b889e565ff507269761b6c588e14bce545fbbef2d771e237139d359fe7458741

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReiPatcher.exe
Size 32KB
Sample260620-3d24paa16z
SHA256 b889e565ff507269761b6c588e14bce545fbbef2d771e237139d359fe7458741
MD5 27e23623ae44fc70db4578de2dd11676
SHA1 5c5712fd469fbf49c67a65739afb9f34462daa74
SHA512 85291d566ceeba47e578e303894c4930d3c9eda033862a6eb2c1c46a976346b72ee67676be4c2c2a095b185b8d340db80c23a381810669fa7ae91d1224360a86
SSDEEP 384:kCzuEfEopPNGnru4CtGhoGmgF2PVGiEMrEgmpLkviQ28xQQhQ7cbKOSWGIP:aEfVNNrIo+cPQrM9mdMil8KUDKOSWf
TLSH
T150E24C8027E88729D5FF0E7979B156110E76F66BB833C69F6CC9549B0EB1B801350BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_903400749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_380799202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_380799202\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1072	msedge.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	msedge.exe
4200	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264715454915521"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{545B9E66-D1B2-4630-949E-8F348630C650}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1300	mmc.exe
3616	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe
Token: 33	3048	mmc.exe
Token: SeIncBasePriorityPrivilege	3048	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe
3616	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	mmc.exe
3048	mmc.exe
1300	mmc.exe
1300	mmc.exe
3616	taskmgr.exe
3616	taskmgr.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5620	1072	msedge.exe	93
PID 1072 wrote to memory of 4200	1072	msedge.exe	95
PID 1072 wrote to memory of 4800	1072	msedge.exe	96
PID 1072 wrote to memory of 4800	1072	msedge.exe	96
PID 1072 wrote to memory of 4800	1072	msedge.exe	96
PID 1072 wrote to memory of 1564	1072	msedge.exe	97
PID 1072 wrote to memory of 1564	1072	msedge.exe	97
PID 1072 wrote to memory of 692	1072	msedge.exe	99
PID 1072 wrote to memory of 692	1072	msedge.exe	99
PID 1072 wrote to memory of 692	1072	msedge.exe	99
PID 1072 wrote to memory of 2560	1072	msedge.exe	100
PID 1072 wrote to memory of 2560	1072	msedge.exe	100
PID 1072 wrote to memory of 2560	1072	msedge.exe	100
PID 1072 wrote to memory of 4196	1072	msedge.exe	101
PID 1072 wrote to memory of 2224	1072	msedge.exe	102
PID 1072 wrote to memory of 4196	1072	msedge.exe	101
PID 1072 wrote to memory of 4196	1072	msedge.exe	101
PID 1072 wrote to memory of 2224	1072	msedge.exe	102
PID 1072 wrote to memory of 2224	1072	msedge.exe	102
PID 1072 wrote to memory of 4076	1072	msedge.exe	103
PID 1072 wrote to memory of 4076	1072	msedge.exe	103
PID 1072 wrote to memory of 4660	1072	msedge.exe	104
PID 1072 wrote to memory of 5884	1072	msedge.exe	105
PID 1072 wrote to memory of 4660	1072	msedge.exe	104
PID 1072 wrote to memory of 5884	1072	msedge.exe	105
PID 1072 wrote to memory of 3952	1072	msedge.exe	107
PID 1072 wrote to memory of 5732	1072	msedge.exe	108
PID 5732 wrote to memory of 2472	5732	msedge.exe	109
PID 5732 wrote to memory of 4628	5732	msedge.exe	111
PID 5732 wrote to memory of 2488	5732	msedge.exe	112
PID 5732 wrote to memory of 2488	5732	msedge.exe	112
PID 5732 wrote to memory of 2488	5732	msedge.exe	112
PID 5732 wrote to memory of 2868	5732	msedge.exe	113
PID 5732 wrote to memory of 2868	5732	msedge.exe	113
PID 5732 wrote to memory of 2564	5732	msedge.exe	117
PID 5732 wrote to memory of 3728	5732	msedge.exe	118
PID 5732 wrote to memory of 3728	5732	msedge.exe	118
PID 5732 wrote to memory of 5480	5732	msedge.exe	120
PID 5732 wrote to memory of 5480	5732	msedge.exe	120
PID 5732 wrote to memory of 2084	5732	msedge.exe	121
PID 5732 wrote to memory of 2084	5732	msedge.exe	121
PID 5732 wrote to memory of 5104	5732	msedge.exe	125
PID 5732 wrote to memory of 820	5732	msedge.exe	126
PID 5732 wrote to memory of 2088	5732	msedge.exe	127
PID 5732 wrote to memory of 1688	5732	msedge.exe	130
PID 5732 wrote to memory of 1688	5732	msedge.exe	130
PID 5732 wrote to memory of 3812	5732	msedge.exe	131
PID 5732 wrote to memory of 3812	5732	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ReiPatcher.exe
"C:\Users\Admin\AppData\Local\Temp\ReiPatcher.exe"
1⤵
PID:4980

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\PingOpen.htm
1⤵
- Drops file in Windows directory
- System Network Configuration Discovery: Internet Connection Discovery
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffddf79c188,0x7ffddf79c194,0x7ffddf79c1a0
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,2632911608989656853,7888780834254232646,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,18173118252310906162,6475561504202050692,262144 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,15394626179788217717,2545555884579558503,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,2729783573042488784,16842882537669255967,2097152 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,3778893367429304416,15687161045513616708,2097152 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,5275100111453008015,1288852812668374453,2097152 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,15975693570863691429,11273509240395477458,2097152 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,14333884071085708203,5798359349462457330,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18003892228714732500,13555795677476600977,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9130777074699072757,4664904149416189847,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,11678753899379517913,14684042309523235449,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,11678753899379517913,14684042309523235449,524288 --field-trial-handle=2404,i,8672928906310173031,17700031432936184916,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffddf79c188,0x7ffddf79c194,0x7ffddf79c1a0
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,7577536699686259765,18320924761613824734,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,720727640149722312,6302463418893645053,262144 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:2488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,8285547098115771270,9461604826160010110,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,1920153938218813612,8952734118150585757,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,1920153938218813612,8952734118150585757,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,7813014000555490633,4308723199291993043,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,746348138816745492,7761257311120272781,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,15414876855832216092,12078012798931723821,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,16490772291549266613,14975101749531297858,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9924391824777857616,7723597613126830515,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,17703960871814675294,525565854766796820,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,16523667595048811557,17252272160495932088,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=800,i,8456826482802556993,14682159092628801222,524288 --field-trial-handle=2248,i,3886469559976770679,10762060747809673388,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3432

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3048

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00f01d8fbe66bd1fb570230c0e687b04c1572f0c8a71698e1cb68e35055aea30
MD5 75201e95a77981071809e677d4df8caf
SHA1 a0463248d7fd645290e0a9b87435ac287a13ac08
SHA512 72602f6dec9cb233c9ba8bd15d6731e491554140de0503a99f6a78f292cb46254826be5b7986234dafb3ee8e79892b2c7d2a1c5f51a64c7a34bacba5af7f6471
TLSH
T104D097203F02FA98C00800F482304A00573BA85331825604B120CC0D88F40C0A6C68D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a116ce16b3c2a9f35c461ed7bdb4535f1b750fe975206f0f22512225112b2d8c
MD5 6f96f39851e66d3ef9f9b23eb7d2a3f1
SHA1 dd59c04836b4ebc578233a6e94f9594e7923796a
SHA512 1095ac71e2cdc7e7e5ebce066eeb548a005f5cc91c99befce4ed1723d0cc87037f5ba14b18ac7dd49c508241606aee14d87f23a1e64587ae74ada6538b6629e1
TLSH
T1C5E02B6EC810DC2718FD0B6AB450474BFA5017476750961F773CA20C8FB567A01DA86C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b43234e5f3db2432de43d7d8498120481c73a13f44d43c7f45ac15ec8bbff4ea
MD5 e85739a125bf532e5199240b83b2859d
SHA1 c2a7287d519418079f89ad6523c968a8436c64e8
SHA512 70411bfd82d657def449020053302a49ab16b37a52b039b8b82fb2ab1abc6040afbbd08e26ff80154adc35dac550546ab2f8f4189910b020db61e7f6581bca1b
SSDEEP 192:BPWPbkKUV3CX9jyoFyU3J9b9S9TjQLhXdmiohIv8wt2h5pLu6dbydTkdn+BQePPK:BPykD3CkcXhXdm76whH4m4QePEmjon
TLSH
T19513E9BF36909D02CAC244BE654BAA717B3AC7F6DCD562A3033D307167123675A0E2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 42460d29d5713db0fe965385f3ed96e4970294eb86b2727e4fc17394c453609b
MD5 71297a3d2dfb8d6d96ed8b8b9a246e87
SHA1 2d163184db456395b9bbac88794dda40a8caa890
SHA512 8a28b01241b7da88756095e93262f333f650b40f494a63aea801b7dad9f427dba7ef7158706e552c8cab37ae72d5eb1653cfc609383ebb537b5dd634a5bf58b6
SSDEEP 1536:9g/hL/nVL/wv3sh1oAgy3Lzi8BTkkfYE0nzL/:S/hL/VL/ec/KK6zL/
TLSH
T107442EF71951A01BCBA842F5E2133E3EE17B425D7CD1F8E9E53C0C952925B21B6BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 2797b08b0785efec197942be667fabdd63267d5639118eb8412a249ae4f3f2ad
MD5 21637a326301065a97f6184c9f550fe3
SHA1 85bb598d31be7ff903f8eb23ec443e90ef4d069e
SHA512 e50d4b92fe888079d3605e9ec5c784016b472c164eb92b0ec6fe45a09216b4376f90d3c27fad16d108d14630040ff054048eeec0cad4ecda9d8e38cab6d28d0d
SSDEEP 24576:LyKnGsPoqhxYsvZMW1xElAaIcGstJhkVjng1Doa38a:LvnPPo+mQOQcGshSng1Dtl
TLSH
T18E167DEDCA6858C3CD639A70B4F0E9577C7413C3F994C1D6C89CC584026BBC5BBAA269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b946d7f917105dd25669e2ed0b638d77db3e3626a534628ec6e227232521309e
MD5 415a19a53aaf3b9656a97c5e996ea6e9
SHA1 26a1db59590b4a8f5754c53334cb6460e1ba39ff
SHA512 dcf22928ea71f4260c842a19d272f964fd09596e23da393054d21803c14c2c1f2741d853555ea764cf7cb795781984be5e07b7766f37d61a29450cfd5f1b77d1
TLSH
T1257191E4C1950D26CB2143B222D224B7F378C99E6F7B2E1484E55EF9CB067B5B0A14E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599d7e.TMP
Size 3KB
SHA256 a40f24e83893ed756c771ed07b327e5ffa91138c7c74e656101c2eddaf3e056c
MD5 f85bee2edb638cbfbfc2ec4afdeb0bf9
SHA1 3a6d820ce3eaf36a4af4013634d4c0cce98cba24
SHA512 7bff3436edb50e4fdc979fcbce13e55eb8eafcc29183521133aafae93d37db90692f1ccd721fa75270b4edba999eadd81ced6688083f6ae35b007d7568bd1f6a
TLSH
T14071C4E4C1950D25CB2143B122D224B7F378C99E6F772E1480E41EF9CB06771B4914E2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 9388e30b9569f6ca47fd094689008c85713c61f6e19d62dbc7acf517cde362b8
MD5 24f60d316e293dca08ff14ce9ed5b164
SHA1 2e60364a2b9eb39c638d6cc6996b92eada2bf50d
SHA512 2b2d373e60256b449b163f942ea32d9c3bdae54ac8ca93e7a8ff1b4b814d2e27d5fe1159543308b5bc487d7805c580d121791b22f8b939681a7e5275b45a92d9
TLSH
T1F2E0D8E8A5EBC22D562434C695645748C284344BD68A7DCB2B00C8D4B642605F74BA6B
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 6cd12a8fe182a0ab95bc79eee5e9de48cd26e4000cde8750336d7198e0c8639c
MD5 cdde50b738c0839a82358dc2e60407db
SHA1 39cfa3c2a7d17a854e174f23edfe19e3033a0d1b
SHA512 40e53c213b78071b6e8d729bb5d89513b16a36409a910b44029ec153c006ac1dde0e39a23c75a51718b57819334f59d7546f6daddcefe7311242cbdffd4235e9
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj2ZQN:TdD4jJ/0UC+lf5KY
TLSH
T11AE2A04C3E21F511C4ED733CA0D2C5D09EBC647C478DB67142386CA68D52AA2F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 266B
SHA256 c7db8e6b956909c549e1a01710917898d7f403724f1e25aa83e2bb7175684f8d
MD5 23545cd766bfa59b0da06fdcf3a429a5
SHA1 9220aa9d16de417210e4c45bc1fc44c0e15b352c
SHA512 436e7434c8d9529a853df7d470e53979e41257508829e50eba39090ab7ac511cbc11602ccaf710fedc43b3266d04b5f5e3aa9f9bb27e01bdb865443ce3548e82
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 2dab72212d5357e620ccc9ef89ecf04949a0b3263176dff0d7813678b1b63b5a
MD5 7d425bd468a2cd4e46914adb774d1e23
SHA1 d7b713c052270fb513a587c0a177d0b866c9f57f
SHA512 c98fbbe7f048d135ac8c520cb8eb5af8081f7991e8c171f3f516371f790bf0e9276dca2b84265d60c91aa8a7b9dba13cd6edd6f3504c9e6c2d6132786d40827d
TLSH
T17BE02628A5CEC23D5154B4F7C6E48308C3A2744FE3883986271D88C5F001704F38F791
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 88ca72083dca24e34efb1792f6af19e4f73f55f4d34a33d1b60e98e8640ea2e2
MD5 a0b35f50de81a67a094a0aa38bb67617
SHA1 c82d60469c6548dab388d036d2d58099cb491c0b
SHA512 af01c3d8026a6c03edb985d7016b280e955f7035dab19d7df9af7a1f885ea42df51b9c887591b335e41b3a5b4b122e60f6efb1120121aa9055f7af84bde226d9
TLSH
T1AAE0262858CFC2295124B8C7C6B4D30CC3E2348FE288B9C63709CCC4E001700A7ABA91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 f5a776991372a9166e0daa185cf428479f9dd6ab4e4b48bc2e5d6e5853356568
MD5 e8d6e1567b1c742aa932953fccd25768
SHA1 26fdafa5b568b222bcbfb485150f37c8b217d46d
SHA512 0d491764dd71c3c8d845b26b4084028969df87ebaf3efdbd81007d4d727f152ea2d1a7854c22fb1488cdd5729037d2954d45a6586763ea4e7110bd5a5edd2ba1
TLSH
T18EE0201485DDC21A551464DBC6A8470882E1380FE2843A85671BC888F142342E35F955
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 33f66c4a29769ce948fcec26e30c9e9c9ebae76f7a29afb295a9ffdf22211563
MD5 ac3a8b4dacd330ad6e8efd63b13b488e
SHA1 7a4c3cdc899eb2031c5a173bedd82b6b9b7b9732
SHA512 8937bc6ef6a27f11969418fe5372666ab9fadf1a0c01e4063d4189b8c6b2e4381e4c8dc0e59525ead34ce7fd157fb58298706470df307a397c57518d18c11d3f
SSDEEP 96:ragtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/dLbbEOVpZf24JkMfXSFR+CFqrn:rafH+bF+UI3iWGVoWN3qL/BVVV63
TLSH
T1DD240F4E5F252722CDBD913668E744B35C7CF03F8B1366DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 46b0d449aeae7fa2d1c1fbf15b5d1766d94a1cd269509103cf0560d532e873ac
MD5 65065d40aebcf17279f1a732f61a5a7b
SHA1 08814f396b9f3ec729646c706ef4c183c5b90ade
SHA512 80ba04b35bd135b348fcc9ffb699c62684c35dd1598b1547c0d6ab923bc5d768bd9f2837a7aa363cc5e35064b5a1b2591eb216b2c85b9682cd85dcf5e35d5669
TLSH
T124E0D87488DEC31D5308619FC26EA70CC3B1350FD6893A852B059894F401244E38B5D7
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 c0b76459566292eea30566f1f1c5b7e56caeb8aa4fb8cf8dbf94233d2356bd62
MD5 ad7a91b2bec8274adc844ca2ae39872c
SHA1 2d6f8a3a19b5633e25f46bd266db6800529ea6a8
SHA512 288bc9363cc32f5a962f7b04fc16cac5dbc70b8c9b08a22d1d83980cef608492eaac3e8ad381412d744bcaaa5144dac9825858b2f7d09df1c9fdf10c2c346393
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAwn+oowJ1Yvd1h:qDeMatha9RA9qOF7
TLSH
T177B20E4D1F307211D0F45B36EDE085273F7C111DD3632659DA1860B29DE3A9BB6160AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 352f86d7e8b860452efcba5189446db164d2b3e593aacd64a6161aa45499363a
MD5 1ed95be93d48eb3cac4829db075a612c
SHA1 6852a79cb6b05f44bf56c7c5869823fcf46986d4
SHA512 f40831813fb8b4d2cdddad0518d844994f774d93e1c45ae8c3f6a3c4bcce0d5e71dc13716d8a012ea5d5902d5ea538ae24007ae64584faca59a690ef071f7b38
TLSH
T10E318CF7C3E8867D890156F4BB146E1BCE2D0954832C3D5AC5E4AF5F93E2871E58089E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 24abafb29a7a5196330a01f289b82ba6e1449e071e96dc3079683028758118b0
MD5 3539dd214861bf3057be9dd08ef50658
SHA1 2b9cd2cc3c48d155654c0abf990612b022125624
SHA512 369239f759118a4c70883ae4d163a7d3379b534a007e4401891138b213c71f9335ec7f63f3f1886b47b648cb6906c7b7a852f7d52af365acb6e7af79f2020e52
TLSH
T1BB41AEF3C6E8866D890156F4BB147E1BCE2D0954832C3D5AC4E4AF5F93E2871E58098E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 a3d31d328ae1a3b0d24ca41e6ae3abeb1e98f1a407a57aaa779249dc4978b4eb
MD5 c0597e44226eda1b3a4bd7f0cc4882d7
SHA1 191db9cb0b2f891f467cdfc57a2403b15dedba4c
SHA512 7a1ab1c622b8f24bea68d3f442ed1f400814ea928b04664afddefd4fc2ddd13bada1ded08cf487026c761775475e340cde84bdcb3cd51e7c97b383d55b43ea95
SSDEEP 96:OIEumQv8m1ccnvS6xtQIRycf6CnF079i04g:OIEumQv8m1ccnvS6xtIF9h
TLSH
T15EF2CDFE0727A206D99444B0E4009F8EAF16001B47B6B7DC76D447E3F7A20E2B578796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 f26c4bd00d4a192599aa9ac07970e1248592401612005d0bb58e0584a6016f2a
MD5 5cbde9d39b7bdeb6ac5136c2b06f783f
SHA1 d8cdbd8f38ba930a5e471b16832bd18d7ddf873a
SHA512 d8d2f66e824ad5a435ae9e2c9b526eeb24c2b2fac7b80713edd252305be02393eb9ab17ff65e5997ffc0a313004259f05aacfe5244af79e9044b4c16e23021a9
TLSH
T1ACC0126684F9F4761039597E2A846881777DD439145198E0D9A6833CA1900F79B2903D
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5af367380e5b81a03d50603a5c118431e04dccbab8713895b6e345781950f92
MD5 573ff45af02db5c223b6d0792008c933
SHA1 f80801c48f5ff7f27dc94836f87d69b98de23a3b
SHA512 fa9976d9ca6a48cd1f0ea59655f8ea3dd3ad8a71c980b09d8f1a9e4130b42ad9ee93fcb9590c4adfb9a163d5267dc933ca9d8a0d868d64415810302fb2f11a47
SSDEEP 192:sxRGRWcI/fRsRWpV+eEZU5lzoA8p4C/g6+WNIYwMaYuqZ8GcIgtJ:sxRGbI/fRsRWv+e63X/5IXqZI3
TLSH
T1A64297166928A93B9CCBD21DFB657F13D6FD1032A1915E48E6FC8A1C04EBADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 49e4532d8995e7c734e1b4e2b6e69f70ac60f243d558d1520725487a2e6805b4
MD5 abf6a3cf7ea8f4f9e0b06df39ec0687b
SHA1 9f531223e1dd8cb8521f96fe8a584f5f5411dca1
SHA512 5443fb3e5b69047bbdfe912fab6ebc606c304a9f6e64c894c2d680f45e5c467fc03fd1d1f9eed2c6a2f57f16104f49d7c963ad4ca149f378a8969bced9be6317
SSDEEP 192:sxRGRWcI/fRsaWpV+ocGqzzoA8p4C/g6+WNIYwMaYuqZFgcIgFJ:sxRGbI/fRsaWv+ofrX/5IXqZfv
TLSH
T1954297166928A97B9CCBD21DFB657F13D6FD1032B1A15E48E6FC861C04E7ADE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f1bce0ef503f6e667c96333b68f80530dab8d564344441c769c9f59c949af5f7
MD5 968f387a8d62bd1d64b32a8c30df3162
SHA1 e1156311374c41c52bb4f082cf5b5f5b7db69cb9
SHA512 6d1939b3cd7cb58ecc6f72b5dee90e9ba29d6b43120481a408a9249a22f162a71aabb9f4cb8b8cbc0360f805e6a28a177e0528212a4b8366c20513bb6c2bbacc
SSDEEP 192:sxRZRWcI/fRsCWpV+eEZU5lzoA8p4C/g6+WNIYwMaYuqZ8GcIgtJ:sxRZbI/fRsCWv+e63X/5IXqZI3
TLSH
T18E42A716A928A93B9CCBD21DFB657F13D2FD1032A1915E48E6FC8A1C04EBADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 68c7a94613dea5256a29e090c7ee3dfb770f7b6541d9243ca4c0b7c4f15ad502
MD5 1ee257bb81fcd3bad5549b6b8388476e
SHA1 8f1a36ac9313f8c0b818a281548fe84f4301a422
SHA512 9c28fcbc4a713ff085fa7b07a32ccd3aaf1b4fc2953b4fa13b012e7bbc8cdbe7cf6aca40b3b4c590eb841ab2fc62254b878a6e7ef026f78e053e1726b7c23197
SSDEEP 192:sxRZRWcI/fRsCWpV+OEZU5lzoA8p4C/g6+WNIYwMBYuqZ8GcIgPJ:sxRZbI/fRsCWv+O63X/5IIqZIR
TLSH
T1E742A716A928993B9CCBD21DFB657F13D2FD1032A1915E48A6FCCA1C15EBADE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fbbf68a1bf40ef8d5dd5ccca4660e97ee4664304b071a2f60c652568bef15ae9
MD5 4b9788ea300296933a28ec5c96228022
SHA1 14ad1fd4419a08273d9597258915b13a86d16f14
SHA512 bc3ab53a33f2c4e252303bb2cc3a6430d4cd43473cae4acd6f4bae515865463a1b6e7891008ec19441aebcd8e6a3c1bebbd33e97c9693798bb7b9d2b5ee7fdeb
SSDEEP 768:jnWu1A7pLuL7m7WgNVf338F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BJYMronr/0:jnWu1ME7m7WgNVf33u1jacHYXnT0
TLSH
T1F2C2CA7B640CCB7E4F804ADDE8197A9A6DA802CB9798CD8047FED51C02C6BEF51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 b022cb5979c2de54ed807a76718f3ce15f5cb0f686d03732ed6563b2e962e690
MD5 2e159f78c3b6428bb1fdcd1809c7d64f
SHA1 e1cff8415def363a10c166cb2b99d54005749e01
SHA512 36355f877b1a3d426c2e3ea0fceaa4daf95d216383a90ac1c146661163479f948850c298a0bb9da48afddf352f8462da4464c0f17ca35a97405b9c4ebb4b4b32
TLSH
T10FE0266486DED27E621536878AA88308C2FA740FD2C83D863F05C8C4F182B04B2AB592
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 acca5541b65967bad65c009f488428e9dde098a109071f99fdb64b04bc2f765d
MD5 17c5493e0e2fb062ac8eee9a12774b60
SHA1 2e838729158a3eddd0d896c8e9966efe5cfed977
SHA512 14e20d431f84d73a7e4275e0a6732efb8129d08cba6f4b4285e5a2e0ed59e167a1bce287259ede5e4de82a3c05942f4ec5eaca10bca73d6d7b45020e7132569e
TLSH
T1B4E0D87066CEC32A624574CF8754E308C2B3B84BD6C969993B09D8C4F246740B34B551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 ad921712b7ea87522ef02cb27c88c6a1d296a7c70259b110982e230b44a06c38
MD5 d61d87de68a781b2023690d3372174ed
SHA1 95531f7cfce8390b7ae9ac1d6006fd95f85de013
SHA512 c2c66df075ffdaadf1e6c025710c5486f6c71e22d13926d2b94c223c6b0fca3ba8350c3d65e2b49684d21c919779a0254a86bb4287d178ee17a614d0d3411b26
TLSH
T121E048B089D9D33DA28870C686A4A70CC3B5790FD7963D85AB1C44C8E10574473AF5D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 fe85a4ca048804d930128b3cad45290eb5529e01095b5d218e9101f57fb34cf9
MD5 03daf31c316ead4aaa79a8e6555ac8bd
SHA1 cb45e8c37c06016339055b88cb238cc0fa93285f
SHA512 08b47ae0d6d5e85bc2c6ff7faf0163a3f9bbb3e3a3e174cb0e11596175ffc3a903db105f5cac7a38ae09771db9295f0d7c9d47b36b3fe478b005b9d6c72c2bc6
TLSH
T1D221E005317B625438BF3ACC84E5AA5F825230673616A56A3BA564D35E1FE000FFF8D9
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 6ebb0428193ed40b4f4a6804620e3c1ebba029dd9afd757dbe496076e649724a
MD5 89b6c6157c5ca031d2ca3684e2eab463
SHA1 cb55b9237e27c0fa982ba7687f420444c210a2bb
SHA512 8512da0f8a3cd147e826aa6c25b2cf7e298f1f04dba1793e72410fabaa79192c8046dd48125bad832cf2645d4b2e35398431424e3ab4f11b8ce7d3d7200e7ee8
SSDEEP 384:DNrRZyCSDnxTICXMEhIKyll7svbFKfk7:xFZJSDni9yI1l7svbF9
TLSH
T12844840A7B747001EDE6D9725CB080771E3CB16D8F22A6D16DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 8a520c75e5f8e0326fafce7401abcfad56035c9a531189b4192e3aa8ab4cd73d
MD5 650311d1572696caa7516646b157c51a
SHA1 ddf54b5ced479fc08316b9e2251c4ebc3b22268b
SHA512 c76fb9b806a48a157664336779ed0578df8e0336f26553726430c0924ff6d5c896b303bc018c6294dd73a459d947ab06ed29bf3785da10604cdd3e7e1acfc683
TLSH
T1A8F0AEC76E030977CC02913551336782FF658ACB0024B577438D212B6A2D1F1C9CC0E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 956e3b6017c819ca3efc7cb2f6d0a46b8b9d6e0a95dcc8cb70fc3d09d6600bf1
MD5 3055fddb078a29d169a4860df022babc
SHA1 c831caf2d9623d0264364be7601d9d2f97b313b2
SHA512 10913df6cb411233afc67b9420c2f35b8da298f933a9296c942d5d2ea0ea2d40c24f826af51e15f0d4acb8cd78bd6a21e69c1a25f0db2d5c8e47ffff4f198971
TLSH
T1F3E02060F5CDC25E621921CF955447088295341FEB842AC92F15C4DCF401301734F952
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2f80d14a67e9f4a6ececbf1c06821521034d6fd11068811acba717ec580b7a17
MD5 9b67e0b5047aa6d1dba4b55986ad2180
SHA1 3241b146218bed5a032e7bf06ed11cd2569599ff
SHA512 7bbe4751a51d99577474bbca80623e79b0aadf10c6b2cbefb6e724688b8c4c1dec0a81242b21518ebba8852e770355287a91d1270d7b4b674e04410c967781aa
TLSH
T17521B156F330C008E19A827AA47F9B361738D8468FBCDD0F85B924246E75B040D8B6E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 0e9521debb2fd9d63b8b194426e92b30b00da0dd28e2b3dce3493928d74efcdb
MD5 e41e3f7c7d662b013fd2dfa76314386f
SHA1 2541e0843afac01749b8e682a22ca51532457402
SHA512 1ee8fd3c7b3d0339680e53bae10d06fd02af858ead95e60b40e744c4e2c0eb084d9b47e69a7660beda54bcdf1e56d4e5fcc32e0086b7eaee0f9983e01a16e51f
TLSH
T1ABE02060E4CDC26F511521CB41A5878882A63C6FFB842F852F05CC8CD101345734F562
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8c63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8c63.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 c2075180bd4ad0212a64c2d7977f6504b0a9063298456d96fa68e2faf47d7ea7
MD5 39c550e72d71981754461a47ad395810
SHA1 a57f6c10413f8bb7fc557f1eaa90cd21efb35e9d
SHA512 6b1469c6b2a5701db4c3cdcd7147b40da298127b97aeff0e5d42c86587d724dc641f0bf26306b864b5c96677f7d2616251ffdc545806cdf067a64978b6714ed9
SSDEEP 3:MsEllllkEthXllkl2zEflcl:/M/xT02zf
TLSH
T1404404047FC10445C50010304071C3511374D5100D31574734D1043F5CC75400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4f5e448ac249683bb7174d1d50cf12b84785ec8a630b08fcaa5806aaff4e08dc
MD5 4a03370c7f7a21e57dbc1677d12d7df1
SHA1 3a2465cba6d99be0cc59f9485089a1732ebebe9c
SHA512 b13ad765cdd835c366dcadf24147548e87964eefd2f58686c656bae58f55e5365c9fbbb2ee09215d4b963d845d0b1394afba0e4d5621afd217d41d7918614fc7
SSDEEP 768:aj+9/3Ki7gaffUfiyJ5p3EFlnNMLmt6pAX8hVIGsvC:Z9/3KAfUfnp3EFlSC4pa8/avC
TLSH
T126F29E38DCA09D3B88ADA744754B279B1CF41273D5A46E4CDAC86F0D84A779C370B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 dc88ba113d6d07ef83599c9e2d0159df1301b14dbd927bbf88304a9c2164a686
MD5 4501b207b004fd351f54c65a5bdd7d12
SHA1 ff5fdb3b073fbf657654bf2682eebb9280bd8c16
SHA512 15429e8bc6b4982d0c5bc76e7e2c8b6a1866b852ca933289f447461df6892695250e36401b47f7eb2841d2cd9124f76f1a4288eb926dc1042c946bc143f8ee0a
SSDEEP 768:JjaeqD4MlshiLdMmt3OV7gaffUfSfPRyJ5p3EFlnNMLmO4oAXqeHjTy:JqcjhIdMK3OXfUfSfPWp3EFlSCdoaqeq
TLSH
T140139D3C9CA0587F8CAEB745650E27671DA44277C6B56998DBC82B0DC0772DDF30782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 b56e5c5a72a3baf8c22eee2a6308d96b664c33c9d8a9fdf61e6289638bd50774
MD5 073d0b957bbfc747850eb1c3f5a02b3e
SHA1 4b9b12bb30eabd16ba8211b45aa1993cd581b52a
SHA512 e59c4ef527476084a2b7726ea8d554b8880e8c885690fa5c44d18acf98e9d0d81099818d57581a0612a826e13527dc505e5be1fe98e38deeac0c8aac133bb09a
SSDEEP 1536:59/3Ukp3EFlSCbMyawz2CRA8B5TrPsIpa8/3vC:59TREnLb5awi2paWfC
TLSH
T1AA43CF39CC90CE3F9DEA6B81764AB75B5DE40137C5A8AD88EAC82F0C40972CE5707C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 87c5688654f3b7989ff75348e139bc865cf026dc67e38ec38072df3f3fc34eab
MD5 e463f8046f2f0c1272d64cbe5be35536
SHA1 d6a42c74f70ff328dfbeabb8e08fc7558e4aca10
SHA512 3584d9818b54591c8fad2083938a3e53dc656d751b435a2a00fdfab5a123c58d55b3fa0712214679fcadcce698800b60d64ccdda5d3d33bf7590b50a93af1a9d
SSDEEP 768:cj+9/31i7gaffUfSfP1yJ5p3EFlnNMLmtgHGsvC:79/31AfUfSfPip3EFlSCynvC
TLSH
T18FE2AE31A8A0AD239DDAC785B50B378B5DF412639A856E4CD8CDAF0D40C77ED270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 760a3c395c30ccac3e6b74b172877c138abaca0807598e53c8ce54c83c973f26
MD5 8cc78e904baf41123baef2117c778988
SHA1 b72a463c836f655ce1db54207e7493464df6adf2
SHA512 36ece7310c99402f4beeecf22715229f95190bec94623b363216c58bcba7eb104de4aa8896e43f1b624a1801300ef0012d8e336dd7009609ee6578233ed6bc7c
SSDEEP 768:UjaeqD4MlshiLdMmQ3l3gaffUfFyJ5p3EFlnNMLmKkyjWtTzTb:UqcjhIdMH3vfUfyp3EFlSC7yj2v
TLSH
T12E03D13A98A05877CCB696C5760777976EB04693CB913A59DCCC7A0E40AB3DE230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d15d2a8a309aa4157ebc437eb77cfacad0ce6616f9f281ea9d4b5669b500d6dd
MD5 2631a948de8e625298d8fd39ef03b060
SHA1 106ab106837a95d9366f902f4b1e839706826b98
SHA512 255c45a9972ac829330022af3ad7c35f3575844a2e54e1c5d1ebbe0549e9b37d38e6ac39587265ab94cc0e2abf78228a1b01baffde49cd47dfa50fae3c1b4d92
SSDEEP 768:Bj+9/3Ki7gaffUfSfP1yJ5p3EFlnNMLmtgHGsvC:c9/3KAfUfSfPip3EFlSCynvC
TLSH
T13EE2AE31A8A0AD239DDAD785B50B378B5DF012639A856E4CD8CDAF0D40C77ED270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 ab13a765010a87223be6d9795423afbf0da02e7d5f367007a5f17142552b731b
MD5 fbe13d7b915cc651bf1fd5ffb1fb33b0
SHA1 366e019cbfae45bf1a4971889c7799ecc9c358cd
SHA512 e3bc83124fa870e92c5f7fd54e41704e74ab648c21573619425f4095341336ffe555afdafe2d5b775557e5c731b6df37e9d915059fa2ea8908c94583f80b3192
SSDEEP 3:MsEllllkEthXllkl2zEflGyKtl:/M/xT02zDyKX
TLSH
T1D34404047FC01405CD0010304071C3531F70D5110D535F4734D154377CC75404C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

bc20c880-74ee-4610-93fa-db5bdd4d1a3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc20c880-74ee-4610-93fa-db5bdd4d1a3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3832ff9b-c0be-4fef-92dd-bc262c1f2a10.tmp

Path C:\Users\Admin\AppData\Local\Temp\3832ff9b-c0be-4fef-92dd-bc262c1f2a10.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d57430a3-5b27-4a1d-aa57-1720c941be22.tmp

Path C:\Users\Admin\AppData\Local\Temp\d57430a3-5b27-4a1d-aa57-1720c941be22.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5732_2095947003\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskschd

Path C:\Users\Admin\AppData\Roaming\Microsoft\MMC\taskschd
Size 141KB
SHA256 4cd213329cf9d069a173070ae8e42e6bcd2c5f82827b29325aee9d1b775b6aad
MD5 0625d2ac6ff555189dd4b5889467d064
SHA1 14c0901bb52c712afa314fe227b4219f260b0ba7
SHA512 446480da335a1fe019f9ffb8ede7c90530af2c21fd14b5e9bd965da5abf8b893355b65f55daa57338ed4fa5f93866cfcc05fcd12096d016113f84ca51353638f
SSDEEP 768:2cgn4A2qbiiNMRYhNPWrUjI1dtk9w4VW6U:84jqb/MUNPWIjwtkj2
TLSH
T1FDE300715EC65BE28B65A824021CEB208D351FD309AAD507344CBE925F2F4705BEEEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3616-412-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-410-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-409-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-405-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-403-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-414-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-413-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/3616-411-0x000001E01FE20000-0x000001E01FE21000-memory.dmp

Download

memory/4980-1-0x00007FFDE2CD0000-0x00007FFDE3708000-memory.dmp

Download

memory/4980-2-0x00007FFDE2CD0000-0x00007FFDE3708000-memory.dmp

Download

memory/4980-3-0x00007FFDE2CD0000-0x00007FFDE3708000-memory.dmp

Download

memory/4980-0-0x00007FFDE2FCA000-0x00007FFDE2FCB000-memory.dmp

Download