1ac60122a83adf3b5aed0835095ef7de9c440df1a27aec0846fdb44a4d2ab3d2

Analysis

user interaction
yes
max time kernel
70s
max time network
72s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
DELTA CRACK.exe
Size 454KB
Sample260702-kjayaaex5w
SHA256 1ac60122a83adf3b5aed0835095ef7de9c440df1a27aec0846fdb44a4d2ab3d2
MD5 6b661d90903d6d0adde704994d21d6df
SHA1 e3f58b9591f92821e1eddb903e3ba28950e2cd2e
SHA512 194b3640d4a7076c8c482bdfcad7e0f6f125c34011e4abaca74487685b0f7d175af1c8759c82f195ed4e1cb72f59b66e122feb3ecdb8d9177884ae7070c1e831
SSDEEP 12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t43:xuDXTIGaPhEYzUzA0/03
TLSH
T1C5A47D0AE7E809F8E0B7E57889574902E7773C4903719A8F13AD156B1F673A0DE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4192	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
3008	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3760	msedge.exe
3556	msedge.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
4324	timeout.exe
3336	timeout.exe
1536	timeout.exe
1904	timeout.exe
1372	timeout.exe
3292	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274550944970206"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{A974FC2B-E2D5-4644-B0E8-2A87E9E8B64C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	DELTA CRACK.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{B8CE5949-21E6-49EA-BC60-60CED872FC5B}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	DELTA CRACK.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2948	powershell.exe
2948	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	powershell.exe
Token: 33	3732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3732	AUDIODG.EXE
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	1840	shutdown.exe
Token: SeRemoteShutdownPrivilege	1840	shutdown.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3008	powershell.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4452	PickerHost.exe
3384	LogonUI.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4192	3020	DELTA CRACK.exe	88
PID 4192 wrote to memory of 3472	4192	WScript.exe	89
PID 3472 wrote to memory of 5376	3472	cmd.exe	91
PID 3472 wrote to memory of 3336	3472	cmd.exe	92
PID 3472 wrote to memory of 1536	3472	cmd.exe	93
PID 3472 wrote to memory of 1904	3472	cmd.exe	94
PID 3472 wrote to memory of 1372	3472	cmd.exe	95
PID 3472 wrote to memory of 3292	3472	cmd.exe	96
PID 3472 wrote to memory of 4324	3472	cmd.exe	97
PID 4192 wrote to memory of 2948	4192	WScript.exe	98
PID 4192 wrote to memory of 3008	4192	WScript.exe	102
PID 4192 wrote to memory of 4732	4192	WScript.exe	104
PID 4732 wrote to memory of 5224	4732	msedge.exe	105
PID 4732 wrote to memory of 3760	4732	msedge.exe	107
PID 4732 wrote to memory of 1248	4732	msedge.exe	108
PID 4732 wrote to memory of 1248	4732	msedge.exe	108
PID 4732 wrote to memory of 1248	4732	msedge.exe	108
PID 4732 wrote to memory of 5328	4732	msedge.exe	109
PID 4732 wrote to memory of 5328	4732	msedge.exe	109
PID 4732 wrote to memory of 5864	4732	msedge.exe	110
PID 4732 wrote to memory of 1800	4732	msedge.exe	111
PID 4732 wrote to memory of 5864	4732	msedge.exe	110
PID 4732 wrote to memory of 5864	4732	msedge.exe	110
PID 4732 wrote to memory of 1800	4732	msedge.exe	111
PID 4732 wrote to memory of 1800	4732	msedge.exe	111
PID 4732 wrote to memory of 5620	4732	msedge.exe	112
PID 4732 wrote to memory of 2752	4732	msedge.exe	113
PID 4732 wrote to memory of 5620	4732	msedge.exe	112
PID 4732 wrote to memory of 5620	4732	msedge.exe	112
PID 4732 wrote to memory of 2752	4732	msedge.exe	113
PID 4732 wrote to memory of 2752	4732	msedge.exe	113
PID 4732 wrote to memory of 3924	4732	msedge.exe	114
PID 4732 wrote to memory of 3924	4732	msedge.exe	114
PID 4192 wrote to memory of 3040	4192	WScript.exe	116
PID 3040 wrote to memory of 1840	3040	cmd.exe	118
PID 4732 wrote to memory of 2008	4732	msedge.exe	122
PID 4732 wrote to memory of 2008	4732	msedge.exe	122
PID 4732 wrote to memory of 5964	4732	msedge.exe	123
PID 4732 wrote to memory of 5964	4732	msedge.exe	123
PID 4732 wrote to memory of 2596	4732	msedge.exe	125
PID 4732 wrote to memory of 756	4732	msedge.exe	126
PID 4732 wrote to memory of 756	4732	msedge.exe	126
PID 4732 wrote to memory of 904	4732	msedge.exe	129
PID 4732 wrote to memory of 904	4732	msedge.exe	129
PID 4732 wrote to memory of 5800	4732	msedge.exe	130
PID 5800 wrote to memory of 2080	5800	msedge.exe	131
PID 5800 wrote to memory of 4140	5800	msedge.exe	133
PID 5800 wrote to memory of 3556	5800	msedge.exe	134
PID 5800 wrote to memory of 4140	5800	msedge.exe	133
PID 5800 wrote to memory of 4140	5800	msedge.exe	133
PID 5800 wrote to memory of 3288	5800	msedge.exe	135
PID 5800 wrote to memory of 3288	5800	msedge.exe	135
PID 5800 wrote to memory of 2872	5800	msedge.exe	137

C:\Users\Admin\AppData\Local\Temp\DELTA CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\DELTA CRACK.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DELTA CRACK.vbs"
  2⤵
  - Badlisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mc_launch_log.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\system32\mode.com
      mode con: cols=110 lines=32
      4⤵
      PID:5376
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3336
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1536
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1904
  - - C:\Windows\system32\timeout.exe
      timeout /t 4 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1372
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3292
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $form = New-Object System.Windows.Forms.Form; $form.Text = 'Minecraft 1.16.5'; $form.Width = 854; $form.Height = 480; $form.StartPosition = 'CenterScreen'; $form.BackColor = [System.Drawing.Color]::FromArgb(255, 34, 34, 34); $label = New-Object System.Windows.Forms.Label; $label.Text = 'MOJANG'; $label.Font = New-Object System.Drawing.Font('Arial', 36, [System.Drawing.FontStyle]::Bold); $label.ForeColor = [System.Drawing.Color]::White; $label.AutoSize = $true; $label.Location = New-Object System.Drawing.Point(320, 180); $form.Controls.Add($label); $timer = New-Object System.Windows.Forms.Timer; $timer.Interval = 3000; $timer.Add_Tick({ $form.Close() }); $timer.Start(); [System.Windows.Forms.Application]::Run($form)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Asta -WindowStyle Hidden -Command "(New-Object -ComObject Shell.Application).MinimizeAll(); Add-Type -AssemblyName System.Windows.Forms; $text = [string][char]69 + [char]823 + [char]82 + [char]823 + [char]82 + [char]823 + [char]79 + [char]823 + [char]82 + [char]823 + [char]58 + [char]823 + [char]32 + [char]823 + [char]68 + [char]823 + [char]76 + [char]823 + [char]76 + [char]823 + [char]32 + [char]823 + [char]74 + [char]823 + [char]65 + [char]823 + [char]73 + [char]823 + [char]76 + [char]823 + [char]85 + [char]823 + [char]82 + [char]823 + [char]69 + [char]823; $title = [string][char]178 + [char]194 + [char]178 + [char]212 + [char]194 + [char]178 + [char]212 + [char]194 + [char]206 + [char]194 + [char]203 + [char]212 + [char]194 + [char]203 + [char]212 + [char]212 + [char]203 + [char]196 + [char]194 + [char]208 + [char]212 + [char]194 + [char]203 + [char]196 + [char]212 + [char]208 + [char]194 + [char]196 + [char]203; for ($i=0; $i -lt 7; $i++) { [System.Windows.Forms.MessageBox]::Show($text, $title, 0, 16); Start-Sleep -Milliseconds 150 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://upload.wikimedia.org/wikipedia/ru/b/b4/Herobrine.png
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffa77b5c188,0x7ffa77b5c194,0x7ffa77b5c1a0
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,7818579262522252850,2435811531203171809,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
      4⤵
      System Time Discovery
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,6509972044428443431,16240756791777193255,262144 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:2
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,1293814929576449653,18308682230760580617,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,5268415370513436735,701706873968175437,2097152 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,546076246834680979,5346661814975283994,2097152 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,11415918963817359839,9820911645471842625,2097152 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,15703424794109004337,14316995446274796803,2097152 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,11901348787944548013,9572616432565801857,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1998133092459883283,14592931720635089983,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10600232668587606371,5322623020158451591,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15758475066891167112,9151191013260922187,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15758475066891167112,9151191013260922187,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,10816529833904651816,13315063028715759943,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,13930707160238072785,760307355472074827,524288 --field-trial-handle=2740,i,6953155653928153061,10979936638443706334,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa77b5c188,0x7ffa77b5c194,0x7ffa77b5c1a0
        5⤵
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,12179484266083731198,15229151458302205143,262144 --field-trial-handle=2512,i,4195433853094364229,8346501051577234474,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
        5⤵
        
        PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,10891280967670985683,11990160708978676070,524288 --field-trial-handle=2512,i,4195433853094364229,8346501051577234474,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,4107819819484195259,6474170439300949667,524288 --field-trial-handle=2512,i,4195433853094364229,8346501051577234474,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:13
        5⤵
        
        PID:3288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11603993272581589888,7099642596819683746,524288 --field-trial-handle=2512,i,4195433853094364229,8346501051577234474,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:4844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11603993272581589888,7099642596819683746,524288 --field-trial-handle=2512,i,4195433853094364229,8346501051577234474,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:2872
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c shutdown /s /t 10 /c "Â²Ã‚Â²Ã”Ã‚Â²Ã”ÃŽÃ‚Ã‹Ã”Ã‚Ã‹Ã”Ã”Ã‹Ã„Ã‚ÃÃ”Ã‚Ã‹Ã„Ã”ÃÃ‚Ã„Ã‹"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /t 10 /c "Â²Ã‚Â²Ã”Ã‚Â²Ã”ÃŽÃ‚Ã‹Ã”Ã‚Ã‹Ã”Ã”Ã‹Ã„Ã‚ÃÃ”Ã‚Ã‹Ã„Ã”ÃÃ‚Ã„Ã‹"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3308

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5456

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a30055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d05d73eddb2d50e22f8fc8b6b14cb39f4328fa865383e7d59010483e6c7fe98
MD5 7291bbf7ba355e888452f2a1c1453eb0
SHA1 38d6b1f43608b38237d4c2581b49866038eaad5b
SHA512 e68434ccbda0a69fe6b853d8be43cdd98d0e99462efdacdc8b760ff27aa8e34dd566fc04d3411007c20cfdcfdde4c8bd68a6befb55d10440dce5359c0465bdf8
TLSH
T1B6D0A7B476767A92D62A617782604B0077790563221642456150840C4C74489A6C66A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 66daf895764497002de09559cb55a7b20561397fea7196ed14dd95a65d54ff83
MD5 15a753d33525244bcc60109703eedd33
SHA1 26596900d387bbaec1f558de1d4a28d41f3206fb
SHA512 d07b64f019f465d4be6da965384630f96ababe8e8f000631d17ecfbd52999c75444c1f2e005181116b38c2088d069ade0dce7b6a43f7c1fa087fed9f60de2029
TLSH
T1F5D023FC7377B502D625757253104B0077B50461311A454275F0C54C0C7D5D8D7CA1B6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

49bb08a6-2f5e-4cd8-b2d2-bc05334691e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49bb08a6-2f5e-4cd8-b2d2-bc05334691e8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c4a62a893758b16ea5b6ca03d7360026820085084f838ce9243692200df939f9
MD5 fbd8fd1b2cf16b06b0c62fa87c6f9b89
SHA1 5368bf2918cae23db2580cef99c0e4c2535d0755
SHA512 495e3b958fd325aeb390179af33d0ac50441cf5b676f5723ef1e689ea7e18a63c302c94cca9ac9d7cfec2b5f18d676148bcaa185f31747eced2691b6d3c9727f
TLSH
T153E02BE7C866EC370CFD0B5864801746E752435A2740A54F3A3CC20D8FB4226458586C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6e95bc7f9115595d54501b3742d24de54b8c086da2c1a14b4abd6a0a8d4151f2
MD5 b554b40635279b8b1ce38aec3b8a34c9
SHA1 873f52120b85b54c87f8015c97a1ae93f20c81fd
SHA512 ebe5c001e0b8c68804b9a7c18ae2ee8d2902133afa0ad1055c7e3bc7ac6778847a4f0550f515ac76efbabaa3dc4df92a73bda84cfd5a1084d01ce9c0608c792b
SSDEEP 384:E77PY6YDw5AlPln2U5Uk1jd6DX0zpcV0T2Rdb0jjP:EXYNDrlPlnvADX0ziV0Tq0j
TLSH
T118131CBC76042D6DC6CA983F816F6B7953F4E722C6D0598783723B2293253126D2F938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bfb806a8d7be01ced37e79862832e6711c352b1af204c992196c273cf28ea273
MD5 3393752dcf125bc6c7d1d6427130f060
SHA1 a73243bd0f44b22d02bd570c784783e873022561
SHA512 99bc4608660bf08881db711c811c262429b7bdb22a6dbe5a87950194766bc27937b67ffa35fc0de5a96227e50a1dc58f48fb439bea078b38c4ba1309062ac4eb
SSDEEP 1536:y5VgyL/5fL/8FuGxbvoEQLHLvpmfZSno25ddLqxbVw3kSGVbvpL/oL/mL/Q:ysyL/dL/66YBxGSL/oL/mL/
TLSH
T1A2445FF70951A00BCFA852F6E2133E3DD1BB060E7DD1F8E9D2784C952925B21B6BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 a9fa57ed32bdd41ce6f4e0385a88d0a20fff60b6c39868a0041a41f6d53acf1f
MD5 d58e3153d99eef52beb400e70f45862c
SHA1 dd5141758ed2ad0c2fde913ed1f88bcb758d29cd
SHA512 7ff56914c32f613071c21e5fe91bb5031e521e2f14bb3fb5fc4d907762174c48fb11e471d8639f8acacd0fce1107a0994ae4375dd45e07ee46713d6f0d768982
SSDEEP 3072:Zv9G+HN4I6iHWb+pzIWrHLQDkUW/lCb5:ZQ8uI69WfmINCb
TLSH
T1D72529EECB282C82CE6B8774B0E0D9077E712183B65CD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 bfd3cb21c813dc1e45d61b477ea23cf826b1b1487f2d5a62728450d6a9c84955
MD5 2f2bee5a7089179c412d1c930fe8061c
SHA1 4e4a2c5b077072cd31baad27e5734ccc84c49816
SHA512 ade3522763b9392b26801817e3dd81dc5dccc9284b3518062bf1d0c39cc098268b7fa01251e2afeedd69d2d082d2f5ab182681326bdb93e17346aa662779979b
SSDEEP 24576:OHUCNIx333A5ryGMarxFXBpJL84Z02SJnPgc/9Bord3mIP3zCHPe:Ooxnw5NM8LXBpnSJPX9W3Z
TLSH
T19B167DEDCA7858C3CD639A30B5F0E9577C7413C3F994C1D68898C584026BBC5BFAA269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aad0c0a0d3b70c05dcaebf83f7e5e48e9e3c641445df31f28ef9ca75c93552f7
MD5 ce899d328cd88d0b3d871f732a67b0f3
SHA1 de2aaf155a0574ebe0fcd986b0754da9ae2d4dad
SHA512 bbae213b368e2460cad32c6d54974f0427b51b4751b1953a53597dec543f01235b13f5045b7252ab9c26c2ad27a74526aac5b34fc56d9ac7d581290b7aa7cf72
TLSH
T19F613DC43C567A9DE32FF4B390D111AA37F4C2AD850B6A07D848B3B8483AB5478C2935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0ed6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0ed6.TMP
Size 3KB
SHA256 0fdee460c9de5d17f191d29cbd1fb23a2fab90156d8a4a23f60c947ea56663bc
MD5 af0a8d6fb4214b577f31c8be1a4058a9
SHA1 497f781da35471ef18c7447a490fe15e24e00683
SHA512 33a36a19bd02e11f6bd08f4105831b7d6d1a8275f2c1ec29d047921429dca5c84b322f41fb6ad095e49cac46fa342c89a78eb1623be90579031cb5c64c9dccb0
TLSH
T14F613DC43C567A9DE32FF0B390D111AA37F4C2AD850B6A07D848B3B85836B5478C2935
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 2ae1da8834eba80a4daba257d6b1784ac4c080678ffc8f566ed1055d62e81768
MD5 44a1d13395934c0a4af5269f1844b3ba
SHA1 988aa6e9cd60bb96133f28085e576b2e9e1b2ba0
SHA512 fe72216100b5fa3d69dc3d8c4ce51cc3a3686dd610efce79a7357c2bb2ded1f43c4e6d6cb03bc712f2a0731e01a511efb45143e9563b5b1264418063738f1225
TLSH
T15EE0D8A45AC7C11D551435C2517C574D81E135AFD6C6BD036704DCC57742401BB42596
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 a3271d2cea38cbd716f71a70a41a46ccf641a96d10574789290acdce9e452781
MD5 582280f9bc7f62c45a4f702948573185
SHA1 f7258e177d469598fffc70e399bc21ee6f9fa58e
SHA512 0043298123227b2ed59798273d08c1f48ab66fc777a279b6d7c3c7e6cd93b82699b769c63a328f3d6bcd508316941a69196b390307211d1e9741aa77f5b70519
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfj85eRW5LCxFtIRqLNVqYpRC:TtD4jJ/0UC+lf57RWxUFOEVTpk
TLSH
T13EE2CE8C3B11F511C8ED733DA0D2C5F05EBC783C8A8DB170523899728D52A65F49E55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 26135890049a5017ef946fafa5d1b92199c1a316106f685b6dbb5cf5682c96e7
MD5 f92f23169be5307fd5562815b65b4e63
SHA1 6c1835d19dd48aa304503a6a57b320d9c48675dc
SHA512 9001ea9620c62f394eba72ec5c14c619254f9eedd85279f1c1cf85117bea795c4f2fd3c5417102972e61822ddbca97536cdbda6940f512bbc531291faab564e1
TLSH
T143E0262447CEC12991586893C6AC430CC3D2351BE3C8BE022748D9A8A201341A38B6D0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 e9e292ba03e84a0c914456065a4d8768c9a4cf319d74fcaefd750ea54032461d
MD5 cfb4594bbc93f0da6ac848ea1c3161e1
SHA1 0ecfc4604fa730592145934e97bef2a8fc5e4c6a
SHA512 a1afad9f853c6b8dab52aa5f66e001c3074a709ee4a16af3e87f7cb1a4a85d8a5533be48d638b9135ef1f5f9ae72166ca280aa3ba760ef54a3e33f62ee67eacd
SSDEEP 48:uzBmw6QU1PzW1fW8oB1ii+cDAoeIHYfrhe9g1zN3UaTpNx1+Kwhcw1aA:6BCxHhft1Juog1h3l+KwhcRA
TLSH
T17A9219972F387403E7491E3A2A2E083E8D36A17EAF6B5D14741414B5CEB8884A03C1AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3f402714245655a603ad4604f545be0fc2ec2ce036e80c1ebfdb2b8554f8159d
MD5 7317f57b978d8129c100cabfd1ce42da
SHA1 110c86f9d2fa0b27631af8830eb4e5369ad84a58
SHA512 af9cdc82b70a115248e59e288d116b724d5390a36d3da6c9aeb6d97449ad8f7912347fec29bdd0b1db9ba13c178d4ca788b41d83f6397996b9b47c86e29a10b2
SSDEEP 96:rmYtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/sYBbbEOVpZf24JkMfXSFR+CFqD:rmXH+bF+UI3iWGVoWN3qL/vVVV63
TLSH
T1E524000F5F242722CDBD913668E744A35C7DF03F8B1326DA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 156c334c33f6bbb7d6cdaf804886827029139807df332ee05f2a81e4af2e55f5
MD5 4fed1faa27c673c9c6c5de12bfb75d42
SHA1 1d1b74314616e641951b716b459311cbdc2c2012
SHA512 203e0a7d1de479c71b87e72cee13192f9119965bc3133e3bc33410f9cf5f9b3e5567d9f99e336e87f52608eca8aa52577ac1cb802ed28a8d9f9927efb1f1f42e
TLSH
T15BE0D8B047CEC11A6144249B427C670DC3F1365FD7CC7F426B04E844F249004BBC61D2
MD5 SHA1 SHA512 TLSH

Submit Download

9d3a4521-eaf6-42a1-a02d-13e876123424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9d3a4521-eaf6-42a1-a02d-13e876123424.tmp
Size 2KB
SHA256 96386438a5b42f9d8dec720190e037010cf65236cb797a8549db88782c1d991b
MD5 a14ec4885e1c9506c70f7938b5421787
SHA1 390a25550ccb4240f9f292e91964c14b777dde62
SHA512 a81e617dd8dc89b9277c084d92e6813cb21fb6a876e40e8f50f055ee7617b86bd35b90ec7eb2fad064931b8bc94fa406f251152148a6edaf515a17083fd675b1
TLSH
T19C51AAF7C3E4857D8A1146F0BA186E2BCE1C0915832C3D56C9E4AF1B93E3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 67cb4ea8e92542d757a910f794c36ec23be13b8bf2abe213e159005687b0bd3f
MD5 a53f53cd1d73d25e70863524043f791e
SHA1 e913093e287898e586181e7d974c5a0858c01dd6
SHA512 cf75b447b049328873e055231e803f6e0fa48723995c8699cc3c4269a93621f05d62f4019d3ceb3727a8aee5ac33de9cd64b87d57a69a7fa08336d448c133f8e
SSDEEP 48:Txk/LopFMaty423w/a9NUuTgwbjouwIn/tokpcmr:qDeMatha92qtPTnr
TLSH
T1FCB2224E1F607212D1F55B7AEDD184272EBC202D87733795AE1450F3CDA366BF5060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3091f1e32fa3dd56d0db75aea4c20250bbfce3e248a20585d605b12b78164988
MD5 00125f45cae861fd64c1f39952905fdd
SHA1 0056bd759c209589b814c1f2a2f038cbced80193
SHA512 abda680445312bdfc32200f8371f295c87e06966a9c27381b4ee36ef9c8a9ab667a290121880bca921840ff6b0c1db820adbf8d0c3ac41486f64ce4f69ff6716
TLSH
T14351A9F7C7E4857E8A0146F0BB186E2BCE2C0915832C3D5AC9E4AF1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 66ac1ffc9bcff26d611098ff32ac15584f6969d6c7bf98cbd514b244ce60e21f
MD5 8dbe388f28e3f7c2ca946bff2b5c423e
SHA1 04a3df88f91563f4ecf8bfd11459de36f2ad4e76
SHA512 a296b25f011b66d7d03d9201d3ca41e07bde0893fe3757d45171f248b964d9d89b26702bc9408b414c6f6e070182795bb1e1be7047a5c209734087b9b8fbaf6c
TLSH
T17DE0205286BFA4371038487F1E84FC459579B4364341B0B5DAD5D33CB1B18FB5709435
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ddca3a5aaaa14a16d302dc3f7779ca2d900af8622a778a79c5167d2a44b7e4d8
MD5 63ceaf4cd820e3bd8878b45d58776091
SHA1 7ec2139cd773b62886712aa1040b492c59d4ab41
SHA512 1d656d2710399a18849d0cc10db7154ed8bcbd7c75ae2eb1ac1bf19ace20c11759673fe5ec7d3ff2ab735eb7623b360dfb7f2f2bb352cfd9772056234abc1d5b
SSDEEP 192:sxRmReyM/jK1Ml8Fcp/fjszWpV0pHdeZ3zoA8puC/g6+WN5CTNRm/YWBJjg4IgtJ:sxRmMxp/fjszWv09dYex/55+O/tZ3
TLSH
T11E62E816A538997B8CDBD20DFA517F53D2F91527E2901E44AEFC8A1C01E76ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 38eacbd76934de8df726283ccce205d0c376f4d3e944fd795fa07b4a8d2a45fa
MD5 550e6d5c251c90aacc809ef4ca471837
SHA1 4a36a5c04e7986ec3d785de7c4cc9ae609955e5d
SHA512 8a50b0ea1aa9b6800d4fca7afbf62cbace2b62c7362c07c04784d4f6fbb857061e8dd38dab3a171c943d2918949a72e8fecbe81c48b449aafcb5d084693074a1
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0kgcciero53lt7:AIox/OE7p0WguMfnAu1javkgXi153X
TLSH
T17EE2DB3B680CCB7E4F804ADCEC29BE9E6DA801CF96D8CD5447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ded2a802a4d069b48a3d505313e96c792bffc546d36ec1336de9d0d1cd5076b6
MD5 9fa713f5fba64f75ea40d98e9df78678
SHA1 20bcfbd40a8031e83b146b5c451ed0f9aa1a7451
SHA512 0007f7577c396ae2c30207b0cf4b8aaf2b2a98c21dd4603eb2c6b496cfe4abcfe3524cad5db871e0662c68f9feefb8f9070dc68377bea2ccd670214ea0065951
TLSH
T1EBE026E00BCAD1BD6159224302BDC30DC2F6752FE2C83E063F88D84CB243505B2971D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 aa92c222556744da3ca32df2350cafdb7852ea06eecdeb8e7bd2b8b0d662f8bc
MD5 991f8c1f2c07b45e3465b9eb0c0e99c0
SHA1 f762d48681b4939da8a25e8fb59a5c5c277a4435
SHA512 53165ad61c5819feda69c30285488ebb60b7c788baf407320532009ae65c8aec290d4081ace0a21c1236302979120c1d659375277afe80d7f9dfa9b07fa82845
TLSH
T1F9B012C47B01DA42D5CC1DB30190CB80B770F01110618507BC885F312D059993F40CEC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6c493b62e1d73d075413795ee6723751bbb9d7851452fa812ebb24881a59bf78
MD5 ba903e6d22e4dcd2645a2500aa4b9f06
SHA1 5a521269c95e58ecec3a953919fe40985ac48776
SHA512 f35c00b572c4f800cc9aff08dd2a86314bb799e5b86eac85be0b41ca11b4ce9751d0b705407c58297fbb982fb7ccd3d1f2e781c4e5eb5a20ed97c4d7a9fd2bd2
TLSH
T1C5E0D83057CAC72A6146208B426CE74CE2E37517F6C87D113F08E59463461847347190
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 eabebc5ce29cdf49621e5c64487b316560519c3043692becc20dc2ad18239019
MD5 fdfb88c7841a5e1097e8bdd1051b4335
SHA1 804bed0bd1aec702bdd26291d6c9fa6f6d809570
SHA512 9c47561f55aea6fcb2ed71799ede6b6b7674d466673c8bd99588e0c755f7448c30cb78118307bf3a14075c880b7e083557903750610ef10e66aa448662d8d5f9
TLSH
T108E086F047CAD279540460C382BC974E83F27D2B97C8BE46670898D8E282155FBA75D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a015dec6e69f87362f3f0119b24becf9587af561f7c223ab22d634df917d0514
MD5 1afe6c8d84dd29e4d84d1f3abae716d3
SHA1 1542c995513fd0a114195c35c4c29c5a665d0fc8
SHA512 a37d7b328a25e84a0ccbb6a30d7b5f7e2933adde11963c715c94c6b2454f69eeee62a3c28799a92f0ee4a4a35863f8884d93297c91702c543d93bdaa5b6c9a89
SSDEEP 96:KHyruiQEYkoEJPOqkKGBO4kaCipQC5KEQKFanMN4cWaO8Wqnngk8K4pgu8cscHG2:kyruiQEYFEJGqmBO4VCipQC5fqMN4cWV
TLSH
T194912461357B3710387E641D86B8F45B428231B23099B57B37A8A1A61F67F014DFEEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 23d009bd1a1b9907cfd2b1d6d21be08336dab2f210bed2246829b8d8b38ae271
MD5 7bb1cc9fbd39fd8f08bdb1bcfba2d830
SHA1 983020b9f8687a8929403b6dfa6dfcd101992142
SHA512 64a998c80033ed2ae5fae0f6cc530541a47b74682aa63b27e774c6fb7490a8a17d5df3187b0744650658f6b0a2d3ba8214abf659fe6ac07e4e725f61594d7f0c
SSDEEP 96:KHyruiQEYkoEJPOqkKGBO4kaCipQC5KEQKFanMN4cWaO8Wqnngk8K4pgu8cscHG4:kyruiQEYFEJGqmBO4VCipQC5fqMN4cWr
TLSH
T181C16460757A3710387E681D81A8F41B42C271F231A9F57B3BA861A60F67E019DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 303f5ba125291a18e7c0986da528550424c435aeddfd404a0b4c0380607b667d
MD5 c7cf5daed52243019c0ec6984e43f70b
SHA1 c17e711861bfe8ea14ce55881f99113000c7fe20
SHA512 48028ff4e44570152ec38cbf17652f99680f36db46fd31c6f21c679cd5f8ed7e3155dcae551ecfcc3fde36877cdb1dce59bd75cdd9bba500151734e70b11f4c5
SSDEEP 384:DNrRZyCSDnxTICWMEhIKyll7svbFKfk7:xFZJSDniqyI1l7svbF9
TLSH
T1C444740A7B747001EDE6D9725CB080771E3C716ECF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 0350edb7ec324fc6bcb321985086904dae313e603e567d6088d350a13733f4b2
MD5 030585d7908a8513e852d8e8bd944571
SHA1 b5d7ef1539cdc6e3a6e065c5bb15181886af9c3c
SHA512 c44e1b698410263abdc46f8f62c6624fdce61549d82c008f45082edf38cb9dba6b210b391646c3ac5998598e5cb1f5f5b7e8701a11c17e91fa99f4517cf7eefd
TLSH
T1A1F0E9D0236D34907ACDE941C11D3803E0C97B55226EB872335D66E84B848098A2FDB2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 249c42e422f54d6c949395230fe4254800d07e45787a673cfb89bc81b3775699
MD5 b066adc1fc14667f61f85129d3bb17ac
SHA1 c909b7a8fb0e7ade360122bb82c1aebefcfb79bf
SHA512 ad7fa5fe639c2691514a7b345fc6e194e9a4f2e59d216d8c805ceecdb095d3363ba84d754ca8edf501be6704503b130810e9504e44595729e49f43036713d1bb
SSDEEP 192:FYQjIIISbiMIMsdYcYlQUOmhAsIl8TEus4e:+QjIIISbiMIMiBzmisqCs
TLSH
T14842856E26012B73D09E6B769363D5546AD888C250B2A52D31532C1F8FF7B9782C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 44af02893653579828b64e34c03712695540328b16e7c65435f5e37821869700
MD5 f6219529fa3ac42d46f3a6af40043cc0
SHA1 93026dcb4aebb10722cfcfd808290a7f58a8155e
SHA512 5ea54108ba6a2e2046c471914ae9c7f3945eb29fe627fbf2fbc939d38f5ab4636e6aaab270ee91e16e2f40d361501cd5c2e7b3c905529b6de17f9785095c8f2d
TLSH
T10EE02630ABCAC2AFA158318712AC430C82D23A1BEAC8BF163F01E448A701184B78F1D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c4d959a82afa088a44bf31ba8fcbf6988f0553f5f46c9f2046d166a247edb2e5
MD5 95be7f7863e7d67dcc2b2795b075dd1e
SHA1 967970298efc059c6c0e8a5297f30a8f392d0f04
SHA512 6faf74c1a7a5719ef0d414dc1a25ac07a06e2fbf7ffd74550e346ed4297ce70892a29792aca2a6224a42bc99d7e413341b0ad80cf484d03a3b510022fe351f9e
TLSH
T11421C495F330C109F149867A647E9B291738E8468FBCEC0F457920356EB2F090E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 fe2cffb18eb1b1e16c310d1470fb874abe2cfbba4778d8f8ddad23ed6efe8f76
MD5 e130bea6da86ef11e7970535a0da280a
SHA1 24b4f7ba2c1e4c7d9c01466c14ba0d68080370ba
SHA512 f4f16495fd923e6870b0bf50bae4287fa8ef6b6948327c78d2d911980aa61a7e268a5028797d68d2b47acd370cbba82f07abebf020afdd450be92fc1b6d28f6c
TLSH
T18BE0D82076CEC1DF5150218302AC834C82D23A17EAE47F023F05DC486702181774B191
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 fa4c77b1543462733742bce8964a70cf764a457aec819859c597e90e025c4b10
MD5 f8a76b42f27e07acf08f32eb0c38d6d8
SHA1 b6311f42627eb003dc2dc58a006612eeb79151f0
SHA512 fee9700c16f5df62d80bd10d617985a7d6145a536b3130c34fe68f0d273e549a9f1d4c19b591f29bff16d181344ebc8d4fe2655f918996a688ecc5bcf8af2c80
SSDEEP 3:MsEllllkEthXllkl2zEflkM:/M/xT02zb
TLSH
T1424402156F80140AC7001234406187902370D5105611775324D108265CC65800CC0001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8d5e8391df0fd9339ff3b3c7703419d0788af4081caa9e12f7f7476f3903442b
MD5 189d2d209ca3e8a7535701f95a75c42b
SHA1 eee8067d40ae606ebe54fba83447403bcb87a944
SHA512 7ff90a394e4f9c9577b57a921972ccbd92c850bcab07454f6e8017ea6a94219dc5bd566524fa60b9c03308600745919260b02898300f2f511e088cf17920bbb5
SSDEEP 3:MsEllllkEthXllkl2zEflm+:/M/xT02zj+
TLSH
T1704404FD7FC00515C50010714071C7DC1370D5100711775334D10C375CC75400C40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5a51d0c3e93029c744eae8d2212f1e7336e312c8eb750251a6541cc6fc1a4bdf
MD5 1724717a94d0d8e526a2cbef922ad3c7
SHA1 0a0ddb107cf0f0aedaaa9cc2cd5d9b7d28d3cee9
SHA512 426024f4d9e8e834663b7381b34e46170f249a82d643117fff51da27de2d9169cba1c6b25b69c8fe96320014d2d4cc3045c0c8fe3eef075974211300c7533266
SSDEEP 768:nj+9r3tGbPQOJIh0Ngahu/hUAFjQIMyOV3N5E9EfDl8BvTPa3wC:K9r3ANyhNFUIpONNmWDl0W3wC
TLSH
T1A7F2AE71B8A1DEA74DE7D3C5B31662876FF411B794801E84CAED6B0D018328D134BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 94cc0b377840cf2fb10f6540f2debccfd1d0858006a03710ee733127c7fa6d17
MD5 5045f3c7cc2037d2e22ca5732c48e9bc
SHA1 9c15d9d285a16ca4b2e129e37c7a1827779e6522
SHA512 35df50b344faaa10d7be61af5499486cd5bb2a0778540fca4c2a877857e8da31e745805f30c62c1a6710e510c1f2b73ad29eaea44d1a141862563e3fbff62b3f
SSDEEP 768:9rv+4UNbdF3OQsQOJIh0NgZ/hUAFjQIMyOV3N5E9Mlo+8r0mL:9bsbf3sNYhNFUIpONNmfDrv
TLSH
T1F503BF32A8A4DAB39CE7D7C5760A72537FF4416755C10A84C9EE2B0D824B5DE230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 13ae97506eba3f0a7230da44a3ec94e63ed302946265e33411dcd737e0a70de1
MD5 5e86af6367d7fa266f759ddc052d5fbb
SHA1 8713a65cddc33723bc514056d5be4fc5f14d0f7e
SHA512 f24752d1138985cf7641771842314130e1e1351d4ebc59a85ce07269f9d3148470eca7e89e418ad64372f631e82500910c9369a1295339ebcc728603c8296a95
SSDEEP 768:Nj+9o3tGPPQOJIh0Ngahv/hUAFjQIMyOV3N5E9EES9ibDl8BvTPa3wC:o9o3YNnhNFUIpONNm3zbDl0W3wC
TLSH
T1D8138D7CAC518E7F48EEB789630E26A61EA8027BD4B45848D7ED5B0DC13224CF747D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3be8801d049421ee1ba9ace96e8af89661b9e94c2a7681b4b6a1b1eb2e8e927a
MD5 e94279414cb81440b491dad260a75939
SHA1 75f6dba038580a4443db1dd68f720b204e732d4f
SHA512 ab67b681e72fc5ecc66b2649a3bdb3ebee72ba727bf0635da32ff688db7f9c29172e1351d03cb17ee0443b30a0dbaf82930b31c4f927cd847532a6d6369798af
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T19344040D7FC00447C54010304071D77017F0D510071177473CD10C335CC75400C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

8e5c0214-5b00-4721-a675-cd0a9d7cc1fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8e5c0214-5b00-4721-a675-cd0a9d7cc1fe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af025abb72230fda70b4da955b61fe319939552379f39eaaa22e97457a234067
MD5 184f5e0281013f77f7c5f749f8ed9e61
SHA1 5088e57f77b8539e86f26d959d193b70acc5619b
SHA512 2a8ccb738923910079d73ff9e12a1ff5076c05e1faffee957c697c3e7817e9acda3d50fc43257236d2a85e3ed59ddf7e5de743e4ff28a14fa5d54f83056a8516
TLSH
T1E3216833F3CC8215D88A403650CEAC1037B6D7DB40DECE5BAB85D649B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

DELTA CRACK.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\DELTA CRACK.vbs
Size 6KB
SHA256 74a7ff97058c744d38dba9394f3f3d321ada0bdaf8f5a2abad364b0239a43fde
MD5 ac7d6854d99ebfcacc11c0e54b52348a
SHA1 2bfc525ee9abb8a532f6e0699c6df7a0d3a9466e
SHA512 a246ae19c8b27a26dfe9bc386ca8938c518701e721beb15e131d6da2eb7c038dcf5b7d138a7445831fa0968ce9c9be23186e21d9fc5bade7665e24c029274553
SSDEEP 192:kuXmpzKcupsM9Ym0IjwN97g1IjgSFTcgtg1zqd:kuXeVuh0IMNRg1IrDg1ze
TLSH
T177E17411EA1F28C20A51B3D1801734DCEA1642B7778FA2D6398ECC4BF6AD344726ED75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wrlq2g0s.22o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrlq2g0s.22o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mc_launch_log.bat

Path C:\Users\Admin\AppData\Local\Temp\mc_launch_log.bat
Size 950B
SHA256 71b81686b83156cba31f14b46b438a7835aca5c4878cb71333c66844d7d1078d
MD5 96815415f23c865d4722da6b07a7b9f8
SHA1 1f9bfd140c09e31b3e220aa0825b3b3a819fe630
SHA512 3a34d1ecfe4d4c82121a246fc04b453aac7c2749a4f571c7f8aa893b52b77878d8af929439dc777c9586cd8f9d6cbc3c6558f1c04b384adc3e086e7f0a17f9e5
TLSH
T14111ED033512B4C398EA7430CE3870E675F145BBCE4CBAD03B42C2588B4DA82B76E864
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_1413747843\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-22-0x0000025DFA830000-0x0000025DFA852000-memory.dmp

Download

memory/3008-30-0x0000025520150000-0x0000025520202000-memory.dmp

Download

memory/3008-31-0x0000025507DD0000-0x0000025507DDA000-memory.dmp

Download

memory/3008-36-0x0000025520320000-0x0000025520326000-memory.dmp

Download

memory/3008-29-0x0000025507DB0000-0x0000025507DCE000-memory.dmp

Download

memory/3008-32-0x0000025520330000-0x000002552034E000-memory.dmp

Download

memory/3008-37-0x0000025520770000-0x000002552077A000-memory.dmp

Download

memory/3008-33-0x0000025507DE0000-0x0000025507DEA000-memory.dmp

Download

memory/3008-34-0x0000025520350000-0x000002552036C000-memory.dmp

Download

memory/3008-35-0x0000025520310000-0x0000025520318000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads