614523700836287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc1bc03cb8,0x7ffc1bc03cc8,0x7ffc1bc03cd8
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2060,16497448702814708569,11730298369826695129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
      4⤵
      PID:5688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1016

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3780

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

861cecb5-2fd8-449e-9747-5b9ec9e22f4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\861cecb5-2fd8-449e-9747-5b9ec9e22f4c.tmp
Size 8KB
SHA256 121e2696afbd4bd392277480bec7ea6e5c1eaf0b4cef9d58f5cc0242f821abd2
MD5 cdc76982630d5d8684624a288d2af8d1
SHA1 611753d1ea39333bf5c039c341873ec41132c510
SHA512 4a6a0f442ef4d6b31d6b93ed34d0bac8d628590a3e30195c5ae5dd3ac3b792ec32b068510a908edb4b9df9d9c8ff5c5cd763486b2527d734f82b71ce8f0af077
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oMlAxHe2RUgPRRaE2R3YP:M9iIxuERzA83h09RZxA3NMV7a7hYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e0c90a18f02eef7813b39729d33043d1f938bb9af4d1536ac0dc5f66e336d0c2
MD5 dbf6eaa2e4c4159e4bf9731ecf7a5fed
SHA1 5e7a69ea9ec1bfdd6a250b65b23c495136451114
SHA512 5334119699dc524e15bb2c104efac326b5ccb814d6f8d840550482bc232867e53ab1783666ca2dc5bcfc5945c5971f5c85b962fa7a0e08b16d9b185f9cef3778
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae
MD5 d56e8f308a28ac4183257a7950ab5c89
SHA1 044969c58cef041a073c2d132fa66ccc1ee553fe
SHA512 fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de
MD5 8f2eb94e31cadfb6eb07e6bbe61ef7ae
SHA1 3f42b0d5a90408689e7f7941f8db72a67d5a2eab
SHA512 9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 2a3f774985e30f861a8b93716a411e9c0f6406c1cbbceb0e2e700b78b3a53619
MD5 5c7a6e92cadcde6ccde8009ff17780b2
SHA1 997f349e7dc0f42c693a75789956894a31d1f3e7
SHA512 c61c555e1ea12496af9d28e27e0c3e64a7aaa975a5ba053689508a4cd06cd63405e33f9d1cfc5a85d424ae6b094ade4d9e173d6f9ffd266a81d0ce98468f8b3b
SSDEEP 3:MsFlYhXllLlX8lR01qzl9H+clNsJlll/:/Fiz10SaHecQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 e8e74831d24eeb105d01db534917563d33d820c767a0df6b3a438164670c2865
MD5 dd7ee730ffc00c7f96ed96ff253eba5e
SHA1 84bb2ca215be37a57487b7c2db5e1d7f104d1ec2
SHA512 64d99a18f6a5bd6c0acd6f84d8077b1d0b4cc8e1deaa6fecd8ce768eefd8a5abaa246e5645f37760fddebfd8a1fd3a19212fe89ec4a89dba822e5562ffc981f6
SSDEEP 6:/M/PXGuEa1u4COR3uJZ1r3uJZ1r3uJZKKiDvcROXV+:U/PX913COQz1yz1yzvWvHU
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 129f77748141a33443e3813ebc3e7854eba70560c17b1701d5cefa3efd727475
MD5 30191311173ab1df92e43a98bd0a13fb
SHA1 2e4312da12d823a14db595cce2522c825b5816bf
SHA512 eb923565e7e7b975c4697ae3f7c11f454519b605d222faf94ab536d6eb3c8b0b9e79c78f8fd9b1cfcf3e480731908e38258a3acaa6698a1e77ab88632031da55
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
Size 36KB
SHA256 3b358849502f5cfd881dd035ff274a5753f90047a131884838c677e22f2305ab
MD5 5d352a03280eba57cb274d27ba6c6b7e
SHA1 8887766642a81a1248dd5f93239ce63e93839900
SHA512 b8037a046c4be7be120bbfddedc780a4175fc8e6c863e9095e39a4e16d2e8ced27c40f38c569a79df990057175e3db6aa35eac645598af3647caa5744052bb1e
SSDEEP 24:TLNPD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFS:Tt/qALihje9kqL42WOT/9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ad34ed4adcd4b10f102003de865abede77ea380550cef008b78b1dbb1375fbe6
MD5 444d879f6d21d205111afdfe7d471d66
SHA1 1a2f3d4fde2325e496866b6bc7843042c9b07d78
SHA512 80ad235d82e3f53e0ab518045afc7e2581eb919c598e4f89911ab592a7064e519e570afa8248eecb230a4542f8323cd4b049f349ca08f11e92c03b3e02102832
SSDEEP 96:ncjk3HsDPkb2ExcGwSv0MoiVmdHIeJ+ME363K+0WQyV+VuziX3wI3:nik3wPk3tv0MAIcDRLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c8c1e9f473fcf04bfafd6e87f713313820869c12377816a3769cc813c270ab59
MD5 c519637281d0752af3884d5e082fabad
SHA1 6303786176c299b2e02538b994adecfa88e67cbe
SHA512 12a0828b63a125617dca190d7b70840c22153b68b47fd2ad3ed0ea88bfe0fe64b108b2231d5bbc69f4e62baeb83451d0ff42a6f7e0d04cbf7a5a39461ba4eb5b
SSDEEP 96:ncjk3HsDEkb2ExcGwSv0MoiVmdHIeJuE36C0WQyV+VuziX3wI3:nik3wEk3tv0MAIcOCLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b0a66abc775e3876e126e0764545dbf7a2f8d19b0eda9db0f15799d50476e7b2
MD5 40fe8ffb18b39f2202c77adf838b5fc3
SHA1 067d43fb939e932d203dc3919c6661b9aa01e546
SHA512 6b08b2fb8ccc28b9d804f1dc5fc782e7519bed90ab967301949fd989a237282ee6602dd0e38b7944aa7326f2992f037c57c6763baf2f8b4621602f7f7abf8863
SSDEEP 96:ncjk3HsDEkb2ExcGwSv0MoiVmdHILJ+ME363K0WQyV+VuAiX3wI3:nik3wEk3tv0MAIlDaLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 137B
SHA256 c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e
MD5 a62d3a19ae8455b16223d3ead5300936
SHA1 c0c3083c7f5f7a6b41f440244a8226f96b300343
SHA512 f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 316B
SHA256 eaa956811e97d30b567950e2e33a4003220a94364dc58e3b9ec72bbc40b9cb15
MD5 4903cac5f808a59e5d21f444b16386e5
SHA1 6bca22d69cb461d6c44cdd0ddcd11d2ddccf1591
SHA512 f93ee791ee389eaec4fa922750165ded46b5ba9bab9f79c182d21eddd77a775197993c615c638044d22ab1beeec4ac97ef255af10019b2b8cd0b1687a45dd32c
MD5 SHA1 SHA512

Submit Download

Session_13362972812841001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13362972812841001
Size 427B
SHA256 45821998875694a133f016f2b6a8cd1ac269ae0a2b394a11aef8bc698723c74e
MD5 721e0bc48d4bb53cc1764536cf28a784
SHA1 4b2d4982a1ba3f1984e42b671ba47c9a1596e280
SHA512 f8c4e9da3cde83f37108a879a84c37907af5cbc67faac0d629412618417aff203263f8e120445c94d769f418ba871f45852840bc5225bad753fc0cbd25d2ad40
MD5 SHA1 SHA512

Submit Download

Tabs_13362972813027001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13362972813027001
Size 717B
SHA256 828b705822106a4ccbb253b6c64525526fbe37bd5e9cb694f78b2ea4ebc108c8
MD5 5d1829a4710a99a75e924eb2ac048105
SHA1 cd019577337d56e4ffb6fcf99c0f7e58e81179ab
SHA512 de4cb15ab8202168e9a4d24507b78b45142e69c206a0af978473f4ec8a33b8e7a3844d23bd26b426e9f99fd59d8a722d65a47ec77e40022af05325e471765429
MD5 SHA1 SHA512

Submit Download

Shortcuts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
Size 20KB
SHA256 da78d36c765d3248b1a72ead5f83b7a58cba7d361f17a6831332ee994cee939a
MD5 8be985ece811ba0a3f10087f5f4e6fd4
SHA1 c87c84d4fe182ffb8362f3cabd33349af94e9b55
SHA512 901932baea8712e89188cfce00a6b2388ba38697bcbfeebcf8b83b88b0cb26c7323b098ba6983c312ded1041f6e297412010113a32e99a9350aa4492ca40efa9
SSDEEP 12:TLiNXcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLi5VMnYPhIY5Qlvsd6UwccNp15fB
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 36e16df4339b1ea54d712d7e266b6c9a21625b76f33c1062db7e6c9d0b6129ec
MD5 4138b3353bf0bf4e23f6927dc8791e08
SHA1 310675007ade8ed384a5d2a1d890749d3543814c
SHA512 9272fd537debe6eebc80a2c3eee75807bdcae5846e9207881ee41c8cc06c633d8b5a4b94ff606a54367733b92a2f066b22501004f67b57d53951cdc6ee7b20ca
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8965d5954cf639663b44cdb0cd30be5ee72b58fb763a7f188087a957cc1796af
MD5 49f2475d9e6eb093f78023b0c21d9c50
SHA1 9c9275aa6fb1a2f4bed71ab8d92cd4f30060fa6a
SHA512 a503b692cca0056a4429a2d32dc67d893ac82dbc34b6c37a2fe47964275058af7728b37266b26d29309c867a3190e5f1cb54e743355c92142d84d95f3eb00c26
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
Size 198B
SHA256 00afd347ec7b9198a4991bcec6742d5029f472aa43eee57d5aa2d9abe779fae0
MD5 32cb1cfad7673048eb61f7adf6e18b95
SHA1 2ff29aaa8ed80faaa82b97b844175d8df574ca0f
SHA512 b5c0e4d02cbaef985bed8cce3d96726cd528f4951e11602f45ceb9158b0ad82eee5ba2b40d0f2d1604a59cded2657051de6fe717e3cb9cfbf837db1231747447
MD5 SHA1 SHA512

Submit Download

MANIFEST-000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002
Size 50B
SHA256 e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
MD5 22bf0e81636b1b45051b138f48b3d148
SHA1 56755d203579ab356e5620ce7e85519ad69d614a
SHA512 a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0
MD5 SHA1 SHA512

Submit Download

heavy_ad_intervention_opt_out.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db
Size 16KB
SHA256 9ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be
MD5 9a8e0fb6cf4941534771c38bb54a76be
SHA1 92d45ac2cc921f6733e68b454dc171426ec43c1c
SHA512 12ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae
SSDEEP 12:TLCjwaBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLKdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5 SHA1 SHA512 SSDEEP

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 02ffb1b20e25e071a38c6ae49e2d320986006f095be73af29a0acbbe6b16ea82
MD5 459d2517bc351bf51f3cb212f1baf0de
SHA1 af9b4e40305e2105f5967999b073f58a545e23c1
SHA512 c00715a50462c8a9dfbbf0d7ea9617d6cd012b34f64bb0cef0eb5836da1fe30705675d5f0a123775d9bf727caaa96404875ce36b3c5caf1331042b0fe0fc267f
SSDEEP 24:TSa6UYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8LffqGkmlhyhrtffqGbhyMRDcIy:TP6UYVAKAFXX+AHJhyvHzhycDcEc
MD5 SHA1 SHA512 SSDEEP

Submit Download

previews_opt_out.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\previews_opt_out.db
Size 16KB
SHA256 4f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249
MD5 d926f072b41774f50da6b28384e0fed1
SHA1 237dfa5fa72af61f8c38a1e46618a4de59bd6f10
SHA512 a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f
SSDEEP 24:TLKdBgtBgJBgQjiZS53uQFE27MCgGZse:T2vg/gDgQjiZS0Qj7Bge
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 ad0ee23d90d316da8e792bd48256b685626426d502a3f3737328f08819c937b6
MD5 49c08c17eb84b5b691798807d64ef030
SHA1 b0e4a3a7bcb9e340dfea689bd89bdf62d44634e1
SHA512 7b605cd14d142140239241fc8dcf40c7e26f4ce70f6093d60164912510ca413c99ad96705a49f01a1fda296ff395aba2c335c71fce2716151b6ef0e6cc1cffea
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 0357f5773e472c662975c485ab1e67a9e437db206fa19942452479981463041f
MD5 3b2a9dce88a299f2c61ff1cdd9ff6703
SHA1 ab17b8b73db87b073af8ba2b68a542c00ad33e1b
SHA512 f12db22aeef439257da79c5377e910e6008d01e1112be9a51ee6ce5cae651ffde81271adca75328d8caf3d513d97a5e7c7f4852e62be85179544205d475ca5e0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 56dfaffa8b3cae1e0d86ddede1c70825cae4021e8d01786fa9d1a67bca4755e2
MD5 07b1e1e3163898666a4b11018a175283
SHA1 025cf32c50062df21ea357f21611d6d4917577a8
SHA512 caa1eb46699775c3e362d80b724f821007601fc21b335a0ae939a4b0281f2ca37f8f1da0dbfb284faaee822b1d4f4c9374021bccbc9e828af973b416392fcc78
SSDEEP 3:MsFl9tlGallc0UQThl9ikM/ljapX8z9/1Jh8q8y/Xl1P//+lt:/F3XGuG0UcHikM/lOpXYfPZ/Xv/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 5b48c50c719108f5229b2745d23405aea42a5f5d0635423944b84f9d75a4b0ed
MD5 dadc773886a1b0017b604069aef98a70
SHA1 bcef8d94b82a7fa859c401804a6321fe67b8ea86
SHA512 ffe87934da25c3deaef9ba20fe2503712ae6bf676380d065ac2c24ee4b3cbfef65d64823505c65befbbcce7d92c5504022c9c5d36b16af7ef7509b5484b748bd
SSDEEP 24:AjwLd+BQCxSNSJDsd+BQCxSNASid+BQCxSNzrW:1ZYSNS+ZYSN/iZYSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 0ef23912d1ba671c7c919c2734fd32cf7c8c5a1cdcc8d4fa4e9bc95149f25be1
MD5 d2f556bc43588e3f0211c2fcd936c10f
SHA1 e17cc2316e76d111fb94228fcfefdbefb12e9091
SHA512 455e23a53e2da49d322b9a4470fb69d38db733b7fe14037f1370f118910ed4102b2949d022e787f03e7c7fedd218ed74d84dcae8ede0b64f9de46ee3623757bb
SSDEEP 192:C0VWhO7DInZXF1YyEQ0H0ipNgZ8v1To0VWaO6NImuZXF1LyEQ0Moh/mHOnEZvC20:cSInBiv0ipS94IBB3rh//nCNIQR9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
MD5 b29bcf9cd0e55f93000b4bb265a9810b
SHA1 e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA512 e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8871fc96c25009c76c979094e3a909bed1012ad0eaaef447f71994087fafc3b8
MD5 acc262b7c79ba7d577904230aa5b39ca
SHA1 ff13fdcaf1d919a9647dcfebb26cc869e8269839
SHA512 12e586cf4b1a7cc3a2906b2714d63f7279295348e9549274ad12684410b75a1f747c1016f0495ad543d1a16d6c47ff5a3feb4f87116609082f05f5e0947c4821
SSDEEP 192:KoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oMlAxHe2RUraRRL+RAYP:O9iIxuERzA83h09RZxA3NMk6L+uYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e97b388de2c76d53ec0a711ca217774bc48b8a1f0e36740c27b7ae1b82441f3
MD5 2bae2a7a3dd7b6c38e2f984fc8a91388
SHA1 c5d82c0714f6026d5aeb57306dc223efedc78851
SHA512 6a35f94342730eb1899d2a06552d904d9f1b3fe88d75e880985d9311e7e20152d9b50495c9a6a0ad9f90c5eef9499335ec48fe1ca3e95cde6debc07be8f64c77
SSDEEP 192:eoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHMlAxHe2RUraRRH2R3YP:q9iIxuERzA83h09RZxASGsMk6H2hYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 5B
SHA256 9ef3c2399bda81196490a7b6d02a6375edbc9d935b60d62f1be17dd0c69fa7af
MD5 679c0d550ec61a846f00bdc2acd5c374
SHA1 79f4751f6c59eea36a53e0a32b677605e4aec457
SHA512 91211b112c6e5bc65e227cddfc50127db1cc75069a3a00b62ee627eea8ff9247f5e409ddad0fca266d9008931b83e09b72dddfab6ab0ff88cc0fb725f2c74530
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download