3a186b7a992516bb19f9948d4470c4716ed4b070249a7f6f3d1a28817a1b2ae4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
17/05/2025, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe
Size 4.0MB
Sample250517-s77k6awkz4
SHA256 3a186b7a992516bb19f9948d4470c4716ed4b070249a7f6f3d1a28817a1b2ae4
MD5 00dcca2bfebb197718197a4337259e9d
SHA1 c91d6a05fbdd30fbd96481da7e6c21b216be3e0c
SHA512 b0d1c0edad773d512177204a90cf0a98bd79194f7b780323d5ce687b93c63ea3324649853e2d3f3e738fc23e89ba9c65e422a7d53fba6e277d911c1229b0f5c9
SSDEEP 49152:zjNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:zRzP88fBsnZTgOtqB3m1RC3
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1415536041\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_390141636\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_390141636\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_390141636\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_667185387\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_622641008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_622641008\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1415536041\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_390141636\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_667185387\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_622641008\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1415536041\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133919704399928817"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3518521428-3897247806-4080064211-1000\{29E25B5F-57BB-4523-B3A3-9D938E779746}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1656	4400	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe	78
PID 4400 wrote to memory of 1656	4400	2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe	78
PID 1656 wrote to memory of 3124	1656	msedge.exe	79
PID 1656 wrote to memory of 3124	1656	msedge.exe	79
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 3212	1656	msedge.exe	81
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82
PID 1656 wrote to memory of 4828	1656	msedge.exe	82

C:\Users\Admin\AppData\Local\Temp\2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7fffba4ef208,0x7fffba4ef214,0x7fffba4ef220
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1940,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2016,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2188,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3432,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4076,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4108,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4144,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4300,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5412,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
    3⤵
    PID:72
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3604,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3516,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4728,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6032,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1136
      4⤵
      PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6032,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6368,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6524,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6472,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7024,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
    3⤵
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7060,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7020,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6400,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6720,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3412,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4444,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4432,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3764,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5900,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=884,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4152,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3736,i,17796178729442068017,16711784856596852475,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2025-05-17_00dcca2bfebb197718197a4337259e9d_black-basta_elex.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7f4ee78a24e42c7c3291be9948dd6c8bb66948a9e40a705320162c6975f6dd4a
MD5 6b75d9bb2c81bcca8182bd8251593e50
SHA1 3e330ed26fd626ee18e992dd50b698375afe1a1e
SHA512 f83bdb8cb01f064b7e13a42e563c9bd70fcb952fb3f7c0a4b9dcc8d6f1da395198e5d7482e9a848427dac93061a2d97985b94f59fadb92a739d23d33f7e83186
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
MD5 SHA1 SHA512 SSDEEP

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Size 3KB
SHA256 5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
MD5 f9fd82b572ef4ce41a3d1075acc52d22
SHA1 fdded5eef95391be440cc15f84ded0480c0141e3
SHA512 17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 824ff52b9e28e389e749aac3d46c0e0bde93b4681f5750c0448b1af930978f13
MD5 322bf661a129017516132be3d26a7c58
SHA1 40b498938914eb549ebb4db34529144e04b9c02c
SHA512 ee9695d8a5a3ae033464f872b8260b9f92a0d46764bbc5dcecd5323dcb483371ca69faba071ac912d4e71adbfba78483d099793cf5e6bf107bad7c840e29ba2b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c30269429a6566c9ed1321abce723f634a09b72d998d88ef4d06a63ebb2a2fa
MD5 7c4661929987ca0b76dbc14e1f4e48b7
SHA1 e76fb8bcd0bdc0bd35fd828ecbbd9e4b4c9265e8
SHA512 3b31d21d33f8ca67b91ac7931cd1514e6b6cc312418fc972ff4b6595f35ac0d1fa8eee827fe84666831945645f01e3148b47526d7866ebbc8adada3fa4eca412
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582054.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582054.TMP
Size 3KB
SHA256 46261c20bf09107fe6fd150df79ef4cc16ea6a9a0be737fa1ed63ddabc1f49ee
MD5 0440c0071cc16969a7bb241b260bb8ff
SHA1 046fa1b71f18f7a4239cbcd038cf83359e84dd61
SHA512 f1d9bc1d00d4da6b5f5eedccca72895ae5c8d6c0f73981c4f9b234d964df5521a20545ffb4d2ddb5f736b8782409f2893596d6e7bab06cd98f81f3f898040802
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60
SSDEEP 1536:I6LPH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1027345d039683d9fd59b8cece7461b3faaf0da4b8742ab8141687b082b4c2a3
MD5 f2149a8eb8a1304a7889ab8ebde73f8b
SHA1 bb6ac5bff6425abf1e681dd2f14463ea477fc6ef
SHA512 2ee7edb16ba1350f22b0fe92c786f2ee89055a9fc693f494fe0597ba8080aebbed77b154a2ff98355b0abca2adf222da098a12190188e7ade5c35d0c4019798f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2873a12649b2d1a63d6c69396990e2f9ed953873e822747a8044c6f4c79e12b8
MD5 1902ac956212e14675dfcd36c6d4d20e
SHA1 03b4608e4fbe60cb078af645c651f661d8982e4e
SHA512 4c15b6fa8343eca71706d5e3b87ef3b37823b90fa4684962d247add545d31b20f24e175b51d80fddf4219b71087f268d52e4704715994ec83f4dd2c705a8f422
SSDEEP 192:sVuRFyMh/Ky0Ml8M3plsIdCUwhfwIJ2Mo4cKCWjuIZ8p2iJ/Y+WNlMQayGk2cWIm:sVu5LPpls0jwfZJJVcvV2iJ/S+Q9zun
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 769a160ea290707826ca9e15fb7b27272536c9b83a691940cef1d5c63dcf63c2
MD5 bc3e37e464aa99ee5af2bc0d2f76d4fd
SHA1 3e200c2b67202d188e0f8a8be600a89d341bdfe2
SHA512 ecee31da319b65a39a1b5837f4f616509f1af91d39507e1cfc13e81580f3e01bb00fea15f1d3b88c177f37e63c5beb0e1388eb4d71046199f30b4241db9eed1a
SSDEEP 384:sVu5LqYpls0jwfZAJVcvV2iJ/S+Q99Auk:sIgajEZAJVliJ/Sz96
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 19f5c6a5e687be53471e26e75d744783d6ee38943d3ea91b05a5c2bae62f44d4
MD5 937b3bd4811e4e682233ee48e6fb1267
SHA1 8eed6152f96ac38d9d25ed2a9290957d0edb12f7
SHA512 e89257459359369bd5566bae08c012153fc0ab5de88b632e7775d206c36f1e98b61d89657c9d29a63cfb8bf43ecea11a5afacec0eed983eec65bbd489b091ea3
SSDEEP 768:gTqPm8xe2WO7pLuLNzpWRWRHQdv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3iMKcLlK:gTqPm8xe2WOENzpWRWRHQdvu1jaKiMKL
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99c01ce47c997ef6c2ae79fa3f7f345b51f1f07cb7ff35a7167b94745834b6a8
MD5 9c6410d263c00fe806074e79af19770c
SHA1 03a6c2a2a93ef212ae9fad934c011d76e3878b03
SHA512 36e798cb35758c2e5227b69908a6dcc4fe1b1202a97090f393766aacb954fbbd0f5759c43c8c4c507e8a5f5fe4bcd1dea1e23e5f31acc17244de14e0d2cdf1a1
SSDEEP 24:xwOgPKKGS7sjKcyX0o/wgKjMSa1wKo84QRK8KSZOxK8yXekdEb:pyKFvyhJKQaIKvpyJ0
MD5 SHA1 SHA512 SSDEEP

Submit Download

8ae42b63-8d1a-4a3b-8460-2b13cd1787b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ae42b63-8d1a-4a3b-8460-2b13cd1787b6.tmp
Size 22KB
SHA256 4503345ee70aa9ca0f90012b665743d7c13ec7052e7a943222287973b752b9c7
MD5 3bca8411b45106afaa963d562c371631
SHA1 78857d33a65e7061ca18a3540c304f01e7e85325
SHA512 a6a7e9af6613a30730a0b87be76f87144a3483afb756445d462de7b22543027e5e8f5822e0337ba2d7b65e413e526da962783d05d226c0d13d113d57d28b56ff
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uz:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 23KB
SHA256 1a1bc57b7cd67d63527e551a995dbde5f974bff765d994308233e550777b7f83
MD5 342b8384f31637a42ca6eabdb9938df8
SHA1 0f85a4eea418aad79770f28a8ecba5211006847d
SHA512 d281d348044da4481d3e60a9b012c1abb14bdfa750e450278fcc82f31df515301b84dda96e4dd4b18e8abe8fb07171677a881b7e143b86a08ae9a1524c12fd7c
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/u7:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 880B
SHA256 39209a1cd809f5323a2509e0566e12e6c79743ace6b000b1db9ed9949a03c08a
MD5 99af008e13e1e6c177c4b5ccb0364973
SHA1 5a2518da2d26ea2606251931c695fdc5ac237b1b
SHA512 ae4dd7cf51550c36bf89479a54afd9c07fa744df63364d1a3d190af280ad4b0b2177782f3f5ef99f83ae23e041d1d45eb9e9550132fb98a34179edf9efa82e1c
MD5 SHA1 SHA512

Submit Download

CloudConfigLog~RFe58a207.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe58a207.TMP
Size 469B
SHA256 91f33e97807394f26be92ede2f5cf7670fd749dac7599458566573900ac7dff2
MD5 c1fe9fbb45f8a8a4d759e266c70e94f5
SHA1 aa7374e1fb4c408a1f9304f31810fd1835cc35fa
SHA512 c660e6eb363dc1ed859fd24cb109b0aa61add829ce596643d49d236f9777d4791e060ec8c5615adcea6169fc7391792c061d5baff95796f2078a7e4fe996f0fd
MD5 SHA1 SHA512

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 6KB
SHA256 3feb62b0e92b420283d6c688ba9fade92531d3f9c4ffe7949f11043ad215d2ef
MD5 1960c4a856969f50eb9725e843fa1cbb
SHA1 4078f50780a257b11bd726acd50604ed081e06d1
SHA512 ae052fdf728998b8be36b4d510e8f5ec36bc3c0fc74f858da095b3243ff62634e660ec07c50b2c596c6d1ceafec8dae0383eb0c2cc3f511827f316c4e181bd59
SSDEEP 192:3GNbyn/WiRU4F7qIgsA2KhZYBynSd4xfppJ1:3GNbyb72I97KhZD6471
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff4566471a2d10bb706614445c7990b6d014b248ca33b97d54dbdba653170390
MD5 4339324485e5586c6128da284f481165
SHA1 bdc5343427b10a60d99aeaa97e2512e42161157c
SHA512 2129ad4042aa1b7fda4390a30223e8b80f478f5c529df79c2114321daa0517657f409bb586bdef01945fca2515584e03a93122ddc25dc623e10fd046ddcef432
SSDEEP 768:xQPE6esE8lDldUGjywgPLX9sx1eF2C7uGJHWQthe/BjGe:yeB85dL0LXVWQthepCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 c500d47644d54634b25f3cbb73c1fbe345888bc601a9a866490ecbaa44e58a45
MD5 f07d08106e1ea94b35ec79dbac80f4ce
SHA1 159a21628915d4c9157add942b085532726b9fc0
SHA512 a78a00f766319497c784f26cc19a9acdcfa970ff30bf23613cfa69a5b498175b4c6de38cb0f92cd42c91ef2db68059a231202a726a2860a1c515da6772786b46
SSDEEP 768:mE6esE8lDldUG3kL2967uGsHWQthe/BjGe:keB85dfkL2tWQthepCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1fa75f14b663c711f046bfc298cc140f5bd6b88bd274cc04887ce0a6793c2b38
MD5 fdb601bc9248d596ea62b45282d60a1f
SHA1 f22749b60f0482c3e22213b875d06c02e93477da
SHA512 0caab78108aaf0de7a835302e4159c3819f7888bbc4c6b3e8c40c41d0cf9be7f09da38764f7ce3764858ee169f7cb61b0695075732d50d49f74f4d8b393bb84f
SSDEEP 768:RE6esE8lDldUG3kL19sz7uGsHWQthe/BjGe:peB85dfkL1FWQthepCe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 caadf1fa33260870f3d25f2463a4bfb11f2dcc09cfe3ee1d159a74ce671bc045
MD5 56581515e327b696771b85e72140c3b1
SHA1 48f3aa4f563dd73ab5421ce1546714d985c7ed03
SHA512 263a1c24733ccd097af4b86874b5be4ecb85226d5d5ea52a2dd206c32ade994357164e6a93c7347a5a9816a170fa110e4526fab68cea4a25f053c35c945f2692
SSDEEP 192:3GNbynPRWiRU4+q9ngsA2KhZYrU0lqcGSW1:3GNbyBDp97KhZGVl8H1
MD5 SHA1 SHA512 SSDEEP

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
MD5 SHA1 SHA512

Submit Download

1d4f94fc-5979-4fe9-b39e-64ee3145f49e.tmp

Path C:\Users\Admin\AppData\Local\Temp\1d4f94fc-5979-4fe9-b39e-64ee3145f49e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

95c3a281-e130-4c6a-b97c-47ef621f81c6.tmp

Path C:\Users\Admin\AppData\Local\Temp\95c3a281-e130-4c6a-b97c-47ef621f81c6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

233344ad-d4fd-47e0-860d-204ee46e0e49.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1656_1683485734\233344ad-d4fd-47e0-860d-204ee46e0e49.tmp
Size 153KB
SHA256 fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff
MD5 cc05ed3e66468e692745ba6563c69740
SHA1 eae9dbd4d36aa91fd43f7d452ac3d252b103759d
SHA512 4b527db02d6ea36b914558a3e44fd3d15772bf2be4ba0a640bf70427af07dcde5ed6967930cc3624a244cfc82290f125eea2754812586216b3d5a37757ce8db4
SSDEEP 3072:dMO8I/Yce/ywr7jDIbm0l4nbcFyEMz8sCMuiXp6amLWlFCnr2dTP:d0/7Hz0lC5EM5/p6amlnidTP
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_1415536041\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_390141636\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_622641008\manifest.json
Size 134B
SHA256 c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
MD5 049c307f30407da557545d34db8ced16
SHA1 f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA512 14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1656_667185387\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download