3fb01072d64b9779cb00b86450d88c93fffdc35c7861685a61e92ca1eab3a7f6

Resubmissions

30/06/2026, 15:21

260630-sraaqahy5s8

30/06/2026, 15:08

260630-sjbtkshx217

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift-Setup.exe
Size 2.5MB
Sample260630-sjbtkshx21
SHA256 3fb01072d64b9779cb00b86450d88c93fffdc35c7861685a61e92ca1eab3a7f6
MD5 57ed7730a4c56d3d3d04ada679efa92a
SHA1 979f9f802bc73835b8e5dcd2609d7c89eab2293d
SHA512 aa1e9b1b171ffb9011505efaa0648ecf71c95bf1617abac6f2fd9a54645df0bd0e9d8e253872304a902c1c1fef2d47c803c6014c301fe8fec2cbda7446fcdc0a
SSDEEP 49152:IuI2h9NCWa4AGnznzhb2XS6/fVT1MDZglGd46PoMla+cB4:I5O9va3UzNbz6XjMDmGd44F04
TLSH
T1FEC5E13FB28B653EE06A5A3A7A72E110583B7661A5134C5697F4C88CCF254B01E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1108	Swift-Setup.tmp
6040	Swift-ManifestVerifier.exe
256	Launcher.exe
2276	Swift.exe

Loads dropped DLL 4 IoCs

pid	Process
2276	Swift.exe
2276	Swift.exe
2276	Swift.exe
5168	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	discord.com
28	discord.com
40	discord.com
43	discord.com
53	discord.com
70	discord.com
25	discord.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5164	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5168_1269077849\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5168_1269077849\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4536	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Swift-Setup.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2848	msedge.exe
3828	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4220-1-0x0000000000210000-0x00000000002F6000-memory.dmp	innosetup
behavioral2/memory/4220-8-0x0000000000210000-0x00000000002F6000-memory.dmp	innosetup
behavioral2/memory/4220-80-0x0000000000210000-0x00000000002F6000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273058287098754"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{A88A107A-CD26-42C5-B0DF-4E806A7D63F0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{1816FB83-0DFB-4AA6-AD81-26D5792C1B1A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{0B566DBF-FEDF-459A-BAB2-9D7C431A8289}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1108	Swift-Setup.tmp
1108	Swift-Setup.tmp
4536	powershell.exe
4536	powershell.exe
2276	Swift.exe
2276	Swift.exe
5168	msedge.exe
5168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	tasklist.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	256	Launcher.exe
Token: SeDebugPrivilege	2276	Swift.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1108	Swift-Setup.tmp
2276	Swift.exe
4616	msedge.exe
4616	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2276	Swift.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1108	4220	Swift-Setup.exe	89
PID 1108 wrote to memory of 2836	1108	Swift-Setup.tmp	90
PID 2836 wrote to memory of 5164	2836	cmd.exe	92
PID 2836 wrote to memory of 3272	2836	cmd.exe	93
PID 1108 wrote to memory of 6040	1108	Swift-Setup.tmp	95
PID 1108 wrote to memory of 4536	1108	Swift-Setup.tmp	97
PID 1108 wrote to memory of 256	1108	Swift-Setup.tmp	100
PID 256 wrote to memory of 2276	256	Launcher.exe	101
PID 2276 wrote to memory of 4616	2276	Swift.exe	102
PID 4616 wrote to memory of 5236	4616	msedge.exe	103
PID 4616 wrote to memory of 3976	4616	msedge.exe	104
PID 4616 wrote to memory of 2848	4616	msedge.exe	106
PID 4616 wrote to memory of 3976	4616	msedge.exe	104
PID 4616 wrote to memory of 3976	4616	msedge.exe	104
PID 4616 wrote to memory of 1088	4616	msedge.exe	107
PID 4616 wrote to memory of 1088	4616	msedge.exe	107
PID 4616 wrote to memory of 5600	4616	msedge.exe	108
PID 4616 wrote to memory of 5036	4616	msedge.exe	109
PID 4616 wrote to memory of 5600	4616	msedge.exe	108
PID 4616 wrote to memory of 5600	4616	msedge.exe	108
PID 4616 wrote to memory of 5036	4616	msedge.exe	109
PID 4616 wrote to memory of 5036	4616	msedge.exe	109
PID 4616 wrote to memory of 1188	4616	msedge.exe	110
PID 4616 wrote to memory of 1188	4616	msedge.exe	110
PID 4616 wrote to memory of 1188	4616	msedge.exe	110
PID 4616 wrote to memory of 1116	4616	msedge.exe	111
PID 4616 wrote to memory of 2096	4616	msedge.exe	112
PID 4616 wrote to memory of 2096	4616	msedge.exe	112
PID 4616 wrote to memory of 3112	4616	msedge.exe	113
PID 4616 wrote to memory of 5156	4616	msedge.exe	114
PID 4616 wrote to memory of 3112	4616	msedge.exe	113
PID 4616 wrote to memory of 5156	4616	msedge.exe	114
PID 4616 wrote to memory of 5864	4616	msedge.exe	116
PID 4616 wrote to memory of 5168	4616	msedge.exe	122
PID 5168 wrote to memory of 4636	5168	msedge.exe	123
PID 5168 wrote to memory of 3828	5168	msedge.exe	124
PID 5168 wrote to memory of 5508	5168	msedge.exe	125
PID 5168 wrote to memory of 5508	5168	msedge.exe	125
PID 5168 wrote to memory of 5508	5168	msedge.exe	125
PID 5168 wrote to memory of 1492	5168	msedge.exe	126
PID 5168 wrote to memory of 1492	5168	msedge.exe	126
PID 5168 wrote to memory of 2200	5168	msedge.exe	129
PID 5168 wrote to memory of 6080	5168	msedge.exe	130
PID 5168 wrote to memory of 1240	5168	msedge.exe	131
PID 5168 wrote to memory of 3976	5168	msedge.exe	132
PID 5168 wrote to memory of 2740	5168	msedge.exe	134
PID 5168 wrote to memory of 2740	5168	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\Swift-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Swift-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Users\Admin\AppData\Local\Temp\is-G071SZAVM9.tmp\Swift-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G071SZAVM9.tmp\Swift-Setup.tmp" /SL5="$6003E,1419094,883712,C:\Users\Admin\AppData\Local\Temp\Swift-Setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist /FI "IMAGENAME eq Launcher.exe" /NH 2>nul | findstr /I /C:"Launcher.exe" >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\System32\tasklist.exe
      tasklist /FI "IMAGENAME eq Launcher.exe" /NH
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5164
  - - C:\Windows\System32\findstr.exe
      findstr /I /C:"Launcher.exe"
      4⤵
      PID:3272
- - C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\Swift-ManifestVerifier.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\Swift-ManifestVerifier.exe" "C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\manifest.json" "C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\manifest.sig"
    3⤵
    - Executes dropped EXE
    PID:6040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\full.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Swift' -Force -ErrorAction Stop; exit 0 } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Users\Admin\AppData\Local\Swift\Launcher.exe
    "C:\Users\Admin\AppData\Local\Swift\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Users\Admin\AppData\Local\Swift\Swift.exe
      "C:\Users\Admin\AppData\Local\Swift\Swift.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://openmacro.net/api/v2/swift/auth/discord
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
        6⤵
        
        PID:5236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6352637068174494524,17137449004986254196,262144 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
        6⤵
        
        PID:3976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,12676120673832547328,13428798974472183428,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,7247989116770208466,11321888469330772278,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
        6⤵
        
        PID:1088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,11380782533928311639,528787073263196705,2097152 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        6⤵
        
        PID:5600
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,1802221941046887950,15275064650870105235,2097152 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        6⤵
        
        PID:5036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,15124542486132285344,781784724916211215,2097152 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
        6⤵
        
        PID:1188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,7338925178088304555,16872001658956108253,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
        6⤵
        Modifies registry class
        
        PID:1116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,13107029865947899804,11667038919475649637,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:12
        6⤵
        
        PID:2096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,14507565761377523271,14800115525931784444,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
        6⤵
        
        PID:3112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,12790509561268756251,15892623222973560461,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
        6⤵
        
        PID:5156
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15376659559156178279,11062893115068679446,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
        6⤵
        
        PID:2200
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15376659559156178279,11062893115068679446,524288 --field-trial-handle=2300,i,12115456249195113695,6911294921819369758,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
        6⤵
        
        PID:5864
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Loads dropped DLL
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
        7⤵
        
        PID:4636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,7637951953836390036,5264025346190457019,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6164953074271223061,3985515949158149843,262144 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
        7⤵
        
        PID:5508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,1769317667879101515,15404280643147283148,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
        7⤵
        
        PID:1492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,8489913785028228539,18223493877543522900,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        7⤵
        
        PID:3864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,8489913785028228539,18223493877543522900,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        7⤵
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,14970890275777291891,11094567181317822313,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
        7⤵
        
        PID:6080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,1970209987797220254,15047744842200358319,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
        7⤵
        
        PID:1240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,11523512627211083833,4364610199323799461,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
        7⤵
        
        PID:3976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12624085097522418205,15885010047752298061,524288 --field-trial-handle=2336,i,3470198238531201881,12229937394574292494,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
        7⤵
        
        PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 63e8834329d7a2c5e81f0ad4eb09e7a1e4dc065ffc2047a07cd54cf0877218b3
MD5 1e538ff2093fba87af2e2daab718f0ad
SHA1 a802353ac1ab1af10a42a76c1ca847c8005af81c
SHA512 15100f0f11eda9ad7e6f2dd1027ffb437f4e098c66e5e3d7fa315f259456f72e129d2c50a67c4ad1516fcba548dfcc68cf5e66e4d11a60c91dd46ac87b4710ea
TLSH
T1E2D0A7143B2869DAC92E3176C4308240A666456223568B457590D50D8D79093A7D67D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d860d83a76a978ad03162a6eef2ce5ca732c7b6cb759d4e8f464088875f58ed5
MD5 3a60aca7e9746f0e0726dc4125710dec
SHA1 8ca778e3dc7d3df69408fccf2277953b8769fb9b
SHA512 0c1106f1de6977b776da9d9873e4f0bca28c394dca38247b6f19fa19fad9a70fb0e2f82202fb33e53be3e93fa49637cf987eb0367e42b07051293b0a7430aaac
TLSH
T19AD0235433086946C90B31B3D426C341B7B28432774A8F457590F25C9DBD4E753D72F6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 378bbd8d0d5e5e350aa1943e1e8fbc7f82e6f64e5a92a508b943c0967718cf2a
MD5 52127c1705224d18b8f38f6d052c384f
SHA1 214821f35e1f59ab6ee8ccd98c52e54c830f05e8
SHA512 8de45f484996854eec62efdd0b066b24254b648c3eb365be8248d0ae4402bf2b590bd472f7cf7485b807281cdd09a3b36bee9f4204083871d5c9d1ee1e66f0e1
SSDEEP 768:wK1KOkihSlFgSURln/oELNC6P1AU5Icg0aEk:wK1KbihWURln/hZVIcg0aEk
TLSH
T1DF132F3DB9C51C82CDCA727C090F0E75EF60CBA5C7946577AF21782AA2D639E187E108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 776KB
SHA256 4fa3056509c58777f0cd52f715f107d71f659a112831f89a3a1e28fda05a7445
MD5 533f11964d71c5d78b11b7ecb0b9523a
SHA1 711073fca9435224015bb5ae7026a38e2779adf7
SHA512 5d1018fefc3bec025e21a79fb273405a5f2fe5ef78bb1ad87e3f5d75dbb4bedda52fe4e8bd460e4be28fdc7f486ead2ae23b893130b69226761f957b32b53f9e
SSDEEP 12288:GL/JL/aL/IL/AL/F2vNwjijd2V5epqSiMjM5:kwjisDIjM
TLSH
T107F4D9F38540582ACB7C12F553033A7DD237418D2DDAE8EAE53A1C996829F33B264DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 3.0MB
SHA256 cea4eaa19e00d6808edfa5a6c3d6ecfff0303ea364d47e1eab1032d43cc12ad5
MD5 f9cb375d85a18a5501acad026ab3574d
SHA1 1edb16f32022c0937e034e9a494edcd109ac178b
SHA512 6afb6229e9b96c5f6db998476f49aa4726d987e83352b0f3005ae8b1d0ea56966a97a014665bc1c97660aba2155aafe7681d5fcfcb03c8318ee2c0a04fdf9b69
SSDEEP 12288:qQwAaP3aTmZF0PMPTZ59vxBSxZ5vK1YD1wZBPTvCKEg0iPVQgRWn1V1twB7SAIoG:41RYMutjjcN+1O2
TLSH
T1D1E53DDB4B749A51DBA7DEB0FDC4DC5D7EB410C2AADAE0836502C6B900C37C12B9568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 4896cd81c77d45a1188cbcb7f9d620b3f5d7f6b2d4afc7f41070ce209dc28b57
MD5 cae4b25b70df5977260f892ec89841a3
SHA1 357d2a2b75fb4f602f0d6e91db6c9e80479d800c
SHA512 3c9e196344ee96017b4287a7195431d6121060850cd56e7e2698e1ed083731033d3aed5aedef5c2441b8603972a05cb41c53ced5f3090f411e11e509f3db255f
SSDEEP 24576:wHVcuYbCYA4Kglyj8JwHgZgx3duRBVPJCrhCS+wNJ18QHpQ3OBFMTZyM5fBzv4C:wt+C/4PM8m53AjkCKJpJQ+jM1H/F
TLSH
T11A866DEDCA7858C3CD639A30B5F0E9477C7413C3F994C1D68C98C584026BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 3491ce734b22ce68f2e109dd09536a6a73944dbf05245c695011e4ad9f4c798b
MD5 b3db4603c80a7bb1acd41073f760c17c
SHA1 5d359a53707bc31fbdd9d36e1d47d802a8138e8f
SHA512 f98fbc9abe6276e5d035335bc455c756b6aa65cf838e32fcf436f92867bb6949870c8d6c6cccfc2c2eed97de148bbdda5866964e31e4c47225fb4c8198762065
SSDEEP 192:k+DEWXwVgFw4NiotNxEHpgxKtMsj/DDS5Knl:nwWXogFBLtNxIpgxKt7j7DS5Knl
TLSH
T115D1815013A50AC9D76D357A2AF577A8FFBDC4C1474B1DA2C38AF2B618CB3B46435028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe597d54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597d54.TMP
Size 2KB
SHA256 111914d25eee02c52612cddcfb7548a61b108347ab316cdefad333a9c2ec66bf
MD5 69e215fcc6eda5bf4356cd5a9b887159
SHA1 6e9fada6903908beadd5079a218f63561730c031
SHA512 8df1eb58fc258af2c0baacc94da089bdde183e99f29802e1c11bb049de36d51c4b2a7a29f5bdc01b6152144c2a7d5dfd7ba29d51712994f4f8cea2304a257bd8
TLSH
T11341505465945812EB7E05BA2AF233D8FFF5C4D243035E06C18EF4F858CE7B9A875491
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c38b0d15ac19e0502864aa6ff76234feaf9f01abbc2f69ea40a8432db3d6df95
MD5 35bfcd38e0c7552d1b4a6fef8b4a9003
SHA1 98b9da30decfc6b0ed3534066b181569dfffec3c
SHA512 5aeb8ce28715c6958a48d20c6d9571093cedf6724d4c58ef484408157e3c66b2517b08935f22dbb79dfd772e1b8e73d3c23521cdd741431d3b7ef32552890cae
TLSH
T134E0268C64CEE229D16E68D7C378674886D0358EA2C83E4637CA8C44F10924AA3FE6C0
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 56KB
SHA256 9c385b475974f6a3e56e4672b9c14bd34ab365e1110c19e13e45275a03b210ea
MD5 03215cc0514024bdda20ee6221fc13c8
SHA1 95dbde85c13d1a3467b3e8044b2d57bf00a061e8
SHA512 ef09a1e9c5eeebf05dc8a607090ae3db12a72210f07d3e85d8826cb55d6a4097bfea2937cd943dc0da9de9772aa21d5a0f2dc1671e442493edfcbe0926e29231
SSDEEP 768:3QuQSEbG+Q3wJMHTFcyg2Yte5pbEbGnP3w+MHTFcK+G2YEgJ5ys:3z8i4kTFcyg2EeTwiIpTFcKl2dgzy
TLSH
T17243D0699E3130C3C35507B62B5F15B60F5803C78CA84D72744B81BA8CED973B69B65D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 0457ab756e8e28b3e5b613551cd73efd096570bad4b42fd29772f5153a6fb615
MD5 a4e2335af7644978a8dea6ce0683d0fa
SHA1 4e7527d3d77f98d132a96840d8aa2683ff4b07f5
SHA512 96fbbe22472eda6314d84e6db1a6a68a629a7885963aed8949ca0e2bb844a5ca8751fb5f09eb27e5fdc5a3dfbc4616012686ac034c673785653c18d5e9fbbf34
SSDEEP 96:8NbQuhPeZltejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/VemNbQbfbbEOVpZf241:MheZiH+bF+UI3iWGVoWN3qL/qvVVV63
TLSH
T17624621F5F703711CEBD813668EA04B35C6DF03F8B5766DA686114B4CEE3A46A01C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 6KB
SHA256 089a21187a028f9654ac6f802e6fe86b6e19883639bc90c997fee81a7da42b6c
MD5 a2f55492ea7370464c0b4db46c7568dd
SHA1 5e754f10b58b95f69687d3ecbd8397b3360c6336
SHA512 162a171a107af4dfbc894d848dd49450f5f06b73ba85c524f4825864c48efd6995cc55385fe476356058ba2cd7d1e3d146e49c0779bef569108df17512924634
SSDEEP 96:4njX9ZOWtDvj5cNgKXl+CJF9o1uqNXTZzgHODlPADt2k+qtmQDrb:gX9wWtDLmrMChWjkOBXSmQr
TLSH
T12DE1AD7FD50C85B9833B82778783351CC7B726AE188DF59EE0825D0D045A36B66019EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 323ee87232bfe6b9e810471fb44d5cf9010699c0c93f028c47b96343105e8091
MD5 100d93c6a2e02a3bb7c2146ae61ace47
SHA1 31d5f57efedfdb04f515f6e0970b1ca175f58e88
SHA512 23e94bce362a91c737c920d48711ddb8e069293691fbf4bd69ba87cf1e4f60add3667563062412b3f83197166372457f99a39ed4c387fa6c03f5eb3c620e4e84
TLSH
T109E020A995CED25D934C20CB432C774CC7F0354EE6CA7F873B089845F585288A79A1C1
MD5 SHA1 SHA512 TLSH

Submit Download

368e3f19-841a-4097-887e-fe8a9c754e9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\368e3f19-841a-4097-887e-fe8a9c754e9f.tmp
Size 4KB
SHA256 667a352939798e56a27bf8c4e6fc4ba3ff1b40e3f5fd7434dd6e72108383712d
MD5 ad6a9a32aeeed80eaa9b6a3564cf836c
SHA1 21666d0efefd864b763836cc3a1227dd26ab87ed
SHA512 1655e35d3f73cc4fb3728a71c271f0b18c1795a2faaa390f2432c676180c0cfd9afc2815daedc94528c14cfef8267308499344a9d13bd81e3063fbdcd1c361d6
SSDEEP 96:D15A7jZOumuxorNIjhnZij60PzQXA7Smux+Gu6BwBxvuM:D15qcXqMNIjhnZij60PUXvm++Grkxvx
TLSH
T1EB81BBF7C7E8866DC91196F0AB187E2BCE2D0914432C3C2AC9D4DF5B93E2471E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7e9634c0f73ead90781bc4afa48a72d0b628b8583933b11c9108a19d9977499b
MD5 b274bc2206c56d93533999bd956ab2e6
SHA1 a0c403927936a14be4f4acafc0474a298c6093b8
SHA512 bcf2cbd865d479ce502421d21dea4a41a3ca8f4509208537ffd6126deadcfd816b107b05a895c7ebb455032bfc0f880225285dbde8aab8d4c2c4d5e3ddb432c1
SSDEEP 96:D1A7oKOuvuKborNIjhnZij60PzQXA7Smuqu6Bxvukq8bGwQ:D1N5OhbMNIjhnZij60PUXvmTrxvtqeGT
TLSH
T11081ABF7C7E8866DC91196F0AB187E2FCE1D0915432C3C6AC9D49F5B93E2471E141A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 e29c31089ba4e819198b8a42d66ce5267eb9bd7c6c5b49945435f7644b259933
MD5 11c4d0ca3048015490d3d8591b2a97de
SHA1 e92c6f193ea1a16a40d808a4d7c1e5fbdaa74cad
SHA512 4d411f023d786048cc4d77f24bbcad9b15525dbd478b5f387d8298c42580f1b7e44ec6ce64460299e74f0135f48c575b06eebbc455e9cee6086de7500452f920
TLSH
T178014797C6BEE82B10680D6B1D8CFC1CA9B6A876126188F4DA96C17CB4824B35B4701A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 dba13636ac777767bb4ee7c96b46020eccab295593f08187088cb0ed3b0f1424
MD5 5420567ea6ce7e52fb62d4fa63d43581
SHA1 5184585457982f048a9bbc5f9432829c728fb90c
SHA512 6d012eaf728da7760c5fc4613a2029d7a78a1858a2270aa198447911073ec330ec7a9291442782805d92b8de947ed8a76ad0a8e0fd67a0b7ac9dcbfef1d56a58
SSDEEP 192:sxRVB8RI5yMqZjK1Ml8R1cYn/fR+sYIWpV36AZUBMU4hzoA8pTVP/g6+WNDV9Vp4:sxR8NLc/fosVWv36eUBJN/5o/ujQ
TLSH
T16F72E916A934593BCCD7D219FA95BF53D7F81523A2905E04AAFC8A0C11E76EC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1fc38c3da647981fe23b30e1296bccd8ed64781ddf972883d49dec6f11171fab
MD5 98a81e72537f4dac124dd21c8ebbea29
SHA1 fa86ad5bc98b3dfd75dd03ce19692cd28dfd47d6
SHA512 d774d8bb6546a28319c5697c5d3f17c1f2e1d3281365af98ac1d843692bd7a31de76e0061ad51a5bef11fa39aeef304213f9500d65fda1f3da4e6d4f2450e361
SSDEEP 192:sxRVB8RI5yMqZjK1Ml8wcYn/fR+s76AZUBMU4hzoA8pTVP/g6+WNpVpA/YUTgWtu:sxR8NCc/fos76eUBJN/5G/zjQ
TLSH
T12E72FB166A24593BCCDBD219FA95BB53D7F91123A2905E04AAFC8B0C05E76DC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 393abc76abbedcecd0a472a3d3fdf34a95b1dd708aee8a0e710af9b37d6e1c62
MD5 e333455a056b287594b8d049159672e7
SHA1 f93a928e4ca55b3d2b01af4e46118519e83abd93
SHA512 37fd021fe361512def20f6129dc2e0887c55dd9f2fde2179a32d8449ee31f0ef107c74028b41abc5f06f1ae2380cdf86e32bc18953bdd4fb39ef69691ef3ef14
TLSH
T1AED0A757A0484D55EAAF8EC10612159A42253C88189A848CA41302295CA5A67E592FAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 1c5938d43bad8a0f463149983460dea470add1b2064f1df4b75e4fbf63add9ee
MD5 0b7b7512bb952a85ee02b5c2f1384c03
SHA1 8b4180fd96343756df17dec82ac8e680adec3a01
SHA512 128ed6b1ceed8c04a258b95703210ff31006d0dd4b89151533ee303c15869a525bc8ecc4f54edcbb9693e2012d48c14894376a12101791cea92c9a6a7973b798
TLSH
T120D0A757E4550D55EB6F8AC20622159A42652C881C8A848CD413212D18B5A57E666FAA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe595809.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe595809.TMP
Size 138B
SHA256 457a7d916a522337476c43d71e1fb18ed10606c4a0c778be8b08b5398402b87f
MD5 e031b365ad594d6c173f750ec1c22055
SHA1 41c3cba8c6d732dd4d21db17170f28fb39c61d08
SHA512 9fac0159489381f99718237666110d915e2c73224d4abc180678cbb26fbef53c8e566b2ba69095b1ff6f45924bcc02a591e55f6b7a6333e2d4ff420930d7c378
TLSH
T16BC02BF3F4440602871F9AC10232198E43092CCC8CCAC49D611330183074F33B202FE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 d6c53e69d502345623c23021556ce6e3ec82ea6047444d860e04768d3ad45f36
MD5 32dc9f99703597ba9bf1fda47783ca9b
SHA1 ad41b93809cb358a963b34b7a6d62e755b7f2f94
SHA512 94ad0a4f5e5930423f3f7455fba0cc060ca927a85412f638dba8e93507eb12f770659073956f54381e26381932bf263dea0be042b10450c569241e253e290d03
TLSH
T1BAE0DF9899CAE279F25D34830229E34882A576CFD2CA3D862F008844E58E50BF2AB1C0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c2eb1f3e42fdeb54f421d247495843715ffe80d895719400597b85ff82244f77
MD5 64838c4d500e7c2a8f74723eb106f208
SHA1 5894da4060e216cce130ac7b2e0a6f12f6de175a
SHA512 2c0c545798e30a26422f4570209e1def365661601b1a6c73845434d114585a56f914bc590b906cf4f397b0a722fbec02a64a0c5166c0c2bfd3c6858eb009a05a
TLSH
T1ABB0129437108B13C4C6097203E487C05784E0112083D903CC18CFD26F49AA83E62CC0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6b5ee90cfc55a2ed6d399dfc3cfbe8b32d88440785a45c4dbb68b4cd45d73075
MD5 e3c59e10770aedaf7a03fc16abc67b66
SHA1 67df145fc4c55640ef6f03f3ffc60280d260acaa
SHA512 2f5af42a9088ba055de3b19529c652d4c37b581a11640a14d1bc72c0cff81a7f0868093920fe2f08dc3dbd20b813f1fb1116760564d2ac6fe92fe25f8e1148d8
TLSH
T1A5E0D86469CBD36AE28D34C74316F348C6A3758AD6CB2D553B08B484F24A145F35B1C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 f7c5c917aa6640101ad32537779189dfcc2ddd686a86dd84edd2240de75b35fd
MD5 fe17561b6f1fd519c578e311153f14f0
SHA1 cddf5dc977ae53a4e12721bb7b3c4600e6b17222
SHA512 16705194937a1d5668e7327588179604ca9d0898d3d121cab08d47611754923155c2f757bb775b2f00fb3de9b03deb67fa23df7a2d02ef86f78d4d7756826196
TLSH
T18DE09AB599CEE239908864C24364B74C82A17E8A93C93A8A6B085454F94110AF7AA5C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c3e5ffcec1510dac928968a1d5f91a49dc512053b4b5cc62149b7915f410e4b9
MD5 2bf37eb918bbd6eae4acbec4ae05da60
SHA1 7b7d5264494ab33ed6508e13150cfad220afb8d7
SHA512 b7293b8017e0b3526266bec4a39e859224e69f016652d4c455e84777ffb6e7b257a343e12a3f873421fc6d5bf023a1ca70a03f9d5deb4dfc1bd26494b196399c
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931IH:UVI1zrZi+JK9ALXEBR9
TLSH
T149B25E5171BA1741383D280E93B9842F164630E230DEA97B7B6931E66F67E004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c492ad3e038e401b97cdc36fc626e03e7c27de408ce31f03748bb584e35f34ee
MD5 3d713152fa2c0ff879d7828e9f3df590
SHA1 41af910f0817c98dd08eb432d790351718b5b426
SHA512 b7553111a6893b71dac82fc993bad34d2b0b2de32de4eaf9206c00b7c2d6610998a0555ddad526357901ee3369b7858fb704cdd36ea07537a4e1246031e53444
SSDEEP 384:DNrRZyCSDnxTICU9MEhIKyll7svbFKfk7:xFZJSDnilyyI1l7svbF9
TLSH
T12044740A7B747001EDE6D9721CB080771E3CB16D8F26A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7765c96-9d2f-4f7c-aeb1-850efc33f05c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7765c96-9d2f-4f7c-aeb1-850efc33f05c.tmp
Size 32KB
SHA256 307145222ea27d5e3c212528359bbab512d345e0da94eda64beb595e1296a44c
MD5 fdfe469d3f47b0f62d6f6941645db375
SHA1 dd92b755ab76a067388b11f37643a8bf02fae5fb
SHA512 c4930cff60504c347b96a86b20e7f632807b17f6cbf762c8e4cc627f9f2b7db3f67e2f60410db03fad939f6c614e272e41846feeca87f717191bf71258ea6b1e
SSDEEP 768:4eOlrA7pLuL7P6WgSYfnS8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9FpuOGirocS:4eOlrME7P6WgSYfnSu1jaeFpTG5d
TLSH
T112E2FD7B680CCB7E4F804A9CED29BD8A6DE802CF5AD8CD5447EA440C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 7a5d9aaadcf700623586eed61a19a9d02336f390e33ffcfd5b15f4599fcbf0a5
MD5 4736b117fa52b918a41b9d1cfc89daae
SHA1 9e2157b3b2814cd98f381d4eea870cd286166804
SHA512 b826d0f73506d12064ac9ac1852ec46b10cad20f5f6ee9a7834cf08b46c81216f1145e2f69a96b1ce7580c445c12e5bd8517314392b54cb5802a0b041f42d65c
SSDEEP 192:VHQOIIINbNMIM/mYcYNsOoOAs5l8+NusZ3s6ubSb:VHQOIIINbNMIM+Bko3sbwsZ3sFm
TLSH
T12B52515E26051F33D55E5FB613668B516FD9C8C10232222E3162294F8DF3AA78AC96F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 38589f76392ea473e341e34bffac12e29da7bcbfb54c9ae5e4ceb4273b37a446
MD5 c8ce0f4907da91e297addf710417b6ce
SHA1 e68b1a984a7b8f7b256964cf5552c250ad145004
SHA512 172b676f8d8c52b66d865e0c55c3e3559e09eaecd58c9b88677a29ff7b710fb9319833b9563bd2c07ff0fdd1a16a8b3f87520fe0fc9a334eb232b369071eb01b
TLSH
T1ABE02058F5C5D29FE26C24C703165348CF803D4FEAC52D492F01D458F409105777D1C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ad814d9dbae6c9e3eb95798f5e6a9f28e7474d896779bd83708f025749fed51e
MD5 f3872810a8bad3b51d73288e0a011ddd
SHA1 d7b94f8675fbcda4d8b5149d0543674d8ebb077f
SHA512 d1c86cb3bbe6aaf81c47a646625542b6616dc82d5bbe69d3030ba29e801b3345daaca5412bfdfaeeedf636eb7b3ca7ca155520de9c1e4a63f42b467531567788
TLSH
T1D631A956F320C148E04AC27D946A9B350738E812DFBCEC0F84792036AEA1B440E8BAE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f8a7638e944709a5cbe9d576f0248dfbcf27a296a87058adea57447c7538644e
MD5 f39ce864984daa8423b9073c2ca68a25
SHA1 592c724d78c49890625321ea17b7ca40dfcf964a
SHA512 967e59da08fb3870147ffe41500e0e077be961d4f3b1d48e80329e9cd22595204b06a14fa7bacae3c6a286ad0b8ec3908242c9f3224fdfd6e98cd32ce7c1d2c8
TLSH
T1A0E02058F5C5D25FD26C20C30265938CC7D5394FEAC52E452F05DC58F509146777E2C1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b0dea99506f7f9c708aa6ef3ba92e25980455153224c84cf6d4ba112c01922b9
MD5 53deecff08fc9fe4b5cb2574c4564ded
SHA1 4e038aaf4fbbb6062e96b7a1597dd8e24073d59e
SHA512 329afbf48db5fb19dd360b4173a50d1cdb5908aa01e3ede69310c85c72dd0bf2eec1627d30468df897c1b3e360b3c54bffeb8f9328aa709741357c0dccb61719
SSDEEP 3:MsEllllkEthXllkl2zEZlbQ:/M/xT02zF
TLSH
T1A84404047FC00405C5407131C017C37553F4D530071757473CD504135CC75C00C71107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 df00192e5bb268ba140d7dee439eb82b8dfe22f07982fe1f980bb36657ca4a0e
MD5 44126d4d81258960dddf3e4ea44df3e8
SHA1 8c45e95624fbf25b8334b5c386fc56db25317769
SHA512 2ccad638334acf9ee500d30c4e692fc08e99251663cf9dcf1d42441211a5686d7bee2f2e232b28e861a4c23ccd4a2583527719cbee336b2888ee3280baf50550
SSDEEP 3:MsEllllkEthXllkl2zEZlI:/M/xT02z
TLSH
T1844404147FD00415C5003173C051C35453F4DD301F51574334D104335CC75440C01305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 71284901c374e07bb83751f2973d46f4ca3adb4fb3744fbddcf5324865960117
MD5 eb0ea158b3a812d88fa7f7fe2c22e6ca
SHA1 05687c27876b2c2b9e3b902191adb604c64ede43
SHA512 da213f790667923e8c11cf2c1561b4e6d897550ef250619bef51d732c8180cb535fdcdc14c746fe9d0550a9be5c68e507e08affa07ed374de5e1a65afe48faa0
SSDEEP 768:fF1j+9KUwgWcbLan9FGig/zvrfVncGvmn12bfx:W9KbcJzvrfSg0yx
TLSH
T11ED25B36D8A4CE77BCE78BD5B70A7256EEE0126785C85AD4DAD84D4C00D32DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0ccf0a03c5020ef078e8ab6bd59186f18863ab14ff4955921146222a32797379
MD5 37a68cebcaf69ebb62eb6f86a6b1d027
SHA1 6c2a9e783984e218238014acf6b396bc7f653df8
SHA512 30f47cc1ace28a934626d18a492e8b586571a0fe8f2aec8424d2b8efed2eaf826bc1db0a6d37531f930099d8b0e93e18f692d5f1b4736db4b715ebea67b46191
SSDEEP 768:fF0j+9YUwgWF4Lan9FGig/zvrfVncGzBMfb4uiHmn12bfx:99YbFMzvrfS+B+MZH0yx
TLSH
T120F2283EDC648D7F58DEBB89670E662699E01237C5A84598E7C80F0C90B328DF70AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 921de1ee1e97b96a5874796d5e2e8d3f7eba82f59a8423927fea333fb54b3941
MD5 91e84a105e8d1cab7fea9f1e78f5f1d1
SHA1 ba52b03c983229c10e8b85d78e0cb4d6e7fd8810
SHA512 4516739ab3eaf337e69bec2041fb44d931ced2dbf64b31fb095d4970039bf3b9a6a3bdab9f0f0f3238502a3ae1df7fadfd301ad480595dc9d5fd2cb0b5c9d276
SSDEEP 768:DF1j+9Kjwga+Vean9FGig/zv1xxmn12bfJQ:S9Kk+Gzv170yJQ
TLSH
T17CC24B36DCA4CA77ADE78FD6B70AB656EEE0126785C859D4DAD84D0C01D32DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f27234163f9f6de235a75b5e60bc66c72c246af29adc821bd70701e831d3c9b4
MD5 d2ca7c05985ba3204a0d26bf3dff76fc
SHA1 ea1b8e6cf63bd87b07a2a507a4088a02176010b7
SHA512 9b438a9420ff4192ad1c3124e0da931e43c1492d7d3858289223e173173a43606a50a46441b4b60fb51b1c12711036fcccbbc2144bc9babb41fa0e3ee854dc57
SSDEEP 768:yF0j+9YgwgWFtLan9FGig/zvlvDs9iU8n12bf8:29YXFbzvlLdUGy8
TLSH
T1C2D24B3ADC54CA7BACEA9BC6A30D7616EEE04277C59859D8D7D80F0C40B319D930BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 68a9b03eacf8dad6005227a5be41d7b119b4b7b17cf4bd2ce94c1a9dfac13ed6
MD5 a5fc88c35f86423ee1fdc7069be84798
SHA1 0da8b49a2eb5a4749c03a7b025d7d830c6497e28
SHA512 1bf1df5e4298570e78732ee61d9b3837839b2e8c23addb8fe83da531e4531fe0832e71b53308fb062db7c55cc31946f5746dd4ee41f72a20956494a9edb5222e
SSDEEP 3:MsEllllkEthXllkl2zEZlKS:/M/xT02zZS
TLSH
T11A4402046BC10405D60031358025875113E4D5100A11A74329A118125C856900C01001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Swift\Launcher.exe
Size 6.7MB
SHA256 f0ea0ec767494ad8d0cf25e899abd51066652b740812975624420512ebad6859
MD5 a86d3233828a11d8a2f57b19c99b88c0
SHA1 773b4eb2a1719ca85f260faa2f85743785a73815
SHA512 5f36c464f5980f18921c9817b6648fbb772f6de1dd9eda718d0d6e8815eb0ddd0eb8f0fd65be51a86f7c8650098286f3f17487db48fd2453dce20d99ffa5e9d5
SSDEEP 49152:wSGT550jdBc77b42qT6TXJhzdfX5+89ob1n6Y2sjXEmmjSAn8tUobdEUa2qRHolx:k9LDVNh88UJqRIaLyOtQDjnjAxz
TLSH
T171669D15A3E900A4E427DB74CA65D333DA71BC926735C64F0A58F64A1F33A908F2F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swift.exe

Path C:\Users\Admin\AppData\Local\Swift\Swift.exe
Size 28.8MB
SHA256 97d4dd040314c6d8ea77e6d68c7fc31d4d93d0ef8954aa61de9bacb26935a71c
MD5 0467957b7c06edd43f8dee626d274899
SHA1 4a2c7e757cc7614614078d9cbb92d453aad85ef6
SHA512 34b23490349b4ab970953f90a30e367cb5bec73e1489fcc4af3d61d5f47d5abf2838f0d7322189e60e97e636866ddfac23b1268b5a461ce7f5379af118513527
SSDEEP 393216:Geu2zY4cocrSERWaEcjMKjuNKos76xVEfhajHXBDGwFU9w:1DzHrE6EhE3BDGw9
TLSH
T19567BF19A3E50975E527EA38C651C333DAB0BCA24236C10F296DF6451F77A608F6F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Swift\av_libGLESv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.DLL

Path C:\Users\Admin\AppData\Local\Swift\libHarfBuzzSharp.DLL
Size 1.7MB
SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
MD5 fdfc5facbb8d7ed52bcfeda911586cd6
SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
TLSH
T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.DLL

Path C:\Users\Admin\AppData\Local\Swift\libSkiaSharp.DLL
Size 11.1MB
SHA256 6d6eca64ec333daed78858a637b54c545aa01558204b8e2ae8870692acada127
MD5 9f1deaee40e34c7c08952a3e5ebb3ca6
SHA1 36f50165a5688289bb3877b8f29a354c4d5fd458
SHA512 a5c9178ac02cda3feee7f8e1f26dce5cae247e6bb38ba596fc843d985636dc53a08cf20c9e3f4a8c542864f9dbb1d1d9f02cb7b9e879bbbd622219962df60a53
SSDEEP 98304:61DvlpF6Tf9V805SPZYjyPytfdn93P8bZaFcbNB/ezHL84dYTFffN6G:61DATjy6d38ZaFcbMn6TFfff
TLSH
T114C64B067A5A54ADC48AC4B4934B4967AD2034CB0B35BCEF41C596393FBABF42F39718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\Swift\logs\client.log
Size 799B
SHA256 c64a394207c13096c1c57a3391bfed1da01f4b2776bce94e8934bee80602ba78
MD5 6e4e3bf943775aaa84d714b57bfa0583
SHA1 45a2f7cf04b4026afaadb5244cd304ca193bb908
SHA512 f180b912b34bb28bcc4c9c4a4c55298159492047c4318f9feb8c9cef79697a48fc73fe485d1ec30cacaa058da5d4c5d7c250a0770d30cd3dedfa96c95c30aab3
TLSH
T14201C60127277025CA1E6E52A569564D6C63E4A0931FAC6C3B703884DECD88F9B3D215
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ft2lxys0.dkf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ft2lxys0.dkf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Swift-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G071SZAVM9.tmp\Swift-Setup.tmp
Size 4.2MB
SHA256 09b4d5d2e73e7e469be8180e6c7bd7382c29fdc3c47a7f1358d4fefa1cb05572
MD5 811366bfa9d30b31825db9c5b3d8306d
SHA1 52238cb37145989afe43ffc8be473a5b02ff9548
SHA512 9570d2166fff6e8dd4867c1e3128cd536982a4f0c8e1f7b97810bb1bc8ca44f68a1dd4738e50f7546e60c5e7a15f3b5fb8bdc51940d3b991af21730593274207
SSDEEP 98304:GYU5hnuOajWwMPdCpepI3GrwrA+Jt333t:GxuHjWfZIzf
TLSH
T116168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swift-ManifestVerifier.exe

Path C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\Swift-ManifestVerifier.exe
Size 1.4MB
SHA256 ddc067f96de67bc565e048bd5e76b1c9a257c6707003fd8a15d2a3b1fe253971
MD5 1079e79519aa1647f993fd9053344823
SHA1 dce1d575662c01c61e07770f1c2fd6f14da79e11
SHA512 b93e3b0cf6770c7b946757bfc17663a02739df33984299b191d2cdf3ba7ee7bf29a7a52b7c4d6c635cab4824ad6f35631e3ca67dfd3adae295fb23994c365444
SSDEEP 24576:Bz3eVOAJRW6HVLWSTg/aeNNLQzQ7ns3b01Ut9QMvW3NQOAhSU0CGalV+y17g3Ro6:BDeVOoPVLWSTgieNNLQzQk9QMvW3NQD+
TLSH
T1E7659D14E3A821E8E577DA34CA66A332D6B178560771F5CF0699C3152F73AE09B3B312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\manifest.json
Size 5KB
SHA256 4a714656c2175449527b3146eaaaaeabf6cd658507f81728251856a930d5bf9e
MD5 31f0e842851cede4d512c04648c25c26
SHA1 3886c5c598dbc62f67b568f75851e8afe1b76b9e
SHA512 23065cf45ed5ccc8f783e2e3fbc1ce2bd33985041be077978d5f0e915404d6f130d7564a2e7302702c4da7fa162986888ea00c43d85ce271c62d35e718c83953
SSDEEP 96:WCWxzc6p8ks3jNDs6OnDQaDxMejoIXui2f8ZVHcSU0U/+At4nieBRxymk:WCW9ik+sDaeUN51Opk
TLSH
T1F1B1E477C6B45D072075A6EF1B7A0791F90293AF44805B0B323C858CDFB3FA56966938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.sig

Path C:\Users\Admin\AppData\Local\Temp\is-IQQAQS9L64.tmp\manifest.sig
Size 88B
SHA256 fc5fb0b96672915d8a04d9646ca84aa1553cac3ed777828cf234fec3fcca20df
MD5 fc3525e01b128022af85e6f70f29d16c
SHA1 99165fffcf2485c26653d56f56e3f7b46da3b6d6
SHA512 2fc92987f2952c2459e6c93693884e09a80ed1b0e297c9f4993e1663c12d48948920e37e6f20a5427fa0e249bc0d6f9bbe39ca3958161997ac7b5308013cc9c9
TLSH
T1AFB012218814180417EF24901A99F8A2452F812449CA2407C4816F001008906011D70D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1108-79-0x00000000007A0000-0x0000000000BE1000-memory.dmp

Download

memory/1108-10-0x00000000018E0000-0x00000000018E1000-memory.dmp

Download

memory/1108-24-0x00000000007A0000-0x0000000000BE1000-memory.dmp

Download

memory/1108-6-0x00000000018E0000-0x00000000018E1000-memory.dmp

Download

memory/1108-75-0x00000000007A0000-0x0000000000BE1000-memory.dmp

Download

memory/1108-9-0x00000000007A0000-0x0000000000BE1000-memory.dmp

Download

memory/2276-86-0x0000021F00090000-0x0000021F000A0000-memory.dmp

Download

memory/4220-1-0x0000000000210000-0x00000000002F6000-memory.dmp

Download

memory/4220-80-0x0000000000210000-0x00000000002F6000-memory.dmp

Download

memory/4220-8-0x0000000000210000-0x00000000002F6000-memory.dmp

Download

memory/4536-42-0x0000014241DF0000-0x0000014241E0E000-memory.dmp

Download

memory/4536-46-0x0000014241DF0000-0x0000014241DFA000-memory.dmp

Download

memory/4536-45-0x0000014241ED0000-0x0000014241EE2000-memory.dmp

Download

memory/4536-44-0x0000014241ED0000-0x0000014241EDA000-memory.dmp

Download

memory/4536-43-0x0000014241E10000-0x0000014241EC2000-memory.dmp

Download

memory/4536-34-0x0000014241B60000-0x0000014241B82000-memory.dmp

Download