hxxps://git[.]churchofmalware[.]org/mastercodeon/DataDeath/releases/download/v1[.]0/DataDeath[.]exe

Resubmissions

28/06/2026, 20:12

260628-yy738adz8r8

28/06/2026, 20:04

260628-ys8gssc19t8

Analysis

user interaction
yes
max time kernel
110s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://git.churchofmalware.org/mastercodeon/DataDeath/releases/download/v1.0/DataDeath.exe
Sample260628-ys8gssc19t

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	6076	msedge.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	DataDeath.exe

Executes dropped EXE 1 IoCs

pid	Process
3776	DataDeath.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 29 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	DataDeath.exe
File opened for modification	C:\Program Files\desktop.ini	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	DataDeath.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	DataDeath.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	DataDeath.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-runtime-l1-1-0.dll	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORTL.ICO	DataDeath.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll	DataDeath.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll	DataDeath.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationProvider.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\msvcp140_2_app.dll	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF	DataDeath.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\de-DE\MsSense.exe.mui	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fi_MASCULINE.pak	DataDeath.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_MASCULINE.pak	DataDeath.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_shared.gif	DataDeath.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\be-BY\tipresx.dll.mui	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected.svg	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10R.CHM	DataDeath.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-cn\ui-strings.js	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll	DataDeath.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG	DataDeath.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\classlist	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat	DataDeath.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll	DataDeath.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll	DataDeath.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml	DataDeath.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271508934720641"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{A9B73470-B972-4BC4-AA6C-383152872090}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: 33	2124	mmc.exe
Token: SeIncBasePriorityPrivilege	2124	mmc.exe
Token: 33	2124	mmc.exe
Token: SeIncBasePriorityPrivilege	2124	mmc.exe
Token: SeSecurityPrivilege	2124	mmc.exe
Token: 33	2124	mmc.exe
Token: SeIncBasePriorityPrivilege	2124	mmc.exe
Token: 33	2124	mmc.exe
Token: SeIncBasePriorityPrivilege	2124	mmc.exe
Token: 33	2124	mmc.exe
Token: SeIncBasePriorityPrivilege	2124	mmc.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	mmc.exe
2124	mmc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 5136	3324	msedge.exe	89
PID 3324 wrote to memory of 4612	3324	msedge.exe	90
PID 3324 wrote to memory of 6076	3324	msedge.exe	92
PID 3324 wrote to memory of 4612	3324	msedge.exe	90
PID 3324 wrote to memory of 4612	3324	msedge.exe	90
PID 3324 wrote to memory of 3464	3324	msedge.exe	94
PID 3324 wrote to memory of 2464	3324	msedge.exe	95
PID 3324 wrote to memory of 5724	3324	msedge.exe	93
PID 3324 wrote to memory of 3464	3324	msedge.exe	94
PID 3324 wrote to memory of 3464	3324	msedge.exe	94
PID 3324 wrote to memory of 2464	3324	msedge.exe	95
PID 3324 wrote to memory of 2464	3324	msedge.exe	95
PID 3324 wrote to memory of 5724	3324	msedge.exe	93
PID 3324 wrote to memory of 4456	3324	msedge.exe	96
PID 3324 wrote to memory of 4560	3324	msedge.exe	97
PID 3324 wrote to memory of 4456	3324	msedge.exe	96
PID 3324 wrote to memory of 4456	3324	msedge.exe	96
PID 3324 wrote to memory of 4560	3324	msedge.exe	97
PID 3324 wrote to memory of 4560	3324	msedge.exe	97
PID 3324 wrote to memory of 4824	3324	msedge.exe	98
PID 3324 wrote to memory of 4800	3324	msedge.exe	99
PID 3324 wrote to memory of 4824	3324	msedge.exe	98
PID 3324 wrote to memory of 4800	3324	msedge.exe	99
PID 3324 wrote to memory of 4148	3324	msedge.exe	101
PID 3324 wrote to memory of 4148	3324	msedge.exe	101
PID 3324 wrote to memory of 5732	3324	msedge.exe	102
PID 3324 wrote to memory of 5732	3324	msedge.exe	102
PID 3324 wrote to memory of 5732	3324	msedge.exe	102
PID 3324 wrote to memory of 1140	3324	msedge.exe	103
PID 3324 wrote to memory of 5676	3324	msedge.exe	104
PID 3324 wrote to memory of 5676	3324	msedge.exe	104
PID 3324 wrote to memory of 5352	3324	msedge.exe	106
PID 3324 wrote to memory of 4720	3324	msedge.exe	109
PID 3324 wrote to memory of 4720	3324	msedge.exe	109
PID 3324 wrote to memory of 4720	3324	msedge.exe	109
PID 3324 wrote to memory of 4328	3324	msedge.exe	114
PID 3324 wrote to memory of 1108	3324	msedge.exe	115
PID 3324 wrote to memory of 5268	3324	msedge.exe	116
PID 3324 wrote to memory of 3784	3324	msedge.exe	118
PID 3324 wrote to memory of 3784	3324	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://git.churchofmalware.org/mastercodeon/DataDeath/releases/download/v1.0/DataDeath.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x25c,0x264,0x288,0x7ffa1affc188,0x7ffa1affc194,0x7ffa1affc1a0
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,18162731815206007441,6441082945335809528,262144 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,13236311936285514803,5657898249197817029,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,14936726768265930384,4488109974517216572,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:13
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,13514031023653342744,12780105456245607189,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3348,i,12797849706676575849,11987278768718696679,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,15002463641939777250,13091785643006384625,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,7039351083764381055,2551639641082564719,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,15214198588706200770,14483135336926977680,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,14581041277574762801,15598053527766692611,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,17483021397013757274,7237673688273862129,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5732,i,11984351645620109062,2281789102838889169,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2687623296215159333,16147368298092526247,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,348651107794233159,18196625339700337099,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,16578331260567064624,4598748233816244348,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,16578331260567064624,4598748233816244348,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4688,i,13033066477257152754,8324216385276623982,2097152 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,13092697372869106789,15195859615781344051,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,8802280316296940218,13305994556414112460,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,3415035193361140949,13642553191785914971,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,1093774612793199185,16670864747507703541,524288 --field-trial-handle=2268,i,2210238027090602318,13913530967268899940,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1848

C:\Users\Admin\Downloads\DataDeath.exe
"C:\Users\Admin\Downloads\DataDeath.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3776

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18f202f0-3ec1-4cc2-8eb2-47ee4a572ca9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18f202f0-3ec1-4cc2-8eb2-47ee4a572ca9.tmp
Size 38KB
SHA256 f8dc41a6931ca448639ad424d2ef23864cb206fbd30e9eca917b153f911f986b
MD5 3dd1053b2853e77e350843399fef2c4f
SHA1 39b319fb83ad7dfa8d3bd1d345aec8198d478fce
SHA512 473da1119143a3b261f24d24292384a5a85781cc6420da0d8ff4f3627ebc9a03d1c2db706275a35981125ed20dabb15e4acda615f7ad93a74c8bd93f94027d0a
SSDEEP 768:o/jaeqD4MlshiLdMmR3m/HcO9fyPU75riXYUsZUgb9eHciKCT6:o/qcjhIdM23kMUiIUsZUgb9sXy
TLSH
T17203B075DDB89C678CE3D6C4B22736836FB5409385C92E9C9DCD670E02D71DE520B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db527a753fa1b61c1784c7e59df5ec18881ced2d5206b75096d75bd1aaab39da
MD5 18bd661cf22857144a33398357bf42e6
SHA1 3e264f95e623055c7c7483e5d23fbb942ee082aa
SHA512 d5c779c90686c1eb63e30520d2d6a02b002ab9c6178d9cfac791717faff5ca9bd60abe1bc6c7a38d6665f83ba6a7411aec3777dac3cc18ada53e1d3395db2451
TLSH
T190D0A730BB15B7D1D75501B681205620627A554735C28609B291C90D88780C0A7E7DEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb
Size 330KB
SHA256 d7c85c13e40ce03a51a243405ccafc260138e52bae2091f46e166d23f803714a
MD5 9ef41f1edb9e9ac0ca9bf9bdcbf4b056
SHA1 85d24df64e75c45de0e435fe2fe8b99775b3c428
SHA512 03e26be05dfde59e95e70fd7971e3a5e6af3933a3b5188dfe63865fd3959061462a91da8c34e7794e375b544043ab80cf080bc0b6ec874cb4ccaae8aae24f198
SSDEEP 6144:lrJal6K1U8TCEI97rUfbBDWEIYoIuxCgs08MnIznfRzwA1hJnys/vCkHo:lrcllWPEIegZrxCHj2I7fRzwA1hNri2o
TLSH
T1837412F36C75D34B41B643CBD5FE74C6F6A98AD4640094FB610E4724A10F7827AE23AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log
Size 791B
SHA256 dd47298da2e56cf407baffce990d32e3137b82a8db4fc330dde6993150d36e5f
MD5 ee059e8e461b20c00ed8b7a472ad4690
SHA1 d57ffb954c5097da467f4af3c0f7e5af9ea89bc7
SHA512 fa695716aac45d6db55680a17f82d140484913f41fdddf14eda3c222a06fa5c057917cdf3b632494459a8c1dae1fbb77e9010538d9d5e224bb2c8019a2bf8bfd
TLSH
T103018EBD598C854AD3C0317AB287B0811A7E93019657DB3E0B71F6C072DCE942F2A761
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 357B
SHA256 30300dbff42aa17f107a142b8cf0dc83017d3b151e5a7086a3e746ff7df3058f
MD5 1c234051f508e7c6db325987e1a1ee9d
SHA1 d3a71007dec9649cf38036df503300e5c3ff10d7
SHA512 96aa807e4c57f868eb99baca0814abed18675a80775fc63564674a7494a52a121ddacf438edc1881c5598ec8d06c3b233e50747215b49e5a4c5bd51a1129267f
TLSH
T1E5E0D855F2C9F394150AD447C04C42976060610EE64DE56F2304F35919E0242C18E7BC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7885d16b865c507d1c1e34c8b581e176a90166d4dc5e2cb6f42f0b14d7f20e05
MD5 269930d6dc5806f5bdf5f11f6ff7fa43
SHA1 725fd960baa40e456e88cc3572bb933795f8b98d
SHA512 6fd048931eae44a44f986463efc17747a1b14e40585eaa5d71b3082a802a837244282bcce25254f93b29f409c3e787afa81d987a5808a049a0441b2e7413dc6a
TLSH
T1C9E02BAAD921EC2B1CFD276C10584B46E744131B6F90485B3F3D960DCFF2637018686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e0fa89872e854ba5f603a62553ed886303786a8215e17f86be9b53b93d881895
MD5 8d212bebe29d58d0515c55e6fd2d3922
SHA1 ea87585b0fc62fb417c1a127736157a216df75e1
SHA512 079b0f89f640329a26ba9f05584760dae89b3d44cf5be375fc37543cb28967537f2ad9442bf31f588e1b09a492bb5fba35b0207b858d60ddd672dbc1b6aff0ac
TLSH
T16451071183F38566DBE2067C1FE2169433F4B84EBD27EE857C5C50B48E4E7803891349
MD5 SHA1 SHA512 TLSH

Submit Download

collectionsSQLite

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Collections\collectionsSQLite
Size 72KB
SHA256 846d4b3ed5153cb6d5176d30d84ce9f5fb9918365d6cbfb5d519a1070ac26094
MD5 24d04a6ce2b8e31dca9aa73c610683d9
SHA1 bdc346b650eb755e2d3833a538f5e0a7c2b16fe5
SHA512 b298abfd55ac38690cad81ab44576fd89d3fb6dfdca3e0316e083ed3296e3bb7bd859081ce7fd3f3b73edbb5356a9fec04723139e5c67d94ae744dd7916567e9
SSDEEP 96:RR94jweGq2L4H7pgNPdQyoDbel9myJrDVb4:/94ZBS4FgNPdPl9myRDVb4
TLSH
T1CA739D5A29143731C5BEB339CD93A0E21D3DA16ECF90E51178A8D9148DB0AF3A0A795A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DIPS-wal
Size 52KB
SHA256 1bf3d69341b8b7adef7a98c26fe7e0fcf4fa695e8be1ad3c28daf09f158161ce
MD5 4be56ce9a6dee7aea1d3b871d6a49d28
SHA1 006dd780724b1eb85c9322fc6f10555afe8c9a85
SHA512 5187a6248dc92f546ad7474d0d00096da1b6191e91f46fbd290d7128d565dc078cc3f9326bad2df7badb205e35b43279742fe5d40ddac77c7d0d03dd8e3a1d9b
SSDEEP 48:nBLQq3qhmJPG44pv3tY8uaLNW9WhmcUDg4/Paf:n/EmJPG4K3tLuaLNW9Whmg4af
TLSH
T19B3366468F6EAC53D4CBC67BCDC04AE20B7B879C972F6E14547808B25DE0144417F4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 aa1ea8800e62b8c80d44e53a468c5947e2335fa55b2c025c690960888e79025a
MD5 5b42daeb676890e41b12a79df97f3632
SHA1 0f73248b4986000b700cea6eb5dc4cefc6f8e5e0
SHA512 ce304d06db5115f81f4c28b2409176934e73c179b29f92fd296d18fae1e1b95582d1cbec5080c91194cb75e0b28358c265c6c9be576225637f11121912dfb5ca
TLSH
T1B5E0D895E5C6E35E9D1074E391689759D2943897D686BD07170098C07E82202F2AB7E6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 906d2176582bf9f80d2be8cf5b727e9222f484c39cb2612988ed62d23a8bf694
MD5 0348b24154c60806a8e7d3080621b4b9
SHA1 996a5770d2f09a8f6272bd1382948cac3e0462c1
SHA512 cee0f5ec366c8bc888120afa2456a500c35e3532a740fa875c2ecdf8bf9c6311b9b611bc2eb11103c039a7b7f0f55d7edaba8933c46f6c37457edd44342d7bd6
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjcAa4yH/DZnm+oga//Nit+mpo:TtD4jJ/0UC+lf5oAt6Zm+o7/lit+mpo
TLSH
T13CE223893A12F511C4ED773EA1D2C4E05AFCA83C4AD9B130863C99B78D53565F48E20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log
Size 148KB
SHA256 bb1a95bc1582cd1a01b317fa842fba5ebc5f37b12b16c105992131018240f1e1
MD5 56090855065f2499fe39db54174b4294
SHA1 38b2b41623f6d5f3cf0542766c64df141df4eedc
SHA512 39346e7489701d5c63eb38cf2986f965b4ebd4ca2e45f6b3318c817230e523ddf5483323486066f9f27e05a386ba85409ecfe952b9ea9c95e31f89c90560d00d
SSDEEP 1536:n705iRQpk0FzfZwk6D/nKQbpx6WLD8wNTErBz:n705iRQRFzfZwk6jpx6WLDNq
TLSH
T137E3411271FBDF7301E24A48369715D6BB7C1A99421CFDBB7F912954A6CE0B4A3A23C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG
Size 350B
SHA256 f1a96f89c821a4864c9b11ef75434c50a0cd2c724151f9f9d201134049cc697b
MD5 0db5eb56b47b0768be875477042aabd1
SHA1 112beebbae56d5ee480f2a041b911f9176a8a694
SHA512 d7912bd1e7a5c989b0a590bd083c83f1ad31b2f31902a430940a25b9f23880a3972235f6c4cfb287c9d7c328d6392f2b5b6d3ea9b3f4f1daa0d4883c6cd7005a
TLSH
T181E0D890E5C9E36E66402483826C4349E1F0370FE688B9172B0899A47545189F2CB368
MD5 SHA1 SHA512 TLSH

Submit Download

domains_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json
Size 128KB
SHA256 44ccb0282cb0eab19946e27620ac60ec43885f4a7c8895a11c10d3a9bb4835f6
MD5 656f56187bde211d5f3986292cfc6e0e
SHA1 2f20035b8d5d3fe26c1e631a9caffaf5cb610b7f
SHA512 b54aca365c51cf38b84d0d218dd538de3763148a86039a3c91550290389a562423cced38bae3367b769e8d4db4d86a3b605b96ea795138509e8649c249d536b9
SSDEEP 768:OgXv3f+MKGMACimkMAQeeE+GCsk1j2zk4PCAziRQVFzfZwkD4q0MOu0MGWs0GW+V:OgT9CAziRQVFzfZwkDHA789VnDA54m
TLSH
T14DD3154231FBEF3B45DA970836877F52B76C1AE5406CFE65BFC72C449AA00A4B362146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Extension Cookies

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Cookies
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 322B
SHA256 a4b28a56c5fdb3d437c0fda6dea46d2233e43c8f142f3294cac7f0f2f60b35b5
MD5 35202945b7a5846bdd4da15c87950566
SHA1 cc6a0bb804a8ec02c9fb8d904d0c8481882637f0
SHA512 1b1079920fb3d840ae4da2ef8c7bff5db33cab505cd773de768cb901c6db4583a435d021a3ae83646f539685594812cc4a44b9c1d399e4563926f4045bb8f1ec
TLSH
T112E02644E5C8C33950147487C6A8838ED392380FE38A3907170CC8C6720120AF3EB7A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 304B
SHA256 1f844da045ae4e4e56937a272b1c4679f12badfc99e892895bf61bcaea111fc6
MD5 e31621408f289cd9771b4a7bee72f0e6
SHA1 730336e9c21b7f4f753b1fd9c4cafb9d868be5e9
SHA512 a0fe5b23623294e52f151bac2e1d57ecdcaaad55297289ddf3657329e75744e6776ddf4421e5d7e89f899f72465181a9e33dd8e0ac64671678ab6126344a1f60
MD5 SHA1 SHA512

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f73bf6b88d4c45ebccb33142d958af1f7a849be1141d80a9e5ca883b2d7657ae
MD5 20dab033ed2954024469a34afc23f771
SHA1 4ef63c80441381c7cdfde584daa15a15b2872d09
SHA512 ba4737e8a3b3c597fd09619ec58a9a32411c0c43bba00a558d18104e318d07820488dcc1b74939b325bc47126332add968089651138a5b90d48f16f89a201aa0
SSDEEP 192:rWP8pVvFoH+bF+UI3iWGVoWN3qL/9VVV63:r2qv2IkUI3ijVoWN3qL/9A
TLSH
T15C24115F5F342721CDBD913668EB44A35C7DF03F8B5366DA686104B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 eb28a09ee08dbbbcb59c7daaa38b35c252bf916c01d3c01a4a1ace99d097c963
MD5 aa18b3ac5bea4f12630cd539f473b8f4
SHA1 ee20b406b95fad85e93ac9ff256bf5baed745db6
SHA512 3a9d175e0e2a95dd1aa8423a955b10866005f92c3d55647e9b745037a9a037338d9a4c3dc0b5728df0ac3413d1bf48267425dfdb784785c50edaa9ae28935090
SSDEEP 1536:wfEEMUHqdm31/ZGZqW3UUPDuVepBLU9vlZsC62UMPq:J8HG/Q3lUh
TLSH
T14CB36326D6A54C6B01F12264EC754383F325436F9282A82F3A7C5D5C2FBD93A6642F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InterestGroups

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

InterestGroups-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\InterestGroups-wal
Size 221KB
SHA256 ad779fed757e41267a799bf8cdc128e641b683d631b1cc11238e2fdf7aace54e
MD5 fb7a25bec0146b72c0bd3cabd4d41b8c
SHA1 cc69e760182d7db62b0024bfeeed3b36f115dba5
SHA512 8916721334de69d2e0d039ea97270395ef041697052f15e8639982871a45b925ccee67396c1267efb3fdb3573f0817f18cb7274acdb2c88bd30f519ecfaf6275
SSDEEP 768:sZ+l+lMlqlQulrlklR8lT8lG8lY8l8Sl/QbQYQzQvfQ:1JKPhJSQbQYQzQHQ
TLSH
T12824208E5FA53629C1FA22B5EAD04D834E3D002FC7C356C9269442F2EAC7856D73D1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 40e65051797ce08143e4eb601291003553a4af76551d4865e6e38cfc8b8f3b78
MD5 98302c722ce092e1e1dd702fc78b5bfc
SHA1 84e14269577889e799bb20557c79f601fee00665
SHA512 26dd9a23550359d2b8c4887625dd81523862746eb7826ab20248c65eefeae12b7aac6ff4599e30262ec40d747eb79f88b3fc7cec3afb9fd4ee15e0a202de2a43
TLSH
T1FE41AFF3C3E8862D890146F4BA192E1BCE2D0964436C3D1AC5E4AF1B97E2471E14085E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6d1c4c47b38c34390ed62940767fc432620c2f099acf66c3a1d75ad79ec55cfd
MD5 8e93613cb4e378bdf752c6b6e28c9148
SHA1 9542b8e09e2ad4112b0c7a1e5d279d06cb2e5fec
SHA512 fc7964aaed1e69f0c85cfd14d30cc8965682f93f9261151749f9a923589c346fae461e9eb6243a0c28721f8758b933cc7a06413231b9d307207172a373819a1a
SSDEEP 192:sxRB1/yH1KOMl8wHb/fvs4FUuIyozoA8pi/g6+WNIYPHUcG7mg5IgDdJ:sxRB1TBb/fvs4F3bi/5IjDmgFj
TLSH
T1DC62C916A624597B8CDBD218FA55BF53D6F85473F1941E48AAFC8B0C01E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 589fa6f752ce68585b7a383e30af9f4647c8cf830c211ac3f2038b6b8ddcc03a
MD5 9256bf70a7b941c06364f4a39f2dc7ae
SHA1 5dfb55fb4f04b257d37d880a56ecf3da055e0d70
SHA512 39c303cdb2b190401350d00696530963eb5fca012657cea3e34a251f6f7c9791c7468c267017f687eed7a75fafc96331ddfdfc86e52c7dfbc493b77d740a88c1
SSDEEP 192:sxRB1/yH1KOMl8wob/fvs4FUzIyozoA8pi/g6+WNIYPoUcG7mg5IgDLJ:sxRB1TOb/fvs4Fybi/5IMDmgFJ
TLSH
T1A452C916A624597B8CDBD219FA55BF53D6F85433F1901E48AAFC8B0C01E7ADD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cff39cfa1032fec4d4e0c5e8c4e8df2ef7b51d416e8aae76da10954e36abb396
MD5 cf697ab445af407277639c14eb6754c0
SHA1 af94077287c5c7ed769477afd069aa6c9fe9d6d7
SHA512 9512fa9df5d8a35d19d2258d50ce5467a91935f08ae6765ff3f9eb3a8a3134fd9bd8c2763e71815e16d6bcee1f21c71a3c8049cd91a0088b31f2510000978a67
SSDEEP 192:sxRBu/yH1KOMl8wob/fvs0UzIyozoA8pi/g6+WNIYPLUcG7mg5IgIJ:sxRBuTOb/fvs0ybi/5IJDmgFs
TLSH
T16152CA15A62459778CDBD218FA55BF53D6F85433F1941E48AAFC8B0C00E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrivateAggregation

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PrivateAggregation
Size 20KB
SHA256 fcc11e1d32e72f65db7326f72f06a9af22ff934db247fbd2e1db6265f175291f
MD5 b75fbb6b6c9274ab483deec4683702c0
SHA1 82bd27e0cd226ce350d1e0733dc9dee92e174d55
SHA512 0fa0ad7dd74ed3d5be75dad91a4cb58bd6f035d6ea5ba7cd6063e6b7be04d48b54142f2c211ad44414914a298362586489bccff26ed1abf3fd515cf9b39dc5e9
SSDEEP 12:TLyqjXWhNOUhhQvbKL2LzKFxOUwa5qguWfpbZ75fOS:TLBjXWjD20wzK6UwccWfp15fB
TLSH
T15A9202834D449227C84E5E36C3C393D1CEB5711DCB61EF80539068133FD02C0426E619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1c35f917f3a251dc4a8d010158a5a882a3b348756ed0b08d120133b827b5c7aa
MD5 e138dd544d29f807929300f734c38200
SHA1 0b66ce21407ae52c1d3177691648e2d05ba93942
SHA512 2f7321c35690635364456357c3f36ff22e3aaa34e966f04f071ce3ddcbf173393a302cd4baf830b36ea3d080da6e97770ffd2dab0ea555212fd5e0b98d248acc
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nY8rouevdWWmT:LKKg6xWgdVf7ku1jaY3YnuevdWWmT
TLSH
T1C1C2FB2B240CCB7E4F844E9DAD26BE9B6DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 636ab4828e7e7100b6955e9b1b6cc00a032edd584e18d261714939ad6e5a53aa
MD5 9ab9ab95b66ae694010417a52948edf9
SHA1 23b15e1a4d5e990ea36cf932a9ee7ea931f6dd72
SHA512 b9707921a47f8cbb52df8568b46b7decbbee7811f2d4c5b52396cfa48cf61e5be94dbf96e26ea1f20531c2bd857c6a4d613852a03b9d039bf73b6c49ecec2716
SSDEEP 24:KF7kvgHIfKLhO1CSatLyXhdQWdudldV7daEdjdjd+BdzdOHdlIidhd+KDdth7dPa:KE4IfKNOcryRgIHKFOcVlIFKOwgvyU
TLSH
T17491F700357A234138FD395881689A1F619634A7313A793B7BBC21EA1E27D406FFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b4c02d3013348e491290710cc053584db7da1da94b7e2486a9f332ba1eeabc2c
MD5 90d3123bd03d8f6665f387e3cd30e255
SHA1 984e957da42e617b68ea7cb3d5d77fdafde78fe2
SHA512 9d68bbdab827c69c6136f4ae1795f901897881487785ef21b35c8d48b0278dc99cc299fc38e0c872b5979e87a7ad2d3e04d639ceb1a93784012ca6949b9d8a9e
SSDEEP 384:DNrRZyCSDnxTICL7xMEhIKyll7svbFKfk7:xFZJSDnijyI1l7svbF9
TLSH
T12044750A7B747001EDE6D9725CB080771E3C716D8F22A6D16DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 426B
SHA256 203175374912510d3e42c3f81e502b0ebf8450fc24cb14df7111b1e84a618308
MD5 861209e92dca51dedccb4d124ebb076d
SHA1 379fc2eefe7e79ae5c87f7edf2cfc0cb779a2cb6
SHA512 29ce919ef08e1edebc4bc2c0ab6adfa4bb13fbac2b3352660542140cf63b3f356246c072c76e1191b5fd35b1197642f58e697c5107886a1fa10dea11da2b8fda
TLSH
T1E9E0308073BA31946ECDAA81C11D2507B4E93D6A161F6871336DA5EC6F44C085BAFE32
MD5 SHA1 SHA512 TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.7MB
SHA256 b0eca106360ececbe2cef250728dc31b7e3e5479ebf8ada79826f153ba70ac97
MD5 54046a85b54a810612796870e3dafa1c
SHA1 b5b46ee84354aeb49ed34a0fbf92f5cc90ed692c
SHA512 83c5d6baa223e8cbd1e8fd98966f7be1d768a32017ed29486808b03186721751265be9f5975df86143ab5e24bd8319c75b8443150884cbd721ab6d9af5202865
SSDEEP 12288:FI759uxLu6l6gQP4xxf2aObUdHPqHjyKaShmPeBA2znixegNL79BKkiFTPeFEQ1n:FL
TLSH
T1840695F76D15819BEACD7174A82BFF00517386218A24C8E5BD3D48CB7B7AA023D75AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7b7c382-dbf7-4dbe-b534-433a67688423.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7b7c382-dbf7-4dbe-b534-433a67688423.tmp
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a8c08d16e43a6ee9352b61b68749e3fbf21bd0e678088e0df6babf9acb7dd31f
MD5 5c38ec6a1ea59775637f372b2f4d56bb
SHA1 b288230fef1be0e63070d7829a757bcc5056a37d
SHA512 bfe5002b39c0438680c8804b1a7d8d85d80c7023280bffeb3d17293e47d15132c469588bd902b1dc3efa6da65340dc1a84a6bad7a569d512db78fff5f0b346a0
SSDEEP 768:AEFzj+9Q3wwgg/HcO9fyPs75riXYUsZUgb9eHciKU:Ap9Q3TMsiIUsZUgb9sX1
TLSH
T175F2BF329DA4CD6B8CE2DBC4F62A3747AFF540A385C559989ACCAE0E02D719D034BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 cf96cc640081f038682c08a883f0739a2b1875997c9326befa94830cbf6a9476
MD5 142066cd1f605673653e72d9e023d635
SHA1 42b031cdf66b8ec9ef823b26d0fadcf88602368e
SHA512 b1f9a12b9549f32383a6a191926a7a94b5592d10fd507f734960f50bec43c4f0985ace6530c36c02e791a57eb2ac4dc36ed768a062437cfbaeaab4acda5df060
SSDEEP 768:uqjaeqD4MlshiLdMmT33jHcO9fyPp75riXYUsZUgb9eHci+ApXTcsTJ:uqqcjhIdM43VMbiIUsZUgb9sX+KXP
TLSH
T18C13C0799DB89C678CF3D2C4B26776832FB4419386C42ADC9DCD5B0D02D71DE520B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6d1bde455a3adc7d9848efb7eb4733637098a88ef9dc3c3c54d4fb30ac224450
MD5 0f4558a4520508b721b5beee77d216c3
SHA1 91577d100efb9e93a947fec8a16a1cd41990d5d4
SHA512 899921abc18d8af1289b18bdae075761a65425c42d9db64c899ddfe840ae873259cb0de5a1a052f7a9c80485270bacec3fe22a11be708b275d1ea4a5ea8755b3
SSDEEP 768:ojj+9f3r/HcO9fyPU75riXYUsZUgb9eHciKU:om9f3FMUiIUsZUgb9sX1
TLSH
T11BE2BF75DDB5CC678CE2D7C4B22B36876FF5406342C51E9899CC6B0E02C72AE430B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 809e8ba0655db980b1cb634310e50dbc7ee675496172244467b00ea5f06ee494
MD5 dabd9ddf82509acfa087d2100bb0b62f
SHA1 9bc895da0bf4cbda8db779db484180160560665f
SHA512 6147eb6e65b19f7866ff1b85282ec15f4a122b4aa7f499bef77c33e66ff72c689579253cfba43e2307e00a47e52adab225d9ea2382f140b7190bfb102caf2ab0
SSDEEP 768:ujjaeqD4MlshiLdMm63LrHcO9fyPp75riXYUsZUgb9eHci+ApXTcsTJ:ujqcjhIdMJ3JMbiIUsZUgb9sX+KXP
TLSH
T12C13C0799DB89C678CE3D2C4B26736832FB4419386C82EDCD9CD5B0D02D75DE520B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fcb757aaed3a97f08f585b2929be9027ca10a4b2f52f0f796e23776e69784474
MD5 a2cc17ee78a1e7644925782084195344
SHA1 85728391d4817af107041fe9deec48f91c5a1e73
SHA512 c26a1da607ac4429c834490760d350c452142064c3481ee5a878d87083fcc5aaaeeb2fe6913116f156c397a96d4fc24f3fb852b8120b07c00039e675e8f593ab
SSDEEP 768:AEFNj+9d3FwggTHcO9fyPD75riXYUsZUgb9eHciKU:A79d3GMxiIUsZUgb9sX1
TLSH
T1C5F2BF329DA4CD6B8CE2CFC4F62A3747AFF541A385C569949ACC6E0E02D719D034BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c9c45b63354bcc10d50ef21e5c6eb2bd868726fba10440c65791e3e8a1434b55
MD5 10b91856ad70cfab216a760e5b051c37
SHA1 c9e4b08a8b19fef2c2db93bbd529c1cb6f55dcf0
SHA512 3872462994ef50c3900a0dd1b0a2e62ade8fb3ef45347a86bc72294d1cc8ccd0a715837291ea5900f723cb6a26f632361a59f31a75e4fae1905d759d8ccaec04
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3FUIcO9f075riXYUsZUgb9eHU+4+ApXTcHT+:ZkqcjhIdMG3FR0iIUsZUgb9sQ+KXP
TLSH
T19503C07999A4DC678CF2D6C4B36766472FB941A386C52ECCD8CD6B0D02E35CE520782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

de73339c-0139-4ca0-b6cd-7a92f661a670.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\de73339c-0139-4ca0-b6cd-7a92f661a670.tmp
Size 38KB
SHA256 b52938ccecfe30c016b817ae533e3a45cc5989591bb406eda98a1d35ebf89caa
MD5 3d876de81465a383826d00469608237b
SHA1 30e3fc783038c82271dabcaa4cd17cfd6bdbfdf4
SHA512 9744b9737885450f104eb01805476bd1c3f2090596147d79281555f1b84b4aa8dc1ad5fdb55c7c024d8dc60f0a105d00cec738d75d7821324e94bd1374ed45fb
SSDEEP 768:ocjaeqD4MlshiLdMmR3m/HcO9fyPU75riXYUsZUgb9eHciKCT6:ocqcjhIdM23kMUiIUsZUgb9sXy
TLSH
T1B803B075DDB89C678CE3D6C4B22736836FB5409386C52E9C9DCD670E02D71DE520B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DataDeath.exe.crdownload

Path C:\Users\Admin\Downloads\DataDeath.exe.crdownload
Size 23KB
SHA256 07f143db9891ae5ea1c54d2916c449e43862977ea77d58f101aa2b7795af9bf8
MD5 bb8451d86ec4d6ab2cd2b7410eda1360
SHA1 37373d3151d75a8854657f93a3042da988112065
SHA512 3169a88b5cf92f7e565c5e321cedfb3478a0b197c77822ef180535d20be59264daadbfeef67bcbab3b2a5f8d897f790dfe5638d2ed67f52438a5813d27581cff
SSDEEP 384:yp+l+qYlVHEtvQxWcwAHbmQpsEiJETZpvMsI9og7gEW50:yp+wqYlBfWc1bMpD7xB
TLSH
T12CB22A01236CD236CAAE23BD5DA642B607B3E14F7133EB685DC8F1562E173A185527F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-294-0x000000001ED20000-0x000000001EEA2000-memory.dmp

Download

memory/2124-295-0x000000001F1B0000-0x000000001F1D2000-memory.dmp

Download

memory/2124-293-0x000000001E970000-0x000000001E9B6000-memory.dmp

Download

memory/2124-292-0x0000000006140000-0x000000000614E000-memory.dmp

Download

memory/3776-213-0x000002244B950000-0x000002244B95A000-memory.dmp

Download

memory/3776-214-0x00000224660A0000-0x00000224661A2000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads