40c6b8bec9237a1e0fadcb40c367b8efacde417e2a00cc624563b026d3fc1977

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swb56wt.exe
Size 277KB
Sample260629-yy59maev4s
SHA256 40c6b8bec9237a1e0fadcb40c367b8efacde417e2a00cc624563b026d3fc1977
MD5 ed3913e420b237fa72fa51fc52829272
SHA1 a06b7037f5299dd6c507f3daceb10120e1929106
SHA512 aca8dac0cc673b8314c5148f0c84e8b1b6ea27824a7147ba2b1291d523254625d1a2a15df28f04f4e2923e4506574d541257aa0948c45c59acce9799e24ea0ee
SSDEEP 3072:AZ/BEIveCNoHG6QIAn8CI95g1u9dgxvY71uSJevefbuFMPi+0+fKhpNQ6aJ2ooOu:qBE+23pJKvY71uW0VhpNMFay
TLSH
T18954B71FEAA614E1D4B6C038D153B12FFCB170A64331A7D797815A4B1B62BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_2147373204\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_441246796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_441246796\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_441246796\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_2147373204\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_441246796\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\TransparentAdvertisers	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Control Panel\Colors	swb56wt.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	swb56wt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	swb56wt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{153A742F-D1E1-459D-B74E-7F89A8F08AB5}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	swb56wt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	swb56wt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\NotificationData	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	swb56wt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	swb56wt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	swb56wt.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	swb56wt.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1436	swb56wt.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe
5868	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5868	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1436	swb56wt.exe
1436	swb56wt.exe
1436	swb56wt.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 5868	1436	swb56wt.exe	88
PID 5868 wrote to memory of 5124	5868	msedge.exe	89
PID 5868 wrote to memory of 3168	5868	msedge.exe	90
PID 5868 wrote to memory of 4472	5868	msedge.exe	92
PID 5868 wrote to memory of 3168	5868	msedge.exe	90
PID 5868 wrote to memory of 3168	5868	msedge.exe	90
PID 5868 wrote to memory of 6400	5868	msedge.exe	93
PID 5868 wrote to memory of 6400	5868	msedge.exe	93
PID 5868 wrote to memory of 7112	5868	msedge.exe	94
PID 5868 wrote to memory of 7112	5868	msedge.exe	94
PID 5868 wrote to memory of 7112	5868	msedge.exe	94
PID 5868 wrote to memory of 908	5868	msedge.exe	95
PID 5868 wrote to memory of 908	5868	msedge.exe	95
PID 5868 wrote to memory of 908	5868	msedge.exe	95
PID 5868 wrote to memory of 5672	5868	msedge.exe	96
PID 5868 wrote to memory of 5672	5868	msedge.exe	96
PID 5868 wrote to memory of 5672	5868	msedge.exe	96
PID 5868 wrote to memory of 624	5868	msedge.exe	97
PID 5868 wrote to memory of 624	5868	msedge.exe	97
PID 5868 wrote to memory of 1404	5868	msedge.exe	98
PID 5868 wrote to memory of 1404	5868	msedge.exe	98
PID 5868 wrote to memory of 1404	5868	msedge.exe	98
PID 5868 wrote to memory of 3884	5868	msedge.exe	99
PID 5868 wrote to memory of 3884	5868	msedge.exe	99
PID 5868 wrote to memory of 2672	5868	msedge.exe	100
PID 5868 wrote to memory of 2672	5868	msedge.exe	100
PID 5868 wrote to memory of 5316	5868	msedge.exe	102
PID 5868 wrote to memory of 6936	5868	msedge.exe	106
PID 5868 wrote to memory of 3000	5868	msedge.exe	107
PID 5868 wrote to memory of 5680	5868	msedge.exe	108
PID 5868 wrote to memory of 6648	5868	msedge.exe	109
PID 5868 wrote to memory of 6648	5868	msedge.exe	109
PID 5868 wrote to memory of 5092	5868	msedge.exe	112
PID 5868 wrote to memory of 5092	5868	msedge.exe	112
PID 5868 wrote to memory of 1328	5868	msedge.exe	113
PID 5868 wrote to memory of 1328	5868	msedge.exe	113
PID 5868 wrote to memory of 1656	5868	msedge.exe	114
PID 5868 wrote to memory of 2408	5868	msedge.exe	115
PID 5868 wrote to memory of 2408	5868	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\swb56wt.exe
"C:\Users\Admin\AppData\Local\Temp\swb56wt.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/davedown
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffffb0c188,0x7fffffb0c194,0x7fffffb0c1a0
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,17617579142979566437,10015157922199313340,262144 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,3721941053525842463,7930495391990027049,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2369400258523238422,9113768689956578559,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,2997528229444611947,18192054739798783413,2097152 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,12016759443878517515,2277221699368833563,2097152 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5160,i,3322837019981908842,6760659318956617492,2097152 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16198987976060863322,14581770810973012163,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:12
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5360,i,11742225395939839647,11935744323814879333,2097152 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,7581819638185156563,531780425144241457,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,16963120733241582003,5374622084110088569,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,18381788501919878565,15064616391150844924,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,18381788501919878565,15064616391150844924,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,11465886435940349829,18392544933809602389,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,4012152523821348280,4483389167543994519,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,14248776962470183551,9170608950781105528,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,4144202403969075000,2085284621645647388,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,11049837800976389676,16341637257864125613,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,1567793785045728992,15113378972743486791,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6956,i,17935259998093559413,12278916209166697870,262144 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,14525774771938776410,11215772141300389378,524288 --field-trial-handle=2372,i,2282937131215326509,14475245052335995093,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
    3⤵
    PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 298dbfd720b4c23219184ee34c22486818d53dc1cb117db25400c864c8cddcb6
MD5 7972c23af2eeeeb9f7a4aeb624c7087d
SHA1 f5f4330c0c62758acc19c539c5880471cc9e56e7
SHA512 5908210aac901fef9eff627fa7b5b46b45b9a613aeed72265a21f77e6f607324b37fabf98b92bcf04cdc5d42a687cf4bcbba9ff6fd21ca754a9b5d5b5c4fce05
TLSH
T122E022BAD821EC6B18F90B5961A4024AEB5613172A40496BBA3C810D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 69915f0c963d16a8fd27db3401d101f4858ab36ccbcfe1b48895458921a05ec7
MD5 a18d82f9d31a4cfd2bf5828f129f49a8
SHA1 a3e79462a35230331bc7adc05ef366ba2cf5940c
SHA512 3798c1578f1c919b131425be7680ae463c07c58d04ca79b44f3447a2121ed40b63feddd716f8acf39bbd5628e8d5a09ff9d270140771eb3e6b1b9bfb02ac9abe
TLSH
T1DA81921F66790DA2DF294A77A4D935E5FF7B4162C1CF6E36B8B4A63B080F3442016034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 899429e3736bd6bc74e99f2ceba1cd612f070d8b84b2c580f6946a8cc4d8998b
MD5 18ea4d07b2616ea573148ff43155751c
SHA1 63c6881a2081a6da67a5e0344aa8ac5172d0af37
SHA512 4764ea4873dc02f06cc83be78d0867fe49123690d96be0a47ce00668201e18741e26977d53190ffecafe1002fbb21b2a28e251c1e9727c1c0b2aa54b9fd97a9d
SSDEEP 96:DbS1/O+N/sxzaOToaZizBj6VLI//8LmQmXLlJNW4tfz5hwQ:D+1W+N/OzaOToaZi1j6VLI//8LmQmXLJ
TLSH
T17DB1B0F3C3E9866ED91162F1EA147E2BCE1D0515432C3C1AC9E49F1BA7E24B1E141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e065102f0be42bed49d2cb7255b98fc8d861ae783f4ee221e502372d13418a39
MD5 413db3892d5ff82f8e2e847ee596ca88
SHA1 c1672e6565f898d1994f6661ba081be0d7c584fd
SHA512 d8703b8754bb2271b2ddcca73b07628d62dbe3e2e3f20b046cd9d6c63d47dbbb3bfaf437dd07c6b9c47130164c59d2acd6b3a5ea1ddb3870a9354ef1149a64a1
SSDEEP 384:sxRwMCe/fvsPT15OhvN1z/5m/eAvTu7jO:ss9e/fuTir/58eAvTu+
TLSH
T17072E9166934993B8CDBD219FA857F63D6F81523A2944E44AEFC8B0C01E76EC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 92a779f009de9905b94e6b9864a34e8f82d46e23415228fa8a5fef04ec1b803c
MD5 8a0c14c9495baa48722a01f4600935bf
SHA1 17ac58e07f01006d7c31b77b6862b825c825d1ea
SHA512 7cc358750c4f99a4e67203585263ecf25c180840ecc016679e82de061a0103041db02406b67a050a1084cc1333898bf30625ac811566d8b5bbb523f98156bf6b
SSDEEP 384:sxRkMqse/fvsPT15OhvN1z/5m/eAvTu7OC:sw7se/fuTir/58eAvTuB
TLSH
T1FD72D8166938997B8CDBD219FA857B63D6F81573A2944E44AEFC8B0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 24ca4389d149f3ecdefdf19ae801c6b30017473da7b4dfe5e0cc37d06056b49f
MD5 b872b5990eea5ec1534449cc75fadeaa
SHA1 f852edb23f272d80012bab9b2b483eda0c07efec
SHA512 e95e27d7cef35a1929de4116a116c2734fefa1b077d5a5a9b34289f670c644699672df8a69dee499eaca666017d60f32df43a9121c82efa5b89aa595cf63f31d
SSDEEP 384:sxRkMCe/fvsPT15OhvN1z/5m/eAvTu7OO:sw9e/fuTir/58eAvTu9
TLSH
T1B672E9166934997B8CDBD219FA857F63D6F81533A2944E44AEFC8A0C11E76EC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 fccbee8e4e94c33c3f736a20afc633ac2c4d95f3328df88c4ee711847f76fc65
MD5 0e3e591285508641a67563f03645a1d6
SHA1 287f1b1efb86362dbcb5791dfa0848ef5f5dc019
SHA512 2fb95b5af407f4a48404d36916b16a6abebcb1f6ce0ca086c93b16fe6f8cebf021a9470967d5473c3936be9b7a64d45414dd8ad9f3459aea565dbe700f45095a
SSDEEP 768:57pWlr7pLuL7S3WgTXfOF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmAVdRtAroYA9e:57pWl9E7S3WgTXfOFu1jaBAVntLYA4
TLSH
T1E2E2EC7B684CCB7E4F804E9CE8297D9E6DE802CF56D8895447EA840C03C67EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 37e0c189e5c0209d959b0c23ed0aa1849ebf3a46bb85808b481a003d54b167da
MD5 624a249de01af03b5a98b70534924beb
SHA1 ce0c9a87b15b44d002b6afc4550d16d841e5821e
SHA512 cfb588f024ef6fcd195e5f6782c76c470d529d7653643277388dbd480981bf1bf7ee4e651d68b1b4add5932185009866d3c499b90e3fa3dfd4349979d5c8dd12
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v2M:ShJtf3BlQ1KbhJv3aax
TLSH
T1BDB25E5170BB2700387D250E93B9842E564630A230DEB86B77A975E26F67E004FFDED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a9ede979b272d5664d4cea4b5ce5cb41b38c00816b8670e32d0b61b108bcd0ba
MD5 dcc46071a02fe1cf241f5a1901b774ae
SHA1 24b72b095dce18d1e290d4e27b0294041cf9e39a
SHA512 21d9d73c01ac8b02c0f8c26ab7a2bc9e4c00e782c58555552dcef1482257abda56058b05e368092b64270b9d0fda1895e878b77c64f05f199a6c86ca03983e04
SSDEEP 768:iF1j+9SUwgYbRlprW9oNmFILmn12bfJol:X9S7RmM0yJol
TLSH
T119C24A36DC95CE7BADE28FC9B7097A4BAEE0126782D819D4DAD80D4D00D72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 220417a1dc27e452d1c45875f451a3085ec05334812d6a6efc90bf6811cf67cc
MD5 c0c6bdb26fbbc1bad01c56b1f1d23e31
SHA1 e0b1409e7f2a20125146de6717ef952032f548df
SHA512 b9132e2b1d3d1e20646960968435120275934259c60856e9a5ff3ee170ef3c0d11367928c1e92a9a52761d1266e3648ff32a7e1eea972893e4b5ca275a00c4d6
SSDEEP 384:nZtiF1tNn/s3n9Sd8NW8TUNTUlIRet7bRlgdWQWUtrfLFoN85VsUmXKANLW8L+1u:CF1j+9gDwgQbRl7rW9oNmFG1NL9
TLSH
T157B23B76D895CE77ACE69BC5B7467A87EEE011A385C85EC4DAD91E4C00C72DE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e277428a18cf344e95ae0e12453e8e9ee42cbcecd08b427059dbc3ddb39f6e26
MD5 2510832f85bf8c71ce63ee2053184212
SHA1 997af3f5b460eef2765c64376e68d15fcd6c9d33
SHA512 f716e1ce0947f26c2a1b67298a3dfa8041c4da865c9175e6d623f51c4b12cb5246dcca3aa32fa66a9e3af5ef5f0d65a5bb6ad7f78266ccacc06969e294814212
SSDEEP 768:xF1j+9gDwgQbRlJrW9oNmFG1GLmn12bfJ4:Q9gMxmy40yJ4
TLSH
T136E2B3F698D78977D8AE8787633D2E469AFCC163B5881984B7D80D4CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1b712c06b195a5b98ffb5a904c06da6af1090ba503b95333adb049ea4fad5af6
MD5 1abfcad17117e61eb73135b6eb85fbd0
SHA1 0026d675ee3c62eb3bd5607da45f0026c11c5a0d
SHA512 71430b0212786f3d8d779f76902809943894c8245353196a385bea065e1f77195a9a24819c4dacd4aef558b136fd1e6af4a264588573bf1ea5991e05ad603487
TLSH
T1842141E09C3C29C2D8BE08AF600B25FCA8D8C326F59474386858ED88513A15E264083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a95831319d8fb036fc53715151ff2921dc9a1f4564f0302a17d676db3f67f13f
MD5 734adadf2423db56a83a2eeb66d45412
SHA1 e1ed01da2a5bd86e0b0743d82ab75b5a2169dc92
SHA512 917af56a1465675f5fef4d6c9acf12c3b218068c93bf1c2c66eb5d83546f0cc4a56b4c37cf9752533c241698035eddc3dfcb6d14f1b201ea8de4cd14ed529f7f
TLSH
T15C111FE0883D29D2E47F08EF601B25ECA4D8C326F964343D6858ED98567A15E268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf288ffad27e8d7111ecca6422c42575377392883d684de617dd2ccf8a523248
MD5 8af5c61e018d0af455c78be11683ae86
SHA1 95f9d88491737292205c83615f640a84f136b286
SHA512 190be5da5c9ac31b30424a50312c781bce37a4f314d3f58967c564789791eeec63ca216edc4ce2fad5b66bb74f24d55c6526382bf4a0d6c9038e4ca6676401e3
TLSH
T1B02142E08C3D2DD2D4BE0CAF604B24FC98D8C726F59475386854ED98553D55E364083F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5868_1685605172\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download