hxxps://cdn[.]discordapp[.]com/attachments/1514488478329602168/1520218452487307354/rasp[.]bat_dabeans_2[.]zip?ex=6a406543&is=6a3f13c3&hm=a0d3d47fa88094294e0ea5d00c9202b141d91ec8bde085bb08fd5d112491126c&

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
4s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1514488478329602168/1520218452487307354/rasp.bat_dabeans_2.zip?ex=6a406543&is=6a3f13c3&hm=a0d3d47fa88094294e0ea5d00c9202b141d91ec8bde085bb08fd5d112491126c&
Sample260627-eafvaagw5w

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1416	msedge.exe
1776	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270054614986517"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{F1661EEC-183F-4AA8-89E5-5FB49238B5A6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4308	2608	msedge.exe	89
PID 2608 wrote to memory of 1784	2608	msedge.exe	91
PID 2608 wrote to memory of 1416	2608	msedge.exe	92
PID 2608 wrote to memory of 5756	2608	msedge.exe	93
PID 2608 wrote to memory of 1784	2608	msedge.exe	91
PID 2608 wrote to memory of 1784	2608	msedge.exe	91
PID 2608 wrote to memory of 5756	2608	msedge.exe	93
PID 2608 wrote to memory of 5468	2608	msedge.exe	94
PID 2608 wrote to memory of 5468	2608	msedge.exe	94
PID 2608 wrote to memory of 5468	2608	msedge.exe	94
PID 2608 wrote to memory of 4544	2608	msedge.exe	95
PID 2608 wrote to memory of 4544	2608	msedge.exe	95
PID 2608 wrote to memory of 4544	2608	msedge.exe	95
PID 2608 wrote to memory of 764	2608	msedge.exe	96
PID 2608 wrote to memory of 764	2608	msedge.exe	96
PID 2608 wrote to memory of 764	2608	msedge.exe	96
PID 2608 wrote to memory of 5652	2608	msedge.exe	97
PID 2608 wrote to memory of 5652	2608	msedge.exe	97
PID 2608 wrote to memory of 5652	2608	msedge.exe	97
PID 2608 wrote to memory of 1868	2608	msedge.exe	99
PID 2608 wrote to memory of 1868	2608	msedge.exe	99
PID 2608 wrote to memory of 3136	2608	msedge.exe	100
PID 2608 wrote to memory of 3136	2608	msedge.exe	100
PID 2608 wrote to memory of 2592	2608	msedge.exe	101
PID 2608 wrote to memory of 2592	2608	msedge.exe	101
PID 2608 wrote to memory of 3088	2608	msedge.exe	102
PID 2608 wrote to memory of 3088	2608	msedge.exe	102
PID 2608 wrote to memory of 3088	2608	msedge.exe	102
PID 2608 wrote to memory of 3448	2608	msedge.exe	103
PID 2608 wrote to memory of 2664	2608	msedge.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1514488478329602168/1520218452487307354/rasp.bat_dabeans_2.zip?ex=6a406543&is=6a3f13c3&hm=a0d3d47fa88094294e0ea5d00c9202b141d91ec8bde085bb08fd5d112491126c&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x22c,0x7ffd221dc188,0x7ffd221dc194,0x7ffd221dc1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,4819972393748598341,12190100057811599120,262144 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,9160970061486093135,5371259300158546352,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,15759926340740375898,16887276881739888259,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,5636963124211885764,29783902892724897,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,13558180479701041395,5306481312536098980,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,1419915830589538080,17594815472120966297,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,8341337422912579319,7828588965037548223,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6908923810450194867,18435750586105396377,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7714587248861000352,3086443008473403541,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,4159019623742558997,17970893377484855722,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5864,i,16070713611037440198,12213852804071830834,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17855172087952296383,14007733511047709225,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,3198164143389762201,6054705426786647552,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,3198164143389762201,6054705426786647552,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5084,i,12782814317366629486,15137124505281260353,2097152 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,4239454291311883819,11426830847709408888,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,1281139236709001952,8798617397230336222,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,2598919975337698950,179227808263286505,524288 --field-trial-handle=2420,i,13252468452765873165,1624416865586209759,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffd221dc188,0x7ffd221dc194,0x7ffd221dc1a0
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,17623887451950288267,5696195401293846834,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,7662036912476600934,11520989007330334213,262144 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,13516752306170515174,8430110078240533558,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,8570961545034026960,10200437655152326800,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,8570961545034026960,10200437655152326800,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,15047850993477557526,4577843139232725356,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,4642635531493528330,12675803355364581108,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,5204201841891742709,7338099257668503928,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,5394279395858950459,17220997257413007126,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,7205822451917714168,10132893549048643474,524288 --field-trial-handle=2628,i,271122394642649612,7623171950090174287,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
    3⤵
    PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\rasp.bat dabeans (2)\rasp.bat dabeans\rasp.bat dabeans\rasp.bat . dabeans (2) (1)\rasp.bat . dabeans\rasp.bat . dabeans\raspdabeans.bat" "
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5aba9d0ab4f693973f0c5d4aab3d272e28dbee0c306a8ab9260328b6c2f95877
MD5 b05a426a7f87a107a2f13aabfc50da0e
SHA1 fbe290a278b36887eee8d28f9850e4ff2b455018
SHA512 9a6615854997ac3ad1163abd8522764637293f16bf1e8af1ef26bbaa66936560402a831eb395db0ad18233686477024f2a0bb737baf814c5194e61d4c11c33d9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T1ABB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 41efbd80297a08a50e8065925f2383124b96a2f31d7d6386033d115b555278f6
MD5 ab747a15079fba1c9bb8a4e89de248ff
SHA1 45a7fa36e27990e9f84c094917d17f71672471bc
SHA512 37a31992f004116716ae4cfeb1367887f7af376630574ee4c6d9fc9c5f61c76fe0389768c6354b6ded9fa887b5dfc6e16cc5fea4357ba1997ff1b872ae0f4396
TLSH
T162D023743B763502E71430F5B4114352B3278C53375AC203D125450F5D394B543C72D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78fec02cfa222330ba187bd379750d03292192e9712ef3399a43b89d6a0b30e6
MD5 ad456e1c51734b99aee1b69ab2eb3189
SHA1 b8cf568fa1eb213ad5893732359aba43fc23dbd6
SHA512 67abdf7887a18cca0a3973874e977276c565d2d2e813cf30cb2978db44416de8c2819594b36f7d36ad757079d6832d6cbcfc756e2cf40afa2074e8160315a540
TLSH
T10CD023653B257C51C1113071F4218711F323447133CAD1035159501D5C34DA993C67D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f7d48e404f6e48d64bac6dadc65c0ce3dad250ab6bb5397fd99d96456f061e5c
MD5 26a7c6987f457ad60ca2b52899d72e75
SHA1 dd3c1083605d797e5a271eb5e4e404249e60097a
SHA512 24e64cc49bb13518dee4170f046a90de384a15cabdadfe7bcfec482220c3fe35f29c7446f7b9826c142f02611dfa5e68d7b0fc47008ecd375e133008fac913eb
TLSH
T1D1D023613B257C55C1213071F4218721F313447133CAD1035159401D5C34DA993C57D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bef5fb25da00cfcf715abf8cb80d405085978824336ae9efe8503674f675dac0
MD5 85c93e487a8f8d10905b717e63381252
SHA1 f3ae0572cf314d8dee271b415098173ab765ec8e
SHA512 93244b12ed759706c8bdfed6dbcea93a3d00e36fcc34b1e29358d667aae8c7f43922dce7533aec8d656e725e4357f3086a0fd423839635f40eaed97613ba1935
TLSH
T1A1E02B66C921DD370EFC5B1850584745E651037B3B80484F773C921E8FB167A56CB81C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c2b801e00dda5df2e57e8aa823422aa208a4f7a9ec5b2497da72c6e9494d56af
MD5 9fa74e99a09958d3b2fa1fc30609936e
SHA1 4149daeb68a8a2eff6436ee48e93306b39790f86
SHA512 67d784bec3c4582b73c164cfe79ee56ec2ecceadcae1da8d367c911e9a8dbc78c16d19c5186b67913e98b23ad93941d6432bc9f26a0b5c0a91cf41608e652998
SSDEEP 192:3qPHc+27ZI+q+fd8tJSrCZufF9JTzjLaosgpTz1TL7S4TZE15YWvT:afIPTfGWGufFHzjLaosghN7SK219
TLSH
T11813F93DB20E1D43E6C73ABC8527ABBBB379DBD2EDC2259B5A7D36A402017005D4E542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 57b61b9aa0d7c0ae2cef5fd12e52d016964a100d05ee19b2858c8e26e9a981df
MD5 1d28ca1a3a688da234fc7feb2acf4185
SHA1 8de79d5d1abad759fe23de5e952991977975b9cf
SHA512 94f7cbcefcbb4b899a2dc3b3479f0df4d109500bfdb704749e71a0cd13f7e80d312fb2249a71abbacc84946c767b37197777751421130791c3c00f1884e7a7a9
SSDEEP 1536:8zffDL/+JL/YeXUcy5Onfaodmz+VDcP+157kMjJ/yc/:8zbL/OL/nEgtUM
TLSH
T115444FF71951A00BCBA852F5E2033A3DE27B429D7CD1F8E9E57C4C852925F21B6BCA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 de7dc06c79493c6edb94943db53a47352b458b09de5cddf31b8e9e857557f718
MD5 f16ebdc178f1893b364815ec9ca8f8c5
SHA1 62e93c538b2ee4484b5077774c4ebc0be7bdd50d
SHA512 f2aa7e191ddfc6e15674f16a8c7c957ed4cdc8e861f10efcbd97ce10ea0986c22c46765cbad0af16e43ba0bc5af9dc1b9dfce782789c3f4f88ccfd322f30e099
SSDEEP 3072:Hv9G+6KXNGkliHFFj+y90mxDkXGTj4WMS:HQm9GklazjekNM
TLSH
T1522538EECB682C93CE6B8B7070E0D9077E712183BA49D0D39944C5D997D2B8175E92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8d0f9fed64939fb66c683dc41428b5d4f5c78e783d8292e02f787477d668759b
MD5 4c5184b439ee71240d3bf039d55d0b21
SHA1 759fbd5c9d57d4f4414b2c8277f3c4907ab51b1c
SHA512 5e56928391766d95b9156f1878941b5ef73bb92beb6a0b2649115c001791388442c0c942883b5cac97297933569a7ba21b0e6d258b6163b4842c94c2489581fa
SSDEEP 12288:KZD/dEFmL59nc//OEgO7OLcceU2K0JYZkhAacAYV9Rd45+MA6u1+nOPj5q/cdhNZ:+p0mnODd9jnOBCZNWMZ2sbL3XN5N2
TLSH
T118167DEDCA6858C3CD639A30B4F0E9477C7413C3F995C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1d476e52d34e074ab4646a3836d593bcd5a3cf03cd48c91765cf8a84361f8a4
MD5 d4b0c297676be5cb3ae63f48b63c4dba
SHA1 cb748894430db9c4fe76e202086f34b1afca9595
SHA512 04987dbe5ce1fe36f28a1522a9f324e2a41bfabe4060470f9ba1e7a9cdf6550c61cc5f56a042e00d2dcc0ae7937024bbeafb1229853f041e14af79c865fdbc72
TLSH
T13A613BD9E45CCEA2EB9731F583E022ED7BB4DC0B91132E1164DED07C9987B12620308A
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 9c2a28517b74aa2530f088820bef8ccebd1eb557bf07c44fbb9a4132cd9dd145
MD5 4231bb1c2a8814bf710315e4d63f3ed4
SHA1 a26f731ae113b5578d3a7d12f531e0bb085c5c20
SHA512 954a6f3fc07e9c10050aab15ef002f74d3426d01bd7eee691be1acc81862db487756cc9d67de9d41b0140ae7cf3783922607b7e23c72abd5c2cbef8ebeb2df48
SSDEEP 3:MsEllllkEthXllkl2zEklJVl:/M/xT02zn/l
TLSH
T1D94404047FC04405C50050304411C3504370D5350711774734F144175CC55441C11005
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 d14953d305ca305a6c4f59972cc30d02113a23a6bef7631ac058614f293e6eee
MD5 9e4a62ce3807b92a2053a034cdc5ec0a
SHA1 ac9679c126d69a237b47859a38562c3d019d4e11
SHA512 c57b6979d1de5ae7b4ac63d2d97a8e8eb7f1121a6e51f2af7389017faa2cf1d2698c1d820e2786b52047dd4906bb0eb658c19f963b5d4c7e3e15351c67d556d4
TLSH
T1F2E0D8A4E4DAD39EA52434C342246F48E2913447D7866DEB27089CC17687209B2465D6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 51ba6727e91377b2fdfa51bc4e7cf5f7ad5b54f44563823c060e45bb64d73dae
MD5 866db23219fdc9bb1669aa881a8add53
SHA1 e60e833254ea9cecb94928a8323382ab0cfbc5d8
SHA512 57e664aab7719e3ecd565c3d9312694da1ec05a2002dbbecb6bec0fbb44a79e9e8cf66ce2d783308c4f78e7071895a89f39e6c65f57d09f374e33755e66eeb74
SSDEEP 24:TLZHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjTDW5LRFFtIncNVqYp/:TdD4jJ/0UC+lf53DWxRFFO8VTp/
TLSH
T1ACE2C08D3B12F911C4EDB33DA0D1C5E09ABC692C8659B57052389C76CD225A2F59E11E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 75d784b4fac24eab8b5036a13991f3c6ab5f7180129af6a54598666380dff0df
MD5 2e8ed52804bc27435b5905f470989eb4
SHA1 14c093853f457528811eeedc0f819bdb729089d0
SHA512 994ca734ec6ceec4645dd5ffa418cbcfaf0873c98580a55939a824aae49b519861850312ede8fdd8c9bb0d6f59dd5ecf9f462e8a406880bbf90c9d170c3deff7
TLSH
T1ABE0785454DCC36B70256CB783685709D3D13C97F2843D551F08EC4071C1349724D160
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 0e035ccfc93aecc0fa69d1df53358f980b8a1a1a71234202a8d52815c5d7b6eb
MD5 416cf0d8a69064013c7058e84214591f
SHA1 b4bc1a4a07f115b8f5867e5a9b2d64c1c9b701ad
SHA512 df919bb1c2f6cb5bc0045200d3cc9c860f6f7fe743247fe727456125fc9e7f01de8a498ba442794b0d55cabf906edabfaba4851befff70a5efe1299d7e7fb10f
SSDEEP 192:rehtD47H+bF+UI3iWGVoWN3qL/9VVV63:r6D47IkUI3ijVoWN3qL/9A
TLSH
T19424015E5F342722CDBD913668E745A35C6CF03F8B5366CA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 83840e8c714f4ffc0df9089efd99eb88ed5443fdffe00c966dbcb3b7485b9df2
MD5 8528ba161a7939eaef4f7bddb0b71031
SHA1 9f7e1167fd400919736a10a51009c4b8e03e32fc
SHA512 376123c79b3c89a7476e62812ecf1e3ace322ba54ca5d3dcf5ec791adc2c545cc7d7cfb66a9c119eaef0a8abebb423e7dbde96031dcad24e81ba17f123e071a0
TLSH
T169E0DFB195EDC3EA631530AB9238670DE3E1340BE6893EA61B04F841B081608A6922E6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 1fb7cf2e22029f3df22a17aa12619f7d5e7709fd8453a58cb35730274989c0cf
MD5 4dcfb4ba90bc6af0b35127f06490a5b4
SHA1 0f76a8ec7a043a5c6ecf06221804d1a2ccc1bc66
SHA512 8bdd947453de7d5b6a1b7eb65b6af78c1471caa5cf44a7093ebb61c46a4f3549916e3799608a30ff05b3bc249de0bea3f666f0d6c3b70b4859896fdf4fd89e29
SSDEEP 48:Txk/LopFMaty423w/a9NUuT1PwIoi6n/3HEwHoowoGr0wH:qDeMatha9Tun/3kwfy
TLSH
T19DB2334E2F306152D1F95E3AEEE084633E7C211D83636A59D95820B2CDA365BF51286A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b57e3d1c2f1c9d8e0d922bdbe85c47e6175455057f1f47bcc3b98ae5ff024504
MD5 56d745838060f5c31bdadc0b3535e6dc
SHA1 0eef62d54a150e78eefc929c38c2a6f97c94c564
SHA512 c307091579abac5c0bf6305b8f254ed074ece06eb8f953d6f3355d0b0492fe9fc5f8fba12c5cdbf36768418b967f2a069f849dcb8548e1a46adcb051745c58b3
TLSH
T1C85189F3C2E8866EC90146F4AB186E2BCE2D0914832C3D5A89E4EF5B93E3471E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 d9618e3ae50bd5fc317e689aa3de35ed03cb641882755f882d8d88a3425cdc4c
MD5 3f1a7ca71f5a3fa68c368cfa78994ef0
SHA1 7d4a349b599d97fadebba20b682cf8ed8b18b989
SHA512 468ef8a1d11385ce2ff252aa5bd628832f176675e6af9a48c237ae15a6bb3b86e6398e67d38ec52d064b6390c04070b7edae3d2340ffaa51accb67cebd4b5c18
TLSH
T1BEC0226288F8E0362064443A1E84A8C9A639C838000284BAC8E6E23CA0F00B79B1A03A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 525c97abaa7ffc81f367bc2ad1e7683d7ab532b89720f4ff2f7d2b15964d1d94
MD5 70fc2db888fff2ee3fb495b5d7b58f03
SHA1 c9e3b499d7e7e075dbc064cd951a0b8c7a582ac4
SHA512 52f5a29e7bb3eb69366df9e45b949e25def2ef5350f0b5812b6bd12558e4d35dff3c92f3ebc256cf9e0162071f1725a93fe910b8f0b648656b17fe7255591a1b
SSDEEP 192:sxR6RfyM/jK1Ml8Wol/f9stWpViGNkUQUzoA8pi/g6+WNIYZsfcIWgxIgDpJ:sxR63Kl/f9stWviG7Ei/5IRf1v
TLSH
T14362D815A924997BDCDBD21CF6567F93D6F81433A2911E44AAFCCA0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 08adffcd01235ed4bfc33fd0307b72d7f6e6ce74443700657b272a021c8734bd
MD5 edce1d629b1115f7fdee384b6afd210b
SHA1 7a9b30aea92561b776c5701f49b4e1161d178844
SHA512 0c53197158daf080977331ce7fb6ecc7255d280217a515c8af4c3bf12b06953e06b89b429d1bcf05e1a0c7b69e15faea38a02de2793d05fa2d4a9c8e77f09382
SSDEEP 192:sxRhRfyM/jK1Ml8wol/f9sVYNkUQUzoA8pi/g6+WNIYZHI+GxIgIJ:sxRh3Ol/f9sVY7Ei/5IFbs
TLSH
T14D52D9156A289937CCDBD219F6557F93D6F81433A2941E44AAFCCA0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a0912c738b06b61ae26bd17bb0f017b23c8ac3c8da8d14b693c2a4f7e390b239
MD5 4ad9f614901f5282c0c27e17dcef598a
SHA1 2b4d7c8e1ba3d95db6c71bd57edcc5f83153b149
SHA512 5c1685aeec5bbfde1a6eab009215abf2249d6d50b14f1caad92a78f67a6ab3d3a6fd03269eaff5d7d1ccccefdff071cb76b870c896ded87dba84ebea2dfdb10a
SSDEEP 192:sxR6RfyM/jK1Ml8wol/f9s9YNkUQUzoA8pi/g6+WNIYZcI+GxIgDXJ:sxR63Ol/f9s9Y7Ei/5IUb1
TLSH
T1BD62D915AA249977CCDBD219F6567F93D6FC1433A2940E44AAFCCA0C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fc9396dd0db854060c047064af9f3cc09c57fbcfca62112db0c293eab4187396
MD5 59c0a34ffc48bf4a77be71d843a5869e
SHA1 3a8def89709349e328de28d114842b56b730a75e
SHA512 683bb451417e8cad52f63091bb19c6b32411ca57fbf4fc8f45c4e953c468d4fd156360319296aa1871164f841f649e2f0be395cdea70445ea3e377aadfbc6b74
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQsro7ov8noV:eOEt7IWgKgf16u1jaZ/Q388oV
TLSH
T1BEC2FB2F640CC77E4F844E5DAC2ABE976DD801CB9A988D4447EE890C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 77bca676646ef02fe834a38588ddff5039e71efbe33af367e96fbef258b914d0
MD5 79c33d26c6957d3bd98a2f2c2f657b88
SHA1 373dc64eac58e1df9f3e45c848d2365779b4d103
SHA512 6b93493ad008ab3875c863dad6d5b4a2623cb8aecb83557f9ff86d5f45c85b80adabd0333f7af837bc6b461783261da669bcf674f8a20c116e867d25b434abc6
TLSH
T1D0E0DF3055E8D3BB7135209702A48709A2A5F40FD2C8396A2F08BE8061C2B08F593192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 d284c2a5bb30dd0a65ec1ea9b48deadf54e4b52c62507d2a600a7d632cd072d4
MD5 20a59bd789193bacf819d9c6fdcf9c74
SHA1 505de6923246e637ca97d20ca82bd5e650f12f75
SHA512 c46156fb58a60a558dd8ca15cd790517b43ae57d8a08455479a4bda99877497b5ef1c1a3d35afde02d85e5ed4412f0efc4c133eda50c8b5a45d46b7c1cc73e93
TLSH
T108E0D83466EDC37B7195609B4218D30CD2A3B407D7C96D753B08BC8172863487253190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0ba12cf471d9c39f1cb377214c24fd973cae8f9dd438c6b701064c246831225e
MD5 7ed0e09179d757364c5bf8745fe8adb5
SHA1 c76becef863ef6465cc9298d4c09f8b8b5baac11
SHA512 960f72ce2c3a8fa37cf2133073e713f58c5a6fa463b754355e373449b91646a8b34ef32f63b42700da43c64fac19a6d9fc5399d4729ce5b2cc50418245343afc
TLSH
T167E0267095ECC3BBB01060DB4274971E92F1FC0F93C93EAA6F187C40B5C1308B2A6191
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 6ea71f2a66377d202a7964f7fdfe5a38f239842fd732ce825d5ccee4150874b5
MD5 b42054a14ad6e40467e8498fc8c0d274
SHA1 b1d88cd8a9b413c0347b8e2dd96befc05973dd0d
SHA512 329820f345349d41e4607aa7f3e10ec39151d7d5e5a6d6f48ba0276dadbe4cb2a89d73fd12f521a1d6966c54196f09cb8eb181fae2cc769ef18b1d689c8c8ea5
TLSH
T1BE61160832FA6301297EB6199154949F125330723216E93BB7AD37E22F7AE051EFC7D9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32a9d2b27444a2e55bd8b28fba9e1a9925cff06ea4719a7363539df099b0d9ac
MD5 5bd046f6641a600f10f1f7fbab7f0bab
SHA1 f802abf8aa84b17685cd67e43711ebf9704faa53
SHA512 ba7b0ba64cd81fe1427b9c8652d2de5a291fa6dfacc0e3181efda7eb7208eff7743c423a23c3502a9d8f5bd454bffe98593a3f9ce7561000413c7b6d83d535f4
SSDEEP 96:K+H4LnphR2/hy9Rn2K5TRd2tPHaNHnCQAKdSTKsKnK+z:qnnxLz
TLSH
T16991380532FA6301397EB61D9550949F168330717216E93BB7AD26E22F7AE041EFC6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 671ca00c0073cd258f600c504e9a651e3ab10649360f544e7829018e9694a259
MD5 e94da912191579c73f38b0a5a1d47aee
SHA1 8a4a394643ea4be2903a11b367efd94136e4f84e
SHA512 43d2ddb6f218e6018945777d62b333fc13901b500b4dd3fc5fc205e3495b993a6415dde93f21a3cf28a8380abc63cdfac5c5b362626df1ccb2c48b81ab54e340
SSDEEP 384:DNrRZyCSDnxTICr+0MEhIKyll7svbFKfk7:xFZJSDniicyI1l7svbF9
TLSH
T12244750A7B747001EDE6D9725CB080771E3C726D8F22E6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 99b45c0e9019884b44853d0b047c6dd4304471e996c5658ba39d0ac5ad9e2c64
MD5 d66fb76c347171149f1f2035e41e9e96
SHA1 61be9e65bac5cbf61fcd843bdd12af84f9d212bf
SHA512 357bbb7944752e1bb52c2e9efe8eb5425ac5a4772108926074093f999bfa8278ef8dad2dcd18058b7924dc42e32b19a9b999054cf675fbbbd1d3f15f6713f676
SSDEEP 24:LL0OGxhK3thdkSI5QjUsEGcGBXp22iSBgm+xGt:zEK3tjkSI5IUltGhp22iSBgm+xW
TLSH
T1A452579BEE743212DCEA83319AD001E17E7A903D8FC1EB0255D610115FB5691A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 2c25a5ae2f62989b080d44e48327e6354c39087950b454996f309a71f7838883
MD5 e17224d7e62beb880257d06f7221e454
SHA1 f860991cdbc9772f8c3f5d74cc4351b1ed363306
SHA512 92af8c689dc2cb808c91f0775b6aaa37994d5dec0ec0ab5dbaa2358f759b5dbedf6ef7016daf8514d04619b5cf1f1de848bc4c1de9cfee31d9274cd092158f21
TLSH
T150E0868413FDB1526AACEA61C104384754853DB5574F4871735D7BE45B8880C0BEDB32
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 22b26a046f7c5d79d8d6a5085444eadfdadb80ec0d09fd484b718e3d94b38a85
MD5 75599f5bd098af1626c1d05caf8895a7
SHA1 028bac40db63786d121e2361eaaccaa77697caf8
SHA512 0c54c7c69cb1c9e43f8188007d7f703e576c32cbe0b952eeadc307e1c93e23b8b772e2c1b43c8e83843900d26158f38134b0ede3531fc61c7cb01aaa0c30376f
TLSH
T117E0D830F4DCC39F606070970174934DE293381FEBC93F951F049D44A181345B686652
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 7cad1ade3818a5327ef5f50d46fdeaf220789d8f4957167b65c6fb1d1ff7a216
MD5 7174f24dde0077f726c896953afd4f75
SHA1 b2fee790820187e079ec900d4fb3a5ddfd047fa7
SHA512 318524679fee211e25d29160101a292973310c95f15b83ddbf086f4a9d4bc7a8846b15d9f0f7f483bbd4099014559c1ea9c1edcce939ed45427f684f1cda8ba7
SSDEEP 3:MsEllllkEthXllkl2zEelHxOKt:/M/xT02zNYu
TLSH
T10F44040CFFC45405C51410304011C3505370FDD00511574374D144137CDFD4C1C51000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6d8d8f3a412e6cc3bbb654c87be45bf938d0e0e96f9de2d15f24f66d69c2e0f7
MD5 b6f14b9f1867704f87107e0d3ec9e28f
SHA1 accc249422ed1c9498d88fb27d86e380b3afe14c
SHA512 a26e847bf5c1bab97dfcacd2197cab68c68bcb9a329ad728ba13ea7134f718038bd7fbd49fe8b1b9b05019d647c8c555049a497c1bcdede1b9e4bf09da497cb9
SSDEEP 768:BjaeqD4MlshiLdMmq3fSfFPfcOTfBVDfBAaV5R4HTytYYqgHvPwQhG0fYTa:BqcjhIdMt3fSBfvfTffWTwJJhG0V
TLSH
T1AF13C0B6ECA85CA75CB2C581720336836EF44267C7C52F68DDD85A0D06DBADE130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ce4c171e1355480e2fdbca481f1ac99160b65b660d402cdac9a34835ea08315d
MD5 bd6adff26243d5bc7f655960e4c99344
SHA1 7ce7ef494daf4f9f6c42377736c7594fe594a651
SHA512 9c3d4c6029d1be8f16661c120e19b7e4100405a4a88c68e47a6b93e1cb8a02ef359a722a077a557838148025a9b8d882ce377a398fc0c43f06b3eb437cc12d71
SSDEEP 768:Uj+9/3bS4FPfcOTfBVDfBA0V5R4HTytYYqgHvPwCoXarhG0fo:D9/3bSifvfTf3WTwJ9SarhG0g
TLSH
T1E6139C7DDCA05C7F08ADB748220E2A666DE84233D2F50668E7C81B0DC6BB99DF747815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cd296bcef9f20142966a58c72357ae67d5428236ccc73c32c11143135a01358c
MD5 da7df7eb566e0f033659c094d38e57f4
SHA1 89bca5d880201d2ec6fbf96a03d809d1a2122d64
SHA512 2bb916f8f4c96cf7d0588597c7cf75ad100dcbe6e0fae1223320894fd71c2509670e03333d5f9977a1dda4cb389172184c99d25c638d4359d9c1a0f6e12230ff
SSDEEP 768:EjaeqD4MlshiLdMma3wgPfcOTfBVYV5R4HTytYYqgHvPgXyjWtxjTo:EqcjhIdMh3ffvfmWTwJqyj2y
TLSH
T1A103CF76ECB85CB74CB2D685770277976EB842A3C3C62A64D9DC5A0D019BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2afd10a4b96eaa5877da19768b551f47feeee79956f9a7d4c3cbbe849d6ef495
MD5 97917ed643aed00db771fb95b24ba2ff
SHA1 61460e92a1a1d4867983f5a1eebd6dd9c3543f24
SHA512 be4008e93173acff8d22a65c5fc5c45ead0a5ea3a00a823c539efcf05b81eca3b9ece692e08c18caed4fa4accce69faf0bafc9ed4e0db8c49f835e3c83a876f9
SSDEEP 768:zj+9L38SCFPfcOTfBVDfBA1V5R4HTytYYqgHvPwQhG0fo:W9L38SkfvfTf8WTwJJhG0g
TLSH
T1AFF2BF72ECA45C671CE2C69072133B87AEF8832397C51B54D9DC6B0D06DBADE174B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a5970e48c06ae6b82f2382e7cfb429a46c96e89ce5a13956088c62f7494c0b43
MD5 8a306ac2bfbc3e58d96bc2f5885bd46c
SHA1 716f4ad4a6ca0b763c57288b48f0996a7da24034
SHA512 30dd7ea9f63cb8aa0468bf459d95f6337f29a2ea5be368fa26c19456656cfa600dda10e20f27ce6c707a03552ec410265cf49d08c6e1dc96294dc1a1384e076b
SSDEEP 768:Oj+9L3bSCFPfcOTfBVDfBA1V5R4HTytYYqgHvPwQhG0fo:t9L3bSkfvfTf8WTwJJhG0g
TLSH
T1A1F2BF72ECA45C671CE2C69072133B87AEF8832397C51B54D9DC6B0D06DBADE174B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 970a8d2826e653861b6a564384332eb0e20a0fc605a68ddfc99a26005fd65bf8
MD5 2dc5ee58ff59f1a141b789fe8c1b2508
SHA1 fe21977e84de063cddff383b01b6dc2050cbb133
SHA512 b912b558e7be497c570260ab9ccf89e066c04471435db1fc127fd3086e312235dbfb7465794cd90b9ea43379456c322bc56ea7512f51267f9bb00c4af22c7406
SSDEEP 3:MsEllllkEthXllkl2zEelo:/M/xT02zNo
TLSH
T1C14402087BC46805C6141034802183500360DE5045525743249145126D8658C2C50040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

becc5ad6-a6c0-485e-81ac-29afc919f6e7.tmp

Path C:\Users\Admin\AppData\Local\Temp\becc5ad6-a6c0-485e-81ac-29afc919f6e7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 ddf0068359d5b0337eb3d6a6d4fba0b62c58f08ee0a689af152e352601b698be
MD5 8171061bd831e94bfa5c266c589b76a0
SHA1 55f0517e659b813a9a7fc7e7085849b48e791aea
SHA512 9a1b9ce853b5d49b044cf631011fb00a46c9f09dab418309347e5182482e13b5d79b5c55d4ef98a6230dcd0ed65d815f48791adfdb26773095b97657d7d39790
TLSH
T1E51127A03623723F67C74BC8A1764C982750E184036B6A9CEE164438ED4CEE15B6EBC9
MD5 SHA1 SHA512 TLSH

Submit Download

rasp.bat dabeans (2).zip.crdownload

Path C:\Users\Admin\Downloads\rasp.bat dabeans (2).zip.crdownload
Size 316KB
SHA256 635b85ba0f5bff34e790caf6e43e20e88ef741b3c15e1794d1342fe600eac6b7
MD5 02cd4b441f2df78508e2d7b8307d69ee
SHA1 b609700d7d71cad10c3714bb56ab1360d472a097
SHA512 ec3cdbd807a1424bd48be7adcc9a5d0db92864d88c9761334344dcf6296837794e60f523b14e9982721fd4e081c1a2fb0e81d630a738ea8f07d05004dfc0ec70
SSDEEP 6144:15Z2zCEALx3BZJvhtuRv7+D5sQ0bPkXgPnvbgjo4sqC6COy4jHm4FUP+:/ygd3BXvhkRvqPuFb4o4sqYlyGKB
TLSH
T1DC642273D6ABCD28E71F90388858551E016FF09181F617A08F871635BB07BA9CCA6DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads