75fccad513811f80bcfade34a46f030678e9ac7761cfbf66dab9c64b66b7e40f

Analysis

user interaction
yes
max time kernel
90s
max time network
93s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
phantom-2.0.0.jar
Size 577KB
Sample260702-qq5dcsfs4s
SHA256 75fccad513811f80bcfade34a46f030678e9ac7761cfbf66dab9c64b66b7e40f
MD5 2d6de57afc63367e2f8f903b233aff1f
SHA1 1911b90ad13239fba0c93076e3308cbf05782484
SHA512 976b8f91b4dbfe944daeaa629729f41e7babdfe15035bbe561a15debbd3d95013c1f41abb4acdafb131e1e00ca688d8e2a33cc7a7202d8fc98dad33218e91166
SSDEEP 12288:NNwt+EIzvDVipkqTyJMEaEKHt1gC/GoajPu2g0uCIal5VaPi7fY:L4+EIUk5MjfbOzI0uLEv7Q
TLSH
T1F3C42388B1DD446CEE539D76A78182C2796B339CE52320E9201258FC9DB90C7DE1D7AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	msedge.exe
4304	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274725795378140"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{A0EFE705-EB77-4E8C-89F4-399B83FA2BCB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{87E56D13-5E4D-4527-9039-450E79BFED89}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	LogonUI.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2100	1908	msedge.exe	92
PID 1908 wrote to memory of 4304	1908	msedge.exe	93
PID 1908 wrote to memory of 2772	1908	msedge.exe	94
PID 1908 wrote to memory of 2772	1908	msedge.exe	94
PID 1908 wrote to memory of 2772	1908	msedge.exe	94
PID 1908 wrote to memory of 4252	1908	msedge.exe	95
PID 1908 wrote to memory of 4252	1908	msedge.exe	95
PID 1908 wrote to memory of 248	1908	msedge.exe	97
PID 1908 wrote to memory of 248	1908	msedge.exe	97
PID 1908 wrote to memory of 248	1908	msedge.exe	97
PID 1908 wrote to memory of 252	1908	msedge.exe	98
PID 1908 wrote to memory of 252	1908	msedge.exe	98
PID 1908 wrote to memory of 252	1908	msedge.exe	98
PID 1908 wrote to memory of 5832	1908	msedge.exe	99
PID 1908 wrote to memory of 1132	1908	msedge.exe	100
PID 1908 wrote to memory of 5832	1908	msedge.exe	99
PID 1908 wrote to memory of 5832	1908	msedge.exe	99
PID 1908 wrote to memory of 1132	1908	msedge.exe	100
PID 1908 wrote to memory of 1132	1908	msedge.exe	100
PID 1908 wrote to memory of 6100	1908	msedge.exe	102
PID 1908 wrote to memory of 6100	1908	msedge.exe	102
PID 1908 wrote to memory of 2616	1908	msedge.exe	103
PID 1908 wrote to memory of 2616	1908	msedge.exe	103
PID 1908 wrote to memory of 6136	1908	msedge.exe	104
PID 1908 wrote to memory of 6136	1908	msedge.exe	104
PID 1908 wrote to memory of 3156	1908	msedge.exe	106
PID 1908 wrote to memory of 5536	1908	msedge.exe	107
PID 1908 wrote to memory of 5536	1908	msedge.exe	107
PID 1908 wrote to memory of 4272	1908	msedge.exe	110
PID 3248 wrote to memory of 5372	3248	msedge.exe	111
PID 3248 wrote to memory of 1300	3248	msedge.exe	112
PID 3248 wrote to memory of 2876	3248	msedge.exe	113
PID 3248 wrote to memory of 2876	3248	msedge.exe	113
PID 3248 wrote to memory of 2876	3248	msedge.exe	113
PID 3248 wrote to memory of 3900	3248	msedge.exe	114
PID 3248 wrote to memory of 3900	3248	msedge.exe	114
PID 3248 wrote to memory of 1172	3248	msedge.exe	117
PID 3248 wrote to memory of 3272	3248	msedge.exe	118
PID 3248 wrote to memory of 3272	3248	msedge.exe	118
PID 3248 wrote to memory of 3732	3248	msedge.exe	119
PID 3248 wrote to memory of 3732	3248	msedge.exe	119
PID 3248 wrote to memory of 4556	3248	msedge.exe	120
PID 3248 wrote to memory of 4556	3248	msedge.exe	120
PID 3248 wrote to memory of 2920	3248	msedge.exe	128
PID 3248 wrote to memory of 1648	3248	msedge.exe	129
PID 3248 wrote to memory of 5920	3248	msedge.exe	130

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\phantom-2.0.0.jar
1⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\InstallShow.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd4e3cc188,0x7ffd4e3cc194,0x7ffd4e3cc1a0
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,15045906777473224495,2434513758000905829,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,9270838680518976295,3805147424864475863,262144 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,15963282991384754729,7964503551872521745,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,10680071742407251922,17404077783084932028,2097152 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9926803625588007639,2131389720745582566,2097152 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,17579493602582114171,12690752325016304967,2097152 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,9733082657047703076,8795843919458967064,2097152 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,17352603026729961751,12218854119505810184,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,9308897977240338915,951874364294140367,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,13290485476081881013,14933855559913724023,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16046200494296456222,4631919720524804364,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,16046200494296456222,4631919720524804364,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,5542743981657417219,15929054269763454583,524288 --field-trial-handle=2336,i,16754380287028053054,15552228363036437333,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7ffd4e3cc188,0x7ffd4e3cc194,0x7ffd4e3cc1a0
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,11778922495739365324,5139080261695461205,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,768469510098034630,11241791692499968294,262144 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,3528096106163714451,628109012479899689,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10687368957480421161,14724607758821199701,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,10687368957480421161,14724607758821199701,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,3235708281168691401,6785695208443309544,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,3935041411808836340,6037580727624948553,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6382594685055855589,17052475313189645502,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,12526041754943890800,7899445965027546249,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,11648527849387170699,12881117841440334825,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1256,i,13441656589310539800,11130600418883411363,524288 --field-trial-handle=2368,i,14322991589107462994,3940667110610675032,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
  2⤵
  PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\bb55259eb5624c6184303655e153b0a1 /t 2996 /p 3508
1⤵
PID:3284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68b9ce67fc7866a8bbdba960b8d7871313026cd84ab2d67b0e16a9519f196464
MD5 b3af5b2d60585d372c6493192b8eae2c
SHA1 cf4bead5e3be12d597af832c198b9503208d2ded
SHA512 4281a65f05d2ab3f640e41cbf810c7f9791e5661a99ccacce9bbada0127b93ae54e403eca6b20663fbcc000db320f4b303f2b04e26fc85db22d20acc535e198b
TLSH
T131D023B47AB5FB95D756617753D04701737809732512430D6110D41CCC740C563DB5EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0413698925725b50f0d10a6430fcc51ca03a267204ff25970df09fa6924f33df
MD5 79ad41e483fcb0ac2dc3eb68d04e4d5e
SHA1 649d72e86b76af2ad1e929c9917df92fbc4eb2dd
SHA512 f624870574be583298a4a47862e53a0c3a4e33cb859c11ce2cd6844133cb20efd7d993b79041668a56e8ec62b46be2f181e7c7a1a9350dc1e05329afcc2ee56f
TLSH
T1D6D023F877B6F505D641713253804741737408717416460564B0E55C8C6C6D493DF0FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

016aab2d-7de8-47a2-9933-d91eb613d947.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\016aab2d-7de8-47a2-9933-d91eb613d947.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

67e7af45-f1b1-4402-af8f-eef84e520584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67e7af45-f1b1-4402-af8f-eef84e520584.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e5816074f2f9aa0bdb4dcbe9e6a22860e959ed533eb93ce0cc0b868a948fff8f
MD5 7cb0a62eafcecba38e187d139449dffd
SHA1 c9cbe3cf46ff9cfc27344d9afa9724ef4eca3783
SHA512 32613013243ebc5f88c6b8fe3cc7855c5c6b2995ed1415c31f8a38bbc7fb63f222fd7ded825ded4e7f1375906a1edb3cc9c4a85dc3d623e006ee42e7505e166e
TLSH
T18AE0E5A9C922982709F90B1860554686DB5513562780590F3E3C860D8FB5667558685C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 725744596a91dabddb97280c56919c1e45adad0ab08eaa0d686bca28d63155bf
MD5 dcd05c3dff4bf3af88bfc3879194c0ce
SHA1 9a44d329926d199d06dfe46e1a1acb8b5d48119f
SHA512 c47684ce29a0a2521103681f780494cce7749d07663f6c55ca01d3fa91f1011b95f27c13143b48f5d9208eab048f67018c97d0c63cbabff535a01bf24e021e51
SSDEEP 192:eBVknzboVKYdrkGXpYrXmBy38mQDMWDn8UNApLI:eBVknzbOKGfcX+BBMWHNuLI
TLSH
T19C133B3DB7118C6AC2CB417D07B76B3917B59F81C3C56C07AB3AB0661AA17923E0E178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 da6d8fcfc2864fc77dcf802f444669e5ac9d918dcb302a4feac9302be58f223e
MD5 aea3f39e8b3bc82146c33cfcb008bed2
SHA1 6bbdab706f2b8053976a282f0722cddf0f5cc812
SHA512 93d2c98179802beb4fe44cdd92c223329ae2cf259146320619685e00f3b292f1fa3d9a87bce9d85292ad7cdfb057d40fbb4c41d4ac322e9e83c89f2bdf4c94dd
SSDEEP 1536:5ZVcqUL/OFL/3yd7uxradmdOl7tZIUSPczlUAZL/7:5QqUL/SL/ZSDCAZL/
TLSH
T1EE443EF71951A01BCBA852F5E6133E3DC17B460E7DD1F9A9E2784C812825F31B2BDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 bddab44622099b27ef7814511f054ff8f8b05c2cc6a5c0d9e19689d75bf5602a
MD5 e01d5f486f2df10528285ad49f49d04d
SHA1 aef65c77fd249e00caabb045be21da6d45bd7057
SHA512 8b171ce2727f5e6d6c1a7986b4fece2f1cd28d6653a73db8898c69c1693a1a8257fae8ed83c2f01a8f3410c87189d64c5f9d97587e55e3b0bbcc300978104e3c
SSDEEP 24576:LHUCNIx333A5ryGMarxFXBpJL84Z02SJnPgc/9BoT:Loxnw5NM8LXBpnSJPX9
TLSH
T197167CEDCA7858C3CD639A30B1F0E9477C7413D3F994C1D68898C5C4026BBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4550a6f62770cab24ee23a925295c748501850b3be411e0cf5485307acd8568
MD5 43171e63e05c05210d3eaae4efd7d104
SHA1 3eec7d3b452fc2546dcfa7c59933f8525e21fd6b
SHA512 1c37c963e8d956c640ed5c455fc6dab97ffe275cfec8c6d149dc20b1aaed656942f730238d8586a4d76e26b73c96b140a17fb8a066acfd158d5271447cdb8e4d
TLSH
T163611BDD056E0A1FC72608B923EAD0BBFF70CC9617836E16406697794D0A37B724E830
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 88ebf1b11c7ad2b481178e3598d75dbbd00ff6f0d6a11891d300be80c4c0852e
MD5 5bb1e48fb52ed473b9134c0f3a678b19
SHA1 dd69a1d0aead38a2dfce0d0e795ddb5a595728d6
SHA512 b0956fac77c0a072993ee19a32447339ce49d2ff0eb198a58fd998bf523dfdc2f3efc1f24e9eccafe967233e5fd53b7297b8f3951b8512590b780048f873eed1
TLSH
T135E0DFD4A6CBC22E752038928128BB08C2C23863D6C9AD835700CCC07F83006BB836DE
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 c5443b30b06caeac29207d43b10e70e751d22738c0526f83a2a4b0a192decf99
MD5 fc6ea5cddb437a66d92a6d64df25bd4d
SHA1 caa315246cfce076bea9d44502ccd17275efd327
SHA512 2b2002153d588d4e15c5098977f53cf0065dfde47e8fcc955d58a38d1e51e8a04b2406279441c53d580f76ec431416af4dac105dd7f92def39ef533646754f09
SSDEEP 48:TtD4jJ/0UC+lf5CWWxjWxGXvEm+fwit+1p+:hD4jJ/JgWQnXvEm+fp+1p+
TLSH
T1FCE2EF8D7B12F912C4FE733EA0C1C5E05ABCA57C4A5C7130953C99B68C63576B48E24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db-journal
Size 4KB
SHA256 71f81ddb9374779278873fabce22f634bf69983d372b10ee2c26e84789b55003
MD5 acb3b0c8640037af7b1699fe7ff523f6
SHA1 a4a4a03db5e6b3847f033dbf4395676134daada1
SHA512 3f689f975b276f2845d3eac5fc5caa4c79929bebf4090b9313d609905932a86466c3b5ce3e8c5e446791012217610a0d6c0bea580b84a426d8dcd2356d64bf90
SSDEEP 3:53/n3llv/LwelltztfCLKUhJS5RDfwkttYSUGCLKUhJS5WL8:pXtfmKUhARDwkYGmKUhAH
TLSH
T1D2919B4242035D51D46676BB01C051D557D29751FDF40004FC5DC76E447707D5C63746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 23bf338cf1354b169bbf81759745cc67a07b5a862cd13e9d832e12e2124cc77e
MD5 8a3e7269f99a4a41e8c0b3ee57001d2a
SHA1 eb5fcf165e80ce19e9fb1992d90a1160e6c1b652
SHA512 a7bd39378f2405e837b42c59f80e37954692a65e047c9e183df18eb3de265339237ef09e42b802845edf21d7614ffb973a03dd733268011fd7df06d4224a8ae8
TLSH
T12EE0268819CAC12DE018689F826DA70896E23413F2C83DC6174CCC447B4224EE3C62D5
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 19791e9c63a8f6811aa42d745b29d5eeb0aba7a459198a8b7555bd4b67db9ba5
MD5 ab571f969756f8e1a945db9cae1fae78
SHA1 9555a7127af7610bdd889ba43ae0372521be71ff
SHA512 24e0835b010cba1c0067e4fb93c116d0073b5d5e2c6b867c610390db3841cdf446ab419f66bd249382f87adc27f9f106c1efa7b91cfaa04e4b46f03fa5942b7e
SSDEEP 96:re4tejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/pHbbEOVpZf24JkMfXSFR+CFqrn:re3H+bF+UI3iWGVoWN3qL/dVVV63
TLSH
T11324114E5F352722CDBD913668E744A35C7DF03F871326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 6326df9dec73eb6f02af70cd15cc57c22f74fa5b4cbf3b229c8e64b45f9dedbe
MD5 e4469ec4e1fe8ee479d7aff39c19b1c1
SHA1 36e42510f49253f82f9bc0f96c4ad08ee39e48ca
SHA512 dd138ff4fe30eeedf1fbc70fe32ac1f558ce413594f12ceef4083158ca7d20ecf5f6a190b0ef28b36557242002a36d4da5542a6dc40943c388da7b6f8e27cd15
TLSH
T185E0D8A456CEC11EA255205B421EF70CD3E13917D6C82AC51B08D840BA03044E7D51D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 6013f6c648db3cbb602ed36d9e143b0fe647d807dcb863980508185f0cad872c
MD5 aeb2a58e07a53e6c9795a444039caea7
SHA1 d65b5a8e3335e10da613c5ae066f962bd43cd1a3
SHA512 17ef17dc9cbd7518fd2d7e205c6c7afbbc354f99b00f3242854ccf46ebbfbc9d8f6ef987ce1dba048bf72cc104eeb3e20eae88a6734ac870b2bb42f2169a07d1
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7o7ww/ql1:qDeMatha9RAvl/K
TLSH
T1A6B2134D1F346151C0F85736EDC085572EBC111DC7B3265A9E1870F2CDA35ABBA0516A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a6b3c3d96ea86a9955908c3babb7a8e62b0f87c6857e053058215d22d036715b
MD5 b302146f6490044f875b0c4e576ccf58
SHA1 890eec3e8601a3084dcd3946c1c11f863a27e1fd
SHA512 9fd0246b8cb6cdd1719bbb0aa368695c28666124c05b48edd845506231793a7dafc851b6e365069b79b81d53075bd9acd50d5b610fb2129e7af1e6585a1e3600
TLSH
T1B0419DF7C3E8857D8A1146F4B7186F1BCE2D0915832C7C56C5D49E1B93E2471E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 bb856134bdf02ecdf901ffb6f3fc4e9f601aadb1091914ec405bd6167211f0de
MD5 f76db6b55faf7870acb890a90998229f
SHA1 31478234df85a85133210e0e82c8f26acca155c9
SHA512 e6edd16162e6c0a897086300e84bacecff999de6bdcca12b5726f8dc04da1afb776dc95769bf59f98d79e751b8691dec11d9cea7e10505982cb46a794f249a70
SSDEEP 48:T2/IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBMZ:i/IEumQv8m1ccnvS6EU0Rdf5nFXl0a4g
TLSH
T1ACF2EEFA0727A205D98444F0E4006FCEAF16404B47B6B6EC76D447E3F7A20E2B5B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 186B
SHA256 664b00fab3c7b0312000ca564352412b7942750109883a289864df56403d2391
MD5 5ea6b49dd78db04fcc6e8a3606823177
SHA1 e5d2b5c374c79dc15b21ea38d2af3391c402aadc
SHA512 1dd660e4ac6d0d8fd7db97a985f672ddec492b31b2dd758d68db0952a9b09923aa4483c05052a0f242db78a7c7fa8388f35a88a97316fcdfbc4e93b6f5698e3c
TLSH
T1F1C0229280F9E4B60064443D0D846881EABAC430000068A1CA94833CB0880B76A05039
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c53bbf476dde1a6b598b09fcf56f6a92dc35c7abf420f453e8a1a15b53b0dfd2
MD5 500330b1c0be20e0f9c43daf1a0f6f12
SHA1 c755acd1340e475b3c0c855b2821164bf72b9196
SHA512 3b9bab3c397b9e104c0a6206673c4700285bc57aca072def699cf73377849ad048a63d6a2efef641b3b14d447e2c109caa6919ed2cef921ee2c122e9de1e70e2
SSDEEP 192:sxR0RayM/jK1Ml8LcD/fps8WpVBMJdfCrpzoA8p4s/g6+WNIYWuJfgD8IgtJ:sxR0ALD/fps8WvBG40t/5ImB3
TLSH
T11C62C815A938997BCCDBD20DFA557F53D6F91423A2901E48ADFC8A1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 63ad5befef1d7490e5d5b8243ae8203728802756b1fc19bed8deb3aed5e38a50
MD5 a2c5ccfcba3cbcea64a5cd331f202893
SHA1 4680a96628836a81c394c8457cfe0e505ad5b305
SHA512 792156704ecc1d065dc7b16823ee425cdde914a5e96e12b53d0aa29cbe3564e8b2609f4e444f5d2f762de5d36758ed688a102f42efaf2d40b9a673a904e826fc
SSDEEP 192:sxR3RayM/jK1Ml8LcD/fpsMWpV7MJeZAJwzoA8p4s/g6+WNIYWuJ3GD8IgtJ:sxR3ALD/fpsMWv7GYqpt/5ImT3
TLSH
T10962C915A934597BCCDBD30DFA557F63D6F91423A2901E48A9FC8A1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9849e4f0c9a1c5464fd6d6a7568191099b5491c5d4ed49a51a5882219738d8b0
MD5 218a121eea4a0858fc9149a07363d078
SHA1 c3bbc9217e4af0cb250709d49de39b2ec418702a
SHA512 ba037f331ec96473a618fa109f66286457cd79a072e6e9038c4637526138df32a1e2f4df6c54706e8b3d6718c0a5143eafbcafbadd4851c7384b99240c3e80fa
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJcciTro50l9W:AIox/OE7p0WguMfnAu1jaGXig50W
TLSH
T1E3E2DB3B680CCB7F4F844A9CEC297E9A6DE801CB56D8CD9447FA850C03C66EF55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 572af7db8af1f60efe23e1b9224feb92c405235773d925a1bf1f05c5b4d213ec
MD5 e7fa553e5ddde49c9bb4cddeeeb156c6
SHA1 401b68b3581b38c71cc656eec0a87ca5372ac135
SHA512 ffde78978e8403b06f6ce2e78ed9c3678d9059d0b2335c72c9d5c243d0fe175255485694eb426c4080b6315b41f92551dec5de563e427fa23da2093a3d470265
TLSH
T16CE026A456CAC17D71162083022DD308E2E5B427E2C83D422F00D840B643906F2D22D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 eb30432a130f93136a8d457c6ad41e365902fc9b7aaa304c770b04731a553d81
MD5 0f0ad8ae1184f641a29c5407275a755d
SHA1 471251b283541a860c3cb698d4f85246c201a1c7
SHA512 e6c96a924f6a5bac4d3bf51f9381892a373f76699e3a43a5faf8ccaddad9e0f4f7ac04e7bdf16b00c58611c7aa72362d65387abd935cb676f1c7081f00a0a157
TLSH
T13AE0D8A026CAC63E72493087421DE348D2E3B823D6DC39612B08E4807707191B39B1D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 bf8cd8872d5ddbbec6990d6a1f5ac37a6efb20b29d399d833b581ffd04d66b8a
MD5 3c83fe986cb74bed5e8675bacbd0c667
SHA1 c09023ba581e9eefb2525d15296c19f221b5fb70
SHA512 97bf7e71cb0a7cd7d30f8714e4037149e407300ca9b383a4c831be6eaf8143ce37f7fa2c5c826f527be9652c87fff633ef2c9a7b33bdbaa4c98bc35049620c2f
TLSH
T1C8E0DFB05ACACE3E62007082837EF708D2E17817D3C93A829708D4A4B602101B3EA9D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7b900bf0e59e3826f101393ad1518010d2ae3903ccae876b20715d679c9e8604
MD5 7929806acbdf2092dfcd9e584343d401
SHA1 b481e226114cc6f64ffac83be44646fadf792780
SHA512 ce4ca7df3739c39702629306e24cbf203609b64dc9873afedac4daff81145db3f5263e90571a08980c2655550bf453b1b1aff49b6aec033a74bd73a456bc55f0
SSDEEP 96:KgZiKKkyul+Km8uRu/bpLP7W/cKgD7K4CgN7cRZUnvIHAxEwCb:I9xNRu/bpLPa/c7DBCgNoRZUnvIHAxEH
TLSH
T10F918F01767B2744387D390D82A9952B9A82706330DAB42F3BA891F23F67E045EFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c08ef6e88b622d10a7fb15991f3a7772cd2754eaf7f33623c301db9182e31fca
MD5 fe26fdc5c9e03b3988d00c9e712bbef8
SHA1 41c4b3c2263d988e70f9ae8a8097e626c6ba235d
SHA512 894c62165aa3aa5ece01ab6dcbc34576ca026df2b08ce10509346eefc21c766e930eb9ebb61e37209493c57e3083e36302f447fabe3352e349c79d99db6a5d58
SSDEEP 96:KgZiKKkyul+Km8uRu/bpLP7W/cKgD7K4CgN7cRZUnvIHAxEwCui4WGbrg44K4dg+:I9xNRu/bpLPa/c7DBCgNoRZUnvIHAxEJ
TLSH
T1B5B18E01767B1744383D390D82AA952BDA82706370DAB52F3BA841E22F67E155EFC5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 ae33cb61c3e3f63e44abeea7be037430c1dea0776137924d0b32d6751a264c78
MD5 3a856ce3e39302cedb61f5573086df8c
SHA1 066e9ad5a4881cb36b099e4b95d877467019bc1a
SHA512 5ccec6ab4cf0f432e1ae715fbbfa3e3e0e4eccfa7acc673ad21934e07bc2e91383f2b35e1509bf2012870260150d89f5f58ec27ff7282b131426948c4653a994
SSDEEP 384:DNrRZyCSDnxTICN9MEhIKyll7svbFKfk7:xFZJSDniSyyI1l7svbF9
TLSH
T1D144640A7B747001EDE6DD725CB080771E3CB16E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 488B
SHA256 b1c7499b5dcd79d31b356057728c709e64a332ac0fa57577898af4ef7449c4cb
MD5 5296fad8cfa5110a752e54fa82ca9a26
SHA1 247f87f06c6426afbb728ceb330838fbc84d57e9
SHA512 bff24c58320a1923fa5ba07574a251d41a867bcef4367dd81754a1eff90f82caae3a49c37b09c4e4afceb7c9342df28c5476d49b7615f9aeba750c564535eccd
TLSH
T180F0B4C2237A24D87A8C9949C11E3503E8C57D56214E65B9231D85E45B44C2D4F2EE76
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 38d4e42cff94b0b82dba4d07bd6f62f206e629f691dc784fdda2f6b74a24be6c
MD5 cec4b285b209ecbf980f154f2d374104
SHA1 46a5d7275d7fb6d2c3f5f167d679ea3f390e63bf
SHA512 816da8eb1fef662a6c2b637aeb186f2617d4e2ce77a036806c09017e11112becbe667b0f4bc8268858181f02090f5e93265485ba2b047dcf9b745ca63bfe1254
SSDEEP 192:0QOIIINbNMIM/mYcYuWOIaAsol8+Tss57:0QOIIINbNMIM+BHIzsKcs
TLSH
T15D42945E16056B77E19E5F3623A287445AD84DC10032613E31936C2F8EF3F9B86DA6F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 87ad19356ae2cbcb05c4d1f45232129b35dff2921470cd5480d4a2d346056efa
MD5 2876e13e37583d67418902f543a57a6e
SHA1 8f0f222fa3ed17b68deb3811705a366233b9731c
SHA512 a79e9b76f218c2663dbac660b925cc3553aa04125041f15de5a0f395cdf417eb17e1f7e0c13d544c703f0821f7262cf47ac0bcdc86a1e177d9d7157ace35e1ac
TLSH
T1ECE02050F5C7C15EF01420CB4139934C92D33423EAC429471F00C8487B461017BC51E6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b192bf6fad13c0353afc9f5338210db2f9f65ca1041be8014c8cd7abcc46cd7b
MD5 1ed4b79316a9827e024a5a7a38ce06cf
SHA1 f3287753133cb13b50e16054bf4b83664ea45010
SHA512 d643956522d0ebd32437b25e423ab6a53a1fc477c78e29765b7e27799f76bbe681ce7bc8b7540b2d72b8c59669cc6c2d372744b8412562e0db3499a6e1fb2b64
TLSH
T12121C455F331C149E149863A607E9B261734E8458FFCEC0F457920356EB6F190E4B6E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 093515665df3041faca627a7cf69646c99b7064b325c533e95a608aa45e5a6d8
MD5 1864e102a81d796daa4f14d8cbe607f7
SHA1 f3634c6b9a4b526ce9d5718775df48c37ab962eb
SHA512 f599da6e9997ecaea549af910d4f5b64b67b4ceb2532fe9787cc0a495d003b9242ee1411f76479886d0ae185d23be2f1837d1a53ef5cff67e09cbf1d0e91054f
TLSH
T192E0D85075C6C15F601030870179E38C92E23D23EBC42E421F00CC486B461427BC61A6
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 fa4c77b1543462733742bce8964a70cf764a457aec819859c597e90e025c4b10
MD5 f8a76b42f27e07acf08f32eb0c38d6d8
SHA1 b6311f42627eb003dc2dc58a006612eeb79151f0
SHA512 fee9700c16f5df62d80bd10d617985a7d6145a536b3130c34fe68f0d273e549a9f1d4c19b591f29bff16d181344ebc8d4fe2655f918996a688ecc5bcf8af2c80
SSDEEP 3:MsEllllkEthXllkl2zEflkM:/M/xT02zb
TLSH
T1424402156F80140AC7001234406187902370D5105611775324D108265CC65800CC0001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8d5e8391df0fd9339ff3b3c7703419d0788af4081caa9e12f7f7476f3903442b
MD5 189d2d209ca3e8a7535701f95a75c42b
SHA1 eee8067d40ae606ebe54fba83447403bcb87a944
SHA512 7ff90a394e4f9c9577b57a921972ccbd92c850bcab07454f6e8017ea6a94219dc5bd566524fa60b9c03308600745919260b02898300f2f511e088cf17920bbb5
SSDEEP 3:MsEllllkEthXllkl2zEflm+:/M/xT02zj+
TLSH
T1704404FD7FC00515C50010714071C7DC1370D5100711775334D10C375CC75400C40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2852dd87ae0cb44f867cca6238852d4dddb0fa3cd4edf987e8cd51a6202db6ad
MD5 12f82fb921e8d2be4efebeb6a2f1e190
SHA1 e1aa6330e1ab605ebcc2ebfcd0f6c88ec849f44c
SHA512 85b2ca4beda8773445221945c4fd4f7dce04129dc9dea9c1076d502dc3620e66064b2de8e7977a55e8cd8f55b98b0357c6ec19d909fe9fb66bc7a912027e81fb
SSDEEP 768:sj+9o3epsk9iQOJI1PyM9/hUAFjQIMyOV3N5E9X+dIDl8BvTPavl:r9o3MhNFUIpONNmO+Dl0Wvl
TLSH
T1FCF2AD72BC919EA74CE7D7C9B7166243AFF4017791C42E848AED6B0D028729D135BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26d77d7483574e2339eed6ed492bd4328e3dadfe1725d4b0c479d58e70cfb657
MD5 5c7eec40e82256695937fc0e3c5c8d4d
SHA1 2dd6acf6158cac77d31a297f3b45d6d164438a7a
SHA512 3a4b8da5a33a582e34fef26e99fea1c60622809bf1b672a037cf1cfe9ffc683dbb58915cdb8cfb4268a4ee2570f7ac64dfc485bbbd333e1b49dff33f34b089df
SSDEEP 768:9rv+4UNbdF39SfQOJI1PW/hUAFjQIMyOV3N5E9Mvo+8r0mL:9bsbf3uhNFUIpONNmdDrv
TLSH
T19F03BF32A8A5DAB39CE7D6C5770A72037FF441A395C50A84C9DE2B0D824B5DE231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 36ceb69b9327a1c5ce1edabd869797f261899288ff329aa76e897f595a44f5a5
MD5 6632e8229998db86e087bf6e8ac09c42
SHA1 fc96409a2cc78ecb08f12fec409dafbea7f59548
SHA512 747ee463f557e2ed8878ad11f1a580b4c4e4aed492ca2e7e6b6499435a0745c79b08c69245b4627c26e8fac8ddeb006d304931c4d4c5d0accb5e8f6c96b84542
SSDEEP 768:Prv+4UNbdK3VpskwiQOJI1PyMY/hUAFjQIMyOV3N5E9Ekqf6ZRBDl8BvTPavM:Pbsbc3BhNFUIpONNm3qiZbDl0WvM
TLSH
T1FA23AD39EC649EBF48AFB788620E65132EB80137D5B84588EBD91B0DC237198F347D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 3be8801d049421ee1ba9ace96e8af89661b9e94c2a7681b4b6a1b1eb2e8e927a
MD5 e94279414cb81440b491dad260a75939
SHA1 75f6dba038580a4443db1dd68f720b204e732d4f
SHA512 ab67b681e72fc5ecc66b2649a3bdb3ebee72ba727bf0635da32ff688db7f9c29172e1351d03cb17ee0443b30a0dbaf82930b31c4f927cd847532a6d6369798af
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T19344040D7FC00447C54010304071D77017F0D510071177473CD10C335CC75400C01010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

864d9ce3-5920-436a-be53-eaea36eac4c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\864d9ce3-5920-436a-be53-eaea36eac4c1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 f35a4f569a8d6e9a53c7abbb2fdca981cdaaf4108e2934925648d90000b72a42
MD5 29f0806ef1eab44a9cac51d6178104b2
SHA1 da9a041647bf896631ff9a3a1470aec96da1eeb0
SHA512 02d7f20c525765b0a77f7738b19fedba3472edd6c259dff60db5beb1f82ebbef1c72f48fa68ede5aaf452b953f8d1b959494e48c37cde60ada7cef9e322eec56
SSDEEP 24:TLL4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw/sufL:To/IHRH34kWqB1kQnjhHmr6ITmUuL
TLSH
T14C23896EDA2CB9A1FEE40B3DD7D1D4127B36AA0EC2E4D9F1099B406746C540405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f0059f6-b521-45ad-a1be-e489b7cb9ff2.tmp

Path C:\Users\Admin\AppData\Local\Temp\8f0059f6-b521-45ad-a1be-e489b7cb9ff2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 7f4710387392f5ad3bfd91cfd26c2ae6f4faeb4fe81b2e55ee42411e1d845bf9
MD5 e66f0188d180dc1a320e7c23bcc8e013
SHA1 8c7b1ac30787b956aa00cfba7e0ebf4a5d04bd4a
SHA512 4ce25d078224f2cd8748f89318e3fea47d496671c3c74d63d6ce28e89732e5e0b9a5bd5e7c8b5f78091d9e295f5810ef043d52a65c95076d871d3c5a3766d345
TLSH
T17D2135D13436733B66D647D9A0354C842860F491033F569CEE5648B4FE6CDD0A32E7C9
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3248_152607769\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5716-2-0x000001C802130000-0x000001C8023A0000-memory.dmp

Download

memory/5716-12-0x000001C802130000-0x000001C8023A0000-memory.dmp

Download

memory/5716-11-0x000001C8006E0000-0x000001C8006E1000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads