2f8b8a84d3353ad1b0dacd081d1025e3fda262540659b05c852c46caa87430c0

Analysis

max time kernel
89s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2025, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 8.7MB
Sample250718-2dd67awqz6
SHA256 0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
MD5 6ff57c0aeccdf44c39c95dee9ecea805
SHA1 c76669a1354067a1c3ddbc032e66c323286a8d43
SHA512 d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24
SSDEEP 24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133973516637811420"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4144907350-1836498122-2806216936-1000\{E8A17970-2079-41A1-9AAC-26ED2876FC1D}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4816	4636	msedge.exe	89
PID 4636 wrote to memory of 4816	4636	msedge.exe	89
PID 4636 wrote to memory of 5884	4636	msedge.exe	91
PID 4636 wrote to memory of 5884	4636	msedge.exe	91
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 3172	4636	msedge.exe	92
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93
PID 4636 wrote to memory of 4560	4636	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x344,0x7ff938c5f208,0x7ff938c5f214,0x7ff938c5f220
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=280,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2084,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3496,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4792,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5688,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5772,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=136,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,16530084618684187030,9033766318712399064,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1695737087\manifest.json
Size 84B
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4636_2137526555\manifest.json
Size 176B
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d6d6b6a3eebee46dfa220c021bb383ff9457706c4d700d4958c8fc71bbca8d3
MD5 1a9860d0a63f7df89e69a55c181657ea
SHA1 491f18fcf7320563329183e5b7ce72dba250cbe8
SHA512 2dee55713683f114f393ea12851e14236ecffe2d3e986dc5a57f87d2fa74630042234dc8914e065720ed8a6cc7464b6ea6ca7df14a8842247b3b131b6dc5f946
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 ed5586dcd64718acb03b62456fda21c0ae2e116b787aca7ef24bb719cae9f48e
MD5 5d2e65bf482f1e7b272b73cef1cd48c1
SHA1 f9ca9db3a8a8f65449378c1b340ee70855dc06d7
SHA512 893eb18749954a10fdd2d909983aad3887bfe4e53a295cda4fae2f02613d0ff02fc5774884303f35b8d40bed3313d4ca7eba7ad5054648ef37238f69af1ac8d5
SSDEEP 1536:I6LPH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:RPHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dcfc18daabc1763d8cb764d45e392db109dbd465a2ef2284a8883e04cd670f5e
MD5 9974560e5464fa3b7154671634082b23
SHA1 84e93b855737b54f18e2cd0ca59bd553d0e3b11f
SHA512 d793b6a213b95440dfc93fd433e4a40ae542670c3e46cbc3078fd322bc55a4ea07d402a66f1c3f97337ba768a7dd18113d8bf56db2beeb312f1ad5ff6da8e95c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 361051d9e95673eb1645cd67dfa841c9014bbca2d9bcbf28d3adb054ff316993
MD5 2292593af8a06a3f502de524957fbcc3
SHA1 894316e5ec5d868f41be201bd4713ae1239b043d
SHA512 115994cec11f30d6fcb630ec34da21c415083a09916503416708cd553b1aecdc659dcf8288636d2d098aff72831ec07dfc85530ebecc1903030451d80d1378fe
SSDEEP 192:sVLRJyMqv/Ky0Ml8MgP0spcwtwM5lWVBUJvpn7YzoZ8pkHY+WNrYlWmrC++4Igys:sVLMLIP0seKd5lWSvpnakHSrErCXUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 edec35f455d887bf70c817173df86689ab0048de72cb6be10e8b4daec6d4d152
MD5 9a9c95e2c4b757670c6cdccca3226333
SHA1 949428ba37e6df5352270849446d86ca7969f091
SHA512 1f9aaf3b0bbd51532a1388cffd035ac55683cfa21c8339c09fa006a6d12dd4158dfbb4ffe3ef5726251cf5c71e8d38b5aef755028390a4a52fddec6dee52df85
SSDEEP 768:lLp4Cqr7pLuLE5DWFbtrh8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rIiLlQ2DGiroy:lLp4Cq9EE5DWFbtrhu1jaGrIiL24G5VA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8549e2d254ae40776737f8c1016eac86cc7f149c785359aa382219d0713cd00c
MD5 934fd156612a5f99539b29592c46b054
SHA1 b9c9d1f6d4a919d1c41dec6249962f3a3677cd30
SHA512 4e8c1e83c5ccffce54621a93d133d569524961d0225bda6516ddaf24b22d7dc27af2e835657b6d993c19c2d3a506d503d102ce7cd61852e4c5e0e349ccb177cf
SSDEEP 96:ZoKh6fKLZKDG4KkqKRD7aFJ7V1x0pkFxxKqZbrMxynHK/ipKVLKH6FKxLKn+wKwT:PGRD7aFJ7V1WpkFxPZbrMxyI0UAviUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 8bb08bbf070e6adcec93e4b12ae08b9dcfbdf106d80ea88a145ec493be461807
MD5 4b8165601797848a8f8542097d598800
SHA1 92ecde5fcc00240759c2a78590da147a42233bab
SHA512 f99a069f338ff2f12df715926a53660148cd65cb62b727c8aa6fced7a94e86f78a1c63c75a01c405f6547383e4d6fe5ba1dfd21d7310514ca7c354f9055e1565
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b6da72cb615f88e010df35d67635d996a8ad3e8b2e0a0ed9c134f743060f0899
MD5 9795fbafdf12aed9a3943fe0cdaaeaca
SHA1 00d3fc30d7165c6b6b92cade9b6633f59ef5b6a2
SHA512 86da1ec46db942ba2be03c66e326b6ddc249beaeb752abc4a627376c596160619eb3c7a93637c665392beaa6d84d0f56b6c136705bc1736e1c9b3c57c5378539
SSDEEP 768:6FiE6esE8lDldUGz3rCgIdftvH4eTd4kXNKn9kovGqsW7iIKu8MifLdE1r4W:beB85d738Gn9kWGeiAUE17
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 89b80728db13d9a46939ac3af329588b02f3ba9cee5e619e03f0c9a8afc71405
MD5 b43d26f3021bee04b254f5d0a4a80112
SHA1 20368a653cec070763deb9ecf150acf0f98d2fd8
SHA512 7c28095e4870aa1722c60f7f9c45caeb56f5a03eb0b05ff5980c89aa99ded2732b70e291df0dba352cdba93a09ec279ed5080e81101343021687da3962fbd149
SSDEEP 768:qFiE6esE8lDldUGu3uCgF7ftvH4eTd4gdKL/TZovGqsW7iIKu8MifLdE1JP4W:LeB85dW3kXKLbZWGeiAUE1N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 6259f477f228b823c017a05b3cfdd5273c3a003bd5dd074ac8333a9b33fc7d62
MD5 0da87f0c693fd02986909f9841224328
SHA1 36c7a2ac2d3e04e7f8c7d75f8e1ba54447df6d6a
SHA512 6c77aa65336464a0d2c09e1eee45499fa46be3c6e4897421f5bd096da29cd72243d2b28e8a9fca78a930def8101b2e012edf0a3287ce26bc372c0382d2fb9f97
SSDEEP 768:qFLE6esE8lDldUGb3uCgU7ftvH4eTd4gdKLAT8dc4cmU3E1z7ovGqsW7iIKu8Mig:CeB85dz3dXKLm8dkxE1z7WGeiAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 38418a38d2329ee9fc88addf9099fabc3ac8fa784f99cee9f180f45fee23a892
MD5 92f11c3de0bab575b01f47ec47ab72cc
SHA1 d6fb7dcfa8582499f0cd9b5730404660a73b9f8a
SHA512 0552405f7064320ca3d6384c65cbbb41c95abe802fe5faff17b93db6269358d0e4b1509910f7c3d396103398e6321d3b15f9c297bb4a68217461c56f37970d3c
SSDEEP 768:ZFLE6esE8lDldUGB3uCgU7ftvH4eTd4gdKLyT8dc4cmU3E1z7ovGqsW7iIKu8Mig:veB85dp3dXKL48dkxE1z7WGeiAp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6bfebaf2d9c47ba798801de4aac14e16cd94a41a32e6cdf46c96a255182a327d
MD5 ea092376d504af943601b1346b242e91
SHA1 a4de5c85c41b3d26f0c504582258abd668d1f798
SHA512 0bb105e5cb71cc22149f14e5d4d1515ce9eee2950ea8ab23a9aedda7093486d9ede1e10a9f3d92371f65e29d2010a27fe8acb5cb03204b83bd6489d2e2e63d65
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads