15ebc877e2d85bb16c241252255cf898659092659220f11d67afa53f0e857adf

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
56s
max time network
58s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
07/05/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc274ea2d017d90dd0d0e2894707418d.webp
Size 11KB
Sample260507-jfa87sc12p
SHA256 15ebc877e2d85bb16c241252255cf898659092659220f11d67afa53f0e857adf
MD5 8f0622250ee69b91e87ff0fe6b55aebe
SHA1 be26d31ff2b2d474143765f7d8da409ae739cdd1
SHA512 c7ae835385a125ce6885209293d60f61c1f983f61d9092036e2ab1ad21f8c9ba87a49c40e3dd2ecd8f1dfb6ac6f62a5137ffbe4b835ca47c47b748d087e79ff4
SSDEEP 192:Oi7NODqwmhhkqP6XtErR9e3bb4wsr8ct6q6TOxY3Gr1l8wM6qNYUMKabBnG3i/m8:OaWqYPtS9eLbDS8cV+Gr1lCHznabNGUz
TLSH
T1CD42C0F51A3A04E7629DB459C937838ED117632DCF09F0A874C6414D2D70F9ABEE828E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\offscreendocument_main.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6116_337654517\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6116_584020887\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4836	msedge.exe
2156	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226129967427373"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{C1CC70AC-4635-4B5D-9A80-76F714A333AB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{161B65EB-BD6A-4004-867C-7C16A11C5839}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6116	msedge.exe
6116	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6116	msedge.exe
6116	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 3608	6116	msedge.exe	81
PID 6116 wrote to memory of 4836	6116	msedge.exe	82
PID 6116 wrote to memory of 4888	6116	msedge.exe	83
PID 6116 wrote to memory of 4888	6116	msedge.exe	83
PID 6116 wrote to memory of 4888	6116	msedge.exe	83
PID 6116 wrote to memory of 1860	6116	msedge.exe	84
PID 6116 wrote to memory of 1860	6116	msedge.exe	84
PID 6116 wrote to memory of 5368	6116	msedge.exe	86
PID 6116 wrote to memory of 5368	6116	msedge.exe	86
PID 6116 wrote to memory of 5368	6116	msedge.exe	86
PID 6116 wrote to memory of 2228	6116	msedge.exe	87
PID 6116 wrote to memory of 2228	6116	msedge.exe	87
PID 6116 wrote to memory of 2228	6116	msedge.exe	87
PID 6116 wrote to memory of 5372	6116	msedge.exe	91
PID 6116 wrote to memory of 5588	6116	msedge.exe	92
PID 6116 wrote to memory of 5372	6116	msedge.exe	91
PID 6116 wrote to memory of 5588	6116	msedge.exe	92
PID 6116 wrote to memory of 5928	6116	msedge.exe	94
PID 6116 wrote to memory of 5144	6116	msedge.exe	105
PID 6116 wrote to memory of 3620	6116	msedge.exe	106
PID 6116 wrote to memory of 2372	6116	msedge.exe	107
PID 6116 wrote to memory of 3244	6116	msedge.exe	108
PID 6116 wrote to memory of 3244	6116	msedge.exe	108
PID 6116 wrote to memory of 3276	6116	msedge.exe	109
PID 6116 wrote to memory of 3276	6116	msedge.exe	109
PID 6116 wrote to memory of 760	6116	msedge.exe	110
PID 760 wrote to memory of 4636	760	msedge.exe	111
PID 760 wrote to memory of 2156	760	msedge.exe	112
PID 760 wrote to memory of 2696	760	msedge.exe	113
PID 760 wrote to memory of 2696	760	msedge.exe	113
PID 760 wrote to memory of 2696	760	msedge.exe	113
PID 760 wrote to memory of 468	760	msedge.exe	115
PID 760 wrote to memory of 468	760	msedge.exe	115
PID 760 wrote to memory of 1104	760	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bc274ea2d017d90dd0d0e2894707418d.webp
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x354,0x7ffffc1dc188,0x7ffffc1dc194,0x7ffffc1dc1a0
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,6358404138712264868,271196216284037997,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,1948951336857582339,14941456140507944402,262144 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,8150134995689560846,10539011409410327511,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,6288925355393140988,6222860118588184626,2097152 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,16438145319466351567,3261120582088175968,2097152 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16883469569358107355,2817459530503306472,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8279448420137177588,11188856401056363945,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16567901641526795880,17924272786617548421,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16567901641526795880,17924272786617548421,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17966839575191034659,3362168013390663869,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,11945827704802941983,1895637582975810157,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12575120285287192769,6378465465773089884,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,13822893702344233802,17200188336755925466,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3045602213492326905,4633635962986688021,524288 --field-trial-handle=2604,i,14805719964594549233,14933094651173698025,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffffc1dc188,0x7ffffc1dc194,0x7ffffc1dc1a0
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,4330572097240068724,2789583994846279036,524288 --field-trial-handle=2204,i,17780217809114182800,3048011932540453664,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,1968873151143718844,3583361576001689491,262144 --field-trial-handle=2204,i,17780217809114182800,3048011932540453664,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,17981426780780522791,11352671333987308721,524288 --field-trial-handle=2204,i,17780217809114182800,3048011932540453664,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17861960169523152919,2662418312660574911,524288 --field-trial-handle=2204,i,17780217809114182800,3048011932540453664,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17861960169523152919,2662418312660574911,524288 --field-trial-handle=2204,i,17780217809114182800,3048011932540453664,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3987e6960d50d0b9f4805ddd01d890dd49f30972396d7aa724fe55264630df86
MD5 72df2a200dc3f360121221061041e05c
SHA1 a0ffce40276da9c8f22d0765b43ba3ecfce78466
SHA512 924446a32d5be59b3b032829b97b136ce0eb2369a0e4f2f5ab6d99d948a51ebd95aa3b14cf8487f6fa6eb13a3f5b22fced5b017c4cadbfc1cd31b4d2f40d463f
TLSH
T162D0806C15715D35CCD66970059577293726C863AD53975A1837243C1CC246115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 273b26107e4ec937cbc8a04ef0bfb3268d972adb3664ad2e348adab5234bca04
MD5 2e78ec8b1ad758a24aa77e1268a3e9db
SHA1 828a28b47a4a01ed3d8906937ffaa4a86cc12639
SHA512 eeba9f58cc7960c417ab31e9254edfa5cc97d7b04bf4be92d7791dd1448c9a973cafa90dce826f79e6cd8907e183a0177d9ff13d5c4a050024ece2c0034d3e2c
TLSH
T115D0A7317B449D02C8D219B140A153E123D744C638ABD2CA113A202E6CD446961EF697
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3fccfad79e8518920c853933ff069954f7dae5b0e9c222d0816a6fb0cd3490af
MD5 4b0f6070aa205df4b52860a6be6962ac
SHA1 bfac405ea512197ec50e43fe783375393cc7b2c0
SHA512 c2a6f19c3632f65e553acfd0213aa32eacf8d12750b641a3c96e6b35a1e296163da50e73460980f72b0173eafaf8918f2e4ad86127d5c36d970b60d2f128b305
TLSH
T14ED09730AB091C22C6C12D7200D0035023624043785A82CA062A203D1CC88B6B2EBA87
MD5 SHA1 SHA512 TLSH

Submit Download

00718631-43b6-4f75-9010-222088ec3175.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00718631-43b6-4f75-9010-222088ec3175.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b63c83c29b12b5354369dbc370f46a6ea4be9f88d1e19a33dba1743e645044e4
MD5 2d06bff39f02fcccad958051a8033723
SHA1 765bec02cc9d5fa7d50f154eec816f75c9a6e0d4
SHA512 fb5c6bf4a0d8950c04b3918d89e880b9b4bd9c15b66046d8b4c88c78ab2a8193e55c159885d978af0d0766dd0e56c2cbd9ff2f8860a795a2f35b54410f82914a
TLSH
T13BE02BA7C920DC3708F9475D64540609EB60137B2741995B363C9A5D8FB063A42C685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 be592686d8bb3b46bbc1ab4ccedf1dfc0ede069ec38851980722f4ec176072db
MD5 44f6d5c59fc7dcf95990ed470a9d7381
SHA1 4779786d5f7b58384d8b5cb17249a82af9cc16bf
SHA512 0ed7544115790324745ff784dba6d5dd890457d90f11e61d4fac6eb9a37b87e693262d59122905d1cba70ad305436d2a879f4d4c241879775150888c605a960d
SSDEEP 192:R6WH6p8c+X+FM8tTpMkVchcscVNCLKRp3wv6BPCZfxA1PNvoFrlDGXqdEsUyT0cT:TE8ygcVQeR78xA1PedJ5EsUJTvhGt5
TLSH
T18F134C7D366D2C62CAC2993E8C6F4B796F70CA23C4D0924B7B7277571A2A7422C4E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 be7d88bdb966d0f4363842a680a54c4935733f23c92e7ba5b032a9dab320351c
MD5 b2ee42fdc0c6ef4b911c8e8f8fa8b179
SHA1 802d0e4ffbf2d7c05b826ed57bf3d6bd195bd96b
SHA512 4e594b90fda4075bc2334d72142b83ba2fdb873fff3c0c04f8ed35c775f1e1e48b0c06396628f887a236b3d2e6a7ff2b71ed3e3daa0952ee2096188aac35607c
SSDEEP 1536:UkNVioap81VgowY0lybDLN8W3rwCAwyAkSNN46llsSHZ6I:5oG18846llnHZ
TLSH
T19A4461F71955A01BCFA842F6D2133E3DD177015D6CE1F8E9E63C0C852825B22BABDA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 a3c159b5ab084f2a6ea4c83fed71181d87b036269083fff829cec3cd3aa6abaf
MD5 fb26bf37919a48b40251341b5b34e8b9
SHA1 abe70987dd4a4c02eac1fe9cf1a046c014ffeae5
SHA512 dfff7a3016790b9ac089a658420991ca2f59e98d292e1a154650056bb763d64799dbfb696536d7057fdc9739b35afd5aa8cd06dfdb060cbd9767501d8b3adb63
SSDEEP 24576:RZJWPbYJ53UKPdJtRoqp8UF04b90pD7huDmUuIAgRSzSWEKD3B8IcCCCNxEO:zJZz11loC8UF01HhuDmJmKSW3N8P8
TLSH
T165867EEEC6785C83CE678A30B4E0ED477C7412C3B955C1D38958C59802A77C5BBEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9d6b64a1eb3e90c43f231cd6e4a9f2a03c86cce52f09eef3f85a0830c8b65627
MD5 527e8a9c433f1df72aa2a60391edb396
SHA1 0802a48a35f7175eba16e52c5483659df14e9a11
SHA512 20e98c444da6c089282ae3f3914eb55a2f1db381420ae52a6f49c7b6109210a5c5acf8de81fe7e0214e49160c3bd1dfd88672b1d10d61f64cd64a053e3826285
TLSH
T19361A5852E91AC9CD3F8C3B751EE234B7EB5D62B00170E4632D546BDCA55F616C43780
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a40ab042e26e71d6ad2fcbe9c1f0ba5f56fde4af02343be1d2d66cba3899253b
MD5 15e4df7b2f708312ec19497ea3fdab58
SHA1 014bb27d0a5eaeb7fd264ff8d4b63ebc86b3b0dd
SHA512 27d71d096b20ee6afccdb4590e4b6f1fdefb5f0bb672856423f1fe94ff2983634b68de309c2d8a9b731aac591d8b57cbfb1c7e2ae1865ac445387729c5c70559
SSDEEP 3:MsEllllkEthXllkl2zEkluEuK:/M/xT02znB
TLSH
T1984404047FD04405F50010304111C35103F0D41005117F43345144335DC55405C00041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 d40075eaa97ceda03f78b3b784b48aa29a4a8b8619e185d0829e0e61528e5953
MD5 58c8ecbdc49ef52a73e6371d4a1e9648
SHA1 0b52579649e3a2993d72e45a14c9f01151486135
SHA512 2904652f784cba2eb28a6fbaafe0c3610a0475c6fb15e6777b46f6931dc0d9d1af6875bb3fc3650a7e72865b80d871d2da880807d3905d9dc31dc5f9c3e66633
TLSH
T1BDE0D8945CC6C12E755538D39268670CC2D93593D687EE435B00C8C4B607423FB85DD6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 1b0822a7569b5aac952201365613c094f8a0987eaab21bd8609d586c22732784
MD5 70b3a978a66b8ac44a4ab0345809802c
SHA1 347b5da5ee7c2a45020e5fdcad372ee34f8f8a9e
SHA512 3563373fba1623c94d2ebad3d9b7bbd5541532cce102eb6e1224aefe22ab396caf2a1bc318e79e1c7cb44deb5c659f97acc4047bae79c2388f390893bee856dd
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j3oDpH6H7K5fKFtI2qYpH:Tyi+7f+UZD4jJ/B70H6bCKFO2TpH
TLSH
T10CE2E08D3B11F512C8EC733DA0C2CAE09EBC692C864E7071667C5CB28C63661F49E51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c0175b9793fa170d9db0276e78c546cccbbe24eb5f7a8d79cc3b2cbcfd237eb2
MD5 205ebceeb2154393fdaf883b344c2413
SHA1 23b12acd9f0f787bae24619373bd1ecb9eb626eb
SHA512 4d92d89a6c8f447181903a4788168368f3d17bc26771f21b8bb9708eb7196ec38697a2187d27519daa75ec0d0e4aa65d1bd91dab691b8c59f9afba4b8e852729
TLSH
T180E0262448C8C13991246DD3C7AD8308C2E23713B3883A42571AC8447142B8BE38AAE0
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 7cc969790720650f1e6e8657fbf3e1f70dd2492399dd3a31b6309afa83602327
MD5 b1581678ec2cfdc1fff52b463b05c435
SHA1 c216fcb69cb058100da92fe5777b718abaea3294
SHA512 29cf08727662abe7711dc8ec3b0fec52e56a358f010ba21964747a39eb6202d56536743b8674a94bc30dce3b75e0f7c91423c8f3ca6582bb8a909832da48ee63
SSDEEP 192:nnP6Rf+G83uy3Ct7XBBKkjueH7DXspU3iV:nSR/83uICtTBBN7DXspU3iV
TLSH
T10E14121E4F343721CDBD917669EB44B35D7CF03F8B1266CA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 2f3db1131f523a6211847e4376c39bd953cd4e0b604a351bad72319c9a183bda
MD5 747eeec7aac6bec36a32aa46af31b7bd
SHA1 86b0136e29e2fb0877c711d95d36a0762612d7f5
SHA512 611a8d1e072ff4811cbb3695f49a28cac39775f19117a77f2a0d175ee6f02f6e35607d272f3a24e0b31a92503c75f0a1980a133845b14c62f140d47ec9f90105
TLSH
T1A1E0D86444DDC1795204248793666B48D3E2371BD689EF816B0CD845B442449E6C55D2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 183f00935cdf620146a67a19e5de454f3eeef50995e0ec8d8ac92e9111ff84a6
MD5 66f98150e5a47c28f3327f0e246eb87a
SHA1 1c8b5f674416addd56f42c27315fa3f974aef9fd
SHA512 2258c12a69235f339a9be2a9faa67b6516991bc34a25e21233d6456fb3c9563c404950ef9fae02974779d953381011fc88b189b450129598e8ef655da7b51d3d
TLSH
T10631A0F383F4956D8A0195F4BA187F2FCE690950431C7D9AC5F4AE0B93E2860E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 584909041531571214034ba75dbd662eab98057bee021b4efa7f9a39518b2e17
MD5 d71ca6b0949a85c0f668d348245234e5
SHA1 f750cb1790f5f770fd9a74930783b9f02ff91fc1
SHA512 9a6982f680994e072c7ae999078876ab2d98d034c3c01de9f532a922a53463f621356510d39719e9796fe06b9e19db6641b52bad1358f0a77235cdb109807e30
SSDEEP 192:sxZqIkRDywFXBKOMl8Oj42/fYI/s9WpV51HbAVvcy5czodpHrHW6+WNGYRsZyOrE:sxZvk+7l/f5/s9Wv518vLLHbGJsb+0
TLSH
T16772F906AA28997B8CD7D21DFA457F53D6F91533A1504E489AFC8F1C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 792506b02c3929d0fc0ec7c30dce44f4126f15f522c1336393281cb33ec11eeb
MD5 e8f63110d6b7473ce49416c6e9c975e2
SHA1 afb70539ff3f12db121a0ebef7920e735c763756
SHA512 824de1778b7f7fffbed0bdd072249a1c65e7662f8dd2f500952366eb99d790a7e894a678e468db6a2950465e016e0a86f24e1ae3daa545594bfd059dc38c002c
SSDEEP 192:sxZqIkRDywFXBKOMl8Mj42/fYI/s4xHbAVvcy5czodpHrHW6+WNGYtDyyoSIgjRJ:sxZvk+7l/f5/s4x8vLLHbGajb
TLSH
T1BF62F9166A28A97B8CD7D219FA457F93D6F91573D1500E489AFCCB0C04E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6ffaaebbfd011d4850108cde126345e33b982b4e394f9bf485726ba00cd2fe57
MD5 806e0b77fcdabd884cd411f50fc2af04
SHA1 7c35c7d7cec2b95b11ef1ecede8c0e75517b1015
SHA512 1cc59a08dde4d593ef517ebb2a95789603a417ad82344ee9be7fa9f308806a3553fe0abfe53c65e19c31e92f3e161e79f47ee5e228ea52f81cdbeacadc1fbbfc
SSDEEP 768:wsk8n557pLILxPvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVI/eLlkqHdvroL:wsk8n5P2xPvWvP5kFu1jaYI/eLiId8yY
TLSH
T145F2FB3B680CCB7E4F800E9CDC2A7E9E6DE802CF96D8895447E9944C03CA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e5bb13119981b7f52292c36bb3430fe2442d0486ee2d4012ed7894e149984882
MD5 3643bf167e92c24425c19ffd643150ec
SHA1 dd8e3c7e3b027df61ef44b2794dc40c273150ca6
SHA512 07ba0ae1a025641611715be3d3ff1913df87f3d66c29ebb491ea1c293ea6bf3f8f23e446aea0e7fbf9100d09e74a4dc2439e8ba77c31463b75f7cc3412b48509
SSDEEP 768:wsk8nMX7pLILZ4vWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDI/eLlkqHdvrot:wsk8nMR2Z4vWvP5kFu1jaOI/eLiId8y6
TLSH
T144F2FB3B680CCB7E4F800E9CDC2A7E9F6DE8028F96D8895447E9944C03CA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 12f98f264af9cdbf05eff25d1c66a6ada4a200a6439e546fabc7c135d9ff52e4
MD5 8d26285721fc576bf051d4bbb0cff68b
SHA1 0ab0010c34349f9d770cd4ff87275116089912e0
SHA512 52db425b35b30c76fb5fe149659fa24fd5d2a73fd75bf9215284c9f0803bb324be083ffaa104c7efdf3e111ce8dba299f793616fe0928b25b61c0b807fba27e8
TLSH
T1BEE0269446C8D17DB11B248343A58308C3EA7A37D2CABE866F20C8A46147906F2971D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 87861723c05b441c222311c018636953f6437b6ed922d4e3832e6b8625576560
MD5 244d1ae031c0b2230bcfe80c14c67e88
SHA1 94ae99d14d3783702fe2b22c6eeb2552e662882e
SHA512 3da71a52c76404079517613965f895ab1c549871a9228c269798168827769cd95b280b04ea559d2283c36ef12b3b4a77e489d28afc399a7a48f5c7e2122e9075
TLSH
T16BE0D86456C9C23AB24B24C79355D308C2E37A33D6CABA956B18D494620B541F3471D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 eba6aae6af0ba088dfb0b1b456286a5ebcd211756ed445b6c65e6964b762e0bf
MD5 acd58497977ea799a52c521e9846ef56
SHA1 03d64afdb95b6bed92a548065e047ba4431aea74
SHA512 a911b93c43b1c43d84a7fff93448313356730bf57d6759ad242f6fef13a18580ffea41d3e71804f9a4d4ac3e7ccb7a775515b1fb6cb7601a8bc0be073101ff27
TLSH
T19BE026B485C8C239A00564C383A4970DC2F67E3B93CABBC29B0C8484A102512F6AF1D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 8b7efb2a55061347ceba4c73f3bffa475569e724c9e530266c8f6683f7c36ee4
MD5 40a1ffe5b923804fd3236759a9efdfae
SHA1 8c3cf5744f56abd78a686c02409124c75556b7bf
SHA512 4d5207579ffcc0a7269d9b00283175f0829a5f5b73b18a6f499a40146d9a8fdbeeab35c68c7312eb646642083bb5ba66fc256a841b45e05fcade059429186a2c
SSDEEP 192:eflBf6532xxBzXcn5H3P4x3eT6VpL99WR09hn8OrcDrsx9G3lQ3TNDX8nCDLF6OR:eNJ652DBjc5H/4hUL+lKJ7C
TLSH
T18DD20551753A42A13E7E69CA8595B82E42C331733518E82B7B7901B20F6BE21CDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 cffa6a51653c816133172ce8adb1d53f4f3979f03d303773b9029a2175a9003a
MD5 3785a6e1bb2716ad93518aaf7f81f563
SHA1 a961d03838480a3b961a423f155e48abe7bfa5fb
SHA512 403e8cde3f0102c698e047022d1b9600f805621cad178fa00fc21690913618e802aa4feb99335c3b9f6b23d6eb7668364074997f70afdb58b4513beff8b9bfca
SSDEEP 192:eflBf6532xxBzXcn5H3P4x3eT6VpL99WR09hn8OrcDrsx9G3lQ3TNDX8nCDLF6Os:eNJ652DBjc5H/4hUL+lM
TLSH
T114C22551753A46913E7E69CA8596B82E52C331733518E42B7BB900B20F6BE20CDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e550e0d3e6ddbd884d0f7672fb6d7473982ce6991030144ea61cbd7ba33dcba2
MD5 e5175cac224e9575d72e0a487f14e66d
SHA1 b90175d2f8852e246eefd7ea04301ffa24c2c963
SHA512 15ed004555068c098dffd1f6f3a4d4ca1f1d7a814832fc384ca62ddf561092d0422b03f8b7d9bc03cb7a2acfb44bdc24fb4e33c3baf1f0cbf5de50e146995474
SSDEEP 192:P+xgnrrfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxErrfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15724830A7B747001EDE6D9721CB080775E3CB16ECF22A6911DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 f2c06929b2f7fee0427e8f2b57475094df7b8c53a1d596ed66285edf5174a18a
MD5 1d5775e391c1ea983201144be35362b0
SHA1 c80b515e7aa6bef65ce89824bca182b7f20cc4ff
SHA512 16f18a48b832c4c1976b7c376dbcf756dffaac54dc768ca2a89d16deb7505a22e6ddd5290fb22745cf857ffd54b61bf7b1471e59c68784327cd1c777cafa18b7
TLSH
T1FD5175C093B964A56F89A9C2C20A7403A4E53F67364E9C71233E45F44F4883A8E2FD75
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 89408458e8216c2b2d63122e841728509a90eb8b08d2332a94a99614ae3d9e84
MD5 cda44464d8968973819f134ab7ca0524
SHA1 4c4d6c620dd2b4ed75212886b607a4516972db49
SHA512 3b706cb2079341fc0a7be71d7adea9dd55e0da7ed8de5f4e61cf10e03efd86e5d7ce355f361ec79fa25b841fcf64ff3381fdce464cdbb2d462b239df6c9206b4
SSDEEP 192:OVOP1AsKl8+NCsCFTU3Nk/v1ozqq1ozVl7GQQIII3b3MIM10YcY:xPmsgssCGN4GQQIII3b3MIMiB
TLSH
T1E652831A2B051F33C14E5F771219C79A4BC6C88145F232AD3521685FADF2A57CBC52F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 1a510e2c0ce26dc6fd0467dac1b7726c5442fab1334140f399c03b5c7f429be5
MD5 37fc1bb91088249806553e97ce52b7c2
SHA1 760c33783e3be513e292911dd43254e4d2fc2ea1
SHA512 d55bf5b86e6b0b0207b51cf9ca61812443e604fc8f8a460c23fba3d501a9438368d75b93d5337d415b3e3f52882a87ff6e5bcd55cf7347a29e3460fed90fbcd6
TLSH
T1C2E0201064C4C1BEF15934C75258830DC3C73717FA993A455F04C84C7107516FA4E5E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8a1515abdc7580b4098d649f0b7e7b26e87e0fc5228c3707766c95ffc75efa5b
MD5 798ec2fc3d532168882099a27b6415a2
SHA1 7f2b740f513e0cdf0017d18b8ca819e90a571ad3
SHA512 093778eefd9a95042aa0be5f63716ddc27dca323eb3526538b07f5553fab4c7ebc33e8e6c9f42d029d1b09617063aac1e2776a3eacc1ec38c62e95339d3bec0b
TLSH
T1DC219015F320C248E14A877D912B9B391338E8168FBCED0F91B920356E75E010E8BBE2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 69909d09493a84e11cbaf9a3cee24ea5e5ded8ac12dc04895f968a46260a1c69
MD5 89757c591d8d8c92c267f2b11fedaba7
SHA1 017251c615510d83122cadb6d149d302654a77f2
SHA512 d0e3c9728f442d4cffc9adec8ff2836544c5f51da6a860519fe0c40e9429a553a63e8c114aa0da1734cc39691033dfb5a4251642e55c742f431a35e7a6f97fba
TLSH
T139E0DF10A8E8C1AFA15124C342A8C74DC2D73A13FA9A3F425F00C88CA20656BB78E1A1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 6b46f2500a60c791724c0208eaf0fe2f79875c3ab0d5e30321d1a2b081c7c220
MD5 df9fd182b317ab623303d3675655c414
SHA1 81ed5b3044f59f913f1308b2ac11857f063bb59b
SHA512 5bed45ada93c4798945b64efa0dce020985ca7090adee75859af71686762dc5c288f432f0a9adf4fedf247d54c53c71d89709a492da0b3156ea93152aca786f7
SSDEEP 3:MsEllllkEthXllkl2zEelEEw:/M/xT02zNO
TLSH
T13C44040C7FC41405C5543031D015C75013F0DC1005115F433C5104335CC75404D00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 710de237e1bce6cbf9bed26fd11e7f4106c563db70ed0bf539a25fe71602f8aa
MD5 ba625725b5f8c1e50508ae02c04d7c82
SHA1 d4db98177b8c6e3c8e08d61900874c915c94bd54
SHA512 3271525c81313fc35f5b8871a2e44655deb8d78b857b5c18aae88c40e982a495e2ac6b6c1f6d2e9052cb6d0015df00cd56774c61550067f2181beb90dfa9c428
SSDEEP 384:n4iFEcXqndsNE8TUNTUlI4k6jFqOABAFgVNbfgYmjh2+lFf1FZy59KBKSgCLz/TH:DFWdlwgmjx84YmRlLS7KBKl8zbsa1yEd
TLSH
T1A9E24A79DC54CD3FA8DE6BC9E70E361298E40273C6A89994D7E81F0D80B648DF30B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d56095acdc10be85085922c94f0d9e7decde398112067e4223947f16c14902b6
MD5 7cfaef046adffe0cf00914edec2638fc
SHA1 1182e43fd3bc04c21ddcffe1083664f1bbf0ceb7
SHA512 fa0c0af3d5349e5af536c17e325cd8e58b7c8a1c72aa5f0d454997b21f8ff7efabd94598891545f2c1a6aa982e29cbab667f793eb9d1c37555777d52183185db
SSDEEP 384:n7iFavqMg3sN+8TUNTUlImkrqOABAp+VNbfgYmjh2+oQRYV/Vw1mRu7i9rN1k+50:WFayv3LwgRq4YmRoQRYk1m87Ac
TLSH
T10DC24B35EC58D97BEDE68FC6EB0A7A07EEE001A7C59C49D4D6E82E0E00D719D134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 93be41aa58d76ea86e970d1374696be275854f68dbcc1fcaf02b2622dd1d26e7
MD5 ca6f0eb046b037f9f58fe3664e659014
SHA1 69ef099653332a0acf7bf894515cd8792281cbb3
SHA512 d4cf485d25bb72483d63470f2c3dd8d612f3c0ae08a1e8e1fe0cc5d26e7bd5ab6be4e9698f069da22fdbaf77c177e17299e2b32b405d8d8ebfd43b9817312145
SSDEEP 384:n4iFrcXqnO3sNE8TUNTUlI4k6jFqOABAFWVNbfgYmjh2+lFf1dz/Th+FkrN1k+5t:DFzO3lwgmjxi4YmRlLdzbsa1yEd
TLSH
T1E3C25B32E868CD6BACD64BCAF35A7247AEE011A3C98C5EC4D5E86E4C04876DD174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c5f062ffc8eb519a11386863ae8c90da5b8905e09d8e8964e74d7205cdbd5f60
MD5 d0b92aef5ec48756a31b6a92ade28d5a
SHA1 2c13d9375877386a210c2f4e3c26ccdac93f90d0
SHA512 880951492c6469f25148b77a01fa622a53cf385d723f7e6066d16f9f2f36965d78ca59268c8b95062edb992d436c40c6336f0ba8814ae97510bfae9b7a8bf3dd
SSDEEP 384:nbiFavqMg3sN48TUNTUlImkrqOABAd6WNbfgYmjh2+lFfSdRYV/Vw1mRu7i9rN1c:2Fayv31wgRyDYmRlgdRYk1m87Ac
TLSH
T1F3C25B31E858CD6BEDE68BD6FB4A7647EEE001A7C98C8ED4D6E81E0D009719D170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f9d8ad1367a5f30913fb3ec80a09ae0f28348bc3cae6a793282199827c3d7eb7
MD5 2b75294b8c32de3abc94b5cb7b3bfae2
SHA1 a358597e0a69d6cbdc9580364755b76c7c6f3121
SHA512 5471d0e46b97516e08e1978eb3a5128d374054ba31bcebb35b948e7baf8b422c0f4c8d6a4e97fd2a04c1da16f573b51bd5b9c409d573709796e8737ef4f1f847
SSDEEP 384:nxiFavqMJ3sNE8TUNTUlI4k6oDqOABAtWVNbfgYmjh2+lFfSdz/Th+FkrN1k+5vI:YFayG3lwgmorK4YmRlgdzbsa4
TLSH
T19BC24A71E868CD7BADE74BCAF71A7247EEE001A389885ED4D5E85E0D00872DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4f0de2a8210ec0dfa6137b447db766825964f3528a0e31fe1292995bb86033a
MD5 a8902a750e103309fb886318c97eb852
SHA1 e5cde34af3246af1382e76b79d0ada6e8d20a91c
SHA512 c96fcfc0a16c1c3be5d3ec4edd5e4b4580320024caf9d35655a3e0b3b06d31837810091c58ae5ef9ba46d96dd7c23197612600b51dea1a49826737e0d92929cf
SSDEEP 384:nxiFrcXqnO3sNE8TUNTUlI4k6jFqOABAFWVNbfgYmjh2+lFf1dz/Th+FkrN1k+5t:YFzO3lwgmjxi4YmRlLdzbsa1yEd
TLSH
T13BC25B32E868CD6BACD64BCAF35A7247AEE011A3C98C5EC4D5E86E4C04876DD174BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 17588596fd321a657a94f23fa021d2e6058cb215316a3d8cfa93e1b5ac4a0f47
MD5 7d9a9a20120676794cee330b2ec1a780
SHA1 56c3c62d51194d08e980c5b549d9c1f7426f6c91
SHA512 0ea88a69954403660d6c910320066a347543c59bdef064a521509a4abb2ed2fadd55ce791fa6747b2b8547feeeb4122f10bfaf4fd451ae0f48b1dc649600734e
SSDEEP 384:n4iFEcXqndsNE8TUNTUlI4k6jFqOABAFLVNbfgYmjh2+lFf1FZy59KBKSgCLz/TH:DFWdlwgmjx34YmRlLS7KBKl8zbsa1yEd
TLSH
T1CAE24A79DC54CD3FA8DE6BC9E70E361299E40273C6A89994D7E81F0D80B648DF30B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7b384f1a4a1fb14056253ae915d0682e78f2d5d6855efbc9065c91dc38f521f4
MD5 3a275c259b054c8b3a2701ef8a9ec036
SHA1 dbf4c5ffdc96f6f386a54a4dc3dd47eeeeee3b02
SHA512 00f013380a3ecef411867c19381563307e1c6a1d4d29044c9c2f3c6403a6def29198969c344b6fc5143a6fa0e81f30c7082b063cade471155f6e9b9cb3af33a9
SSDEEP 3:MsEllllkEthXllkl2zEelCxll:/M/xT02zNw
TLSH
T10D44040C7FC41C45C55410744055C35003F0DD100511DF4334510433DCC75504C00140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 7017570471a78ad48e769e847d3ecc53b29ab635f3813881c7dbc889aac6b8d6
MD5 0519629174acc947c2c07561e82a36ff
SHA1 86d2b025330d88ffa0296c800e75685ad1ea562d
SHA512 b689f780891fd3fa4c0ca883d7ada210791a744d5d04db2a898eca6b4b1fc0d921acd89aad71f740718255550a378f3bc20c2611d7be825a1f0a63d1f5d517b2
SSDEEP 768:lQIOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:qxhaqLI1WcxKgdfHJHH
TLSH
T1C163D9FB495B02D0FB9D40F4924B76CCC35B299C8CF8E792F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 923206570a3660ddf45ca8f535b6e5eabdf0d7c44470a13ea2d311b89031a89a
MD5 8efe4b5ad4d519288db18ace65d2a492
SHA1 987fd14319e4d96cb03723074be4ba1eb381f249
SHA512 dd3cc75973e0271592e01d31867957395de37815a716ae9d2f77f1bb918ccb7da33f63081bc386414836fb977f9047f06969a885493a09c1c243c954ec77107b
SSDEEP 48:1refnqZ/IHRH34kWqB1kQnjhHmr6ITmU3:F06IHRHIbKkQndHmL1
TLSH
T13042A86EDA2CB9A2FEE00B3ED7D1D0123B39AA0EC2E4CAF2095B405746C440401DB23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f0281a49d106f9907b0c804fd9621e1b85a93161d9b1ff9bc866301176cf2a6d
MD5 0a3d58531731b7ec9fd27067bd156454
SHA1 2c843a0cd46e3cc0370f850bfe9bd305af914b3a
SHA512 9f35adc9c43e1541aeef1361dfae6a814fad327ac7c8e39425e3d8950d769c3e4d1fd742fe3191a2112d12cec97e762c536e5e83d5ea5225c2b8e89908784cfa
TLSH
T1EA410558A7FA1148B3B37F569BF7A86D487BBC272E1AD19E00110D4E0A22B41D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 9512450ee1b6a929534c2252e2ecf5c75172d463402e5e657f8b2396ad8a3494
MD5 1fd2b059af9828d868c957d8ea3f7011
SHA1 b1c45bded9625c5f3904de3e28c68d74517f4222
SHA512 8485457a3033e78508a9fc84f523ccc7de9b144855507d65afc82d7a02008594235f0730efcd148625e980a882611dcf1731fc7a346e520cd1945391f21dfdc9
TLSH
T13F512C58B6E91158B3B77F5A9BF6686D847FB9372F06949D10110E4E0A32B01CCA173B
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 f3d30b965567c3baa684f85d5ad5c6f0df265a6ebcdb9d470f347997da2fa36f
MD5 0b596f55665e6588025fd0c5ec3697a3
SHA1 7c29bde365ca0fb6eb0db3f084f7fe04c027af17
SHA512 e0b869ee3c6834377ebfcdf278bddd9a345fe8e66b40007107f1758b63c7b3bc9ad52417be585ce1d209e92cdc25596e535f418e85e0625f65fb93120b814b4e
TLSH
T1DA513BE03931B23F87C78BD970764C8458A2F181136E9A5CAE464435BD5CEE1A35EBC9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2096-35-0x000001B254200000-0x000001B25439F000-memory.dmp

Download

memory/2556-687-0x000001FEC88D0000-0x000001FEC8A6F000-memory.dmp

Download

memory/5928-201-0x000001FD22910000-0x000001FD229B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads