hxxp://wecan[.]hasthe[.]technology/upload

Analysis

user interaction
yes
max time kernel
38s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wecan.hasthe.technology/upload
Sample260511-v7hcdabs5q

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\fr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\mn\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4596_152172780\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4900	msedge.exe
2720	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229946809009094"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{054D27CF-4B72-47E0-91E5-215B503DD5C2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{4A4276CE-E8F4-4E6A-8081-30CC7F648B7E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 2400	4596	msedge.exe	80
PID 4596 wrote to memory of 4900	4596	msedge.exe	81
PID 4596 wrote to memory of 5008	4596	msedge.exe	82
PID 4596 wrote to memory of 5008	4596	msedge.exe	82
PID 4596 wrote to memory of 5008	4596	msedge.exe	82
PID 4596 wrote to memory of 5880	4596	msedge.exe	83
PID 4596 wrote to memory of 5880	4596	msedge.exe	83
PID 4596 wrote to memory of 3224	4596	msedge.exe	85
PID 4596 wrote to memory of 3224	4596	msedge.exe	85
PID 4596 wrote to memory of 3224	4596	msedge.exe	85
PID 4596 wrote to memory of 1964	4596	msedge.exe	86
PID 4596 wrote to memory of 1964	4596	msedge.exe	86
PID 4596 wrote to memory of 1964	4596	msedge.exe	86
PID 4596 wrote to memory of 3800	4596	msedge.exe	88
PID 4596 wrote to memory of 3800	4596	msedge.exe	88
PID 4596 wrote to memory of 3800	4596	msedge.exe	88
PID 4596 wrote to memory of 4824	4596	msedge.exe	89
PID 4596 wrote to memory of 5884	4596	msedge.exe	90
PID 4596 wrote to memory of 4824	4596	msedge.exe	89
PID 4596 wrote to memory of 5884	4596	msedge.exe	90
PID 4596 wrote to memory of 2696	4596	msedge.exe	92
PID 4596 wrote to memory of 2576	4596	msedge.exe	93
PID 2576 wrote to memory of 1208	2576	msedge.exe	94
PID 4596 wrote to memory of 1704	4596	msedge.exe	97
PID 4596 wrote to memory of 4344	4596	msedge.exe	98
PID 4596 wrote to memory of 3416	4596	msedge.exe	99
PID 4596 wrote to memory of 5984	4596	msedge.exe	100
PID 4596 wrote to memory of 5984	4596	msedge.exe	100
PID 4596 wrote to memory of 1728	4596	msedge.exe	101
PID 4596 wrote to memory of 1728	4596	msedge.exe	101
PID 4596 wrote to memory of 3664	4596	msedge.exe	102
PID 3664 wrote to memory of 5712	3664	msedge.exe	103
PID 3664 wrote to memory of 2720	3664	msedge.exe	104
PID 3664 wrote to memory of 1848	3664	msedge.exe	105
PID 3664 wrote to memory of 1848	3664	msedge.exe	105
PID 3664 wrote to memory of 1848	3664	msedge.exe	105
PID 3664 wrote to memory of 900	3664	msedge.exe	106
PID 3664 wrote to memory of 900	3664	msedge.exe	106
PID 3664 wrote to memory of 2228	3664	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wecan.hasthe.technology/upload
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff8d351c188,0x7ff8d351c194,0x7ff8d351c1a0
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,487948114059602744,10247137502150761412,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9534804145550141058,4824610753532355218,262144 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,7610047199224666094,9880936434080544827,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,12394534646092010073,6708020906787181763,2097152 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,2240906810349323978,7982506647956520351,2097152 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4832,i,5389713279563297783,16760270085980327548,2097152 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,13714463194509943414,2103537018040848680,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,5438210996011240679,16698745691062772547,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16906005289431338382,4458408030283320686,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16906005289431338382,4458408030283320686,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,18327625069618672279,10672155554577020648,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9718169053760561601,6776502331430982739,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17367683429823115484,10964332191528042866,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1127709922221201874,15512286328286389046,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,9741820188974033058,16272384635231848536,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5022120651684490330,9428605002168795978,524288 --field-trial-handle=2268,i,7550488333344000180,11369998069230046314,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ff8d351c188,0x7ff8d351c194,0x7ff8d351c1a0
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,9663830578237266307,15379140122339778274,524288 --field-trial-handle=2268,i,8592403123758195552,9153644051267886545,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,4643235200614214964,15334013976238397944,262144 --field-trial-handle=2268,i,8592403123758195552,9153644051267886545,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,14229156523428834881,14988608143374154598,524288 --field-trial-handle=2268,i,8592403123758195552,9153644051267886545,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,414569142158035259,15025046207571568449,524288 --field-trial-handle=2268,i,8592403123758195552,9153644051267886545,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,414569142158035259,15025046207571568449,524288 --field-trial-handle=2268,i,8592403123758195552,9153644051267886545,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fdcfd05df75c897a6ae400b90c5e56a6067d9d9a631ff864d75351172596e11c
MD5 7f636df2f175df27d41b07591b4b4a6b
SHA1 a31c2db8df5f6dc0866b38603dec420de4f309f2
SHA512 145dcf5b13890c3aea1861f3172c3eba0f4d10c1b81f3c9bb21eb6eb08fe001c63d8b730fd76f08ba9f1744b5adf2fa2127a312f9478592eabd95fa8bf07c80c
TLSH
T16ED0A7726649A021EA2C5130A123D7541F2AC554B4438611F35CC49CD6E80DA53C15C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0bd496229577750dc53053016b6bdd267124938988db34b5e71bf0c648f2532e
MD5 263449b13962d994b876f70ca469e88d
SHA1 2247710e2169e794f6fbc6ef75243045dd5cf93d
SHA512 86765da2226e42646b12e6b8ce96687a60ca7c8aee3260098a9beeaa188e51a8e7a660dda4322384734641692aa54df40987561b1957a500f3bf69a5adfee1f1
TLSH
T148D0A7B6774DE420FF185230A416C7541E75C595B8079605B354C46CDAA51C542C5582
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fb07646b5c2caac1a68880901d9f4a9530a9765d797c7a297916d5773560527a
MD5 918c36708a69c8634711bb316cf47fdf
SHA1 dc7f6ed87911f272b5a194f36dac5511b7cdb87f
SHA512 aefe726732fe34ec952bfcf2731182aebdfdb111e315c04b60b1bcbe4de3a6950ff9180662ad3414fcf5e68ae7e74c38f632b689950fa57382cc7b8a9e8c75aa
TLSH
T17DE02BE5C865E82B18FD5B2960244B41FB6013672A50898F3A3CC20D8F74E374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 20ddb79eac6e593d80d50c927499f4689b05b20c0d10e6c7026074f2ecdb9c1f
MD5 e4bbbbd3800bdf433f1957140f080c2e
SHA1 ec263e241e5fbc03da0ab655ce288beeacc7e648
SHA512 a3938ad223df912b138bbf7c221e805b5706a5be10a30aaaca188e3b7d5916d2fb67bdde0ff07a0dfacbf81ac2f583621f8831dd0604ed1d0241cccbb12d8b28
SSDEEP 192:QAUwX/BfBT92xqMGI/EX4CJu0e7EzlzSlxR2iZunJjI77uag6BQrP21ytwLZeg8:/1XvMMX4ia2SDuJQ7ugQr+1jZ4
TLSH
T1F013817E327F0D51F2D2803E981B8AB963B1C221E4E3196B57BE3294479C766B90F344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2520df2eba99e93daa87f54102413545983ba1dd439f0964c8ea82497e0e3ad5
MD5 dc4f24ef75d1c5b5fc1b17d8cce5af2c
SHA1 715c41ae5fafb9a0267b279f10cbf55989916071
SHA512 1fc9beab6a3651ab68a3a81fe24a3797027f0b392fe65ab39715598f02707cc24cd6eeb752fb16606ca547d2ac4953388b962979875b2b738966b3e58312eb6f
SSDEEP 1536:dkDyz8fqMXdvLJPlEPBAd1Owb41G9HcDB06FtrICV:nQd8+mgd6Ftrr
TLSH
T12F4440F70965A01BDBA812F5E2033A3DD177411D2CE2F8E9E67C0C852929F21B6BDE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 eba28ebbfe257f113c56f3f8fab2eb60c390d05273d6dcd8d30247ef67b6bba4
MD5 a2ff698cbae3a73392fcf2dee1164b46
SHA1 a7927b00c6d4e4e9d69c26bc143ffa3c8cbb43e5
SHA512 56cc6e682a5bc93a87a678eb9623f0c38f89e1d7ef7f8f00e7c803543c0d5f74a5f8715fe5946cf735535e66f3ae7f5d81fdb54da7da286110ecd08311e1be31
SSDEEP 3072:6llwP5mCwGhF9niHB/BDW7MUfH4yLJLGYIQAXprjkk:805LwGhXmZDwL/4yLJfIQAZjJ
TLSH
T1A4256CEE8F382D82DE6B4D70B4E4EC22BCB411D37616E1D34818C990875A3C6679B6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 5634568298b10ae5297c29b10ecfa9e54ac85892fe86e65fd1585cea49a6ccc8
MD5 4bc2323577b59cf379702961ce594b92
SHA1 95c638d980e25c169f93586f64c7f422c1531cd9
SHA512 25c5898cd79a30cd949c07e5e523fc9c7f18e92738903c4e4fe300bf29d2189b02e2fd2ee1516448d0347936f8c8cff75feec465b6623a6e0279550fbcc5e980
SSDEEP 24576:XmWkZJji5RujRJCVzBWw0Pz9EE72lJ2jP7mhzVPJgPZkARYHtMVR:2fEULCd8fPiE2gjS5MyARYaVR
TLSH
T1A6867DEEC6785C83CE678A30B4E0EC477C7412C3B595D1D3895CC59412AB7C1BAEA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 db1546b897960c80a5d159f58b83af3735ff62e31fe5e7c00f06193cd913a558
MD5 a4742532423d7df4739cbc1e97c18c70
SHA1 7b444604308185267161c392250b82978c066ac6
SHA512 98d6256886c96e84dc70f6561b5a68d5e573e327886285abcb6ce2490a4e18ffe4ee9374348c559fd1b5a29d53a1a63354a515ae5da5f450f0f6ec06b9ada8a4
TLSH
T17661E958B1E39468E3E01DBC12ED50E872B54558057B5E4F27F88CFDC90AB16728F725
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 0a285c683fae7f053c9ec0f8188d22e8c375d1b580da1b3d8376a897bdc311ac
MD5 008b68281df6b88bba00e45833ce1c01
SHA1 a59118c8f8ebf3fde7d4b991846fe9981040ec9d
SHA512 9cab6c4333c5d74f535ad573baade5c114107ecb5d1eac2dfd044d367df2257ab11a5a5583f9e81ca08c5e76ce474e954439fb6fc6208ec36c3a7dff8d73463f
SSDEEP 3:MsEllllkEthXllkl2zEkl6+ll/:/M/xT02znJl/
TLSH
T18244041C7FC03505C50010347011C35133F0D450051177C3355144135CC55405C41001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 9229fd1e8f025f9332b31cc5c49f02dab3ecdb64c1cdbe23611d333efeb51a1c
MD5 48be647dea5b9e4508f25323cec806cd
SHA1 8ade8551e482632d2b8c78a3dafdf12042ab1fcd
SHA512 d96003bf22047f2c91193a16fbeaa3f5a313cf287498e842ab21de06ae21e5788e01ee9a7880f04c5c98a3bb1a6bab94ebcfad8ab6f1d846bb55b95b847de7cf
TLSH
T1FCE0D8E455CAC2AE595835C342387B18D1C87442E785BD0327D0D8C47B02001B65A54B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 0b91b399422120084fd4fbe9fa2f32978e016a645c41500c4698d52064aad047
MD5 db5539b577b8e8aa3ab60a40292cc452
SHA1 ef7e9e4d111bdb0de2de0479a6c340db1472c47c
SHA512 7cb6944d639097a77d8d68f895b09101561956ee8ad426a7ae479f168276dac673e38198ac034cc5a11db9b95f6663f760ca432ea4d18653846e8e64d00672db
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j7AW5L9RK5fKFtIyPqYpyS:Tyi+7f+UZD4jJ/BPAWx9RCKFOyPTpyS
TLSH
T176E2E28D3B11F911C4FD733EA0C2C6E16EBC686C464D71B0913898768C52955F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9f8f0a5d387cf3ff6ff4916752a4990440ad22c26c5107ce0ac519dc7eee13c5
MD5 54c40633a330537571de091c53d75bc3
SHA1 bbe6b5b79cbd365ef4998418fc2bc01a68d74249
SHA512 580d118bdc06474102a0321de5f0e5cdeeab1cdb877316735edb183f39e98fea8c277701ce85914f0f6275ce2848b765f600a110b0f26dec2ecd545ffe40b6ab
TLSH
T14DE0260C24CCC16AD5646DD783A97708D3F03492B3883D03579AECC06141A41A28EE88
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 d399e6c45cd92bb515274eff73d845bc731371313b0cf9f36a110a6141c5773a
MD5 9030db5d2fbeacd13ec6db95154d49ce
SHA1 b8e69896e61b77da9410444d2cfd257d1236c652
SHA512 35930fea18f8c5e978175d26bdee177affa2ab4458843d45c37958b71eabf4fad97d9bb53062075202f30b20e19f48a6112eaf2db93d786492cbcb7b5c7c368d
SSDEEP 24:LLBQJY90+mhh0GY/l1rWR1PmCx9fZjsBp6UwcECjzQ23GLmXPUR8rz1t/ML5N3xZ:uzBmw6QU1PzQ2/UerzuN5GQnpZ9cu
TLSH
T18C923E8B2E38B803DB900E7E216F4D75CE3BE1AC5FA65C9074B440616DB9982E0359DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 38be53fe5e5353c0e5a333fc445e038c5ccd108b4ba8fc99d501d3fb1b598caf
MD5 795c451f20a6d1e17ceb9dbd480a6518
SHA1 b2caa94deaaaf065504bc412b5502c59bc2ac807
SHA512 a38281da5608e95caa866952ebc5ef6d450cf1b91ed4e91469954da2f4831b07eaf9c855637f8d780d93452b93b2607280064dfb44703753a902c1e2c7b71881
SSDEEP 96:kkp4HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jhFEbjBHMsDETbi8:00+G83uxXBBK31GkSJqEJH7DNspUy
TLSH
T1FE14100E5F343712CDBD817669EB44E35D7DF03F8B53669A686104B4CEE3652A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 fa068b6392779fc9a86d1b4415fdae8016618f264e368a77e2e3be4220bc9751
MD5 c3c61e5f9c47ca96e07793c4b576719d
SHA1 620eee7b86a867ba246ee0eb2ab8023bc7af9b6d
SHA512 b43c189aeb03e0ca76e922339e93d8d84ad327277bbdcf70feeef0360b239e3573c01d01a4a66fdf8520864448a678557e42d684775f823d7b428a7a80e186f5
TLSH
T1B3E0DF6454CDC2AA6A5427CB93297B08E3F13456E6C8AE8A9B95DC80B801404E28A6C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 2a295ec12126e7026933ab2b9f26cf7c77d0d2c48ab977445aba10405dfac87a
MD5 d754a026dc4dac4d0b096eae7b413910
SHA1 b6461dd62148442a6e30a0fdf6115c6caa2397c6
SHA512 20931aa6f9e69dc2f5644ea1b25870db9c4d33ae9fa7d8fb93e2a8365a45e740a760f161954fc4a2dd624923d790d25959ce1d22b2ddcfd3f300fb894c9c5cee
SSDEEP 48:T2SLopFMatSaw/auUOt8BY+oCwf2jTauvbAwH:iSeMatUaAKJm2fauvbAA
TLSH
T1FA92214E5F346220D1F49B32EEE589672F7C201DC3637A99DD1850F2CDA259BF10A16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 617450a9798d1169f9857ec671a3b98de56aa76016c45deb2d68d1d9c72ad75e
MD5 f0745770359e011634b8bdfcc4ab1905
SHA1 47dc9af76940eaacaa181b5a999e7836f085ce7e
SHA512 7e5377a89fd66843d595b1a312ae1a51f3715ecff795262afac9f0f7d7fffa32966dc70f333a3fd1e82ca2f722bf80a97d46af8b8f90c7b41d617fa0f5ea5a34
TLSH
T1FD61D0F3C3E4856D8A0195F0AA186E2BCE1D0A14432C3D9AC9E4EF5BA3E3970D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 383e4446f9886b905a167e204e0fb864618d80d9435ed0f75ca19b21dd481f21
MD5 30e9465d970638167ff12811970fc0a3
SHA1 5338c1846ff61afb4e03ff6f7e6e199f8616e2ad
SHA512 c2638f04290d2f71e068ebd773a265c544082cb52b1aed5ffa0637355cd57106a43fc9dc8aa4db580ac5575332d936264745cccdcbf98b3b237ce62fe39469aa
TLSH
T169E06863C5BEE8B30038483A0E483C16BC7AD430A08150E0E496C77DA0504A35B2302B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bf875a26f11d8ba9c44e442dc16eb1a721c1dd334520e5a38a285747122dd55f
MD5 6c957926543f88871d2f3b0abd34bce9
SHA1 fa263d5efc68d3ac11338df1baf2bff2c9d6da8b
SHA512 c5e679a5ac47ce35b5b821ee70e63d0990cc2899edcf29975dd86a5d5aeaf2d9106e8d27695d90268ff8b2c7596b46dc7e856ffd6f8483c0d23b5b4a938fbf67
SSDEEP 192:sxZSReyMqZ/K1Ml8eFL/fvsAzWpVqhBEyRr4zodpK6/W6+WNQrZhZY0RGsaPdXIv:sxZSflL/fvsAzWvqhnL9/bmZ5ILm
TLSH
T1FB72E816A934997BCCDBD219FA457F63D6F91533A2505E449AFC8A0C01E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 cf18f60368781fa5d83ebebc52195f7ccac4830712cb7f8b3a1323e2edce9507
MD5 d33b57daa00a505192f8d9a7da74b12e
SHA1 0bc79f4007164369b91adbdd420f3e994dcd1bd4
SHA512 2a378388685f906a40935390d645f3d6bb9d7cc5867e1a6d3f38817d5da792c7f8d45a12ae723ae79359e64da543c3373b4313fd5beb5b6472a7de25e2b079bb
SSDEEP 192:sxZSReyMqZ/K1Ml8MFL/fvs5/KBEyRrXzodpK6/W6+WNGHU/Y0toKajnXIgjNJ:sxZSfdL/fvs5/Kn89/bJ/5qjX
TLSH
T12072F9156A389977CCDBD209BA45BF53D6F91533D2504E48AAFCCA0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 957f820b5a2a36d000c148f3f97acf3eb3d5d0b8b68a09b6dff4bead3ca387da
MD5 30ad16b9042b20450637a9ca28f66227
SHA1 70154ec399c95374feacddaf7414cd60f516c488
SHA512 ba1c2f814e330c037d38a716642f60f607cabf2cbd33277fc8b0084b60a71975b033198729a0d0f12aba3d763206c68c88c6bf1283626fda3b8c5ecde9dc4314
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gWWlLlB:2DhVP8b320JE/mKWRmmeQReu1jaKgWWp
TLSH
T1E0031C3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 8c893e4f6b61832ed465caeda6f92ea028e090b81fe1ad6cadba486f713c12c1
MD5 7f087cb75c480b79781915c9a35c64a6
SHA1 03ce01b68d6ba773b37834bffc285ae5d6f04e84
SHA512 ac4a41d923c2ae05afef01b42448825ac69c4aa046bfd1f431221b39f9288aa442d5dedc0b59571dfd778bc722338217172e66ee73c27f9299e91c810a4a67fc
SSDEEP 768:2DhVP8b32Ij7pLuLnxKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zWWlLlk:2DhVP8b32IVEnxKWRmmeQReu1jaKzWW8
TLSH
T15D030C3B280CCB7F4F844E9CEC27BE9A6DE8018BA698895447FA444C03C67DF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 b4a9dc3d021ff371ef7841e7d0879f7958e336829b43a2c02f8673c43ee5dc91
MD5 56b6f3bad9059254e2dae3a90c284ad8
SHA1 94f522877419c63ac6a07f5184ea1b6f8124f68d
SHA512 d265025c434248755097baa3da0a04f248771383bac634fc8b71d1f6d871815053465731ec7472cf12bf506e84a238d700fdab13cc43f4beadcd6e3dfbe7aa00
TLSH
T1F4E0DF1C17C8C1BA687566C302A5A70CE2F8B407EBC83E226FA1DC806543904B59A580
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 18b5bd2f3da9d44535af204d9253c6635f13d3a86b162758137e6e96eda11825
MD5 c8c94ffc05fcc593791fc0b4719a3f3c
SHA1 1edd55164834029ab9a8004e90f6c514165a259e
SHA512 7a882cc4e2a74ddd57115f052839903e304cfa411eeb232a1e6584ee5d1d8f3cf761da840ce6482600fa5096b5f8f5d3a6e904926a1056239b024f9080117494
TLSH
T1B6B012687F40F721D4DD8A371B644BC8D319F401679004538C089F510C449BC3F809D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 05a4f1ce38e1734779cac1437c61e37205e2df5fa251a492bb5cf5ac00d83b07
MD5 5f7f2e5c16f3b8b1f3dfb4d5827b35fa
SHA1 6681e30dc6434aa87f47db510e3320ca3d8fe09e
SHA512 69c2b3ee43be4887b34356ff845ccde3c4b63c97f4ad0f4d52259ceafc1a5e69a416ec84caabf837022987c4e7e98143b84c653cd2e2af0882e10f88fa4f290c
TLSH
T181E0D82C66C9C63AA1A525C74315F748D2F2740BF6D86E722B59D8C47206680724B940
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fc736218aafd78a92ece19abad4799e0c7822859355893c2aa8cf13c80cc02b9
MD5 bbb493e00ed2b5b787a5bf465cec89d7
SHA1 67843e461315f49267f1ad58ae08df4973de553a
SHA512 5c09d3978347d02d4f74c28c35e9f0751ea01b08502598940f6f3a432cb6ea199f2922500d4898b2eae2013fcab91139616ade40e3cd3fe81e77f52164c9e1a9
TLSH
T104E0267856CCC679555066C3437CFF4CD2F0780AB3C83E835758C884A901502F2AEE80
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 972a8f90919519c179c6219908a0395cdf766f7abeb4fb4e02630ea2609182b4
MD5 d90bdb021a7b2cef6312b6d06ba311e8
SHA1 9acdad17f07ff238ad2f7e38db85a43de85d433f
SHA512 492f72d7d55e47ee4c37adc920bd33ffb116877a9beedc0e482c6cb5cba42959bbdcb77c5969262ae64bb63891fec1487e4eac87394f7d23ec0b216ba3ea2615
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++JmK:qD1rjvYZ5V8fO9ddTXkrno9BxVPg
TLSH
T109B24C11717B13903ABE354E9195B8AF52C271633014E43B7BB904AA4F6BE24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 4ed138c1e2654de61a9000c1160098841f04fc9bde32126c289550427b8398ba
MD5 14f42c1dccf8de34ba34503a5566072f
SHA1 4b9d9981c94345b582b572612cf814221d234408
SHA512 3e0920260aafd5eaf3eec64bc454d66e59913344a908428cc5c706e8fae9d03c5682acad622a2826f22eaa38f2418216077f86371679622452ee125583531505
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++Jmq:qD1rjvYZ5V8fO9ddTXkrno9BxVPypNx
TLSH
T1FEC22911717B13903ABD354E8195B8AF52C271633118E43B7BB904AA4F6BE24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 58afea7d6761cad8802e05ca6064bf85b3da73022452b68fb1e1c618f5164e12
MD5 7d710f75909f97818b0d632170e488b3
SHA1 22d6a0ad12ddd937ef7243e47824461e1d38f1fb
SHA512 6e54fb8ebc0e502e5b332b7feed2f011a966b62468a78c6e73185587de28421cb79dd32c388f4013b1f0fed153fc23cfead269f375db9081d83e133ced9fd954
SSDEEP 192:FvoWicnHfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aQfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10824630A7B747001EDE7ED725CB080771A3CB16DCF22A6915DA254694DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0349f34-ec77-4679-9443-dd2d1f5cd7bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0349f34-ec77-4679-9443-dd2d1f5cd7bc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 89df452ce52401cd7b5a185c6dd2a1407e44c4feda2ed0025cb0603431d87959
MD5 07c41e3cce88bbe6db471ea3580b5930
SHA1 86351638211ba717644e16bdbabb456422c5e969
SHA512 c9fa6e2c46ad3ee94efd31ae12e23ba262d9a1f11bb3746379f152d88b87b72f0cdaaafe9ddd021e834d8a1e0651b2b19d167a0398fba6d1122fd244195a2a48
TLSH
T1795199C0A3996595BFC9A986C31E7403A5F13E67320E9871233E44F85F88C298E2FD25
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 0f50180caae474b688a1e7119b8fd26c8341c7087e281c9d5f960de0c051b297
MD5 761f3828a055320abf0609187a744af5
SHA1 66d6f8c305335accfccca286cc18fae04ab8ab52
SHA512 261eb2e87ddd7bb866620bc46b676d6ae7cff5c28c425f7dc3874fa1169b605a7d05b05a04363059d13ae910aba42e49e1c4a8f8b40632596b7cfd84b0cefe83
SSDEEP 192:lAONXAszlrhNCsiV3HPBvQkIIIrbrMIMBgYcYM:ZNwsZqsKpQkIIIrbrMIMCBR
TLSH
T12F5253392B891B33C15E5FB7226B8BA41FD688814976226E3430185F9DF2B6F87C51F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 4168ced4bcfcdd607c4f2179eef0bc602088f3ebfaaa6b7b9b45978a8f269303
MD5 d0ed2d9db5d50ba9d4363c62ea37ae23
SHA1 df597c4c153abd39422346fb64bc821be4cf3d2e
SHA512 02052fe2585544a9309d1971f0b52a2a9c399fe9676da7e32fc2191010a5584020702b6827efe245dcfaae139d1d0b789ab2295ed55878f8da6cf739e2e7b620
TLSH
T17AE02614B8CEC16EE46826CB02256788E3F4380BFB882D0B1F51C8C5B441500B28EAC9
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 d83f683c61dfde610e7fbe1f25c701bea9075471c6fe691684b316a0190990f6
MD5 b670842ceb2cb720415024205b6bd010
SHA1 ddcc21fc2815ae314842dd418750bf488bfe6009
SHA512 1cb6be6d56c25b92fbc50f5b74f4fe1273c50afe818df3f0cb5e0c42f63de4ddf7992514a2bccbb37ce5c77f6a0c3e16da57199d08043c49a8a730efd6fadbcc
TLSH
T1D8216056F320C148E54E867E942BA7351338E9029FFCEC0F447974752E72E011E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 6ee0ef4717f6dbb0e34e03467b83149ad35c017dccce3e7c7aaa92deb5fceae1
MD5 35c191bebcd05c60936e0386611d7730
SHA1 35996f4c046c1e61b87331b084f50c1ba0b8707f
SHA512 9b32ba8f91ed50d76a2551f24ef65105750aa6322dcdcce6b5077c6d77e39b3a61364a7ce1149cade386a2b77834110420e741c0f9ec32bac778bab61f6cad0a
TLSH
T157E0D85878C5C19FD16525C702B5B74CD3F63803FA883E031F61CC8465415417A4E946
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 a669550c607d5591aebd1cccba9d60bfa488b5a75b84ec19961c08e23b11bc3c
MD5 2211b572559b8669acddfff85debd5e5
SHA1 b44273c7915086f480dd1669d81ddde56b0b162c
SHA512 b40c05c090daae864fffea198273e6f71347cc2c3c55dec9fc0d42fde89017bb10dafba76c789f9ce5fd8231896c512670d3f3a56d3eef759a6bf9cad8112d40
SSDEEP 3:MsEllllkEthXllkl2zEelLt/:/M/xT02zNLt/
TLSH
T10044043C7FD41D05C51413354111C3503374DC100D1177C3345104175CC7DC04C10C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 5a5ca41fed7010e5e97544250d61d31b920ef1bba5920256920525297c5df60d
MD5 e25bc003cdb080b5f327754557a77c37
SHA1 0432cf9ffce76d31136fd1a480f752697b8e3686
SHA512 70b5566813387cae0a6412991871400c06db4b37b17e26480e46263973ace1c2e936bdc6fc24e6af116c867db449fb409cec71ead4f4b8c41086622d2d44cdb5
SSDEEP 3:MsEllllkEthXllkl2zEelA/:/M/xT02zNA/
TLSH
T15B44040C7FC41505C53414304031C3543374DC110D1177C334510413DCCF5414C04401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 155db87d2d0be7638f7f773dc5d265efe595a08435533c2e10ce1f2604d18d29
MD5 271c809884b158e8a778b0ade31b47a3
SHA1 f194be17584b43c38351a67505dcbc02f9334de9
SHA512 3d7d4d951f9634bd17f588de0a4faa8d68d4de3ba68effd89677bbd02723273448c08cce7a7b3b57ac81caf238abea423fe2cb7dca373e1c4ad3a3b1addaaade
SSDEEP 768:UF6cp6Swg/UU2ZbKYv2zMg9ox545wQhkoFYS/LJgT7:46OUU2ZZkLAOKQhkoaAA7
TLSH
T1CEF23A3DEC548DBF98DE6B89A74E69169DE00133C2B885A8E7C80F0C90B749DF74B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf9e5576276dc7b8a38edbe2dcfce4374ad794c9d50b51c4e46f2ca9918a661f
MD5 9b864dd816f0389e54c945e1c77a6bf0
SHA1 888d6b0cb853b0eac40b1723add0fd2960ec0837
SHA512 f6025597dd5cf466b4bf12877384c0ff1408efd6664b844b151dc609b46ad0fab1e2162ad1bafed63aba7eae1888b99977224568de4ba4c0eb05baf429a2d4c0
SSDEEP 384:ndiFavqMg38N98TUNTUlIxBO2+4Or4LJ+/SOwfbYKbULSpNCI3Ra4RcrN1k+5vI+:UFayv3ywgO2Z+/SYvwZ3Rarj
TLSH
T11FC24A35EC58C9ABEDEA8FC9A749B703DFE011A7D58C4AD4DAD81D4E00C719E130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ba931864b3873b9a7f1a24202fae4fdba16544de0deba0a023d6b77371e9b53e
MD5 a6c07b6deced1a08a3a258a24784d2f3
SHA1 1fc0fb1e3fe9ee5835ac4259c972da1a2d9b64f1
SHA512 7503cc34583e1bd0f670541b705259e5e5433cffb656739552580aee8a9ab5c127e1d43f8604298c5987421d42a3df07eb16216aebd30fac53672ff98bdd8cda
SSDEEP 768:UF6cp6Swg/UU2ZEKYv2zMg9ox545wQhkoFYS/LJgT7:46OUU2ZakLAOKQhkoaAA7
TLSH
T163F23A3DEC548DBF98DE6B89A74E69129DE00133C2B885A8E7C80F0C90B749DF70B915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 00c684157214be482955d9c152706b5c3b5cbd4bd8e3d49740cce9aeff0f4414
MD5 b9c302b3186415566b3afba9307d6d8d
SHA1 eec1dba8bac7a45dd363f0f8dc9fb99e182f181f
SHA512 cffd6705c8cac7b784268a6f24e2bacd4386722f1a7a458cac1c23abe45ea508d31b8f9d23afaa59857e022d25751a7f74cb7ba29b55007a86b6c7ae0b72bb92
SSDEEP 768:wFccpm3Swg/UU2Z0KYv2zMgxhkoFYS/LJgT7:Ym3OUU2ZqkLhkoaAA7
TLSH
T1B1C26D31E868CDA7EDEA8FD6E74A7A47DEE01163C5888AE4DAD90E5D00C71DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 41138924c3ade50a490cfe6bab48f81b93e3eed07a7889ed6d77050d22b68a50
MD5 48fb6af4a0c4658ef6923675e6d4be69
SHA1 c4545164f515de01e82d852e892baf3a8fb68544
SHA512 5aa696c7171f84257d75235391e406273716991430415a0dea1951dd309121d5e0e117d9f9a78844347d993616cd5ef1c55457aea179a5b26e7fd4af49ed8c4b
SSDEEP 384:nRiFavqMg38NJ8TUNTUlIxBO2+4Or4LRobOwfbYKbULS/z+j+ix3Ra4RcrN1k+5L:4Fayv3iwgO2ZMNYv2zM5x3Rarj
TLSH
T149C24B31E858CDA7EDEA8FDAA7497603DFE011A7D58C4AE4DAD81D4D008759E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e17366f39c606ff64798315983228ee48fe89c27c807f4e496001e9aaf7b9658
MD5 ae1beb728d3fd30bc1430276abc3bfd0
SHA1 b2dc16304d3c0977bb56e999a0fcffb6025bdbf2
SHA512 c418a7d66b919b139cc6688482873158360f6a391c71e407de5e1f0f6be1ba5a3aaa4544dfaaa4c322a68234f7796cecd8612cc8eacff03be0122ee34d04043d
SSDEEP 3:MsEllllkEthXllkl2zEelk///:/M/xT02zNO/
TLSH
T11B44044C7FC41505C51410304111C7503370DC105711F7D73C5304135CCF5414C00101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads