4ce67fdd6929d296988354eacc1d6db5516b97782993047196cebe772c10d2d5

user interaction
yes
max time kernel
600s
max time network
585s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/02/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Supernova/Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
Size 490KB
Sample260203-v5pnnsbs2c
SHA256 4ce67fdd6929d296988354eacc1d6db5516b97782993047196cebe772c10d2d5
MD5 6c2ee13d637d438e2844af85679064bf
SHA1 cecc64b29888c23bcfbf7884fc96a5e926c8f168
SHA512 075434e6ba1065daa5bea0db1409f1e17e0104759d578170c9667a4ea8a8e64d7d7170d9263f98576517a896019bda7a29e8b6592c32ea3b97628282cf103627
SSDEEP 6144:Na4InuJg58BkgqPoDH49n8Bb/cPFWdXZcqt/dmzwxCk3S1:Nat0EAH49n8B8AdXZcqt/dmzwxCk3S1
TLSH
T1B7B41902994844AFE303C733146A63D0D250A83F2A6F679A3D65711BFF7DD8BA1C275A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2088	attrib.exe
3576	attrib.exe

Drops startup file 13 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clean.bat	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\make.bat	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dwn.vbe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HideMake.vbs	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dwn.vbe	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clean.bat	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\make.bat	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clean.bat	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240699406	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HideMake.vbs	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dwn.vbe	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4860	msedge.exe
952	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134146144592402696"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{6A6E15DC-E2AC-4F67-A99F-C6D4463FEEBB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{82997D56-3C13-4705-BFB4-3B80FBC21F62}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2724	msedge.exe
2724	msedge.exe
3128	msedge.exe
3128	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2892	4708	Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe	79
PID 2892 wrote to memory of 4996	2892	WScript.exe	80
PID 4996 wrote to memory of 3300	4996	cmd.exe	82
PID 4996 wrote to memory of 2088	4996	cmd.exe	83
PID 4996 wrote to memory of 3576	4996	cmd.exe	84
PID 3300 wrote to memory of 3108	3300	msedge.exe	85
PID 3300 wrote to memory of 4860	3300	msedge.exe	86
PID 3300 wrote to memory of 1612	3300	msedge.exe	89
PID 3300 wrote to memory of 1612	3300	msedge.exe	89
PID 3300 wrote to memory of 1340	3300	msedge.exe	87
PID 3300 wrote to memory of 1340	3300	msedge.exe	87
PID 3300 wrote to memory of 1340	3300	msedge.exe	87
PID 3300 wrote to memory of 1748	3300	msedge.exe	90
PID 3300 wrote to memory of 1748	3300	msedge.exe	90
PID 3300 wrote to memory of 1748	3300	msedge.exe	90
PID 3300 wrote to memory of 1660	3300	msedge.exe	91
PID 3300 wrote to memory of 1660	3300	msedge.exe	91
PID 3300 wrote to memory of 1660	3300	msedge.exe	91
PID 3300 wrote to memory of 4656	3300	msedge.exe	93
PID 3300 wrote to memory of 4656	3300	msedge.exe	93
PID 3300 wrote to memory of 4656	3300	msedge.exe	93
PID 3300 wrote to memory of 3024	3300	msedge.exe	94
PID 3300 wrote to memory of 3024	3300	msedge.exe	94
PID 3300 wrote to memory of 3024	3300	msedge.exe	94
PID 3300 wrote to memory of 1456	3300	msedge.exe	95
PID 3300 wrote to memory of 2600	3300	msedge.exe	96
PID 3300 wrote to memory of 1456	3300	msedge.exe	95
PID 3300 wrote to memory of 1456	3300	msedge.exe	95
PID 3300 wrote to memory of 2600	3300	msedge.exe	96
PID 3300 wrote to memory of 2600	3300	msedge.exe	96
PID 3300 wrote to memory of 1172	3300	msedge.exe	97
PID 3300 wrote to memory of 1172	3300	msedge.exe	97
PID 3300 wrote to memory of 1172	3300	msedge.exe	97
PID 3300 wrote to memory of 3396	3300	msedge.exe	98
PID 3300 wrote to memory of 3396	3300	msedge.exe	98
PID 3300 wrote to memory of 3396	3300	msedge.exe	98
PID 3300 wrote to memory of 3428	3300	msedge.exe	100
PID 3300 wrote to memory of 3428	3300	msedge.exe	100
PID 3300 wrote to memory of 4568	3300	msedge.exe	101
PID 3300 wrote to memory of 4568	3300	msedge.exe	101
PID 3300 wrote to memory of 2012	3300	msedge.exe	103
PID 3300 wrote to memory of 4352	3300	msedge.exe	104
PID 4352 wrote to memory of 3816	4352	msedge.exe	105
PID 3300 wrote to memory of 1940	3300	msedge.exe	108
PID 3300 wrote to memory of 3816	3300	msedge.exe	109
PID 3300 wrote to memory of 4220	3300	msedge.exe	110
PID 3300 wrote to memory of 1592	3300	msedge.exe	111
PID 3300 wrote to memory of 1592	3300	msedge.exe	111
PID 3300 wrote to memory of 2724	3300	msedge.exe	113
PID 3300 wrote to memory of 3128	3300	msedge.exe	114
PID 3128 wrote to memory of 3816	3128	msedge.exe	115
PID 3128 wrote to memory of 952	3128	msedge.exe	116
PID 3128 wrote to memory of 948	3128	msedge.exe	117
PID 3128 wrote to memory of 948	3128	msedge.exe	117
PID 3128 wrote to memory of 948	3128	msedge.exe	117
PID 3128 wrote to memory of 4552	3128	msedge.exe	118
PID 3128 wrote to memory of 4552	3128	msedge.exe	118
PID 3128 wrote to memory of 2888	3128	msedge.exe	122
PID 3128 wrote to memory of 2976	3128	msedge.exe	123
PID 3128 wrote to memory of 4084	3128	msedge.exe	124
PID 3128 wrote to memory of 3360	3128	msedge.exe	125
PID 3128 wrote to memory of 4812	3128	msedge.exe	126
PID 3128 wrote to memory of 3868	3128	msedge.exe	127
PID 3128 wrote to memory of 2236	3128	msedge.exe	128

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2088	attrib.exe
3576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Supernova\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Supernova\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HideMake.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\make.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffbca26c188,0x7ffbca26c194,0x7ffbca26c1a0
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5183081521327881095,10450781907953347521,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,1199240849364927795,12908711549122394346,262144 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
        5⤵
        
        PID:1340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,11400849336149809864,5499716065215356737,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
        5⤵
        
        PID:1612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,11506274278909067263,3394752200321726802,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
        5⤵
        
        PID:1748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,16291304580981061745,5669696037834633015,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:1660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8279642843469878955,10174861972401475709,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
        5⤵
        
        PID:4656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,2872329988959812194,16037292520602115195,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
        5⤵
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,14194725248551010107,11544686265583736954,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
        5⤵
        
        PID:1456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4304,i,4473082945872107008,16057131014430419337,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
        5⤵
        
        PID:2600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3884,i,6273396358279196079,7058011444481661702,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
        5⤵
        
        PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5188,i,140079835394570914,17111394194015816537,2097152 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:15
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,5240236301891953216,6114287553131378089,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,13533642125825508612,15125413770181014965,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1771865574933020346,8290801721596092586,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:3948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1771865574933020346,8290801721596092586,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
        5⤵
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,15455308249764411789,6957634333737236694,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4352
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        6⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,2423315907394778341,4473634955311227705,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        5⤵
        
        PID:1940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,2593461423407192498,4098831093907587586,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
        5⤵
        
        PID:3816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,4185856262317040429,9692181633389827573,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,17148074399007849238,8874207308358836484,524288 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4504,i,5302002866032017547,7511871397748719787,262144 --field-trial-handle=2080,i,5033814570218356223,11352318589811765640,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffbca26c188,0x7ffbca26c194,0x7ffbca26c1a0
        6⤵
        
        PID:3816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,4987820506179401043,12856449830237857371,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,403800270312131406,4224117417392725274,262144 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
        6⤵
        
        PID:948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,5492118975806335506,11925251280283619225,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:13
        6⤵
        
        PID:4552
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,6791625706744644323,11352456939997481256,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
        6⤵
        
        PID:5052
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,6791625706744644323,11352456939997481256,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
        6⤵
        
        PID:2888
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,7475712164068744084,1672654486416627340,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
        6⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11397173632122431495,15366818673157858153,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
        6⤵
        
        PID:4084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,5655936417657689607,1824370234977438497,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
        6⤵
        
        PID:3360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4692,i,3339790381888886310,3258141429227588715,262144 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,15426844680247514059,8424824536353303647,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
        6⤵
        
        PID:3868
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13466369902249536380,3389765209337450493,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:14
        6⤵
        
        PID:2236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,9705011987728866288,13562343109329393641,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
        6⤵
        
        PID:4732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,3516697167244103673,703208319370940181,524288 --field-trial-handle=2140,i,6472984022372716486,6068824660526011339,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
        6⤵
        
        PID:4864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +a +s +h Dwn.vbe
      4⤵
      Sets file to hidden
      Drops startup file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +a +s +h clean.bat
      4⤵
      Sets file to hidden
      Drops startup file
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 393d76a3d1e0981fb8c79e8fbf067ec2567826241ea874a8dcc210e4131d3f45
MD5 aca2955089f2aaedea61f37e7b7c4b7b
SHA1 d09472d68a0d08fbbfcba290375a58426cdc27ac
SHA512 bec7ab4da440e792a88378b896eacca057b1cf1a8d1b039dc3a2257366a60622e3054bd196ab57914f22bf004afe41aa515b3eabfc5351f624901ca04cd17734
TLSH
T1DCD0228C238A2C22EAA8BC3000A32F00A2A0E0228308C320A0B3080A2C820832202080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acc64b5fafe18b6dd8318d3036a3f5c8aba723aef062fb3fcb70757f1fe28095
MD5 8a1ba1ae8c21c699eac9164e0ecbb96e
SHA1 29d13ff7974005e3007ce0900cd6d6066ba670cc
SHA512 ec43dcd4de57fbb5716711bd972e38e38cd27cd080973b78259deddbb7c20cb9c2fc60d37a1021e4a803282ebe4bb115a53b480bfd6455dbe2102b51d62b4477
TLSH
T144D0228CA38A2C22E2A8BC3000A32F00A2A0E0228308C220A0B3080A2C800832202080
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cad39011f4d2bc4f66844c27a586904f2d5c07845a893f43b725353bddf5646d
MD5 6e84665042f5d7fd713d74a09451a16d
SHA1 1ad5df0e5a4cb709e43890a6d6d27b2cfe31e88a
SHA512 b1c53912aa6259c150c53041207dfd4129f448f2ae72d4fe60f6b614a9f3153f163f46f56fb0051ac429c51502cb6ccf19ee87f3818e95ef53cff55952f2da27
TLSH
T165E026B518CACB2EE348658742EC630C83C43A0B9BC8A91E1B14E484B401984A7866F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68ab9720ef694dcb1aff0b75d4086c4df17208d1126677a6b1976606cecc030d
MD5 d4365b1249509675e07aa39fc5b30249
SHA1 2ddaf361cc94a389e3131364d1e0f02ce667920c
SHA512 3e613926814ed83557add0ed8d25ca511ec984808bc1a344a3f36b0cf0b7decfacbe1047a05cd217621fef53054eac418f94495697280c2183e1d1d31104e7c1
TLSH
T1DFE0F1A5C925FC2708FC030800980B46EB55132B2B80840F363C810D8FF5F3F8181D0D
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4f06fd192b6ba6b7b35c8ae7236cd3902d637140cb9ba69d64ce5f5f42833b19
MD5 63efab768b6dfb25dcccf6f34f9d2a7c
SHA1 cba1ea6b444181ad18a5cee3041a9d135dee1935
SHA512 82b762742f086375ac1de0e8fac7afff61e234fb5bbdcbd36d7903d5de9de03d1b13eec1335d45dcbcf99eff28ace5a5f9e399ab1cea41f6868ae6acb3afa0d6
SSDEEP 768:helOenBWbj8K8I8pj868E898F8l8a838S8a8c858P8wDZ:McMBWs3DZ
TLSH
T155131A3E723E9C52E6D3493C9F172F359772EA69E4CE15179332B910A26CB823D1E490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 50056cb2e67278c3ef160230ae2d040af339603890d570e27af12acac71ea418
MD5 4ce2f07bc5e000c6037799a3d542396f
SHA1 1ee125bf6768d95b9801c47fc2c313212ad4353e
SHA512 f854b7fbee6043bd2ebc48fa5ee92fad894293df5ad8d703ddca63a6fa48ca0885c37330c5d202345b69feed814d049b43676d449a345b2a13463f92227b19f6
SSDEEP 768:ykuO/kS0jcS5AEcy5zfdnHn3ODjsmnCDbiqqoXAVMdgKDfGWTucMQ3ZtKVw:ykuOs7cS5AEdF4sPpNSipScMS
TLSH
T1B3440CF70965A01BCBA852F5E3033A3DD17B055D6CD1F8E9D63C0CD52829B22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0f6e747db434605c13e5111c9626523812277984b8729a2e98ea94d9db51ea23
MD5 c6196ffa88f02e25acbcd2af932a8df7
SHA1 79e8ae823130c81a07a3833295dd4fff8312ef10
SHA512 5370f10e12fc4646aad4fa93096114359d08d18da9655882089dbc445b52cc64031017a207e21d68f143e7035ab775c35dc25b95398ea2ec57d7772d010cb77a
SSDEEP 24576:FzWSmwJxd79ZnCPOw8tczZSQB+sPe9dbvWJNfxxBuAVQLX:NrXBCWKzZvB+sybuJl4LX
TLSH
T162167EEEC6785C83CE778A30B4E0EC477C7412C3B599C1D38958C55842AB7C5BAE92AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 786d8667b7cf5a32a967471574907ae25ce7f6c9f6526b8d6452208c041ac062
MD5 871c145c9505d6810072f5aa784b9c31
SHA1 7ce51f56769ab03d69956f74adfbac7b6424265b
SHA512 afaba533ac339dee080f65f505bc2a37f4720b17247d5eef0ec7e95a1f1b96d9a9044ae3d5f74a3c5a21a51883f1ad2a3f572d19c224df240463f07a98e7c84d
TLSH
T1F171F98161E1BC5BEFE641F99BEED40D726441643136DE3712E690FD091FB52E04B5B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593762.TMP
Size 3KB
SHA256 f1830f29b58c48a3f0dc27b70a52e16b7fe57b804e9e91573bcd067e9bb958a9
MD5 8633bb26856c1176324cc41d85fbe05d
SHA1 fab40afbbe30721df6cf77dffa1d6f7454beb836
SHA512 e1dd2b84573bb72c5c5cf0c2b9c9495203219c7d29272b18d1f1f6550ecf07f34b52fa72bf91baf820cf65d6da07178db3161e869744aa637887f4f36d729a4e
TLSH
T14561F89551E1BC5BEFE600FA9BEDD40C726545683172DE3B16D2A0FD0A1F741E047570
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 4751ddf67f56f7af18a2aa72656a9f3eccc0b5ea2b9cebb223ed8ead4003232a
MD5 c93ee592dae7f45f3eea94889f1273b8
SHA1 19ea95a7ac4d59f61b0bdef4c056fbeaf2deb666
SHA512 89b63ada004818cca2e5614acf6ae7c2a9bad848f7ee9219edad7038f261b3359138cb761354aa6c8d67613a46978395e3402a48b87512e22138cdaa9ad238a2
SSDEEP 3:MsEllllkEthXllkl2zEgltOHYl/:/M/xT02zjko
TLSH
T1F2440404FFC44547C7401170C431C37313F0D4540551D773347504D75CC75501C44400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 cea71927fcc5a6955768e4a5e713db8d17b7af86850ff5309c1315dc142bb48b
MD5 59caab81a66e33b3d299459c28dc665e
SHA1 ca488daabc2ec7c0f13f5ec057bf8439731fa37b
SHA512 a63cdad6fa37ec7ab96830dcfc211112cb4fe4441f4182109f5fc669a347e954dc3a24e20ab5bce355d06997da37a30345ecad82c88197be182b4a6cfe0469d5
TLSH
T148E0D8B96AC7C55DA51474D742B46B18C2C03547D7956D0B6F0098C07A83001B7555AB
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 798B
SHA256 a2f4765271e0a5f8bec5e07531a57e188e857beba530a95151277a5ef7ae0e51
MD5 c6bda62773da4630dda4c9a8d59c7eaf
SHA1 3a052395933147b638f3fc0065bb3091dbe04870
SHA512 a7c65d02572b4c418043e605978386e87ed62546b4ee5189ad32e2687932945e5b28c4c3346cc4f0190c60a5e2064ee36a0d2727f15fbf81611556abc2465567
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 60f8aac465a8b01e3d5bf409db6601a1906ff6e3dd9c2626b0029ba78d926af3
MD5 00db04e99bd1199ad0f552042788e646
SHA1 0474a149dbf851b2c139dd5953e1846b70e5993e
SHA512 0e88c7e9db50d481d0a4fa5089c023b4ab0241a3f8d67972016f6b1f044dddfa3431973d2be0e1a2f8771468cff756b8e4ee7db8633a48e1e303811d586912e6
TLSH
T11BE0867415DBC92D901D68E382F8731AC6D13547B7983D162B0D9C41A153655A39A2D0
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 be25c8977ee194f9b903a6bd4f95dca21b9a544fae70997df784ac584552988b
MD5 793a2e2576db687254270e1f8d841c8e
SHA1 caa6f74b85f0e4215b3b635eb6fc2f7ccbb4c4f6
SHA512 3eff0716648721d69e05f66f541186ba4f0a31c3fba4de4894f6d179a0901dbaaf4f958770fd705e2b359ab702c3eb058b5d1c553c02c19e384ff595b1bcccc4
SSDEEP 192:6y0+G83uxXBBK31GkSJWHXikEJH7DNspUU:6ya83uFBBQ1GkSoiJ7DNspUU
TLSH
T13914654F5F303312CD7D803669E658A75DBDF43F8B527A9AB8600471CEE2B52605C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 287B
SHA256 7d3bce0f92cd0f5326f0f5ff2c7b1b7c09f797f6b242a50ff77bfdc2db7cfd2f
MD5 efae38bed82a43facd6b6bc7e2d1dfd5
SHA1 cab43be4bdac1702251c51e73cc673d5727b53d4
SHA512 e4f985a92e46b64bc3a68fe4e2b59a39d5fbbfecaefb4230ce8e9e5c68c6af7fb901e93090cb74268030990a161252478bb93a18a800fa36694a999c6727846a
TLSH
T1F9D0CD444419013EF1386AB6DEF80713D719C2241FB5BDC9D7F70A48952951545C720D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b9f13672c7cdbff539613e0622b9de6f0819efcfe36b2d25fb426833af1e08ae
MD5 c5258141644724357650a8ce651dc3e2
SHA1 691cf361f058ae25da35ee033349bb30840c5100
SHA512 c76468ccd522a601c39490546b48ce53a47cf3f022fafcd9b819f810759a749467ab5e08a014a1c334a94bc73884c1ff2f1874469817979a806a8b184c790399
TLSH
T1CDE0267056DECD2E620830AB82E97B0CF7F0351BE7883E469B1CA940B042008E396AD3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history
Size 20KB
SHA256 5e0ed7ecc3d0b8a2426de16417144aa56d2f6265e34f15a46520174375772ff8
MD5 a1d1f939d26a6409bdf1b5ef059e496e
SHA1 29be251d04af3cf0042e2bc67685b23173484f09
SHA512 19c967f9a17d9f28e862b495f74425ed0ee5c47d19a2bad07a8a9881eff6597040a1962abded6b1faa0100bd8ca3b61759299fa43753031eaff3d986153d1f26
SSDEEP 24:TLM5UOl0afDdWec9sJ809uoOKuYKjB5fc:Tw5UUDbg3qWKADc
TLSH
T1A192CE232D362473ECEA9A3F69A381E11E381A5EC5B7FD45CDD444221DB0BD0909E6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bd19a801129e1604c689d4ae32c59f588e7e54b76718e4398dc7a98b77813b18
MD5 839b651a3401f96bf6a70794f2ee4cb0
SHA1 8344434ae795f304c15b5675a635de761d8b21bf
SHA512 4f416fe527bf460921409e067d56f58b5454a652e9b25a29f925d71d88e7382f4a459e89c2dd557f358f096d88f4b8b7b283eb0381a8a99026b59ff3edfd2d31
SSDEEP 192:sxZXjQUn3lCE/fOswQCodpy3/W6+WNGY0GnlOw7o5Ig4J:sxZXHn30E/fOswcM/bG5wObc
TLSH
T1F932B8127E28653B9CC7E219FB26BB13D6FD503695951E48E6FC861C04EB6DE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e45806d99ec877fd87a58566ddf6508f23db37c3ccba436c8147cc8caf9bbfbd
MD5 89e7ec03fe6b0c5fc0b70a878a935e85
SHA1 a82e2ceab59a8de126380891215195306b0d1a81
SHA512 01628d5982786e5aa4b084e6f792075761aa67c51c7f3db9852a85f7fdb4109cd53d3fd39cca491b8788468bc59a6c22e621683f39dd07b6203d44eb0bbadd7e
SSDEEP 192:sxZXjQUn3lCE/fOsvQCodpy3/W6+WNGY0GnFOw7o5Ig53J:sxZXHn30E/fOsvcM/bG5oObv
TLSH
T1F132B752BE28693B9CC7E219BB16BB13D6FD503695911E48E6FC861C05E77CE130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ee9849f7a6c220e435eb3a92ddbe3049926ebccf755301146e9ded0be445510b
MD5 87f5b5112d7d4bb7b5c1fbd515cbb466
SHA1 8452945cdd3302d1bf5fbe4b08d63aecc92b06b2
SHA512 70731efd08b5989b9c80e2c74355f4f4fa305189b0c4a58e24563838207088f04208a116b88b996b5edda937b9da2a909c13d6bb0807fe7e9792d8c906c3d98f
SSDEEP 192:sxZXjQUnBiCE/fOsQWpVdQCodpE3/W6+WNGY0KnCOww1XIgb3J:sxZXHnBVE/fOsQWvdc2/bG51OHV
TLSH
T19842B6127A28693B9CC7E219FB267F13D6F9543699911E48E6FC861C05EB7CE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7a596c07c6736d2c2881e9a65828ec41601057efab49daf4170c83256f1f84d3
MD5 effd2f5faea971f07792db66a3e004f1
SHA1 2614c39a8fb7528949eb5bf4b16f72bd3e2d97aa
SHA512 67556967207c1674a8f7614825ee92aa86728f0433e674b5b52d193e814e17fdb231680505e37d8256cece37b84c326bba6498c5d9a4d4fcfbdd2bbf4ce74250
SSDEEP 192:sxZXjQUnBiCE/fOsvWpVjQCodpE3/W6+WNGY0KnCOwwJ5Igb3J:sxZXHnBVE/fOsvWvjc2/bG51O5V
TLSH
T18642B7127A28693B9CC7D219FB26BF13D6FD543699911E48E6FC861C05EB6CE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 192b5960b357bff405da1ff81133c954af2612339fb8fce063cfc2ef4ba3f3fc
MD5 b1957cff91644473aeeda84a066e3bee
SHA1 d9d752fc579059b3bed3b87f738efce5abc99344
SHA512 de7839111011260826324f365cd06563642d2a3a70590eced6f341188778e0bee5ffcc960f9f5f64d6acd335d5bf53a9f08a3dcf0110f9649dcd97926b529d7f
SSDEEP 192:sxZXjQUn3lCE/fOsPQCodpy3/W6+WNGY0GnlOw7o5Ig5ZJ:sxZXHn30E/fOsPcM/bG5wObt
TLSH
T14C32B7127E28693B9CC7D219FB26BB13D6FD503695941E88E6FC861C05EB6DE130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 7956171e059c559ee1a76a2bd9569c6f57e5b1e41e612115c5eca39507f3801b
MD5 8356c5f3bb8ccd6897ccd942e980e67b
SHA1 ac627f3598e571100376fa06f0dd5f58dfb6be49
SHA512 75565bbf0115eacb4aab19ac54aec53f6d4479fc69e7d3d954fee0a83fc121ac7aea56dff5369d408150770f2a2d25dc4bcdd99e508b2e1c3fee1619818a56ba
SSDEEP 768:Fn9rL8Sj2OeWRmqSQgq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3oJLl/cW0n8WroCa:Fn9rL8Sj2OeWRmqSQgqu1jaKoJLpcvny
TLSH
T11ED20A2B344CCB7E4FC01A99DC166F976E9802C7A6688D4447FE894C02D77EA912A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 8f7ea9ac27cc893d765cf21ab2555fd8c59ebf743a5b365c08c2be440c45633f
MD5 78833cab25c99b6a4f763fa5cad0cfdb
SHA1 6ede3a87aa08f0d4bb3751aa6dc7279ab8f446bc
SHA512 919d2596f6f0261334020ef8644b302aab6e5e9ee22ee7ed901efb4dc4b4cf0c2d3c4dcc4a476d8ff715d8ace15f8aa7a502ad04c1b850d41d45dfadd30c1082
TLSH
T1EEE0263417CBC97D619E305B02E4970CFAEDB847D3C83D062F00DA40A543504B3965D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 376b6102dc4c8a4f16ae31fe608240c22a01b5b6ff398e9f79f7ed6d8e779350
MD5 29997cd91e737b0dcccab27daabbbda5
SHA1 c09a75dd34d42d8a6be63f50fef21fe763e17337
SHA512 81004b9cc50e0ee9189d32f6740a0edeb173f4e4eb408012f64d9f7e2f189c1d1ed5b7aacc3f6379ae64e70d51f79ca66bc22707fbfdd00dc1aab4e2beb62562
TLSH
T10FE0D83026CACA2E6189249B52F4F308D5E2BC43D7E839252B08A5406207140B357691
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b46a426adc7699364e834c101a7b45038837800cfdb60e40ecc22447b715c2e5
MD5 06ccdac4a4affe61d8cb9ddd0c8b4e50
SHA1 6b61a9ee41007b346d9480adc301a13b3ce87e25
SHA512 c8148f8e58830870aa5e4d8cc4daa5dad6a602dfa2309173ecbce1ae979f6f0c11145935cb898fffaa8f893b9e6570b7b26a730ef8ccb57641c4f65b5071ee1c
TLSH
T1EFE0CD7096DACA3D5048E09742E4E71CDBF0BC47D7D83A5A570C7C91B103145B7AB9D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 d6a03c142266462c1c411f956149948b6b57b23ac14b5232136897b564c7a062
MD5 fcbdbba23d33490026372b8548bc3691
SHA1 f414e006e9dc13d63d156b3d990bbfca4dae5e56
SHA512 04c816920ba23ff490302979c9810d081caea848b3236b7159f55c142dc93bb9ec3b7d0e1561ec5392e0f2a9e7950e53303a8f15b53c6f135d015e9c5b6da6c8
SSDEEP 96:KkegKzqoxSKCkSaa4K/KYRiKiUyy0AKFeMqEKDi6g:GotfCdDIfg
TLSH
T1D1F18511363A024239BD295F95D1F62B86C130A33124A93F7BED25A24F67E128DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dbe8aebc0843a37048730b3ac12932167f07a1454337b3799000525fbd426f79
MD5 852a2c3710dc1c6c3d0a957ad63e6688
SHA1 6c9097c70b1a554f84f6ff2b74aec3ee4e262870
SHA512 8209a4cf1643ee63916ca201570373a82bee147b73cf74b97504d993da59b02ce682caba56a98b29ed0bb82d0bff325b6d5dae5a888806fd4d66474059678e93
SSDEEP 24:KrdKpUhIXK1hq1iS4rXkXsEOIZKUhk1iShSVyXeRON81IPK5hK1CSsPtEHMM:KkeIXKzqUlxIZKCkcby5aIPK/K0zM
TLSH
T19091F211363A124329BD2D5E8594B62F86C130A33214642BB7FD16628F67E32CDFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 78f436bcf5537b068230e71815dc4ce99c202b49f28a04bcb620d80ef00bee65
MD5 491208b89a1bc793d0aee73b4189351d
SHA1 852d47704e84912f4f105f5c4853ff8fa0c8e9d1
SHA512 812ceddc00084cff1bf72d69a8ebfcc2af1999ac325208eb22915bcabde0fe77a67b47b5efd53cb7577dde7e70a3b718a0aa69af52b4bf782628f95bd518076f
SSDEEP 192:FvoW1TvfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aAvfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1BB24630A7B747001EDE7E9725CB080771A3CB16DCF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 50007163d3c4506e64d27ba2ca761dadf9f25a626456e389357522962cf4f608
MD5 33ff64e1d97a6a83fca77a4b0975e36a
SHA1 427e4ee40d95af44db3d06e46da9f2f91afe7dd6
SHA512 c477e9354364ca9bc06d0180719eca8c8dd422efd53309cce334d3a95c486e0126d3671c969581ad942bcf8fca5191240c1ed3c7a0b3ac640d63c355809b73ef
SSDEEP 192:sQvIIIebOMIMUbZYcY6gOUKAsoli/DQ2sJPZ:sQvIIIebOMIMeB/UjsK52s
TLSH
T12842816A27492B77C28F5F3A1656C2805AF888824CA0352D31216C1F8EF3F9B47C12F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 8ed56369a6456ebea71b42aa05081923f2024d2e77e9ced71ce74f7c4e951b2e
MD5 17c8dffd42955f8374b00ee8056ce5da
SHA1 5f2d241e7e88217a5811f0bc3de73b54c769ad5f
SHA512 8754ea85d06025b8bc709676dbd4d0eb1202a5618fc92d06f225dbbc890486a633eeeac121018e3ffd010212b6b2f162c6ad0e6663a363fbeab612d4cf78747e
TLSH
T1E0E086F0BACEC96EB41820DB01F8635CE6E13957EB98299A1F04D484E682148F7DA5D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 0fc4e48315b5708f02e981130c6e2c430a1af924f41bd70e8fb30125a8c00d70
MD5 2b0ed78fdcb7d46cc4a55ddd78949380
SHA1 65e73739af4fd9e02d6e88b3cf6e1ed2440943a2
SHA512 6c75263f2dcb3d2fedab437d408fbcd7f5c2e8b43b8412aff868cc2e346bea8b661dbf2798d3afeec96d9c9fde2a067ce5f267430fe33463acdd93029163a068
TLSH
T12D212866F334C119D149467A583F6B161734C812DFB8EC0F54BA24242E76F040E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 eaad4f197e0c0060e4368166cd612c81499e1c34cd7201c9aafd1cfc1d841b17
MD5 155c8a89232cd01401fd39747fc993f1
SHA1 1f6d64c5dcfe7e72d9b75e33d04a5bcf4d862104
SHA512 aef3eeb37aa589b198781f1c1ed754acf074abf7f19990a6f9b104effdc547aa7ce5533e36cdb34bf95a23b97e7e88ad1a0d69d03c09c3929160df34ab9c29c4
TLSH
T1ABE0D87075C9C55F5094309741F8A74CE2E13843EBD42F451F0489849542141FB8AA92
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 23f9ffed48bc1f78e39eb8b0ed849b9d7e6b30c39a7fc9891fb579b013d3e71c
MD5 e91a1785c0b0a9b1451633c67f1703a6
SHA1 81c4c88cb4125de159c8f0dfd534d991d705279b
SHA512 b4a91fcf94a5e306727c0b43d30453cf07ce86902153467d3d2ff7b7bb0a07776830c393d14d11e94c1edadd557e4846fa5057097fb570664e7d6a7e24aa2f40
SSDEEP 3:MsEllllkEthXllkl2zEgltol:/M/xT02zjm
TLSH
T19E440405FFC445C5C5C51070C471C7D03370D45D15515743347544175CD55501C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ce8c65034ce197b1bf3ac3a391eabf3a9e8264a8d3078b781d12441b3cf660be
MD5 e138e380f0a3d7bf567bc16ee3bbf065
SHA1 1c905f3df9a1d9518a9815d8b787864c40b3c796
SHA512 ebf526cac50dec81d055ff3acd9d1c173bfec52ac07cfa20962f51dc67c7cfa60fe11fa6c23abb38777e993539b7d825ca3f2d0a9a31c165f3ae610f8e08bc64
SSDEEP 192:zjYk8N/YcQV11KL8XiQmiU1haHe4JX5Hw/5+XjzorIX+hoBOI/ASU8:zj/8N/zMvuHqBJX5Q/5+f8IXGFkU8
TLSH
T133420971A969EC275CE7A545B0473293AFA8107BDE842F84E6EC4F1C008B39D274EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7049205128df8914d4f6cd70825d3485861da140ce05fb08c7e71f7f544e5277
MD5 9071c2f4fef6eaecef7b405020eb93f4
SHA1 48eb7fba01b8f93f91a9618b3843888a71ff2d43
SHA512 87e4347aa50f4e9f4e9acc5f7cc00fbcd338e601935d6f3edfe177783a6fe40d77dcd997a30786e3cb72153dcd091b484bfae9acbc185fe738a022f7937c386f
SSDEEP 384:zHQ8NfeMvrz0Bl2DP/Zf7DF7X5Q/5+f8IXGJsfOAealKlj5s+UI:048iDP/dDFzw4L6sbDKlj5s+UI
TLSH
T1F6B2C5F89CD7583AC8AEA347633E2D525A7CC137B5A41A48F7981B0CCC6657FE30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b9cb290bf67fd76ca508176ff094637331f03dd443bb89d57382b714274827e4
MD5 244938d4309db2c831a9138a126aa63e
SHA1 d29319e055848a0614d8f6738209657eb736c293
SHA512 7ee68e604baa7315cf3f229b78ee1eca6d35b9ab55de5a49de6c74141bd5331671920bbb2c64dd2a8151252c1c8940dd1523144803eab0be95309ccb0703554d
SSDEEP 192:z9Yk8N/Y3QV11KL8XiQmiU1haHe4JX5Hw/5+XjzorIX+hoBOI/ASUt:z9/8N/eMvuHqBJX5Q/5+f8IXGFkUt
TLSH
T18C420871A969EC275CE7A545B0463293AFA8107BDE842F44E6EC4F2C008B79D274EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9935bde66824b36e7e60e18e9d9860baf5130a4c2f86a228fbe02de710c8fb23
MD5 05ceddda3d0cc0cf21a065ec00499d60
SHA1 486bcbe1dd064218eab646c435a324865be04d36
SHA512 97a77fe5812d5c420054d79f6851cb3e8d78a7b5b92bb216785c29aee499f1e838cc2b7f765d1964032592d5d148eedf640d3c35efe78b441dcb49e59fd30b40
SSDEEP 384:zHs8N/eMvuYqBl2DP/Zf7DFcX5Q/5+f8IXGckUn:gkaiDP/dDF0w4LvkUn
TLSH
T1059253F0A8D79933D8AE5343733E2E829EBCD16779841A44B7D84A1CCC4767FD60A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 a387661f9ba7b6c880556634e1642fbe8a017b3524ae4b1f4f35691aa211728f
MD5 feaf7b546295cd829bfd21c7aa65d697
SHA1 080b2a8d64107a353a880e70a9075f81075d7c7f
SHA512 0e82d788fee93930385ffef8d2b9cf8ec09e9e70732c443f9ad7a511f33db473bbcbe1168d192ae9b00322702b74d24182f0e9c52bbd96b4b2891cf1eec67ba9
SSDEEP 384:zHU8NGeMvrA/Bl2DP/Zf7DF7X5Q/5+f8iVEGlKlj5sQI:wLWiDP/dDFzw4zyCKlj5sQI
TLSH
T160A283F8A8D7583AC8AE6747633E6D525EBCC127B5941A48F7D80A0CCC5367FE306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54397b4cd0e27902e11bec4bc52bef738e99ecca97683e17d782cfc1be176f99
MD5 322f6e50ec6c7fad4e68713165650220
SHA1 ebe191ced797db290397e47677c4ecb65a049889
SHA512 8317e1a6da1a9e6e5f4c5594948af7abd250aaeed746c32b1f0033ed866a25600ee2bca4c272ada8d8b3534e406b34be224b238c29e4fddf982264f64d82f319
SSDEEP 384:zHU8NHeMvrA/Bl2DP/Zf7DFPVEGlKlj5s2I:w8WiDP/dDFPyCKlj5s2I
TLSH
T1549273F4A8D75836C8AE6747633E6E525E7CC127B5A41A48F7D81A0CCC5367FE306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f35684c19d87375589ea4ab8a5fd6ab5a58d1f467cd878d44f8e18a2ed986c9e
MD5 6c76368295d1a9964a3421b5ce1a9cca
SHA1 26b09f97324ae381bd523545128361cd5f564971
SHA512 b9f6142a04aca351777127777be39502d6bab1b45a19a802f8e1f5e79b1538a55c7af5637be33f739a8c16c1576dd1f6fcc86a24ffc20cf57d4d994374918abb
SSDEEP 384:zHQ8NGeMvrA/Bl2DP/Zf7DF7X5Q/5+f8IXGJmmUI:0LWiDP/dDFzw4L6mmUI
TLSH
T1859273F5A8D79837D8AE9383633E3D429EBCC117B9841A44B7D81A1CCD4767FD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b5fd22f45059b0d81e6f6e79a2913d194e93c2b6b62ffd6d5e78fb16a1c04367
MD5 5e02430cf1c8ccd055e288fb5eed5cef
SHA1 5edc90df1dc3725a6a86b1ed516ffcb437a3b7d2
SHA512 5262b369cb87ea5a13e55e906091bfe633eace48b6327628412ee5c0bc09d63efd09ec41db97afaa18f49f85dd83940552de69cce218cea560e9f5bf1f5ae4b7
SSDEEP 384:zHQ8NfeMvrA0Bl2DP/Zf7DF7X5Q/5+f8IXGJsfOAealKlj5s+UI:04RiDP/dDFzw4L6sbDKlj5s+UI
TLSH
T10AB2C5F89CD7583AC8AEA347633E2D525A7CC137B5A41A48F7981B0CCC6657FE30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5a83abb2b8ee2cde5864244bb07685036baf6910f182e869ca29be8be73d0b55
MD5 7e151e4a4f6e1713417d50800471bea4
SHA1 e9bef6435609a7931fea367cd5730207ce426531
SHA512 054f55af76ce0527255f0c1e7f5a68e761cd385b65cdb2f2acd70380b7d246bd3a49bddd940e921fe3ca2858dbeab39a67db0b2ab8f3250da87469294f430410
SSDEEP 384:zHs8NeeMvuYqBl2DP/Zf7DF7X5Q/5+f8IXGJDkUI:gpaiDP/dDFzw4L6DkUI
TLSH
T1379253F0A8D79933D8AE5343737E2E825EBCD06779841A44B7D84A1CCC4767FD60A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 32f746fb6941ccff50451d5004bbba5e63d51e9e38ec0d65936e0174f21cb917
MD5 fa080370be7176f361bde45f6fd63ed5
SHA1 08538e45c7214ffffa897469c89d57fff11a1904
SHA512 2405073b6c56809f7a6f86e6eb8d47271a5e476f70459aa3273a03e2de2c427292e7587646b3ea4e6cefb2f1a975ea8650a23620df55d9491600113210d3d235
SSDEEP 384:zHU8NWetvrA/Bl2DP/Zf7DFPVEGlKlj5s2I:w+WiDP/dDFPyCKlj5s2I
TLSH
T1469272F8A8D76836D8AE6747633E6E125E7CC127B5A41A48F7D81A0CCC5367FE306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c05df5e2c071921e4fe6b387e45dde1f3a5c76b9e0ddd8bd709a6613d518a34e
MD5 9944ccc6803eb7754f6c95e8d3a84ef2
SHA1 063c2029164599c63cbdebf5aaf85621e084d198
SHA512 0705c179a9fad3e3173cc9933d68a023443ceaa7ae3e52aa1d9bb18541edb86e7cfd7a0b8e938bd5aa9a61abf0d6fbe9ca23ce5d17e80bce01bfc0f437700e40
SSDEEP 192:ZGN66hNQmiUyGGhLNYX5Hw/5+XjzornWYo/U6:ZGN66R9G1NYX5Q/5+f8/eU6
TLSH
T1A602D879B96CBC7B9EF3AE45B44622179FE4103BEA955B84DAE80B1D00C775C2346C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8907ed0ef089735e806b7743826fb8b6305b4a54d19017f97017e5e1dcb89a8d
MD5 648b9145b956cee6b907df6507bdb5da
SHA1 89495ac6e3db11d9b66bfc97f9865fb0b77241ff
SHA512 28327a44769a98876b164a2d1a7ba6007b7b4b0fa48958ccf2524592d8f51477845836c072d1c65cd1a5295f1805cacc666f924187ebfee7e43cf6894063520c
SSDEEP 192:ZGNq6hHQmiUyalLzYX5Hw/5+XjzorIX+hWqLI/ASU6:ZGNq6bP5zYX5Q/5+f8IXGPkU6
TLSH
T1A612F875B969AC275DE3B545B08732939FA42077EE859F84E6E80F2C00CA75D274EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d10f3f735d01cd271d078d76f68f12a7379bf682eb728cd329ba3201e962d867
MD5 51788c0f11da58815cac84c6f1247983
SHA1 784cf07d8e76c6f3334692c0d9a532481684d490
SHA512 fb5c84ae7f8af8e452304886df21ade6f3705b858a3d7878511d5027355e343fa3da19e0a0503bfe0cd063fc5da9e3d8a0a304abfec0f5a5a99da6c4dd5144d3
SSDEEP 192:zjYn8N/3QV11KL8XNQmiU1haHe4JX5Hw/5+XjzorIX+hWBOI/ASU8:zjO8N/3MvbHqBJX5Q/5+f8IXG7kU8
TLSH
T114321971A969AC275DE7A545B04732939FA8107BDE842F84E6EC4F2C008B39D274EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a231ef82da5681715549c2337621f37f11dbb7ede5f155d4ef2ad86433528283
MD5 8bd63b5fb037c7f212915bf43ea610d2
SHA1 539a7fdaa63a41e98889b2eac62fb5e930bc14ef
SHA512 529340f8f0f23f8e17bda1276d637277367e795b1d018b2d70df66d3969d9cb0b9a16e173b3299b7ca4d6aab767ba0ebe600f605fb345b490520e81fc3fef438
SSDEEP 3:MsEllllkEthXllkl2zEgltxll:/M/xT02zjPl
TLSH
T1DB440404FFC4444DC7403070D431C75013F0F4740555F743347505175CC55501C74010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

dc86a82a-7994-4147-93fc-b9da52d21b2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dc86a82a-7994-4147-93fc-b9da52d21b2d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cassetto_Previdenziale-DE_JESUS_MILAGROS-BEROYA-FILIPPINE_RP-DJSMGR73S51Z216Z.pdf
Size 26KB
SHA256 79fcf1dfed05a4278e5877e75dd8bb3f145ed61cc384c51a0d56f92410d611d8
MD5 55e6103f47dc3b5e1bc4089b7080db16
SHA1 4df3450f7d00aa0c2d8b67cad5538de7b6dad2ae
SHA512 7cb91f3d726753515b773eb9498239aa8a48ad4e5ce91222eb07bd6bc0557d174c322dea2ef0c948cd5602986e96471df0a159a8eacd7c9be8770c1f7098ba7c
SSDEEP 768:O4MNGdopiWRTQ2rMCisM3xp/X8TDGxoDsyEUqHDCL1Kh83iWN62lEF:NMEdoxT5EUR1KNWNq
TLSH
T127C25F1C604AC14C66A7CBD5FB6ADCD6975D63637AC888B6799E0E810B12CEDF90F403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dwn.vbe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dwn.vbe
Size 1KB
SHA256 a21b623e9599e57bf7bd7d6f26779ffb1bff08f69a1bc3357239c7cfb138e65e
MD5 4bf712d108e8f241cdb622ede465bef4
SHA1 8ac6c97444607f37125adc93ffe69bdbe1805069
SHA512 21e5016ba960325ef6936c728e6349e7474383267b86144a12c0513fdb2df425dcfb81bd79bf6bcc6efe223d259d05e457323316eb53d7e588cea13dd32b8e7c
TLSH
T1A3410A56CBC66C33A05B9ECE678529245E085CB3E439A90F4B2F19F15811BB3D04C3B7
MD5 SHA1 SHA512 TLSH

Submit Download

HideMake.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HideMake.vbs
Size 52B
SHA256 bdbd3293ee4ab4ce68afcdca42053b65d1702cf13a832ea3b27f0b87010316e4
MD5 5dbdbde4f4f419ad4219c616b68e2afc
SHA1 29187a4ad95352ed9a14cf48c8767521e8df2d84
SHA512 572fc6b046601326926ddb3d695266c2137d789519464567edc684077124d88815398be90827f3dd3e44f6ca83a1a07729a9e577cb716c821458c5a0cf9877fc
TLSH
T1B09002243808E651626445955532580886C46896125099055740916D2361E50061B012
MD5 SHA1 SHA512 TLSH

Submit Download

clean.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clean.bat
Size 165B
SHA256 6481c0b886311d5fc4df63907d21da75b9b40acbb48edf4b5a618a82ec24c28f
MD5 24ba8809683eba72e439c9e3d9e54743
SHA1 6100d78693e66afbcb0049568f4fc0983ae62c48
SHA512 b0acbfaab6a035fa8930844c99d90842e5da9cdb63b002a78c71d3968644412161bf325ba3aa7160ff3b1d3d9a0ef0567336bef9db9289ba6fa095cb0b119404
TLSH
T1FAC0026D800D50F32C08CFC4C10D4056E9ACE6C213E1510795C748E2DB5D8744887FEA
MD5 SHA1 SHA512 TLSH

Submit Download

make.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\make.bat
Size 291B
SHA256 5ff2e9500c94a03014f5656cd49665a9d33e9100c6b9d4157d016622ff67773f
MD5 c41841616783e1586b8438784071812e
SHA1 e27da71a410dea04dba4f3e27c9120a66eddb8b0
SHA512 3781b037c69916c724fd2228c38acec001eeec55181186fb51d3552a79d5b9225bc853d645dcccd150f6394c8268965b47ee2d4115b2a73a2329b3d6e5a76447
TLSH
T1C8D0E7FA0F10A0535F377140434A570D8151C38725837211B4B41453460BC18D0319FF
MD5 SHA1 SHA512 TLSH

Submit Download