c2a4647014bf1993f45a91fa682a18077261432df2012ba31d9188112512241d

Analysis

user interaction
yes
max time kernel
22s
max time network
21s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
05/05/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v.exe
Size 73KB
Sample260505-dvb66afx31
SHA256 c2a4647014bf1993f45a91fa682a18077261432df2012ba31d9188112512241d
MD5 1d4de6f83cd244b4d7cb8a991037de60
SHA1 f1b265a99142c4ef5470b1d049f26f23adac4fbf
SHA512 11fdb20cb2651e1ab16c5f6fb81fd0225afb79e4d9ebbcec592cd31f48f2293af380cb2df360f184a3bde7a833e187033d6782ffc6688efc28ee17bfc7f1d340
SSDEEP 1536:HgkYsnY6IyaEt7v4Mn119bplRxyualtxKesjH:AkYstawvbn1PbplGlt9s
TLSH
T12A734C57BA6800FCD4B6C2F8C5E34E41E7B7F889076163DF036091561FA67C1AE7AA21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com
24	discord.com
27	discord.com
29	discord.com
31	discord.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll	v.exe
File opened for modification	C:\Program Files (x86)\Kaspersky Lab	v.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
932	msedge.exe
4836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224247909515963"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment"	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class"	v.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{E6C146CC-8FEC-4C34-A0FE-C7B274665A5D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{56AE3FB8-17D1-462B-BFF6-FEE276BC45DA}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class"	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0"	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0"	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll"	v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both"	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories	v.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32	v.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4364	4460	v.exe	82
PID 4364 wrote to memory of 3992	4364	cmd.exe	83
PID 3992 wrote to memory of 460	3992	msedge.exe	85
PID 460 wrote to memory of 4232	460	msedge.exe	86
PID 460 wrote to memory of 932	460	msedge.exe	87
PID 460 wrote to memory of 1740	460	msedge.exe	88
PID 460 wrote to memory of 1740	460	msedge.exe	88
PID 460 wrote to memory of 1740	460	msedge.exe	88
PID 460 wrote to memory of 4176	460	msedge.exe	90
PID 460 wrote to memory of 4176	460	msedge.exe	90
PID 460 wrote to memory of 3016	460	msedge.exe	91
PID 460 wrote to memory of 3016	460	msedge.exe	91
PID 460 wrote to memory of 3016	460	msedge.exe	91
PID 460 wrote to memory of 2628	460	msedge.exe	92
PID 460 wrote to memory of 2628	460	msedge.exe	92
PID 460 wrote to memory of 2628	460	msedge.exe	92
PID 460 wrote to memory of 1900	460	msedge.exe	95
PID 460 wrote to memory of 1900	460	msedge.exe	95
PID 460 wrote to memory of 1900	460	msedge.exe	95
PID 460 wrote to memory of 552	460	msedge.exe	96
PID 460 wrote to memory of 4852	460	msedge.exe	97
PID 460 wrote to memory of 552	460	msedge.exe	96
PID 460 wrote to memory of 4696	460	msedge.exe	100
PID 4696 wrote to memory of 4584	4696	msedge.exe	101
PID 4696 wrote to memory of 4836	4696	msedge.exe	102
PID 4696 wrote to memory of 4968	4696	msedge.exe	103
PID 4696 wrote to memory of 4968	4696	msedge.exe	103
PID 4696 wrote to memory of 4968	4696	msedge.exe	103
PID 4696 wrote to memory of 5264	4696	msedge.exe	104
PID 4696 wrote to memory of 5264	4696	msedge.exe	104
PID 4696 wrote to memory of 3344	4696	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\v.exe
"C:\Users\Admin\AppData\Local\Temp\v.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start https://discord.gg/fluxwin
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/fluxwin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.gg/fluxwin
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffb0677c188,0x7ffb0677c194,0x7ffb0677c1a0
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15180958330862025947,15527671592022468488,524288 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,14817095098865884250,17108193420461862819,262144 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,7669148918415841290,15832032666611577848,524288 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
        5⤵
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,6790564657826020066,5040333488900812147,2097152 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:3016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,1073945469945437662,2640370366531829351,2097152 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:2628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3388,i,10123490486372478003,11618095638364266486,2097152 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
        5⤵
        
        PID:1900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,10252709867675407388,21495047396784170,524288 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13434091143919740155,14941687349827136752,524288 --field-trial-handle=2316,i,6721063512891560719,13230615090800916548,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffb0677c188,0x7ffb0677c194,0x7ffb0677c1a0
        6⤵
        
        PID:4584
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15362654378700410876,4713448704415419016,524288 --field-trial-handle=2380,i,8784712665560798470,5190038578455878024,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,15437790637277282280,1361407100368101492,262144 --field-trial-handle=2380,i,8784712665560798470,5190038578455878024,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
        6⤵
        
        PID:4968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17688374457922604707,8444271725827491995,524288 --field-trial-handle=2380,i,8784712665560798470,5190038578455878024,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
        6⤵
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,18416025320278320211,14755689487590800394,524288 --field-trial-handle=2380,i,8784712665560798470,5190038578455878024,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
        6⤵
        
        PID:2692
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,18416025320278320211,14755689487590800394,524288 --field-trial-handle=2380,i,8784712665560798470,5190038578455878024,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
        6⤵
        
        PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3bdd57139d99fb171187e241d0c03cde224f9c176dac9c20c60f28f29e64d27d
MD5 45635e74a1cb997ad7b0c65562e1854b
SHA1 410a8995e5f0ab9af3d7133e347ff08392ea8653
SHA512 239eff3e5a6810ecf550fe74b8292209366c145d90efbf4293b3f4e3842c2b505baa3cc749e27b80454fe4c792925cdb299145af908b40e927282f7899be7372
TLSH
T1DBD0803C52B57C74C86EE57424157B0B7519D87756535F15187315FC0C4314015974EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f75c58c33f249ff6ec0152bf87477c5b2acd4f2d4eeddfd0134eb445fc64eae1
MD5 a209b3a599c6d971aa166d8d992e81e5
SHA1 7ea759c51bf83d3ca01170805a44bbd50222d09e
SHA512 4cca00fda2f520e83e88f34ccf1265c2380d0274a81607d3d38b3aca404805988c04b35dd097c17d2842600ac838126de3155ef2e76ea777d580077c52d169e5
TLSH
T198D0973032A9BC14C42A1070181022563A0A889239A34914A02600FC881B04017D10AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61c9f908475582ec0a8eb3b5cf00399511c5e42d8f5f9e1bd10dee6c3382278
MD5 00930effb53150b1c15782f203b6b229
SHA1 f2d3a801df3b68ee8a225ab8aebfafbc557fe47c
SHA512 baf5ecdc128b0737fee0d6a21544bc1de0f07159bd0b831936ace2f6b71df216792cbd6f9346d50bcb17ca955a247d1d414d019e9f3233553a84f8ae7ace1c7f
TLSH
T138D0C03812B13C34C85EE47024043B0B3619C47306534F1418B314FC0C4314008970EB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6a32aa8b2c0d97007d9671096b02f4596012313abe9f7344b1c9698335ac179b
MD5 9a803f3024c31940d7d9f07e761794f9
SHA1 f3a1ebc5fae1e1863073eca370410c1dab933beb
SHA512 92f8d956d7503bdc81543d889ca576508f61abfeedc9d750fefbd882e5de57a968b9bdaffcc7ea0d62ee7150763e60f2ab950636b771ca0aec699d29502f0aba
TLSH
T1E0E02BFAC924EC6718FC5B1860604786EB4443172A41844F3A3C82088FB912A058AE6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 16054829bf814624990f757e2639f9177d99f55de152d73b507ea794269bf310
MD5 446bee21f2968b7e3cf96b07553c7921
SHA1 12124982230c65657c7fc79c55d6617de78686e1
SHA512 8cf3c4e39784d78f03ebba7ecd844e0574a775316e6d10ac105b65966ff792b84db5eeb81dde334332c66925a7b8c546764ccb4d2d372b3e79b3c53e344f9d34
SSDEEP 768:nkJ9EjvjAlche+Wk0JKTcVnul9vBR1Nd68I34YYAw1nPkkfbkTzgx:nk7Ebjwge+Wk+K4Rul9JO948w18kfsy
TLSH
T107134F3DA9812C53CAC74F3CB90F4E7053A19C68DB85459B837E302A57B7F9E895E488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 951d46163d0ef7939d0ffbecdbfad3788ae9e8e141ee67d53416a2372b8b31aa
MD5 12ae7b4925f585ed4ed8f327679e604c
SHA1 014088c770ed2c1cd36fdfe6b4f110ffaff40059
SHA512 4c534f52ba8db2ca621733ca6a6be2500e1b9e84319533d82c6827f13750a1f737aab7154edd53cc251279f7ad309ffb7da06fc5bb1a87e202dda0bdf6189398
SSDEEP 3072:I9ms2wyPCh165zBQDLXNQQ1cL4hsOUcKlQRnkxy1VcBrT9uDrmhQukeoKw/G:nQh1YC7cMKo+Q0y1VcZhurq99
TLSH
T1A6B4D9F74440A42ACB7C12F59343363CD277014D7DDAE8DAE63A0C996829F32B6A9DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 3.0MB
SHA256 9ae6a1a18d8d597776836b2491c9602155a1732b097dac5481746a1e98476f4a
MD5 863ad0a055ae6881067426275d3dbfe4
SHA1 57385d700cc6367910cc7e3a1081dec499d24ccd
SHA512 cc3996ad482a554a8341fdfb8e3468a3e76cc5ceda3df957e51ce1d97b4a4411b7c79cade015b7ab6d9f2ed63663d6388cff47d7f88635288941650859b376aa
SSDEEP 12288:7M5VGoWxLmb0xAJZBeCKTbtQGUZuUpcOqV24yZA+mJCb61kQ4HeQtWVBe0hknO6H:Uyxq3b7JQbMgLbVHlS/F
TLSH
T1F3E53CDB4B789A51DBA7CEB0FDD4DC5D7DB810C26ADAE0836402C6B900937C12B956CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 e3dae64fbd9cd8bd2d20543a6615a68991e241c93d47bb6ec95efc9f18e4f5bf
MD5 f5df17068ce0117ff9c83066ff889e14
SHA1 a5ed8f8f7b46faa1d085dd2b4e5c9d2c22c6eb40
SHA512 b0e0dcc50e0a0621702fa93e377cd6e83087029c3130ca4155fb420c50b6dede833f5a7c2b117300a3ca904c32d42db09b167936309aeef36abdb8b64da23894
SSDEEP 49152:mJDISM84hkG1g6AltXkNt4sNAXQXU7dZKWAKs/Q:SbJ+kx6sbKWBUQ
TLSH
T1E2868EEEC6685C83CE779A70B4E0EC477C7412C3F595C1D38958C68402A77C5BAAE2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 9c637eb94c9672528668d30fdd95faf80fac48fb269b9fb304cd72c9ff7832e0
MD5 392ecfe087fbb699b7f04165afd3a49c
SHA1 9c19acdbd4667040a4087c3590dfbcd3f6c17fde
SHA512 8bfe3f93607f604404d41010727c83b059eba467d89be28194860d3c32fc3575dd6efa1c3af4fc3bfa568d3a1d29135e3a0b1560004e5f94f400a34040237610
SSDEEP 96:zJWiQFHX0pBQ/yTLjVcxmz2PNAA77vbFRQZ/Vu22yap9qCObB:zJEFHEk/yfi77bbF+Z/VH3c9vON
TLSH
T1BFF13A69C79C04A7FB222B387DE019F57EB1BA4C424B8D1D176CA8F2453B7E2449EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe580ccc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe580ccc.TMP
Size 2KB
SHA256 674b90e9cc84a0ce294af1b7997a0121ac1712d08f7fc22e037b03d0791861bc
MD5 731d42ffaf95588439845f2c8ae556ed
SHA1 185584a601b6b201fb13dfd49518f2ae28911b55
SHA512 0953c10977eaa8352ef0970d7c6f5a7fda1588d322c61e7cca0c76e28bd54e1c53f7f280a74d64aaa482650748243bc86f0178af10d46ff06526d0d6af77af78
TLSH
T106511B1CC08D24E9EB56353CB2E0149672F4CB48478BCE1C29BC2AF50A7DBA3809BF10
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 c5e60cf73bfe75b4bb85c0567ca8bf8372f3b39b7fecb355134642454bd253c2
MD5 9e6fdcb7f03ab4b02aee3a8c21c74b28
SHA1 5afcac0104f7cfa230e8e5c414802cc4b8330a65
SHA512 b9a90faa0abfb494fea6a5c7f6f3532c48f7926943c2dd6474f7725815acab931ae6bd1bb2a99a15302c44723bba650687c2365e56a195ae7be9474523fa30c1
TLSH
T135E0D8F854C6C21D6A1078CE4334570AC1C4344AD6D56F932B00C8CC7A42006F789A57
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 f31942ce1ce254a3e6a0d0c06332cae39e59671475d396e53f7549cc3ace9245
MD5 eb0f3e6ce6c5b23c47106effac947f3f
SHA1 596de78a67072666bb32298f05ca3727046fe97b
SHA512 bb20df24d0b42ec3b028f5d8143a200b4972a08e07c8d7e84c765b72fbb459909106c6812f7eb187581e4e62afbfce3d2375fd67037f057f254dc9d3361ea67c
TLSH
T17DE0807C44C9C579E9556CE3C7755B0BC3D13447A6843B512B0DC84C7512796737D750
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 2d967a8a1bdeb080ad7f354f7e7eedc1e60915d149d0c21896b40ea631b4ad91
MD5 18ca8107828c8297c2a2908ed85a1bd7
SHA1 f7bb8f13b1ae62889e687233c3506cd69e9083ac
SHA512 243e8d1e37ede37141c0c70f1822f8b8ac4a35fd46bb1be7ec93b93d8c9efa6bc56f4665dfb7a1c1a222bcf01928639295724efe785519739a67374efcbc10b1
SSDEEP 48:uzBmw6QU1PzIwJOrZjrte3FJu4yeRvXOGg12AxyU3:6BCxIwAr5M3FJu4yYvXOz1XxL
TLSH
T1BC92B55B0E393853E7092A7A2A2B4838CD37E19CFFA9DC85312550685DFC652E0368ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1c12bd4ed99eb41b72f633e0e9a7ce867ced972b90a1469f5b7d5f71445f4fc7
MD5 65e27b080161ea4cd99290e54bd743f8
SHA1 e3761c72c97cf82c64836007269617747784115c
SHA512 885693ad0aaa480de87ca9d76330f2e7aa524c3f0c32aa1f027c0984994a17bf15b481686297dd09fb1d9839624b6f54155d60e85cf74b56c8b0d2e18abd3948
SSDEEP 96:Xq4IU+bGz83uy3+u4tgp4DLjGQLBze9z3+PwjBHMsDEuspU0wbtqrOQpPfR4J+Mk:Xq4f+G83uy3Ct7XBBKKPYH7DXspU3iD
TLSH
T10514311F5F252721CDBD517669EB44B35D6CF03FCB1266CA686104B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 8KB
SHA256 e0d7059fd9869533b8ef1dbbfafb07034b844b24d8420d001117cc0473ea196a
MD5 49c8fc69cfe07fc4396a4a54c47d6f59
SHA1 531c3f82ec28f7ebc0238c0f36a0500ac04e528c
SHA512 5f0c464fb9a14efb94c66eb47d662140d08e85f6dd625d3f888320c3f626b9a2eb1362aa8a32358a418c6ff4727fc7c707d92ed870bb08272f900bca048191e1
SSDEEP 96:yf2nwePI1ab4GADZXYAyKU3Q2mIAMuUZv3t/aP1KXl+CJF9o1uqNXTZzgFGLtOl:2GP6GfuU3Rjhd/1MChWjdtOl
TLSH
T1DC12103FE418847E87778737928B391ECBBB397A184CF559D0C21D0C066E66E1215A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 6b4a48e51577528ecbdba5706d384645e8d3323eff6fc4b1523215fd59e1bdf8
MD5 2e27ad003f17f8aef7ba32a40589efc7
SHA1 4b415f06a5347a96663d1db3b620ff68b559ea40
SHA512 fee538055e3ee03884b2ae1dce3e745f49195ac2b99c3f017d49e6bdb2ae63dee07a5aa993a3121899770f5d0c73b45754fcbc07f2b906f8abcaf6970698bf1d
TLSH
T1E9E0D8B845DEC19A761420C75335770EC3E0351BE7882BA12B05D94CB402249B7AD7D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7b8aa6280fa5d73841bb7db3591812cb0b9511a4d7e03a0df7e442ad33eae397
MD5 98bb3aff41c2396f33145dffcc68ff2e
SHA1 95ec5aa0da6ce9a9ca99471086b9817870fa31b5
SHA512 32f6c6ef5d472ee9f5c2354f175d537eae68a1c5a6caafb108f58cdc669ccd2523d078a1939d8f5370f7d7fd693c86e5b3dd3d617b4912aecf2bae1e44618f6d
SSDEEP 48:T2SLopFMatSaw/auUOt8BPq0IKE9HNhIeDDHNQBsQ7r+FcDSjfCHx:iSeMatUaAKy0rGtSBsSDTx
TLSH
T15A92D60F6F242112C2F846759DFA406B1F3C119E83A36AE6B85020F68D12D97BD418DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 70a5965515d97d9c6bfe4cfe89d26bd466eefc7a58e6498f808d76bf52e0ffe1
MD5 62f8e2d0d87ddfb8b1c4f295810c5da4
SHA1 6e743a8bbc80e3125695d2c6ea9bc130efa40a77
SHA512 9828eaebc248cb325248736caf6f8df08cdbd74f92726182c2326841fc6cf861d88868f1d911c47b7d5010b0a3601a0f70b2b5a4bd5412cdd036090284c4895c
TLSH
T1D1416CF747B4866EDA1196F0AA187E2FCE2D0510431C3D69C5E0AE1B93E3561F041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 2bdfec0bb27495edada2c794ac3ab5d036b205cabe3d85dff4faf491c1e6558b
MD5 ea52787e2cd38b65d181733642da8146
SHA1 b2b8feafe2034bcc8d1c34f543cfc32a39e41ddf
SHA512 ae0340c172f5f70e8786c4746598c710f9bd9eb80e9813dcfd001fa830169b4492952c4a6b7dd88a898e7ec36b30ec6c1cd2d7504ce2367ed3e095ce32c462cc
SSDEEP 192:eIEumQv8m1ccnvS6klr2kpfLUk6DpfLBkmsZ+hJQ:XpXg2mfAk61f9khwQ
TLSH
T1B2F233F70A279209D64405B09404AB9FAF12005B47B6B5FCB6C15BE3F6D31E2B5A8B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 3d2cda8049422e404f656a2096b0d5032a9a51fbf94f2dee8d89fb333b08d4dd
MD5 19a9dde2c2ed3adeb71500c0726714bc
SHA1 409f3ce42acd9cccfc02325cc38f60e9fa3bc8db
SHA512 cef8e6f965c4859f56f494c1046241a1591fb56163376b489c59dca35bccc91e5ddf495d8d4d553d87c65e8aca60047ce5a798426cc46704afe42be396eaa86d
TLSH
T151F024B28AFDB8B350A8897B1DD83C412976D53500D660F5CDB6C23EB1880F34B22826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bb1326aa06ff78f6b688be3c9aa6b4cef8cf3a905cd24701061aeed33c668d29
MD5 cab26a4b6dbb2f783fee7d8ed3878c8b
SHA1 44035ba4cb9c6aa02c49ff74d9992b3e9f124075
SHA512 a65fd186372ba22ed7db93680c2e230ac362ad1386ada04f88fce0bf86c4775099ef74a67e4635525d79de07164f69cbf4f293c466b8046ce867ad893d298157
SSDEEP 192:sxZ9RGyMqZ/K1Ml8s7A/fHsU38WpVJsN8Z1+zodp+UHW6+WNHkSC/Y3KcegIgbDe:sxZ9HNA/fHsjWvJseZ1lDHbU/K3e
TLSH
T1BB72F9566A38997BCCD6D219FA457F53C7F8156391940E5899FC8A0C00EBAED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6660b1bb1e9a19a1cfc24e7030205cbd48281ce90ad2d66ad687da0ce9b046b0
MD5 763f0103d9b5b4bc9c61d6b8193d174e
SHA1 e9cef5ba5272e55534a9ee3561882afd78e9710d
SHA512 bb81ad86103ad83b424028e13ae8f84e97ac42bb183dad34689abffb7555941310e954e6e1d31c9519c40dcd877dbabfd0fae536d0858156269871b90affcd7d
SSDEEP 192:sxZ9RGyMqZ/K1Ml8M/A/fHsr37sN8Z1+zodp+UHW6+WNzSC/Y3HcwWIgjCJ:sxZ9HXA/fHsPseZ1lDHb7/xje
TLSH
T15C62F955AA38997BCCCBD219FA457B53D7F9456391940E489AFCCA0C04E7AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d00b6b84c4c9fed17d96c2d5b6f2c62cc7a8ed786198483269e0d4bf68325cab
MD5 e757f87986d3035397c3b215dc17ec8f
SHA1 26d8de670c2d5b89bd41dfb7abac772d320bd990
SHA512 54fe3f9b337c9a02068d12e2b542b78cbe5b3b85cd29d1500c0744ab6eb07413c2bebe0716585d9ac8ef249ec5aa05d26b88c0b4356ed8b384c254144135af08
SSDEEP 768:FTsxA8P7pLuL/tpWvIM1A8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpn4zLlusg5qroB:FTsxA8JE/tpWvIM1Au1jakn4zLUx5Bo8
TLSH
T12BF22B7B6C0CCB7E4F804E9CDD2ABE8A6DE802CB56D8894447FA940C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 a9f987fa9737b693b45fe7a4719cb32620e2f2545cf498064114930336ee134b
MD5 5e16e1d14284150ded427970e6188663
SHA1 866c3bed9fa2a592c202ae3f51d418dd8eb6863f
SHA512 b5211eb84e158f0d90d8fe4b2599a6f580c3a236d403995f65c34d1c7308bbe51765b0bc3f6f8dcf1f68d807db1b5ec4c4a0624d43f9259c0228b3dc10b40883
TLSH
T1FAD0A75BD0641990E7A78E831932456EC720289895DDE44DB5224A2D8490A935162FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 564236a668d2b9c18a903a111a6257d5725db77ae31ca8234392c3ead22f1c69
MD5 e4395e410f3f51c9822b3a99e6517547
SHA1 a98a7fcb834522824164663b069d4cdb7bd19bf3
SHA512 46ede0154e3b946909dbcd127d42b2c83da33f60679d3e0a80e0711d6f9cbed5f09b101ede3662a158d3247a911b3bccea0c10686d0b2f358fe7f4a5c0d970f9
TLSH
T179D0975BD0200880E7638E830932006AC7302C8894C8E04CE4223A2D40B0A838130FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe57d09e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe57d09e.TMP
Size 138B
SHA256 e70ce577fe537983364c8cbcacfd2aa33b5eb5bd347420f6cf9a999f53e1f143
MD5 f7d57d59a6d6775d9b5b8bcb765ae0a2
SHA1 204d945edf01925a3b0195a62a0d1b11f4c097b9
SHA512 866c28e23fc112c95d0e3ff8d3f592a86447e086008f5074dc33817463f799f9fff786de8e26b5304361571f38481f0e1230e9a96010850a5404611612727654
TLSH
T1AEC02BA7A010065497114E820632154DCB002CCC5DCED48DF433382C20B0F232101FD2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ac0aac061ec48de8d6b052b49993f21c539eb935011aff18a84af87a90f8e5a5
MD5 407b45bd0805e0b842d6147c86facced
SHA1 48e38f05ab784b8c113559d0369449d6e1d7520a
SHA512 9416d9d925f521154ed057225f1baedcf82be83da8314c3b13cef90a4a7e12066f63e6cd40eb042ae773120a2dcc73c3ebbd88bfa3367441edaa95603bf1ad4e
TLSH
T181E0DFB445C8D179B21530D302B98349C2E47407E2C83F622F02CA487583605B39FA90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 e385adfcd833b60cfcc423a3167c16d866b7286dc407a59382e87871cd81eeab
MD5 ff470220e2bc811e17b70d6902617321
SHA1 b4c738611d5d19a90e0701c59eb841d2d0187b96
SHA512 b4085b54cc93e6024195485bbfd4255b18454120fdc122726c1c57b0f0373c008bd755ce4141dd99f54ba3eaa9c863f38f197319a5650de2efe4242e19753de2
TLSH
T1DBB012E87310D513D419857313F687801704E0111082B113C808DFA21F45BDC3C210D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 c8a1e21d7503030eab906cd2c4279bce3c64dca6e7cc328bc62f8860b4d760e1
MD5 949ebd61dfa5444cb1d268d9543b4636
SHA1 ce408df03124532e4e362ed6c54c78ab5cfe8231
SHA512 9a946f79e7c34a0a81273d551f45198700a69a50b8ecd6e8719d34349a67a25af8b9464100718e2bb2c958328d0224fdb03aaadf79a73f6238283e327740a59f
TLSH
T12CE0D8B865C9C62AB68520D74375E70AC1F37503E6C82F713F09D5487207344775F691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e32c857ddea4cc44fa5fb287f91c89183a625a561e29fe39b2bdd0d7cd23a275
MD5 6833d296b3c7f3f70024be5162217bfa
SHA1 5b898afa582271b2a2c942643234846b826c7294
SHA512 ece8ee15623e34cbf95476b0c29edaca04ee4812d420c5346a8b76183f733d029a9d462e2142d3580542f941dc3b55d7b99d92c3412ddda93b3353e1054755ca
TLSH
T1A0E04FB449C9C639670460C243BA970EC2E17C47A7983FA66708C548B502345B7BEB90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8814bb2b121858c5a427bde5b5f1894b52e9fcba32abe130728683b56ba3e393
MD5 328b996be788beb11fcd4ba416c6b719
SHA1 659be85a813ab9b5bc22402f9f3d2bb28a141662
SHA512 7211bf4fa170acf3286b06a0f9ab7d2c37a3153cc1bdfcb3c4118b981fc79c7231160908ba339c8062ef68c97d1d8bb4111312ae592e7855c9a9882bd5ac4668
SSDEEP 384:cnF65VzPbMf4xNR5BbslV4jFC8VOaUWWpC/WSY8B0Hs0XiXN2B+7lI3MoemWZmdM:cOhfN2B+7vnPtk3Bphy
TLSH
T144B25C3471BEC211397D3AC89199BC26074230A27458F53B7FE940A64F67E281DFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f2442641a201cf5ebad6284c17a2c00561ae96e6590669b6d96f770219a48f69
MD5 693d734d8f1d022ea16244da5795b8b5
SHA1 ce26aeb3afe889b51de1001ee67014fef7d7cd88
SHA512 72daca16b8d85a69274153ac88d8fe7878e456baa2e6768d3a2d0aa3ac21f78f44a285e5ec6029d09dfdba408e09ad152da934d818fe86d14d43777fc475feb3
SSDEEP 192:P+xWXlfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxKfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1EB24730A7B747001EDE6D9721CB080771A3CB16ECF22A6915DA654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 9b2a71d063d213e4c5919d6acd43f2e17f1e02973d5d34715a3dfc893f305b46
MD5 be2494dc48130d9d5ff23761e5af4487
SHA1 86ffa191ef416a90deb1015cf17d25a1ea0721d8
SHA512 cfad3e2510cd5ae72da33f074dc99da1a4f159f66fd53dbd477006d554f81c85ea8b5bf1305ff30ce3dc63b063ee941517b7c3c253f7a24ab8e7019c684105ce
SSDEEP 192:EQOQ4AsklrNTssUQ/n7lgQiIIIBbFMIMLuYcYOK9:gQhsumsxiQiIIIBbFMIMqB
TLSH
T19052B5192B051F77C39E9F7A125A8B961BC4C881457122AD31601C5F9DF3F9387D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 cf9be2ac8eede1564e150f7af2a6419dfcbf91e137966e314d51a6246f3e9b6c
MD5 32c254cf768826817fc1545772befee8
SHA1 b8633570814c15371b172f03fbf2457ab8418871
SHA512 478e7959eafc018fd58e81e4349dd0bfff49953371358f4053bc8307e8e5d6dd6bc094447e6454efb24f43c0130c0c5343231ae790df54a67b956fe014e07853
TLSH
T101E0807495C5D59E775520C702759349D3D13547FE842B973F05C44C7502385737D6D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 a6147218ea174c5df5363900b8672f311f7316a93d0ec49e3f85087cb3d626fa
MD5 77505a0224d7dd515bd2a03fc2c6232e
SHA1 67234c1eceb09c9fff2e232eb38014f6542e7331
SHA512 390e98fa9e20c8f0cdc3d8f4d8327bb5a99827bc22eae76c7b2408a4cf85a4244c1094a8ddd481d28cb48c3027af9a84b2ecd26ba12d6ad62a2db17d16bb340b
TLSH
T18B21C455F320C158E149973EA02A97391378DC529FFCED0F857920352DB6E011E9B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ac8f8472f64c8cd8f280cb7fe091fab429c73dab2f403257d05360fa962c3677
MD5 c8cc3b1415531413b7e6c34b656db5a3
SHA1 33f3c82a3af26d168f024876241917fe1aca67c9
SHA512 0c01f88d18d965d420e06167e6abe5dcc727603d9bd21920a0e34f0d691d6638f09a7761fa3ac297f4296a7a8f1a7999d7c566e61b92c91b00527916f51915dd
TLSH
T14DE0D87464C6C1AFA15020E30B769349C2D63807EA842F912F05CE4C7702286737E691
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7911d2e50be0373c562c65e8022b94d15a90e3db935243397c4b88ba3cd6e9cd
MD5 23139f388fb783af82a0309ed1947729
SHA1 50e0c6d4bd6c0b00e976f2dff4b9a5c8c9914200
SHA512 097e15b6735d98dcc403083b0a61cbb6e6808ebd4198294bbe8fe8729ef2ae23d961b792cf617a7aeda453861abdbdfb224aecb3aadebf158b1ba99ae4b68048
SSDEEP 3:MsEllllkEthXllkl2zEflfKo+:/M/xT02zz
TLSH
T1AD440404FFC40407D54410304151C3D01770D4100D11774735D104735CC75401D0C500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7eeb81f382c7202eb24b32f42745c6adea009a86ec92eedf8576dd7850e99a04
MD5 84801304c95bd5845502b05adcd787ba
SHA1 14f6814bfbca806dd3ded2a7adc6d24e56034200
SHA512 ec23a3e856bd61d3537b5a982a48f4de221940c925188377502074510e646c065c2142450a7e05debdff5b5b3015c97e0c2e149bfe26a11d9c9a51f93e4d88c1
SSDEEP 384:nfiFavqMg3sN98TUNTUlImkrq1/Ilrd9rfLYVhEh3akX+VWi93hQRrLNPk+5vI+R:qFayv3OwgTrrYVq3aMy3uRN1
TLSH
T1EDC25C35EC98DAABEDE64FD9E74A7A03DFE002A3858C4AD4DAC81D0D10D719E1307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b155af037a815f210d4f0078fe0125261106d02de1e9c7063091fdaf891de2c7
MD5 70806f28f971523cda967e8368f30cf7
SHA1 3db294cfb4512078f2af51fe280161ec63eb48e6
SHA512 4bade644c8b8457a8c1c808b9982a931dcd748435560c76b89ba2edbb03896c89745aa0b8c207da9de913582ff75fb56a7f49a27203c49f58a69e66a22a5c684
SSDEEP 384:neiFRvqM03sN98TUNTUlI4k7q1/HDQKs9rfLYVhElTuNZ3NJPLULNPk+5vI+o:1FRyL3iwg1KeYV0TQZ3PTKc
TLSH
T1D0B23A76EC68DAABECD79B99E7097643DFF00253968C4AE4D6C91D0D00DB19E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1ed83fd27890a47c2f62685d49a36f92fb3782fc67bee6e78353c64c963b4933
MD5 e45a7a6b707652cbfa1e2eb638eeb812
SHA1 0bcab74028482606565c7aecdfc73db7ec0a5b1a
SHA512 8800374de891d648a3b8cbd1086490c11959aabbabf7af8c001e4be0308e4c9629aad4a00a3de80cec397b5f337f5394a73aa0560d0d5822d02d4532c7b0ce0d
SSDEEP 384:nxiFavqMg3sNB8TUNTUlImkrq1/h4rJ9rfLYVhElTuNY3NJkX+VWi93hQRrLNPko:YFayv3ywgprPYV0TQY3PMy3uRN1
TLSH
T1DDC24C76EC98D9ABECD69FD5E74A3603DEE002A3D58C4AD4D5C92D0D00EB19E570BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 aeefa7e3f4863a5a149df1cde34a4ab0d55b102fe5768d59726fe724e7a455ac
MD5 add1605115f3acfe3cb5c5b54cc6e7ff
SHA1 2eebe7663af45613f152dc7a2ca6edb12381d8ec
SHA512 7a0ce54bc45a9bb9bd90bc2869c33ddf5837a681cb7b2853da1bd3230490bb84136abbcc737d50a2a0913e4620fc898d1939682eef7a0404cff2b0332ee7c786
SSDEEP 384:neiFUvqMosN98TUNTUlI4k7q1/L2ms9rfLYVhElTuN1uzUP7j4u+mCPLULNPk+5U:1FUyViwgJmeYV0TQ1ZP7j4u+DTKc
TLSH
T13EE2067D9C54D97F98DE7B89A30D26129AE00233C6AC8A98E7C81F0D90B759DF307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 1f47d733a4a4114dba0ab8943810599aed26dcdeabd4a2fcc814ccb9c7d69a29
MD5 21884625cb2efd849bf400192ac74a48
SHA1 d7194eb5f175425b60f56073af2bb929020476db
SHA512 510fb4976288bd3ec35a7b11646dd3d32f28a5fae3b8a5d6198a3c8b02a65d8e2539c2787178dfebdf64f68463b9e9b72b14db3d4d3e101d3e77b7f2c8373fa6
SSDEEP 384:neiFUvqMosN98TUNTUlI4k7q1/Lhms9rfLYVhElTuN1uzUP7j4u+mCPLULNPk+5U:1FUyViwgemeYV0TQ1ZP7j4u+DTKc
TLSH
T111E2067DDC54D97F98DE7B89630D26129AE00233C6AC8A98E7C81F0D90B759DF307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e591ef84032c9424900ec38456b886e0e2c5291b1364c201e28196916a654d9b
MD5 223a79a0d3cb1eca25e469884c544c6c
SHA1 c77232aee47ad010b1302aec0ee1c8b762676b78
SHA512 2729d89dfdc0b9d14b11b327417e6c6b2489f0a5cf431d6bbfb461f2b146c03202902b075106f81b525d2160bac1522d07bea394bb7fe61fcd68f6031c145a7a
SSDEEP 3:MsEllllkEthXllkl2zEflad:/M/xT02z3
TLSH
T177440208AFC40405C60020348052C3501370D4110911576725A11C636ECA9408C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d3e1c0f3fa60f52c2162f1a7d00a2835e336b0b8c51a1d3a91723103da5c07f
MD5 20c86f08e911edec2a4546f2724628e6
SHA1 3e9d32df15a3a5163fd310504505374d0cf0cb6a
SHA512 f04d7f24d887519e6619b0339ac83cb590fd36294886392f5571e411a5a689760c20311358c718b063fa8e9cc214124ec99298b31279ced07055ca206f121ef6
TLSH
T13841E658A6FA0148B3B76F569BF6A8AE487AB9372F06845E10410E4F0663B40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 f1ff7cd9459adf86e6d4cd0284f9e1d0cf2ea28b67d2c83d1e2d44c1e9bb7471
MD5 61859f8aa7dbcbf7e6fd1ddce34a52fc
SHA1 97976bc5af9635e9806d5d1b580f022135d4e0f2
SHA512 ed4b032091834abb2bdf2cb79a274cef79d20869749c7ea1b9e6465037db6688daf1069c2db83018a9ae97f5962b659195db3822065a2f50ec54303669e218a1
TLSH
T16951716CA6F91005B377BE5AAFF2B86D543F7D732E07945D10110D0F0A62A41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads