bb48b85f17e70c6d3d988f8614bfba1899e56c7dbead447e58fb8429c7b8e39f

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
01/06/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Music Presence.exe
Size 12.2MB
Sample260601-cf6lsady5k
SHA256 bb48b85f17e70c6d3d988f8614bfba1899e56c7dbead447e58fb8429c7b8e39f
MD5 9bafa6d01e970930f82fd23033d5919b
SHA1 9de67ac3a64bad2f02501ee3eb25249bfd6facdf
SHA512 eaffb0cb65123d01fed2d3f4296a5a73f78a4eedfde1cb61eedc42250e9545a8fa02b14022de83410e456a94a6161d27c4baa12b775b8b5353698d8d64ce0bf5
SSDEEP 196608:35uCqF9thONy1KpCgOnNB6f2uo+rO3Vr3r8I9F8q+KA3seQOHt:pul/o41KYgONBIIdA3seQOHt
TLSH
T112D6D0E773A401E4F49781B5CE2B42D2F732B4EE6B60E64B2198D510AF139A15F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	Music Presence.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app.musicpresence.desktop = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Music Presence.exe\" "	Music Presence.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5000	msedge.exe
5244	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247531377762764"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{0696FCF8-3AE0-4B91-B553-2C580AA6078D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{1FBC0DB2-0BAB-4AEE-9AA7-189CC7FC9D7C}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4824	Music Presence.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4824	Music Presence.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	taskmgr.exe
Token: SeSystemProfilePrivilege	3184	taskmgr.exe
Token: SeCreateGlobalPrivilege	3184	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3332	msedge.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3332	msedge.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

pid	Process
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
4824	Music Presence.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe
3184	taskmgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3332	4824	Music Presence.exe	96
PID 3332 wrote to memory of 2676	3332	msedge.exe	97
PID 3332 wrote to memory of 5244	3332	msedge.exe	99
PID 3332 wrote to memory of 696	3332	msedge.exe	100
PID 3332 wrote to memory of 696	3332	msedge.exe	100
PID 3332 wrote to memory of 696	3332	msedge.exe	100
PID 3332 wrote to memory of 4464	3332	msedge.exe	101
PID 3332 wrote to memory of 4464	3332	msedge.exe	101
PID 3332 wrote to memory of 4600	3332	msedge.exe	102
PID 3332 wrote to memory of 4600	3332	msedge.exe	102
PID 3332 wrote to memory of 4996	3332	msedge.exe	103
PID 3332 wrote to memory of 4600	3332	msedge.exe	102
PID 3332 wrote to memory of 4996	3332	msedge.exe	103
PID 3332 wrote to memory of 4996	3332	msedge.exe	103
PID 3332 wrote to memory of 4644	3332	msedge.exe	106
PID 3332 wrote to memory of 4520	3332	msedge.exe	107
PID 3332 wrote to memory of 4644	3332	msedge.exe	106
PID 3332 wrote to memory of 4520	3332	msedge.exe	107
PID 3332 wrote to memory of 4092	3332	msedge.exe	109
PID 3332 wrote to memory of 4748	3332	msedge.exe	112
PID 1708 wrote to memory of 4532	1708	msedge.exe	113
PID 1708 wrote to memory of 5000	1708	msedge.exe	114
PID 1708 wrote to memory of 3384	1708	msedge.exe	115
PID 1708 wrote to memory of 3384	1708	msedge.exe	115
PID 1708 wrote to memory of 3384	1708	msedge.exe	115
PID 1708 wrote to memory of 3256	1708	msedge.exe	117
PID 1708 wrote to memory of 3256	1708	msedge.exe	117
PID 1708 wrote to memory of 1544	1708	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\Music Presence.exe
"C:\Users\Admin\AppData\Local\Temp\Music Presence.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://musicpresence.app/
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffcf9eec188,0x7ffcf9eec194,0x7ffcf9eec1a0
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2871490257549514396,10622989566688708880,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,8549007756986772120,4049729400423377409,262144 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,6276589532269000190,14988532341964177944,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11139761662799122102,10924745298046105486,2097152 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,10877995939253573775,9870752357079299916,2097152 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,592734474548518237,7616029735506703668,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,10475229595081877262,14061323628745268241,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1166733250410892622,2546133825111409978,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1166733250410892622,2546133825111409978,524288 --field-trial-handle=2432,i,1266272728035020709,16328958827795057369,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    PID:4748

C:\Users\Admin\AppData\Local\Temp\Music Presence.exe
"C:\Users\Admin\AppData\Local\Temp\Music Presence.exe"
1⤵
PID:5496

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcf9eec188,0x7ffcf9eec194,0x7ffcf9eec1a0
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,11667475246728854671,8089149209959114042,524288 --field-trial-handle=2324,i,5575831553942120394,16477455478735736452,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,13450228224214452636,7486353753380587337,262144 --field-trial-handle=2324,i,5575831553942120394,16477455478735736452,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,9764772176407414753,5232713232806712488,524288 --field-trial-handle=2324,i,5575831553942120394,16477455478735736452,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,12663789589757619809,11637852706607552127,524288 --field-trial-handle=2324,i,5575831553942120394,16477455478735736452,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,12663789589757619809,11637852706607552127,524288 --field-trial-handle=2324,i,5575831553942120394,16477455478735736452,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 74c635bc1fa4c243d3452c0992283857605c777eee55be61d2826816e06e59f9
MD5 815fb31a217f3d89ea1c96e085afa714
SHA1 47c2297ca5e9da866ff5090002f03203904f092e
SHA512 b2d36c48b1fc04d4c62a4412328af1efa92558e45aedb5857bc3555406301a56ff4ba1a72ab159a56ede99187eef54272ce28257fcf2a87260d32ae065186020
TLSH
T112D08077670BF411E35D5131D503C75117AE507179625723F118C40DA9741E693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7334af9e4714693054c18b150d26b0f88babb0c1253e3079ec01d7288f808300
MD5 923aa02b9891f1907d56ddf722bc098a
SHA1 99c94cf8c394dba0609c684e90cca72167e62ba9
SHA512 d950c6e683911b55008aea5985117e538828207964b9b3e9cad8db7d2b6a3bf139d71f62949cd08309fb9e58b772d9845c77308679084db72b239a45b0cec0a8
TLSH
T1F0D0A7A4566399E1D13C303F095542021BDC44625612223A6A1858059CB059784858C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23628b3412acb2a4756c2ace2bb53bda307fa1e51917e125c21c692fb744233
MD5 2fa96b93e6025383d1b5378060232577
SHA1 710cb429384756aad947c7c3229f00c975b4c4b8
SHA512 24cf824dce4cbcdc17e59a28a7125f9f547680d53506a5c4a00caa608853b38b7bb00fff347264894bd7ca1928ac83899fb6b1861d7bcc00edb53b6cd6affab3
TLSH
T1BAD023FC12139861C16C743B0D09C3472FDD4861A57135765A5D74055DF199BC4944C5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 df959780d0857e53302488d0ecbac769eadd1a25a13efebe672d9ea3bdb1c468
MD5 089e1a791354fc7ae5636561b17c357c
SHA1 2cc33080c6fd1a5e708adbccfecb6c56cd86e555
SHA512 9be0700bf2821b236f946e8a752357710f8efddc490a1d2d5e3b4fc8a74b7c3b383942ba5acc42906cc6977406b50df9bfbc16748fd739ee5f0643653b93ae3c
TLSH
T1B0D023FD12139861C16C743B0D19C3572FDD48A1A57135765A5D74054DF198BC4944C5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 f860b3f1c3d2572d82306ba4a379cf9a9985461c5bd883c11e110daa9ebef47e
MD5 c40c1838e712ed63dbbd81514ddae461
SHA1 836a455dc49fd53f642e98adec05fe613dee8229
SHA512 c1f45434ee6849d23240ebce0b52112cff94adad6b54e90d81f57f84bb51f3675c91e890c57b8f5a38014c9f37930671445639af03e327945bf621c4c76c1144
TLSH
T184F0F9AACD21EC3714FC1B2C3059474BE750135B2B41955F3B3D520C8FB163B465681C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b77d164608e068fa64e845096fce37c81c100147a8fb23dd20bdea4d91aabce2
MD5 4a1bb4a3b495a641557fe876cb96f19f
SHA1 11f25565f87da680e1db966624c6f6d639aa63bd
SHA512 901af5eb77ff0efd04bf54891dd6595e13e562cbb17623d4c16aaf74b54b3a29e2b741e69f171dece90258d4e081a409fd4a8833b6a98dce410744c8cdfcbf01
SSDEEP 384:N4idPUFUgUiUoHJDbfgrCzhYlzhoarjKWfDn5imij/:NxdPUFUgUiU6Zbor9fKmD5iF
TLSH
T1D8130ABD76441CE4E2D722BCB50F5B76A33AD735E2CA421B733030A277617A24E0E646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c8cce979cc8833b49fb93c3f2dc6e91301de03f56cbcfed0bca9ce6fc0cf747f
MD5 f6fa88fab7fb74bad31e0f6bca25e1f3
SHA1 2ad32b3d90b993022bcfb7f47b18ba028f431c08
SHA512 094190920e071925f14af72965278fccbe45443f43db03b17b10a9c853d176feeb6f8f0325c1d1179f1bc623fc05796b8987643ec20f5990ee643aa058dfa845
SSDEEP 1536:r4fQL/fslL/T8mN5uOA+YhldPeBUajZGayCaL/nmL/CNpUUyLTURDj:QQL/uL/jNFA+YhtoctL/nmL/CULTq3
TLSH
T152444FF70941601BCBA842F9E6073A3ED17B055E7CD1EDA9E6784C812C25B32B6BDE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 0ca76416d7947a384275ae3e981114228ece0a5e1cbe263dd834a83799f66a1f
MD5 136d9fb05411615843d95b0d353702c5
SHA1 28a0ed148caf764c7e91b2c809ce61759731e4ef
SHA512 4f0b685fddc050b8e575a0e423826bb82f1145803a96be2179acf65883dce44fb1bfaaea114b5f3edd700d7a94efd2c7eb794e1df091c1adb05d1a9f9d8bb2e0
SSDEEP 3072:FDfTkmBH7SuFqHljmkvVr2k0cUASifPjrPbm6fl4+C1PmgXED6V9aKhh+K8YgdLz:tfYmN3K3UABfPKDhd89
TLSH
T152253BEECF682C42DF678A7474E0D9077E312282B58DD0D39981C5A867C2BC176E91BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 3f8102e65896faff6e93c13ca0d8c9fe47a5e636cfc90c743c626c443f693da0
MD5 e6dd592f02a76b86da0ccad01221045e
SHA1 f0353f841f5da3c13a3edf9eee382acaff01bfa4
SHA512 f291d4a8231efc91cfa4298fc0c40fab1259d5c6094e7d6dfd832884bd791d81823d13ad596a8e383d38cedb0480a0eeb9d590f727fe65890ab794b17c15e5bd
SSDEEP 24576:col4YQ5C8m7vwNRd7qrIk8y9x68hxFWCPikJ/qtPUNLWk+m97/M9em:QYeFm7vLIk8q6OWCak12PiLsQ7/M9em
TLSH
T1FA167DEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 31a6fbddf8851a4355adfd7995530c066518cc1ab50ff3ed71a5e0a46ea22561
MD5 0ad35a8d861573f0c9e57f82380fc6bf
SHA1 f34ed180dffceefa579aae8805ee010c5b939ac1
SHA512 65364aeec882a8ccd9f898c0ce04664a89773fa1e0a41a43be261ccc503e87c1b88c01ebebe33fb24200876c618b125c5318796af9032b8f33a2ac4f1f709e81
TLSH
T19571C205368289E5EB804073A4F38285303583FD844F6D4F07677B39252EF18E53DD98
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 5853f2c0e7d4b2547902e4d3de0ce41bf34dd3519e3f802cfb2925481aa4648c
MD5 8ae0a097cb07ac6b52115d2c0385ddbb
SHA1 8866620bed14e053d00b1d5a86cdba4b53a67c24
SHA512 9660ee6a6c7b7b5d85c8c39da020eb6c59515d590318af8a85f4168dafab15ebe1101d17ded54396d5e64dbaf2cf6f85bcccda0a47e92a6e7e396636fdc9e2d2
TLSH
T128E0D8D868D6C1AEB7207CC391745789C3C9355BDB866D0B270088C87643101B249956
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 821b98d827f866ddd548a4d8357b722ce8ad0e4df65f47f1f47696c793a04d3d
MD5 cfcbbb01e4a0a20eb99ffee71fd9b347
SHA1 9e03620bd53aa9e46dde688ec26c3e70e5165a83
SHA512 d19def53f60a6f33dec43395d1d16fbade2b3b333910f51cd9531cbc7bac1fb04c72292f14a9a65b682aae359c1d58cae5ff38dbdbc499887e2d526f7da7e8dc
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jlMA4RDTAH0cA4RDyXK5fKFtI+sUu:Tyi+7f+UZD4jJ/BGAUYHLAUGCKFOOTpQ
TLSH
T104E2F18D3F11F511C8EC733EA0C2C5E0AEBDA92C874D7471963C98768C92A61F09F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal
Size 24KB
SHA256 c9bd40c54d3267c168ee3b9fd9837b0ce57bb3a03006e69d6f107fe6f1f50758
MD5 0edd8b7800e14b3a54b3727d0740b145
SHA1 54b46f75d3c34ef5e14cf932d811895bc798c3b8
SHA512 1728dc44480046f4e16ca805d9dd4bbdf60c2abff0cc472ef5c74026f1776302c10a672cc2e258f1f002038dbe185dff743962d46aa28d252f016671d0b7feb3
SSDEEP 48:vTpfI3TFOfhAU9AUYHjqyi+7f+UZD4jJ/BKV:vTpQpO+UiUYDtLnD4jJ/O
TLSH
T118B2E18C3B11F501C8ED777EE0C2C5E0ADAD996C8A4E707195389976CC53A62F4AF50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 7e4b2402d1080096f1caf7e10b62afa782077fc5c96fb1fecd153d2ebda436f7
MD5 df4f7bde8e403de9644b4b53ac69f8ed
SHA1 52face3bb33a6cd3b8c63bbf497eace5dd22ba58
SHA512 16dd7013d6ee73bb2a74cae9e5a08587eaa3b980c1a4e8ca02ab1fbed5e1b21203e554dc6183efb3fb2ae0b311a0ded6b49defb27db3a6f80a103a63cf85a879
TLSH
T110E020040ED8C19D6315E4D3C2BE478882D13B1FA38C3A452748EC8461031456E7D550
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 024024afb4a423857ada71797e4356fa6447aaa7911b3b7fbe39ed72d637bd21
MD5 d5e5113c8ed2650be183f370bef02730
SHA1 9c7341a5a6c3bda9fe932190607865c2b81a16a0
SHA512 e628eb294b4828fcd6791efa94e1f657eadd2a1a28ad272724373aee45c1bf1037af7a31ba326d1c06f39954a00525588943a45465bc2fd79ce9476685206b31
SSDEEP 48:LzBmw6QU1PzLOyO5hZnzF/n7XhK4hyE7avcTklZSKucPLzzyF/aKbQ/9wKwUPOy2:3BCxLN4nVJhYUT8HLzzyFiK+9wKVPOy
TLSH
T11BB23B2B5A347C27DB465E7F311F367A887BA06C2FA65D44349454740CF9242E43E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 58e3e22350df5e095b145a545befddc91fe551ee9cab2368b72126e76a259df4
MD5 fe6ed9855fb7ae6c72e163f542666eff
SHA1 791244695051ccc46ca0e724aa3968be0737b7b5
SHA512 d554fa928d0acea30f31d1992a3693d900b0893c48abe4596219ba7cfff82c9ed3f9bb45cfa9ab92a84ddfb36f508c9b60415f5cd36f892b0908fceb048bd912
SSDEEP 96:nYxIU+bGz83uy3+u4tgp4DLjGQLBze9z3n5jBHMsDEuspU0wbtqrOQpPfR4J+MCT:nMf+G83uy3Ct7XBBKLTH7DXspU3iV
TLSH
T13E14111E4F243721CDBD917669E744B35D7CF03F8B1266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 289B
SHA256 f1aca5ae1f4cb87d6a95bc4085cadd6b9bcb6503e8068b8cb5ee9ef1075ef64c
MD5 79b9c88b1fd1a02723c24f170c6d4e95
SHA1 95d75b7a92f765bdaa81e5ed3b662e06e65490eb
SHA512 ebdf904e8abe1f4fa6f7b82a67a9d4c39d0b69f0ed4763d4a65908a554272e9ea5b5476e8a82ccf53ac087b6923bd0886b4ce6e15ee12bf4e3367227615b007b
TLSH
T13DD09EBB8796315BF7438C799A453B95BB17A02D0AC89F85C183E4054E496F0219BB27
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 c86eedceb7a5d4bd87177f97e17c0b0e529d992a24ec80595e32943821a20273
MD5 7111b36848ddc65cbee2d015869345ec
SHA1 508c4acca35d4d408581f0b30de060e4c1ab0e57
SHA512 63af72a2c9da030ed501b0927e1dd07ce37d36e4a14f7bc76e1551c0605aba99c3a71e6a3b6442108d2c52627e754f95b92e9a52a236e2a8c207c2638ae9655c
TLSH
T1EDE0206159FDC19D730560F7D279670CC3F2771FF7893E856B049845B442354A3896D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 b1fec064072de5b33cb23a91202bc703da4c9084f4f3c1c9b00b032370e8c9e6
MD5 752e2851953f8898875ce45b7f1ea80b
SHA1 6722f9670fb09ee4bb6fc53edbfa32c61f891194
SHA512 2befb3765713b4fb65430f0ad5aa3cc6609fb18bb3b444105332fa721c649f905ee8d06ebc9c842be361916c31b9705507a43c4a496d86c926dceccccadbd7f3
SSDEEP 48:T2SLopFMatSaw/auUOt8BI8oDMm9PgMV0MmH:iSeMatUaAKIBxVG
TLSH
T12192154E1F346121D0F04B36EDE144662F7C611CD3A72A9EDD5460F3CE9255BF5061BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c54623152a6bd41924c5a6b629836ae9ab131db3eb219fed2bf531fafff10677
MD5 d91fca2ea8c63e7d1d156c598b4e89ba
SHA1 5414be3cba132a14923e343d3531c77ae590fe4a
SHA512 86f0dbde6a668ad192ae082a2aae27e737347c2abab7e96ed86378f42a6cbfc651655ddb26b6ed46ce87f80ee224165fa1822e67763a81e7d85e0eccf36adb73
TLSH
T164519CF783B4856E9B0195F0EA18BE2B9F1C0511436C7D6AC9E4AF1BA3F3460E14264B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 dcd1b90b49ba74c654079d4fffa7ec57f866b784046fa079d295147d10cec9bc
MD5 c92ff657bd769f201a9afa16647909ca
SHA1 cdcd3ddd53e08c5312edd01b7665b4a1ab35634e
SHA512 33d352f19f91bfb0f6ede6d4e5e46f4d39b48077c8ca2eafb4c6e61bd5471bb4b7662f564617ac5b6610a0e447a819e4c9da1e9c839c23eedf428f55843e452a
SSDEEP 96:eIEumQv8m1ccnvS66v3ADaU6fni0nFH15424g:eIEumQv8m1ccnvS66vhjj
TLSH
T184F2F0FA07276605D98444F0E4006B8EAF16010B47F6B6ED7AD457E3F3A21E2F2B9746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 524B
SHA256 15d5155a7fa4a3feeb8dbc21bee15cf4399c7069cf1d841b42e7319c4fed3af8
MD5 10efcc950804a26490b9c2e9093d690b
SHA1 57abe7761408ec45413a7778559bfcfc3176380f
SHA512 cb5ffc8bc294ef14b9bfa582657174b531b5dd711508ef80f32141b6f613972f471eb7a307d3760560efca62ba8b5cae13ec6b585e2551f95106d5ca88560a2b
TLSH
T10AF0245795FBB86B10A90A771808BC09B8AA50350145E8E5CAA3E12CA0C69F70E15432
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cd1fd44a8dab5a0c35f857cba6273a8c21707b07f138646ec464579d36521ed2
MD5 3aeef5633eb140718c9b68fe58fd1273
SHA1 5e4bc594f5b502c896df0672574d7f4b1d5fd02c
SHA512 81458a4f73d42e7f3b4b7bd0db80130c25f9b3d3fb3e2ba39bc749755af4ea6e0131d4ec999ca8684ee15517ed7bba363438f8e471dfd9a2d8be02232d8ff12f
SSDEEP 192:sxZrRIywFXNKOMl8DjD/fDs3WpVp+Zuo43EgtzodpaIHW6+WNkunBP/YXSMRWOIF:sxZrxuD/fDs3Wvp+I1qDHbkw/NIdZ0
TLSH
T1D572C916A9289D7B8DD6D219FA457F53D7F94423D2905E489AFC8B0C04E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d67dc177aed77e4d50d5173bf04e21a020fefc858775722caa6294700bbf0e0b
MD5 a1e897d716c3129b1bd0a2d5cccff1d8
SHA1 d112df2ea62a24da9b868556dbc1a8fe680dffd7
SHA512 f9d35d01ee6ec8b64b5c4b003a979ca028ea263023b390f744d76dc873ff5b7a14cf260f4be2b2cb4f851eedbfe53c9649d28c67edb3fe08e13894276bd4b409
SSDEEP 768:/Zk4Pfe7pLILZXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjeHiLl42vJ4rod:/Zk4Pfe2ZXDWvXt4hu1jaqeHiL+QJDWu
TLSH
T138F2FA3B680CCB7E4F804E9CEC2ABF9A6EE8018F5698C95447F9444C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d2436a6db301c7c6c9c3d4a78630d3e54a3c058e8ab33567e11d733dda43fc52
MD5 b7c3b66e07e5d4ef10491d5ebe176fd1
SHA1 b53df667abcf7a27cdf541cc3430a472419ea28d
SHA512 8342f7f7c06a1f3d9c6a8a1dcc8a61e93d2b078eae6d67de10d9b95adaa695b0cf3a0aa7ffa506b1709cbfc78ad268f3a49d0a11948340581cb3ddc578deabb8
TLSH
T15DE0261449F8D1FD733660C342B8970882E9B92BD3C83D463F00C84466E7A04F996B90
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 d13c809a81d61a71acc05d7dd23a516b65f0049f81363271a825456f879f35af
MD5 3b12de5c460bca6d9dc7bcbe50a419a5
SHA1 da692001cd041ae18850b569206c630514e987e3
SHA512 e6003a7b5155d21c9cb15d592cbb80c96bca18329e42e4b69103c8d7ebd2b42b6bc7681f1c7a0660d9d977473bbf7bd0b56152b2872477591226c27864b512a9
TLSH
T18DB012D47F10864AC0880D3D93504B40A312E0152C088F8389BCBF165D0EABC3E45C90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ea1111296221155dffbaeb2e1508c6ef1d3d410a8fb98dd8588daac6df788d38
MD5 d88df86173d8a4e28edf6178e8815daf
SHA1 09f84061c6d974f9fae3dc9d33f15800ee3a414a
SHA512 6735a1667fed353c48475dc41fe5ceda9267fe5310414b1ab5baf30ded9f0b05a864e8586653ccc9de9b65e8745beca8b0c61a00f61587487758ab91545ff0cb
TLSH
T1E1E0D82819E9C26E734660C7D278D348D1E3BD57D7C929553B08944462AB244B68BF50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 4bab75fa427b22880f60d02a539e6ca63fd932950f0fdde84008453301feccf2
MD5 a89494440fec876740292ab5b96d31c9
SHA1 678da06f367cc1faed373c285ee49f5f15939eb8
SHA512 f6c1a57286dde4ee8cc78d24f848e0cbc1bff21bbe35c03f6b5791dafd873bfcf9d4b14306f2f7bc0aebe404c47efa31d0df791db947e85871e967ef7a4c631e
TLSH
T15FE026744DE8C27D6340B1C382B89B1D92F1BD1B93C93A8A67086444A99220CF3BAB90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 56d670235096e384404771e3ce72c6014e4c76b7718844d278b17d5ab87257ee
MD5 539820cc05003433a3102689d15b512d
SHA1 2e02d60c4e350caa5aee127cdd50b30d4e5750ba
SHA512 0f083ea3dbe162bd8859c48ac6475475a499110669079dc37352cf74fc0a7499f9e187f5506e05df54150b6b403e31f7716cdc234bae44b6f48c07acc49516f2
SSDEEP 96:K4ReKKkqiU4KBGCaoKfaeCEoKh+u8zCuMeavnCZmB2vKZ+BIvlE8RyKk+Jg15Tns:EtjGz7Y1/St59NZp1ZVzDY17mrtL753
TLSH
T1EAC25D13703A43123C7E294CA2A686779E4231B33059EA6F7BB804764E67E125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 7ee9a5db4361a36cc9d48e455adffbe6ca50dc25b1d217b22e82602bbf9412d8
MD5 10ff2f65cedea986379e1d4f6eb2446f
SHA1 da76ac9b6cd0e3d7c0c9bee1938e5391df476915
SHA512 be68dde4897274c1751803f6f4b89537d41a72b34c4d8b20c10efd331eba6bd650372ac7c85507219a6b63059f082bf0afb6dd5dbc50e4b79a68bafa63fef577
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDY17mrtL75BnWa:EJGnYNSv9PpHV/Y5mxLtBWa
TLSH
T158D27E13713A03123C7E294CA2A5967B9E4231733059EA6F7BA804B64E67E121DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 3ccd271f5fba72f173eb5e65ddbd3d1c1ec9efc4d6e0ebb7b30d53873ad4c595
MD5 8a3fad275498f863f1254d45840f0e4e
SHA1 cd541e92e8a2a86ce0b94905c87b51920a8a79fa
SHA512 bf799c40d7099fcbdfaf9a8a88a38a741332b2baca7cc7bb81a7d289c530828bd1ba1e9d95b282d6ab35122452927ad9495990436cb55dea22267fd2eaab767f
SSDEEP 192:P+xgjVfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxoVfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T14F24730A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 8e3653352223eb65bbc48d4af23c46adcccb4d798544840d5ae76a2674733830
MD5 31721ca4498ea81e7a4d39177455b333
SHA1 4c1de42944491d89566f47698255c80c28c025c8
SHA512 bffeaa9187c89ca5240a1a8f4db9d7ed5c2259cbab12e4617ddfcc0f478dcef2656321cc744ed56cdc35b452e25dbe46e0d27ad454cb8be72764be07551b2816
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgXUdrjGt:DEK3tjkSI5IUltGhp22iSBgWW
TLSH
T12652ABAFEE743217DEE987719AC005D1BE3A503D4FC1DB0258D520115FB4A51A32FA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 8b39897414f87df13c25ccb91df47983063fe1791a57dd7df4c70c002c8c5340
MD5 65cec09da4e7b532c39de289103078c6
SHA1 b577878af839d936f6750be4ea5bd9b5868458a1
SHA512 1ddfbffc22b1dd83d258a821551d1405bc264cf3e1038872fbeb92f0b5964b07a7fb4af7362a1b7d517216e536a05b40f7e7aeb354ae58065aea42d649114171
TLSH
T1405154C1D3A56585BF8AB981C21E6513ACA13F6B260E58F5336D54F48F44C290F2FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 be609414e16665faa15517b23b66cf4e01a69c16e12e48a016ca6fbc8bbf65a1
MD5 43587c27b719cbd172a89b38bb1b6f1a
SHA1 516e5c34db1f5963e4b37d8f707d1245061ce90f
SHA512 546a4ed761757d306ad7c10edb7111c23ec980f6025e784ed356cdcce169ff927e2208deb67db0e4ce36d2cad9ce2b82b20ea5a525e76088a342d322430b482a
SSDEEP 96:m89+/VgxZyzQgOXzZeDWXWY1lDoseCZAWVxlr+xsWWVG0fqHwl5N7:sBOz/Asxlr+xrsG0fqQl7
TLSH
T1E522EB687F432F3BC90D5EB712698B5103C2E092427F676F7671095D0DE26AB86C82F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 9bb3503879bae359828075ef6b0a259fd0f1881c4c9662004465440e3c7ca024
MD5 ca206e688ad84df48d63dd51eaaca96b
SHA1 8b61d512345df5f7c9391f4a4fbb969556218486
SHA512 88fc30459fa7c4337128dfb1a5523da4b0b7c07c04259ef1561e73fe7d54a40cd8cf91d42cb6bda0cc28e3ec234f0dd32cfdd724e2fa4cbf3cfcf82f50eba36d
TLSH
T188E020145CD5D1DF731560C7517B43C8C2C53F77EB8429492F00CC48700A10476FD551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8cf1ce2c60d5c7609ed1b6326c9996724654f0d7805500c33e0ddfb6c1519237
MD5 b40c8a0771847343ad476be99c75cff8
SHA1 373107f1ff817c6701065852c812b2e7eb8d04f1
SHA512 ababbb81a31665b34b6dcf24d99f8fe1eead2d66fbd1cee040e9afd2e4834b286371d14f29acef0fdc1d6015f5a4f6f507a841a53a86aa2bfd2bfccdb094a42b
TLSH
T18C218C15F321C248E18A823E902BA7751338E9128FFCEC0F817924762D76F010E8B6F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 d9860799d8ea0d860622b6dddf9104d0b1fbaca32356bf795143e5d24d862634
MD5 e645a2cd9d50463d041faf6269d31734
SHA1 998b72c27d1b0ef574330c3fd7bdd11fe39202c7
SHA512 2787902859869d77a46189a1b945d489041b4f8bdf05caccf700c022ee4056e1cc1cd02ff7e93ec9bb1cfde5eed2a46183d994c8f1bcc263678b45731df28174
TLSH
T1BDE0D814ACE5C1DF731160C341FA8388C2D63E67EB842E492F008C4C510E14576AE551
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 43abda92fe7905519fd0abe16e5f8030c5f95b426d6b3dd995f67f54062e2c52
MD5 fe62d280035d9980abac8e85f1181683
SHA1 bd06c814910a2bb74cf985bac1523e19953a20c6
SHA512 4a27ce2040ea015f0d652e8914c2ad233a24c5585ec051055d5f48c14480a09d9cc492f26520164e657513e44c7bf657d2e1ef2ea5c924c3e1a3922cdacbacaa
SSDEEP 3:MsEllllkEthXllkl2zEflW3/:/M/xT02zL
TLSH
T1AE44044C7FD00445C50050335051D3703370D435051DDF4334D10C335FC75400D0C000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 137436590f4060ca109f585e0a614e9710b610e643748ba82e72909a5495f1e2
MD5 f834dc0bf0b14c061300f3a204e07a5a
SHA1 db3c3a54028f0c973022387ff0a9d28bcc3ff6ac
SHA512 99ca6de80f72a7b38d595be45805e667b6162cc07f77c3e6f5c2dc40c0da82d32c2502a517f54cfd3c9cac02ccb9e34850db474fc2c6672a8a74fa94691fde07
SSDEEP 384:nm8iF9CcmyWCs3sNf8TUNTUlImkrzoNmftvwBfgVR4Eg11zNfhkP+lFYS/s/eCpb:mnFccps3owglXNVRT81RhkoFYS/sLEw
TLSH
T154B25C36EC98CAB7ECE64F8AF74E7A47DEE01167C18859D4DAD91D0D00971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 909b380d7f6a2346b0661790ba252ed563678d2ef7e8d5f6365474a6ce571770
MD5 555009a8ae2a1834df09b964c0604983
SHA1 c1986667a40624469d395740d70a3d1f2975bae2
SHA512 f40068894117e65f0391a4f1e61cf3605c3e147dbbadedd67c8a1851bd494d0e626761c902046054788ce885496a392fe2f07b9a8cf4e85b24c9f638cc92e7df
SSDEEP 768:UnF1jZbf7wgvwKVRT8Ks/pw9xb+SoVXzjuB:UBLBKKsRmb+SQziB
TLSH
T1F4F23A79DC14CE7F98EE7B49A70E2A429DE40277C8A859D8E7D80F4D80B619CF70B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2978fe78d402e367694538761266b3887533032a875daa08158aebe78e8c6b65
MD5 30ec9fd3e06a05e87d6ba880c7f48a3c
SHA1 d56852b3af37591d2755e315b11de65769316076
SHA512 ff2dbf87af66cf652a06073edb5183c6fa098e82b7d0a9fd1c6a1ce292deff69a24a32fcfdf6a745f3c1fb7b85750b2a27a1bff925a70285aed1ca534ba61dab
SSDEEP 384:yU8iF1tNnNnb9FsNP8TUNTUlI4kfzoNm42KwBfgVR4Eg1KFOSaM+SoVKz6Zl1zrO:hnF1jZbfIwgvpKVRT8Ks3M+SoVXzjW1
TLSH
T16FD25B32D868DAA7ADE79B95B70A3A03EFE45293C5CC6AD4EADD1D0D00D719D030F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d146282f23ca2f16d5bf4c4a6c382c1ec2f43745c345ed88c3d365e5321f4e37
MD5 e4c428c7f6409cc70ab4b630df0a1b86
SHA1 b16a8b11afde2653cc2a0f1918397915922b4748
SHA512 fdc72203087f222e005a14623febb97cf1c28df42b0728fa67f793fd93ff9664cc406b3e6bf0cc3939050ebce34159e832626a2ea02d93b4415f02a42dcee1ec
SSDEEP 768:UnF1jZbf7wgvBKVRT8Ks/pw9xb+SoVXzjuB:UBLB5KsRmb+SQziB
TLSH
T158F23A79DC14CE7F98EE7B49A70E2A429DE40277C8A859D8E7D80F4D80B619CF70B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fdb014e68d1899db4fdd6a41cf8f584c01b6cfad65e12c389495ce9dea0572bf
MD5 a91dcf5545dba13e19e3ac0c551d40e7
SHA1 58285e2d5158a0f3493943b5f400efb58dd5487a
SHA512 e3f9611d32091b76f9011abbf4f55b02f01e9fd3501aa23c68a644107de33f5802eea8011ffddf0b272921849e2000862063e0be2ddd3528ecc5f82be4aaf99c
SSDEEP 3:MsEllllkEthXllkl2zEflXEDu+ll/:/M/xT02zG+X
TLSH
T12D4404047FC00445C51010314051C3503F71D5340D1157733CF10437FCD75404D04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd4d65997d04ec617746da7c08f47cb009011f95e7eff8e91d9842d828f4ee44
MD5 ecb85842391f363c169e9c28f6b09270
SHA1 c504cdc20e2522162d5c41f75c4ca980dea859b4
SHA512 3a99999d039f75d5d4f4efc6af178a37dc9788bca37c45efba5f423cc1ab9afcfe65c78ffcaaa01dbbc65eb3fbcdd82c7afa355c94fac9823aac87691bbaa6aa
TLSH
T14341DB58B6EA1148B3B76F5A9BF6685E447EBD372F07909E00110E4F4A67A00CD71733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 5692a2dacb531a7f4c5f69a752dc8be917a9c19360cabbf9c507ac41ff254580
MD5 1bc559f9df33d0727aceac3b030000a5
SHA1 08088b609707a1ca86e627c8e6be5e1acbfeab6f
SHA512 5cdd00cd2920204b461f014f4509ed4e8ada2a20743c5e6d46e8a7e334d39b3daa5beafea5be29f70fbc794082602616222a6ce430b792f8da05634a316102d0
TLSH
T12F513B5869ED1109B3B3BE1A9FF6B96D587E79732F06C49D00510E4F4A23A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 aa86eee2dd3aa3ca94f76dcaf1127eba2b78d78d1a44973a73448867e590baea
MD5 0ee3246606731fcdc10fa75e1db9d0da
SHA1 9460391bc23274d86c88dd8bfccec473a13db8c8
SHA512 311fbd77cc6bd012322c8472c7200c7f7ba9075cc67de355b5fd9a645d31384df064cfa11c1c5ece580cc7fc21bdda840e334d42345f41d1430a078f224ed429
TLSH
T16F51E9913936A23F6BC787C550764C889571F180132E5A5CEE4AC434BD6CEB1AB5E3CA
MD5 SHA1 SHA512 TLSH

Submit Download

port.txt

Path C:\Users\Admin\AppData\Roaming\Music Presence\port.txt
Size 5B
SHA256 991868f35cd0c5a0abb8c0392d8da9acebfef0d9e77eccdcd845a99662645e92
MD5 af92a5343490e6d0e1ab7ff3ede87c47
SHA1 5ec42d0f160ad7cd584e77d134b0f6c540307a73
SHA512 837a15fb2f983b351b3290f5113a6bfcdbe6817c8b7b41b0cb0c832e55e5a2aa07e32bac274300fa2e35e78b11095f5c3e51208330c7b181f595a198d36ac516
MD5 SHA1 SHA512

Submit Download

memory/1544-642-0x00000229040D0000-0x000002290448B000-memory.dmp

Download

memory/3184-162-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-165-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-156-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-158-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-157-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-166-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-168-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-167-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-164-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/3184-163-0x000001EF0B240000-0x000001EF0B241000-memory.dmp

Download

memory/4092-442-0x00000239994D0000-0x000002399988B000-memory.dmp

Download

memory/4824-0-0x00007FFCFD250000-0x00007FFCFD87D000-memory.dmp

Download

memory/4824-1-0x000002146B690000-0x000002146B6A0000-memory.dmp

Download

memory/5496-29-0x00007FFCFD250000-0x00007FFCFD87D000-memory.dmp

Download