6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3

Analysis

user interaction
yes
max time kernel
300s
max time network
264s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lock.Julie.exe
Size 5.9MB
Sample260519-cfes3ae151
SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
MD5 e2ac9e24dce3e923bfe2526f7e4681b7
SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
TLSH
T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6076	SyncService.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	SyncService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSyncService = "\"C:\\ProgramData\\Microsoft\\DeviceSync\\SyncService.exe\""	SyncService.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	SyncService.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3456_2086238020\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3456_2086238020\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3456_1588667116\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3456_1588667116\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2528	msedge.exe
5236	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\WallpaperStyle = "3"	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\TileWallpaper = "0"	Lock.Julie.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\WallpaperStyle = "3"	SyncService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\TileWallpaper = "0"	SyncService.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236296995805187"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{59FF9CF0-32A5-4539-A3E3-9065A73C738E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{9720004D-5831-4E8F-863C-62A09D878445}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4768	Lock.Julie.exe
6076	SyncService.exe
3456	msedge.exe
3456	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4768	Lock.Julie.exe
Token: SeSecurityPrivilege	4768	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4768	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4768	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4768	Lock.Julie.exe
Token: SeSystemtimePrivilege	4768	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4768	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4768	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4768	Lock.Julie.exe
Token: SeBackupPrivilege	4768	Lock.Julie.exe
Token: SeRestorePrivilege	4768	Lock.Julie.exe
Token: SeShutdownPrivilege	4768	Lock.Julie.exe
Token: SeDebugPrivilege	4768	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4768	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4768	Lock.Julie.exe
Token: SeUndockPrivilege	4768	Lock.Julie.exe
Token: SeManageVolumePrivilege	4768	Lock.Julie.exe
Token: 33	4768	Lock.Julie.exe
Token: 34	4768	Lock.Julie.exe
Token: 35	4768	Lock.Julie.exe
Token: 36	4768	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4768	Lock.Julie.exe
Token: SeSecurityPrivilege	4768	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4768	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4768	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4768	Lock.Julie.exe
Token: SeSystemtimePrivilege	4768	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4768	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4768	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4768	Lock.Julie.exe
Token: SeBackupPrivilege	4768	Lock.Julie.exe
Token: SeRestorePrivilege	4768	Lock.Julie.exe
Token: SeShutdownPrivilege	4768	Lock.Julie.exe
Token: SeDebugPrivilege	4768	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4768	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4768	Lock.Julie.exe
Token: SeUndockPrivilege	4768	Lock.Julie.exe
Token: SeManageVolumePrivilege	4768	Lock.Julie.exe
Token: 33	4768	Lock.Julie.exe
Token: 34	4768	Lock.Julie.exe
Token: 35	4768	Lock.Julie.exe
Token: 36	4768	Lock.Julie.exe
Token: SeIncreaseQuotaPrivilege	4768	Lock.Julie.exe
Token: SeSecurityPrivilege	4768	Lock.Julie.exe
Token: SeTakeOwnershipPrivilege	4768	Lock.Julie.exe
Token: SeLoadDriverPrivilege	4768	Lock.Julie.exe
Token: SeSystemProfilePrivilege	4768	Lock.Julie.exe
Token: SeSystemtimePrivilege	4768	Lock.Julie.exe
Token: SeProfSingleProcessPrivilege	4768	Lock.Julie.exe
Token: SeIncBasePriorityPrivilege	4768	Lock.Julie.exe
Token: SeCreatePagefilePrivilege	4768	Lock.Julie.exe
Token: SeBackupPrivilege	4768	Lock.Julie.exe
Token: SeRestorePrivilege	4768	Lock.Julie.exe
Token: SeShutdownPrivilege	4768	Lock.Julie.exe
Token: SeDebugPrivilege	4768	Lock.Julie.exe
Token: SeSystemEnvironmentPrivilege	4768	Lock.Julie.exe
Token: SeRemoteShutdownPrivilege	4768	Lock.Julie.exe
Token: SeUndockPrivilege	4768	Lock.Julie.exe
Token: SeManageVolumePrivilege	4768	Lock.Julie.exe
Token: 33	4768	Lock.Julie.exe
Token: 34	4768	Lock.Julie.exe
Token: 35	4768	Lock.Julie.exe
Token: 36	4768	Lock.Julie.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4176	4768	Lock.Julie.exe	79
PID 4176 wrote to memory of 5032	4176	csc.exe	81
PID 6076 wrote to memory of 3316	6076	SyncService.exe	85
PID 3316 wrote to memory of 2684	3316	csc.exe	87
PID 4768 wrote to memory of 2136	4768	Lock.Julie.exe	88
PID 2136 wrote to memory of 2948	2136	msedge.exe	89
PID 2136 wrote to memory of 2528	2136	msedge.exe	90
PID 2136 wrote to memory of 5208	2136	msedge.exe	91
PID 2136 wrote to memory of 5208	2136	msedge.exe	91
PID 2136 wrote to memory of 5208	2136	msedge.exe	91
PID 2136 wrote to memory of 5616	2136	msedge.exe	93
PID 2136 wrote to memory of 5616	2136	msedge.exe	93
PID 2136 wrote to memory of 5956	2136	msedge.exe	94
PID 2136 wrote to memory of 5956	2136	msedge.exe	94
PID 2136 wrote to memory of 5956	2136	msedge.exe	94
PID 2136 wrote to memory of 4072	2136	msedge.exe	95
PID 2136 wrote to memory of 4072	2136	msedge.exe	95
PID 2136 wrote to memory of 4072	2136	msedge.exe	95
PID 2136 wrote to memory of 5548	2136	msedge.exe	96
PID 2136 wrote to memory of 5008	2136	msedge.exe	97
PID 2136 wrote to memory of 5548	2136	msedge.exe	96
PID 2136 wrote to memory of 5008	2136	msedge.exe	97
PID 2136 wrote to memory of 1552	2136	msedge.exe	98
PID 2136 wrote to memory of 1960	2136	msedge.exe	100
PID 1552 wrote to memory of 5448	1552	msedge.exe	101
PID 2136 wrote to memory of 3456	2136	msedge.exe	104
PID 3456 wrote to memory of 3564	3456	msedge.exe	105
PID 3456 wrote to memory of 2756	3456	msedge.exe	106
PID 3456 wrote to memory of 5236	3456	msedge.exe	107
PID 3456 wrote to memory of 2756	3456	msedge.exe	106
PID 3456 wrote to memory of 2756	3456	msedge.exe	106
PID 3456 wrote to memory of 5456	3456	msedge.exe	108
PID 3456 wrote to memory of 5456	3456	msedge.exe	108
PID 3456 wrote to memory of 2212	3456	msedge.exe	111
PID 3456 wrote to memory of 2264	3456	msedge.exe	112
PID 3456 wrote to memory of 5164	3456	msedge.exe	113
PID 3456 wrote to memory of 2668	3456	msedge.exe	114
PID 3456 wrote to memory of 1396	3456	msedge.exe	117
PID 3456 wrote to memory of 1396	3456	msedge.exe	117
PID 3456 wrote to memory of 1852	3456	msedge.exe	118
PID 3456 wrote to memory of 1852	3456	msedge.exe	118
PID 3456 wrote to memory of 1976	3456	msedge.exe	119
PID 3456 wrote to memory of 5600	3456	msedge.exe	120
PID 3456 wrote to memory of 5600	3456	msedge.exe	120

System policy modification 1 TTPs 27 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	Lock.Julie.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1"	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\ProgramData\\Microsoft\\DeviceSync\\bg.dat"	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI	Lock.Julie.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0"	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard	Lock.Julie.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background"	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3"	SyncService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:personalization-background"	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WallpaperStyle = "3"	Lock.Julie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\TileWallpaper = "0"	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Lock.Julie.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	SyncService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SyncService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SyncService.exe

C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe
"C:\Users\Admin\AppData\Local\Temp\Lock.Julie.exe"
1⤵
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iuenh0n2\iuenh0n2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC251.tmp" "c:\Users\Admin\AppData\Local\Temp\iuenh0n2\CSC672B5F62FF5F45F7A5C9EC157F26CAFE.TMP"
    3⤵
    PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://julie.click/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffadc0cc188,0x7ffadc0cc194,0x7ffadc0cc1a0
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8827791273327542082,5624411362406087519,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,6437582657232006543,3315802131974316291,262144 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,859387841135536525,1663239542809931235,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15566858699186902271,13493932058285248507,2097152 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8531657689325204346,16639449011858791434,2097152 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2525163281492791388,9155258208934881856,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17436899289562912034,8987567933438031210,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17426219679513822545,6313646718319571125,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,3596699936752155231,4410026905126404058,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,3596699936752155231,4410026905126404058,524288 --field-trial-handle=2160,i,9784856760287182910,5056573973015547637,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f0,0x7ffadc0cc188,0x7ffadc0cc194,0x7ffadc0cc1a0
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3824854262668503703,15278001083771636157,262144 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,5345578117126263964,6861413135939259606,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
      4⤵
      System Time Discovery
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,17056580645181343269,16538450317989556283,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,3721045606274224406,5342606717090304101,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,3721045606274224406,5342606717090304101,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6540825291346350466,16056808934058130151,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,9628166136232601476,7934455605261397780,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,310722615859097885,1283964176042019222,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,8655969800347248197,16603186831948807540,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,11510513522076790268,11391569008320592999,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,3403475425537656949,14206982298740430682,262144 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,16764578962345076302,16562647986404575272,524288 --field-trial-handle=2376,i,13490574690555869342,2035395787254120677,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
      4⤵
      PID:5600

C:\ProgramData\Microsoft\DeviceSync\SyncService.exe
"C:\ProgramData\Microsoft\DeviceSync\SyncService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:6076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d2jpfybg\d2jpfybg.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED88.tmp" "c:\Users\Admin\AppData\Local\Temp\d2jpfybg\CSC3CA4D6D694BE4E1484C1F826E77AF925.TMP"
    3⤵
    PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

.dscfg

Path C:\ProgramData\Microsoft\DeviceSync\.dscfg
Size 123B
SHA256 2964c68c381386de729d398125c8a90b2809d3492f64e219a70f6c867b254f9b
MD5 36a9df21981ee05f61b5ba8467963580
SHA1 4a58b02da7df3922be6baadcb099e769b383ba60
SHA512 db071c154ced78fc75c6fe3325fa4e181317c50ef17d13a10bfe4553ee8fca5e1fa31b55bdf81dec451f30a0d7af6998dacac9c75a877f0da39532d27c6b130e
TLSH
T1BFB02B038442555833B400C4C718DF225850131B14206013FBF45D280635C303100542
MD5 SHA1 SHA512 TLSH

Submit Download

SyncService.exe

Path C:\ProgramData\Microsoft\DeviceSync\SyncService.exe
Size 5.9MB
SHA256 6fe3e2b89204368a78e8920afa3420ce70a75052fd54784097f30faaeddf75a3
MD5 e2ac9e24dce3e923bfe2526f7e4681b7
SHA1 d1d3aa5b10d95f31b3191e8cbd23913e185ae5cd
SHA512 4470eae0e48b7c76972b0052397bd6bb6af1a6428b982bd341d82351370f7b592ea2b8d56b46e245c231d86c60ea79e2cc9cb124ac1bbf57f7243672efd149bd
SSDEEP 49152:k7Ne2hvV5WFgXbVDQHf2lKzqioZYUBxbOaZvf/ud+GMnW3ycatyWtJ5NMofZ/9GZ:
TLSH
T19B5633106F9E7CB5CB58817830AF1E6E1E700F894448E4D727CD69DB678FB409A1F8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg_extracted.jpg

Path C:\ProgramData\Microsoft\DeviceSync\bg_extracted.jpg
Size 4.4MB
SHA256 8d547744b4ab2c3189a566753ec1f19470d1367936e11a941d5addc9ca5e7b92
MD5 e5e7a24e300db549a35a5f3d734544a3
SHA1 2b0617e8126fab1c5f136248524283c98d6f6897
SHA512 defa97ade3dc9fc4a0f1d44c8bbaa3ef2c2b664f9554f5dd8a81a0375781fc7ef48b637fdc1939759d1b1da934c43f8d8efc1696ebf38ba09f70ab3b0b4cbc36
SSDEEP 98304:pZ54kuruikPJdefM4pxHzaGhQsXu7H0kV0zwMtHiU0BqIclCHeb:P54ku7QVAxTahsXgFV0wOL0BElq4
TLSH
T1BE2633C0FCEB1F75D993118CCF9372B6969D7160D73E28C6B764B2C24A3E44522A8792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 1c02e2feba3b2af3c045d1ed01f8a67e0923f7e357b32c434e567eef6aac4138
MD5 f05b0294ae4949feed0706bc80fa6418
SHA1 346bb7d2d99251c193652ad4ae7ef2964565b98d
SHA512 348366e162f3a037e74d0e9ff422ba7ca3e14c2b170f50bab2a4b88b29a572028e56965c332bc63cbe89de1a3467c215893ecf3cac514d786ec7ea30c08bcc05
SSDEEP 12:bHiUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:blRqxosfxWMk8xVZ4YWI30otWn
TLSH
T139257D85B34494FFC8C35A7189BD17903774F6DE5F42835B6A377A0E2E671D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92e71b18cc218fa24ad8435c60697e7c57264ec817aaf8090b0bca9ad3f8a047
MD5 835ff967c81c15a11558c1a16400fbcd
SHA1 e5f0b8ac3a5597c069467d7a91d51dce8c99c272
SHA512 397a165e13e51438c9b769a8b470df8fab625e008a92beacced95814d3fea839dbac6712589e7b7835dce92b2a1f1ba4cc38e4ff6c3b3cc02b585a6be2706853
TLSH
T117D01266374AB001E7698230E4C2C311266650E138864A01B214C81DA9A41E86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffc53802c2287c47ee9fbe331ae6c5c43e8883d267798cecfb8b339fb750493e
MD5 f8176dbb137ba0ca4ca5f57139f41b81
SHA1 a7894fbe4feb439a5882df476c6457de065c41ea
SHA512 01cd601751c030ca2f441ebe7f1589c46ba91ccac5531b3168c8e9b723ca91a968e1a5a02619273c43c3203b9b1b4b6066aebdfb33538dca6f8fb3413480ff63
TLSH
T1C2D0A7763786F016E73D4130E5D38365262A90E538864600F218C48C99F81EDA7D20C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 51beb8ad0bcb3c1deceb66834ae551bf465e31df24baba2bed0ffe068a1a6e58
MD5 06dbbe851b289a65913a29a58dc66814
SHA1 408271c280bc4cca46baa4168ceec356d8e468cc
SHA512 8a443f4cb54497717931c272cdf319ee4adbced945592010215a823dadb0b33991833390d771da1ec6f0040df516eb9c165e17545a9a922d18472ead8f083fd1
TLSH
T141D0A7AA3787B441E72B81B0A4C2C316273A90F538510A00B118DC1C99A50F9A2D21C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b55b8b4f09948c93576f18166726b70cc9652a699aab7ebddc6745a96a83f210
MD5 5c3d58f410f20d0c6b11a125e22b4ca9
SHA1 84a5874b6f4c914ec0bea68e9ad67595ddb6e720
SHA512 8bfdf9947c676be643d16631161eeef47e0e90935382cb5c1b40a1dbc09a0b6a429c719ae74d3ba036562f9d0d58cbb41419239630ccb24966fa51151fb6a181
TLSH
T157D0A7AA3787B441EB2B81B0A4D2C326273A90F438510A00B118DC1C89E50E9A2D21C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1ea62bfce7c86ab9baaa18a4e56ffab5d2ced31658a62c205921139f5ed0b1ea
MD5 2f1fc0f73156b2a17a5963e2a88b7657
SHA1 d8921235895e1e28ff7a6456a54c75d8975329a0
SHA512 dc1606d115e108ca0e6ed59b4bdb5baf0ab91a3eaafe9d9a55d918cd3b8cf1e0cb4a6429f7b123ed0dc646ce3ba372e6c6f94776ab54685813abb18047acedea
SSDEEP 384:HnBzGqhlR8kZynnlz+8+M9gz7p6MLNfJiOCSG:H/hbRynlXZgvpJh4O
TLSH
T16A134D3D72940C01EEC6163C281B4A72633CF961E9C9271B73F5745422BDF569BCEAA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bdc37e53ad7311c20641caabb1e564d7f3dcccafd5f8d296223a7557ca8d82c0
MD5 4473d7b5639b29fe36df65d7b3fd7e58
SHA1 0368b931e43c0d52c79eaf61be8cebae40cb100d
SHA512 9f89c51dc05f563a229b0b77ce83f9e70f4f1366c6b6d5715140cccb3af8fe883e6572f960bbd7dbfa71e61b9093711278bfb1783c924c75adc2abb073c7ee21
SSDEEP 3072:X4L/zL/ZLdNUKL/oL/jDSeY84xLiyCc6:X4L/zL/ddNUKL/oL/PQdiy
TLSH
T197446FFB1951A01BDFA802F5E2033A3DD17B415E2CD1E9E9E67C0C852825E32B6FDA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d8f0d8c1df82eb2686c87acd13e1c2b9e6c6154f5af701409c2233ca19931dfc
MD5 17d8c9de33d67b86afbb10fb42cdbbee
SHA1 9df4f2d0c3441d693794e7b189b37cdc3518a99a
SHA512 6885ad8a1b0e88b6932e449ee1622fb21f684b0b4f2d2d776957d6cf98d4817b53d2472039ee999c00cc9df6e62428afc2f949da5e2b3ee844ed3d944742fa44
SSDEEP 3072:uvgg65mR3uEfiHCYDFEBcpDr/UolzAdd2k0wrZ:u4g65LEfGNpDr/xlwJZ
TLSH
T1EA2518EECB682C82CE6B877470E0D9077E712183B68DC0D39944C5D897D6B8576E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 094c7fb8262dc807ed49b50c3fedd3a6579f13c5925c4fab79b3eacd7cf037bf
MD5 fc9f1b1e9db13ccee49825829efa18e8
SHA1 40d6ac4aa47fe0e565b75d6aec5416e145cb95ed
SHA512 8f599e119eab5b55f5143a7b2ad50ed1b82286f11dc796eac0806d2195a9a3b57ba9124d57d327cce4f41b0e95743f987f4e1b1ccf2c35b100a1cbe4205665d7
SSDEEP 24576:Zwb6olBm8YHLJycM/mewHJEB7b6WzkBGSMAoOqq1k1q+RAy+D0CHXc:Zwe8YHLZTpEsW2GS9oOZe1zRA7HXc
TLSH
T1D9868EEDCA6898C3CD639970B0F0ED877C7413C3F595D1D68898C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 a5378071ef4652a2e30bebe70af1d90b9f090d07a4ffa48cd6df50b5621707fc
MD5 2df464e28009ba05bfedecbdbc4b13e1
SHA1 58e8d934f72ba5f7acdf0a65124c42905d8b2755
SHA512 5c6b6e7f502807e2e3fcb60e9e3b4aea8888385b91b35bb4306baa9014d8be5354bc32acb77e9db3035d82954ad5bc44c5071c4179d41c21a05fa4efdeea7499
TLSH
T19DE0D89C55CBC21D659034D74238DF1CC9D13997D699AD475740C8C87A03441F39B64E
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 0d4e48fc3fa688eaa9601bfe80fae207ecbe8ae15e9f9323ebedb6ac70a1b3d0
MD5 ccf3c253950687706297553535d31a05
SHA1 25f54a0d60c83c192ba3afbce6ae27b3f3ff5746
SHA512 c33be1303d7695ca97a8e80aa4757599dfc90b65b11b98f0f33e53ccee6798da56d712539d354ecf76ffb03b91d2022a5a71b671559365aaff48b8e094ac8011
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jn3pHoBK5fKFtIy3qYpyb:Tyi+7f+UZD4jJ/BrZHoBCKFOy3Tpyb
TLSH
T152E2E08D3F12F511C4ED733EA0C2CAE09EBC686C864DB571913C98B28D926A1F49E54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 8bf8a53864fe7a236ab3d28f49105a373124a42f62504dcd64faca5330210696
MD5 dace20da38306f7aaa991c649ba79e70
SHA1 f502dadf2f5d7217ad8181af4dc740d154632a42
SHA512 ebdadcbe50066ee6fb3706e5ac7402f47c6b6e444ba65c99e08903a9335cdcdff05bc05208c30e086b396aab864af50086bfd5730644abdaadae9ac312356cdd
TLSH
T182E0865C04DAC52D926668E3877C571CD2D2398FA69C79029789C8487106645B3DE685
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 60c67a0020c133797dc53b7d5688598585a5359e19623dd79279f588d2c635c3
MD5 e3c167f33fbd33ecbc4d45015284f338
SHA1 0870d0cf40739d026a5014e65906ab9d77cceb02
SHA512 9d3befe1fe29590abb248dddd34066f97c170afe0cfbf59dadab7c1234c7185fb070d1daa0c1b68dd2b225d59753568165147bbf37079240f0508303a0a8707a
SSDEEP 48:LzBmw6QU1Pz1jUp8nhzizLW5opWbQUnmKqy2ajUq/+CyyuTKSZ0ADOUXM9KVCZ4p:3BCxK8am0MnmKq7afR7BUA4CZ7BmyB
TLSH
T13EB23B934C3DBC07EB191FB925A608718C7B80AE5FE29DA5357888108DFC042D9752FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 e06f4b2f2f69a8809ecb221427cde407ec14a1aafc20cbd89c11c9965ac2d3ff
MD5 861cca282b99b30838610ea82cb7b4fd
SHA1 f9f515d3bd166fad30f3fd4a6d66ce4713ca7854
SHA512 fd8e6ed9f6939a627484132024b653fdc3e6b4f09c7103d14be7d9eef904939b1af9633df369075cb4836c29711a68d79eb403553a30ddcf5fcafb45d1c5a5bc
SSDEEP 192:VEG2Mk0+G83uxXBBK31GkSJJNsEJH7DNspUe:Cika83uFBBQ1GkSTNR7DNspUe
TLSH
T13714655F5F343312CD6C803669E795A35DADF43F8B5276CAB8601460CEE3A52A05C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 9be535ed568a139bb3c90f462fbef0d4a24f7fb433d850ace4ade58aa039e9fe
MD5 e7ce002f545c1479c095bede5395d736
SHA1 9b4bab34582419ffe485f5978251561e29e5a31b
SHA512 32970eca102e80ec13686c191925853583297d9a92c4ba912c5d8db06a0d4c1379bba90aad32d822f011b393de61f0c64f385ff348a200ec7c79eae0acb1ce60
SSDEEP 1536:TfEEjWlttjpGZqW3ynPDuVLpBO6CvBcZs862UqPq:gLlEt2BmNUH
TLSH
T180B36227D6A64C6B01F16264EC754383F325436F9286A82F3A3C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 7db20ddc1915a32872faccdecfd9e828f2c027ce47437d978b0a2235f7a375f1
MD5 ebf3d89bcdb030916db1d52e9da212fd
SHA1 73aa03910bacc8eb993eacb27f30ef33a00deb65
SHA512 3c391ae91a0018992f8daf910e5a6d25533d67c290e8fb82bcc0510cbbf37f27370b0e2c59852c83326a99e04e52f551a1cea8e7a16ba359b5bf6d3ecdffb20f
TLSH
T12CE0D86884DEC65D5548209B83396B48E3E5398BE68C6A015B84D8C4F402004B7E99C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7f219023e96e23bd91f0b9ef7d87b62ec8f5ab4e330a1780e15efd39ca1eb39e
MD5 0bde2f6c444cba92b85a50ee7e2c28ee
SHA1 081d5ada3fddf195cd83f51dd68305b48c0cfe91
SHA512 fe41efab2e0a56bce14741bc76db94eab98b27f5f61608cd726886634ed870e75ddcf16681bac0a2eaa0380c635a0501c91c5d37da3ba20a29adb96ea4493208
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T10E928C4E5F346220C0F04B36EDD189672F7C211CD3A72A99DE5410F3DE9259BF1055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 209f84dc201667a5be13a1bc9dfb1995d898abc62869be09a3f9d45d1abe8ed8
MD5 f87873618b7549df002c0b2b75f3fcba
SHA1 283b2c36e6ae479ab6394a8b8a6570c74f6a4a4c
SHA512 675195b562f842713fdf8c355e75f45a7ef3873a6ea604ac26b10430a4fa72431180679b0bdbdb30812efade938896215582c3bf799444aaee74fa0d576dc5ca
TLSH
T1D841B0F783F4856E9A0195F0BA18AE2FCF2D0515432C3D6A89E0AF1793E3471E04165B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 251a1cebcfe5c5d5432f53d732a9f472f2005696b641a73963553a816ec2b1e1
MD5 f7215012927bfdd8447b04b5505d1cff
SHA1 3e8774d7ef649878d89389f9d0145c6d9f1dcaf8
SHA512 12cb43f5198e7c2eee0523daf5900e9afae28283f2b92228f4cbb36ed93f4d2ee2ae2a18a2ac936b02b3e2625d9fefe77f96d0e42537ab3801ba33b0ea28d13d
TLSH
T1A4F059A795BEA97B117606BFBE447C48757EB4310291A4E0CA7A92BCA0810F70B11062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a90d8f2c5802236c8ee9d191dd339787d0dfeeb4c5ea32b289c8150596f82661
MD5 f19b19ed65cbfaad49c5e176af5a32ca
SHA1 663ecf09b9329b795d603e9ea4fcfc7453677258
SHA512 1d9face44adcc76aaedd9dc586ed0c4e1a08b59812e9b52186c4ef838a7e23f45226b59cd30686063b2558b6431b59be140bdc412ba9ec11b06f3f1470ed53b8
SSDEEP 384:sxZ/yFd/f/sWWvFEV7orQ0YE/b//5oBBZJD:sXYd/fdYFEcJ/bH5oN
TLSH
T14772F7166628997B9CDBD319FA957F53D7F9152392905E04AAFC8B0C00E77EC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0933fdde7b9d180ab58d203c719eef3e2aa495d1afd2118f6d27be08bcc60be2
MD5 51ec3efafd768aa90df728e45e8e4d00
SHA1 6b8c4499ff6ec01efb8ce15b4606dab4d32ad2f0
SHA512 e494feed35ab169b32a69e867c9f4c62b7e00fec9e9801119bf4be5928aac8debc913ea676b6db79ad6fcfdb6e090954ae85ca9a8fa97e42c89f6ff190f74be3
SSDEEP 768:XwZh38Dv2S47pLILZZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3GGq9LlL:XwZh38Dv2Sk2ZZFWRm6GQFmu1jaKGGqr
TLSH
T15E031B3B280CCB7E4F844E9CEC267F8A6DE8028B96988D5447FA494C02C67EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 8972541ee9a2cea944206f4278752417116f5b795af67e01b2d530fa4a88c861
MD5 2e48ca480a2c0ac996d0272c7c5ffaa1
SHA1 979e6d076867dcf9a90bd796930a68b486f47d1e
SHA512 c863c8dd4b9cf5c52578896f720e5044302d8ab7734e952b764df8d4a0b40bb5709d00a20c36ce06e5ea6b169865131f870a4694b3dd25d01030f1425480ecb9
TLSH
T1B9E0265807CAC57D705A31A703348B0CE2E9794BD6CC3D026FC8C8586143D04B2DB1C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 9b0eeb597958465c1d4e16633a2e1b2711b2edf51fb0a9c4d61ab1ec5dfa793b
MD5 ff5f51e21a30e49383796f3fff39158b
SHA1 350ca8fb8082b362a51172fbe3f92990d9a653f9
SHA512 69e08054d664475a8f9918d8f3b898de629b92827f62e4dc3043864ed17090e0ac69a4f2320b90d36204ee85dd5eca9514efeb86eee990c64bac2cc7c1bd665a
TLSH
T1CEB012507700BA23D0A60D31116C5BC3A309F80100005F03CCA84F111C459AC2F86895
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 3d784fd4d5497a352b4e70bcac417554c979e955e1416468c1e06b79b48fbdc1
MD5 a6461e7d59d524216acccdcc91fda61d
SHA1 797ea427ad1d8e289c92d8e32719291c0cf3d11a
SHA512 b3666172ff5205697f3b509ea53c44be02983f7b8410d21f0698905b6d9aa41d192d8fbc5185521b0202cac6f19db843e8e6a7a3df5fbc9fc16bcd5f16ab5ed2
TLSH
T1BEE0DF2857CAC62E618570EF8334E749D2E3794BE6DC69126B48F488A207940B38B2C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 48eeed279ecf3a09b9e968e16302d96344bb1075421190931d3f71c58e2fb192
MD5 10778b59f4d04522d42a31d0925e2834
SHA1 6050a6603d52a4871cd83a9196e8e15d917329ed
SHA512 c244a6daac4fe9c694466f9c471fe1c4ffacd9c7889d74c89cbf6f634072efa819b279bd52f8e6edc60e2d57dc4b231b12336cc9327be9b5392b1944a0fb9829
TLSH
T137E0DF7886CAC63D504070D743B49B1ED3E17D4B9388BE0A9F488844B102920B7AE189
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 2086a6c818482af2f684bd30390defd722d981394a5052d993d57842ed28faf3
MD5 116a6363e64bf23d96ef1bb6034220fe
SHA1 d9c70c8eb246b79a54965dd565f5e330ce10bd7c
SHA512 f3afc4028cdd547acd66c00d59b374c76db301df25cde59c24a0fbd3669a7001a7d975050952b49eee70c12a1d623f8bd8a6506fc5bd64e4f6b691a3b3f843e4
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3UZXcnRvbhj:ctGj+BCNC5qFVpUZcRvFj
TLSH
T19BC2661732BB02023C7D691C87A49B775A42B1733029E92B7BE854B64E6BE205DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 ba1a4474cd816637cd55493cace7cfa5121a2680c65dd859714f1b313e2d7c79
MD5 8ae4e32f9923d243d5091f859db2ff25
SHA1 c68fbb007ef408ad63c30e3b115924790e002074
SHA512 42b8d63cfaa20a6bd49bd4811531a4ae44e74757d8f139fa2425697592d9d7b3b5d3ac74d31f597bfebf6a973943b86f6efc3a380e2196af23a7eba2786a3f55
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3UZXcnRvbhFBRA:ctGj+BCNC5qFVpUZcRvFFLA
TLSH
T18AD2661332BB02023C7D691D87A49B775A42B2733029E52B7BE854B64E6BE205DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 365ca1e94f67cba20958209a320d4446a2098a9cd2ae6128646ba7143934d5f3
MD5 c054233c5f6bd04316b8739216423738
SHA1 795ad4846c57a33873783904d8ae94dc88fd819f
SHA512 669528051a714b4994c35aef35c7e1982097d1fbdfb32c1575301aaf68931607e514a6601276cf75963b485f521711559a157b07e341f529a16b1b1a9b76cabf
SSDEEP 192:FvogGZtF76bfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aDZtx6bfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T15424640A7B747001DDE7D9725CB080771A3CB16ECF22A6915DA254694DF3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 78fa75c34e8c76b491f38456ddbe3c5e57a8a85b59694fb3d8fd7611c19d1b81
MD5 0407dc304ea6f4c46b79a0658311a803
SHA1 dd151406583a64b28274120c6e035b1b73460bca
SHA512 a9c01b6a35dde614425052a2ee3a70c688d6b0b1f867e29a239ebb83284f6d2b509a8f7f3b20070a410dc4a9a47dbd0092f5e75e36525e0d554f5691de609df1
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BDjQMIIIzbDMIM5oYcY:FQ8sNis/djQMIIIzbDMIMyB
TLSH
T1ED5273692A061B7BD04E5FB712AE87641BC989C24576326D30611C8F4CF3A6787C92FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4c672de8668648806408fd64f3635e9107b964eb53b182eb21b4c3938a26f811
MD5 7abbdd67841debb4cc58c28c05dff5e6
SHA1 bb81a5c2b3bcf3c4a2698b067391a8f39706c414
SHA512 9b00ba0c2f39f4fc844db59bb7938676553817d2c624b45c41a676bf60605afb61791bea3e226f6f3f197facce66c999bb4df7a8efe9d3c0c79d4e310c0d93ae
TLSH
T1E3E07D1CA8CAC16FB05560DB13345B0CE3C23E4FFADC29069F40C448A007100F3CE282
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 beb1598a895dc952bb593c2fd9de02d578e976728a161211cca624bd0320864a
MD5 2b2ae131c5b6105daeca818ecb901284
SHA1 cbf8f5299957bcea51ac06f571d92f774c5b962b
SHA512 77a0c4a61d8e110fd2518b5e029c6aed730b8b413539f1cc76276d305a7ee5767b5c781327ade38671f5339166a640ea7a6f09e6eb0424e1bc51f256a91032d8
TLSH
T13C218151F320C109E14E867EA12BEB361328E8029FFCED0F407920256D72F010E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 daa36d487948c118c1c3d3cdcc5ff348be09492f505572f874161dd09f068b01
MD5 c5fc064d9203d608abebada4a4d89d67
SHA1 8b9d6b6a1bb488929360d35d3d31a0dc8b197978
SHA512 bcd2d9655381c2601c33e61eeb8743f1d41a9d670c45c2849b18f117f030468d85340b2edfa49c085aea3dec7e594729d222594a0a7399bf305f92d32a7ae573
TLSH
T108E0205864D5C15FD05060D702789759D2D23E47FB9C2E415F4CCC4CD102141F7CE142
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.7\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 74e1960fcea1ec24109c63dd3638d7b4c1cfb2d5f27974571d7063be65de19a3
MD5 9beda555983c8aedb029a2f9b5bb355a
SHA1 294461545f85858e4cbb915d2a46c36c5ddf0150
SHA512 630e9dad8729fc3a19f073798103f3d55b466fccf7172154c4e4a3aefdbde3e33b8fad11ef4a8ffe3ec345b5fe98e2403603c07887abef8509962ecadace0589
SSDEEP 3:MsEllllkEthXllkl2zEj7lll:/M/xT02zC
TLSH
T1F5440404FFC10405C54050344115C3503370F410073D77C734710453DCD5D403C41001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 21317860e6b92a7395a6ff5e1a4eb013e2c5ba56436e6e9c519324f311a4aec7
MD5 396d0a18799b5e0fc3d28b1ef527ef1b
SHA1 10f647e6d3479dfbf632c5fb7f3670bf12f24ae0
SHA512 9100404d2311c969e6daccb74f584020ae3fbbc2e0d29f5c0c8bdef833a7768fbf4e8951206ff5c8d1e470869deedd1a070d7153b24936c9115b3b8054480235
SSDEEP 768:gFEcpzQ7wg4a8qogMHk2mdlmTb4tGWI8p0dL9:OzQa+HdeM4WI8p0dL9
TLSH
T1B6E2287ADC59CD7F98DE6B48664E35229DE01137C5B88998E7D80F0C907709DF70B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 97537c4cf6faca3b6880fa7d8a2f129750ba0bb5dbe966dabc6862179fd1a9e1
MD5 cee18352fa1ce4f8fc04f678b989a92d
SHA1 4be57562df7beeb56d2135259bdbb7a885e3d9e1
SHA512 23fd7aa797c76962590aa7a1015f42b63772a797f34341bf20520d471903a68497d0e4ec9dd5f49c368c60ebf5bb1f10638bde72296887fadf372540e030f34a
SSDEEP 384:nciF9CcmyWCs38NnT8TUNTUlIx0STrk6oFu7F1zCfbHo7kJJg14fe4KV8p0d3tyr:HFccps3ATwgqSchu7zqogM14fI8p08
TLSH
T1A3C25A36ECA8CEA7ECE74F99A74A7603DEE02163859C99D4DAD81D4C009B1DD530BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ed09b5cb3381833a14ba2a9820b02a02da514eddfd0147e038d8ce970aa288aa
MD5 899afe0e709681851ac80dbac242e47f
SHA1 967613fd7c4711948364b887bd742dec87d868b6
SHA512 3836df0c4960e27a5ad1820c48225c412a0d1af2eebeae07bb1bb1b5259fe6d9132a2621f659d2d6913f6a3956ea9abf7ce520d5c3944164a10f4aec2d21efd9
SSDEEP 768:gFEcpzQ7wg4l8qogMHk2mdlmTb4tGWI8p0dL9:OzQa/HdeM4WI8p0dL9
TLSH
T173E2287ADC59CDBF98DE6B48668E35229DE01137C5B88998E7D80F0C907709DF70B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f9beec795b88f3a2b5943368bd49b01c34acb6be15d995b543a9a8cc5f6a5e59
MD5 a1386cc058594cebc88e08ddd3bfbf5e
SHA1 ccf610a42df29808cfd48275f784bfa07b8001f1
SHA512 c0aafba3d3aa46d70fc106b77493fca707e2db0fc7bd7a1fde322be88a067ccdda7d4fff8c887e0037476b1059d9427fb09fa58110e3fab3ee3c539595ef1667
SSDEEP 384:nJiF9CcmyWCR38NL78TUNTUlIRtrk65I21zCfbHo7kJJg4IXEgJ2uDty/7IgE:gFccpR3Q7wg4D8qogMH/2uh
TLSH
T111C23A32E8A8DDA7E8EA4B99F74A3653DEE01163D58C9ED4DAD80E0C009B1DD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e2a7b47c3626181af1d95479fd377241243e44184b1b5b75245de3ce3a6579c7
MD5 9c47549e428a8676ff5ebe9ee880b819
SHA1 b4e88b1e154d0ff63020e6cb09015b6dafea459d
SHA512 619045fccd4c38a7441c8bd4e160a87fa79dddecea73845979e41abf214eaa26bc1d96e7b2efa785c7edc649f7d22e03844e141f9b8d691ae33215b55ac841d9
SSDEEP 384:neiFlCcmyWCz8NL+8TUNTUlIRtrk6wa21zCfbHo7kJJg4IXEgiiWme4KV8p0dL2u:1FEcpzQ+wg4i8qogMHkiWmI8p0dL1
TLSH
T18AC24B72ECA9CEB7ECE74B98B64A3643DEE02163858C9ED4DAD85E4C009719D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2155cac7761fadefe77025fc838321eb4438e82f0ebac0cade490e09797d2c8f
MD5 6bfa5fc6a48f585669741df56904f7c1
SHA1 33db34455a4339598c49632fc4c4b81958242166
SHA512 67c41fb9c36cd39d12eb1ae8c84c9444469d4c823780f04a5ac9516040ea11675f8e5b20ec8198ac66204b80daa98ec1f5378fa18d11bfc52f03157c4b7aaf7a
SSDEEP 384:naiFlCcmyWCz8NL+8TUNTUlIRtrk6wa21zCfbHo7kJJgdg1EJzKnA4ZAA4KV8p0H:RFEcpzQ+wg4i8qogMdgStKnA4Z8p0dL1
TLSH
T1D1D25C3ADC68CEBBECEA5F48B74E75138DE01177C5A899D8DBD81E4C406709DA30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 beb0b6904cff937c9f3e62aae153c36020a6a2b9b0d5dcf16e683de2f06e2b30
MD5 f9985bf7c76b51b730a02c5fe984f078
SHA1 c13bab51b78ef26e41b1694eaf8873ebcdd19b63
SHA512 066db1d2154e9013018a481df73256ef76e87e626609fb0662f3a67662e004b952126e65b48c5a897ddad35e985d8969abab6163a5379aee616833775acbf023
SSDEEP 3:MsEllllkEthXllkl2zEj8Y/ll:/M/xT02zb4
TLSH
T150440444FFC10405C501103C4111C3513371F534055577C334F50413DCD5D411C41C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.18.1\manifest.json
Size 118B
SHA256 fc3bd7b4de79a08dc02345c0aa9ea81bcacb25209a79430a023a3e068dff2f8b
MD5 855627ba4644729db40f7f2ab94c100d
SHA1 03cec8bbdfb42a9ab7eab41be2168f336defb241
SHA512 159b6cd82e2e7c052c4ca546eabf03798ed8f747831d813e196ea522b42634a16cbb8fb8840e1e836bcf756933daaf327d227abd95e3031c1d2f2eb08da7a471
TLSH
T17EB092B00C0AA47B22C09320ECA166C283F80218E8062B1A089036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.18.1\typosquatting_list.pb
Size 370KB
SHA256 c97fa92a0ce8073fac52a1512c726ff968f4b7f981a415e790823811794c39ee
MD5 81c1e32d8c637225044017ea4d6ceeaf
SHA1 9d8668594487ffa5215c32a1713bd9a3d813cfcb
SHA512 fb7b74e3aced3b374e9adeadc216dbac1f25c1e2fb13d7ef32954a4b2cb6700e83ab887c7bb8ffa14df6b6bf4f62015d2ff0c85307515ec166cf172b396b706f
SSDEEP 3072:Ryt9cJgJ6TCPOqproph/0D5FOSgG15h1QDznucMM0ss:o2JgJtzobg7ADbu20ss
TLSH
T15084A4B9DFC00150DB78112D207E71D8181412A180E9DFEAFE7D969F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ce4690115945c4e03a3d94be0a20a99c3fe292d0a8f5b0da03eda050e452f85f
MD5 bd8c97ad9db51b969e7bdb847afc230e
SHA1 bb7e1f96a3e0f6cfaaf35365fb8960048ab74b95
SHA512 bc2e299663c68511d8536be4cb4cc3d24025bf996798eb6e640781530fc31a9911cb6fdbcc5efee88c153861f0ce4e8278c96ef46463d978b3a6268c07167459
TLSH
T12F5150D04C7C1AC0D4BD0A7E609B38FC85E8C725F4A4357D2854EA890A79A2C64C983F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5882f5198b49ad69d4effb77e34e295d884285d5d294fde4352c4195cb5d3575
MD5 34628405df51042a5bd0d40be5a1089d
SHA1 d32c7456044e18aad1808145d2c9cf58334f7852
SHA512 d97375d2ce120dc88c220eefa3ecdcdf60553838cc3379421d33c185ac2f3e512cdcd19daf5aa579ee7acd392deb6b40e2615b4e856f0a3816acc300eecf05bc
TLSH
T1165160E14C7D2AC0D4BD0A6E608B38FC85E8C625F4A034792864EA990979A2C24C883F
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 8514abbce92d9aa81d081c984e377ab7e92943159d58d64ccf99709190803e46
MD5 385ac696e067405599aa298dcc3f6b0d
SHA1 2dbba9599d12799d23ff7db6a4bcbe7a463c320c
SHA512 fde4cf8c8e674e9bb36e71954e6b4a4569815792bdbef17f8c61613524d4cdff27f570d35a4a029b502f34677ac4aec2f08819609fe86cb829da451f99ecb4cf
SSDEEP 1536:YflJnrh4iUx6YklMV9fKQ0RW/vCqMQ7aVhtNG+jH0lMh8kYoeDV3CNBQkj2LOdBg:YflJnrqiU6YklMV9fKQ0RW/vCqMQ7aVm
TLSH
T182538392E9204E75E2E65F3EF15622627C30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC251.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC251.tmp
Size 1KB
SHA256 0668028f0efe2e9fb7b1a9f4957ed0554ba276b88dcc07da48de442282dabc1a
MD5 bd3bb51296d821f2f4936e76f3d5b604
SHA1 259d43ac52c07e8b883df00d9633569d59849dc9
SHA512 bc8dd9a0cc33b5400928b458887ce3a0dc2e72a15de5a99982dbd8cda166272d1afd18a075482ea579857a606e8edc44e54a211520621a7c4ec6aefd5ec3d6c9
TLSH
T1AB21AF0587E84B1FF0B79731ADF6032F9124FD95EF61A35B898042281C51204EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESED88.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESED88.tmp
Size 1KB
SHA256 372449d376528e04b020ce8fad63936de0ab9c17dcd0729a7c14e55fc1baff9d
MD5 2baee384d285b656d06094261f2a88c3
SHA1 c37188e3dab806e4aadba12a10e057cefd345240
SHA512 ec907d6b16ce55c8571f244fd90d22cf7d93a52355efe3554851f44bd275ec5aec6bddd7358d92faa2072720268f9f3063fd3f02ff11b210e5356d7769072e1d
TLSH
T1AF21924553E8472FF0775B326DF6176B6264FD65EF62535B4480422D2C51204EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jhkxir5t.0vs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhkxir5t.0vs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d2jpfybg.dll

Path C:\Users\Admin\AppData\Local\Temp\d2jpfybg\d2jpfybg.dll
Size 3KB
SHA256 88e0bdbf9971e3d7092efde97902c05686612dd6af4ecd44c30ef9b0000665f4
MD5 67aa9fe9bb20853a74c5d7c4cdf32674
SHA1 d6c513b786b89be7a094c354ad7f18f6cfa4f86c
SHA512 6899374679155774620114c726514c72e13323846b1ac2a17e5220cb8c2d3ca33b2dce04289b5aa9d618f431eb25655bfdb1c1a9ada2799f50a9ef418309bf8f
TLSH
T1F371F00AA7E4463BE4BB07317EE743627770F820AE33572A18D00219ACA07645E35FB1
MD5 SHA1 SHA512 TLSH

Submit Download

iuenh0n2.dll

Path C:\Users\Admin\AppData\Local\Temp\iuenh0n2\iuenh0n2.dll
Size 3KB
SHA256 c3eb85cff65e83df7211dfe414fd4913940d12672de08c6fbaaf67d19775dae6
MD5 5c47a0c8a80293cfd2cc4bd99586a0d8
SHA1 15340a0704388895d06b64c5447db7cc0e3173ad
SHA512 a96ccd3a605a406b8ab8512c7ebd866f3bf3337086fcb47c79f883fe1c4d2319f9c137e4863e57585e240d11a152f6e055e50af9808c9509fde975542b39b878
TLSH
T17771041AA7D44667E4BB07346EF743667770FC54AF23972E08D00219ACA07645E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3456_1588667116\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3CA4D6D694BE4E1484C1F826E77AF925.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\d2jpfybg\CSC3CA4D6D694BE4E1484C1F826E77AF925.TMP
Size 652B
SHA256 49b7010ab43f1fc882bc4742d488735925b15ad969ee50c5e7eea1cb5f747722
MD5 57da28a939ba6d524c3f55911a2e734e
SHA1 31b4b183696056659fbc7e5f7083b85765ee3948
SHA512 19af0d94a773ac71b5f1a66bfe6d0387e748f7a473a6e5e92f2905a0da3dcb1e069a9ecdd19d3ae097b9f404302d3af99fcf8d9be5ba90b4ea0cead0bff7fa33
TLSH
T13EF05E0963F8420EF0F34B71BEF643B391A8BC64DE3293ED148003192C646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

d2jpfybg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\d2jpfybg\d2jpfybg.cmdline
Size 369B
SHA256 f587c7dae2a85ed25ba752f3f00a0c252fd1831523c46d7613425e0477a4752e
MD5 a5e21c97d9dc79b707ae96bbaec64d7a
SHA1 4a824985a0f6ef557621ad0986328357b5211bd3
SHA512 5ab6a48da523bedd95dbab6e125d240a652717ae42fe8aa04b458377658f4ed7d635098a3a19e5fb6f4d6b7fb73522766ed1e3fa6aa27d540c338d29b6dd7c53
TLSH
T1E8E0682A42DAC67D81D930072169C5AC83B2376329403F84A040C49DD0370002FD3B49
MD5 SHA1 SHA512 TLSH

Submit Download

CSC672B5F62FF5F45F7A5C9EC157F26CAFE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iuenh0n2\CSC672B5F62FF5F45F7A5C9EC157F26CAFE.TMP
Size 652B
SHA256 3853095c6dac8d056a619030d4c753cc3b39bdc25ef9918221450e81cbc44b77
MD5 4aef7dcb77d360f3f4b25a6bd22eacbe
SHA1 d0f53995e6bc196f2375d1d3b23f55759c412501
SHA512 eac33ddc3245973626c1dc89c432f46a96aaf4dc285a84920afbdeab45c7a3d01406da33d319100ef2cdaa73b83c1d22aa8db58efcd66f430aedf7700f0842c1
TLSH
T1B3F05E0963F8420EF4F74B30BDF6436391A9BCA5DE32A3ED1880031928646109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iuenh0n2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iuenh0n2\iuenh0n2.0.cs
Size 418B
SHA256 cbc4940031baf6e739b3838b4df0fe531d59bea50d713d2bafc9c0e720b16cd4
MD5 378bae59e416d1ef128b553a82dec088
SHA1 aac56f28dafd3444c326fc34f4510f2390a72893
SHA512 1a5b0f05ea0fd2dcba9242d265927eef1ce70c3d1f0654e7f7734924f8e20bcb82a57d0d573a0e3a54caf1e9d07d5fc24c07f8ff89d4009267252f892a0f9d1c
TLSH
T1DDE02B207343D9B9546601162EC3A0A17933E20A39DBBE4875ED6220CF57189B73267F
MD5 SHA1 SHA512 TLSH

Submit Download

iuenh0n2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iuenh0n2\iuenh0n2.cmdline
Size 369B
SHA256 427e34f247e535adaa34499d1a151d5e5b0df1ebc42d7ea171a464e09ae5beae
MD5 392cde1dbdbc9bdff0f1250e60266cae
SHA1 230075cd16e5c6f8c46347cf2eebb7e2ce441440
SHA512 e5d57d2a7db2f3c8cb30e5555f7b79456dd316ba67bfc20925dea5b47b5f509bc9373795dcfaaa633f19f9f25e1741cbd3f3d62e5684056d64a0e6ac4a0624ba
TLSH
T16FE0C02F8A6EC2FE11DE100B2969C4ECC672074369403F847550C40DD03B82027F1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4768-33-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-9-0x000000001C890000-0x000000001C992000-memory.dmp

Download

memory/4768-25-0x000000001C0C0000-0x000000001C0C8000-memory.dmp

Download

memory/4768-26-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-75-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-40-0x000000001FB80000-0x000000001FB9C000-memory.dmp

Download

memory/4768-41-0x000000001FBA0000-0x000000001FC53000-memory.dmp

Download

memory/4768-42-0x000000001FC60000-0x000000001FC6A000-memory.dmp

Download

memory/4768-12-0x00000000028C0000-0x00000000028CA000-memory.dmp

Download

memory/4768-11-0x00000000028B0000-0x00000000028BA000-memory.dmp

Download

memory/4768-10-0x00000000028D0000-0x00000000028F2000-memory.dmp

Download

memory/4768-0-0x0000000000180000-0x0000000000764000-memory.dmp

Download

memory/4768-8-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-1-0x000000001C0F0000-0x000000001C172000-memory.dmp

Download

memory/4768-43-0x000000001FCC0000-0x000000001FD0A000-memory.dmp

Download

memory/4768-44-0x000000001FC90000-0x000000001FCAC000-memory.dmp

Download

memory/4768-45-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-46-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Download

memory/4768-47-0x000000001FE30000-0x000000001FE4E000-memory.dmp

Download

memory/4768-48-0x0000000020570000-0x0000000020732000-memory.dmp

Download

memory/4768-49-0x0000000020C70000-0x0000000021198000-memory.dmp

Download

memory/6076-74-0x000000001D4E0000-0x000000001D4E8000-memory.dmp

Download

memory/6076-133-0x000000001E380000-0x000000001E388000-memory.dmp

Download