hxxps://horion[.]download

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
29s
max time network
53s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://horion.download
Sample260703-x2jdlae14z

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
138	3696	msedge.exe
138	3696	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3696	msedge.exe
4816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275800740692985"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{C7E9B2A9-580B-4688-813C-5A428B89DF4C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2300	4272	msedge.exe	89
PID 4272 wrote to memory of 5468	4272	msedge.exe	90
PID 4272 wrote to memory of 3696	4272	msedge.exe	91
PID 4272 wrote to memory of 5468	4272	msedge.exe	90
PID 4272 wrote to memory of 5468	4272	msedge.exe	90
PID 4272 wrote to memory of 2868	4272	msedge.exe	92
PID 4272 wrote to memory of 2868	4272	msedge.exe	92
PID 4272 wrote to memory of 4000	4272	msedge.exe	94
PID 4272 wrote to memory of 4000	4272	msedge.exe	94
PID 4272 wrote to memory of 4000	4272	msedge.exe	94
PID 4272 wrote to memory of 2612	4272	msedge.exe	95
PID 4272 wrote to memory of 2612	4272	msedge.exe	95
PID 4272 wrote to memory of 2612	4272	msedge.exe	95
PID 4272 wrote to memory of 6716	4272	msedge.exe	96
PID 4272 wrote to memory of 6716	4272	msedge.exe	96
PID 4272 wrote to memory of 6716	4272	msedge.exe	96
PID 4272 wrote to memory of 5300	4272	msedge.exe	97
PID 4272 wrote to memory of 5300	4272	msedge.exe	97
PID 4272 wrote to memory of 5300	4272	msedge.exe	97
PID 4272 wrote to memory of 3040	4272	msedge.exe	98
PID 4272 wrote to memory of 3040	4272	msedge.exe	98
PID 4272 wrote to memory of 3040	4272	msedge.exe	98
PID 4272 wrote to memory of 1112	4272	msedge.exe	99
PID 4272 wrote to memory of 1112	4272	msedge.exe	99
PID 4272 wrote to memory of 1112	4272	msedge.exe	99
PID 4272 wrote to memory of 6408	4272	msedge.exe	100
PID 4272 wrote to memory of 6408	4272	msedge.exe	100
PID 4272 wrote to memory of 6408	4272	msedge.exe	100
PID 4272 wrote to memory of 3376	4272	msedge.exe	101
PID 4272 wrote to memory of 6444	4272	msedge.exe	102
PID 4272 wrote to memory of 3376	4272	msedge.exe	101
PID 4272 wrote to memory of 6444	4272	msedge.exe	102
PID 4272 wrote to memory of 3120	4272	msedge.exe	104
PID 4272 wrote to memory of 204	4272	msedge.exe	105
PID 4272 wrote to memory of 204	4272	msedge.exe	105
PID 4272 wrote to memory of 204	4272	msedge.exe	105
PID 4272 wrote to memory of 6688	4272	msedge.exe	108
PID 4272 wrote to memory of 6688	4272	msedge.exe	108
PID 4272 wrote to memory of 6688	4272	msedge.exe	108
PID 4272 wrote to memory of 1552	4272	msedge.exe	109
PID 4272 wrote to memory of 6644	4272	msedge.exe	110
PID 4272 wrote to memory of 1552	4272	msedge.exe	109
PID 4272 wrote to memory of 6644	4272	msedge.exe	110
PID 4272 wrote to memory of 6644	4272	msedge.exe	110
PID 4272 wrote to memory of 7000	4272	msedge.exe	111
PID 4272 wrote to memory of 2284	4272	msedge.exe	112
PID 4272 wrote to memory of 2284	4272	msedge.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://horion.download
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff93792c188,0x7ff93792c194,0x7ff93792c1a0
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,2639282340243053677,10082090207739718353,262144 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:2
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,3705196459605150822,4221772902749872135,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,13542485109174194948,12727210643160006969,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3668,i,18001192036959130687,11250962247906896540,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3692,i,508297689313267151,14757753240653774935,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5164,i,8268188341319919862,3845827678477953497,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5348,i,16161501044479810813,5429221574341147363,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5184,i,3965261705716271170,5845681260981904717,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5472,i,9895719599356047978,8719310748166814938,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5508,i,8906849438379487554,11001378807266021860,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:6408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,5324611183156758316,17202033191680636831,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4446386175156882035,8949923841522424725,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:6444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,7870309229156075385,11992718577161184905,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,7870309229156075385,11992718577161184905,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6792,i,8172300263819832657,5844461818163796795,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6724,i,2838846043294805226,4675909838739717049,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:6688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,3107453480618142342,13589335582234026893,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:14
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6932,i,2069811932712950350,3729492637513920070,2097152 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,11122498691723774962,12267094965084970893,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
  2⤵
  PID:7000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7800,i,14425503229847944410,10526482585972457528,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:14
  2⤵
  PID:2284
- C:\Users\Admin\Downloads\HorionInjector.exe
  "C:\Users\Admin\Downloads\HorionInjector.exe"
  2⤵
  PID:5676
- - C:\Windows\explorer.exe
    explorer.exe shell:appsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App
    3⤵
    PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,12642314561268221358,392347097111656060,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,15000092381969135485,12304802657062749274,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,5602132522421541446,11995530304988181724,524288 --field-trial-handle=2804,i,14965120125172976270,5980440191180043497,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:14
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff93792c188,0x7ff93792c194,0x7ff93792c1a0
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,5051075074289354233,4123735671870541127,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,11111889851767414350,7068962171137645986,262144 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,9102993049649253381,13745562951425797647,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17034335854299467490,14279967333393985556,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17034335854299467490,14279967333393985556,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
    3⤵
    PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,101270040519934757,10803399384376313702,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,17309211029499308269,9014380506929909120,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,11155042366281058134,3102993371559337068,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5397859434217216884,2039697011801737522,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,768992293388232822,17072235688372851657,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,6516975208575108474,5855756461163279271,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,16316951268190800479,16714948319273493018,524288 --field-trial-handle=2236,i,44636044887009494,3526944083646094661,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:2812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8abcdc78828a7d75789450342f73e6849c86c3bd67601f12062577e29195f7d5
MD5 c1b2c851eabdea5b5210a7330ad7947c
SHA1 3d06d76ce6e7878ce54f7f10f4a227358de05879
SHA512 1a85e4d1dc4df31cef0f3b5ea94cd1fa075006b84dbdd9d474e87f15c7cb198406945867ec2a8eb5d06c890c1a4b9a00cfc61a8e6f7bc16928729d79169be056
TLSH
T190D023F057457047F23511F5B101936116E545893B63C255CC11DC2D5E160F467C61D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fa9704fcd3d956bd7b91ff57263bf84b08e8f0b813d47a841c1e477f0c57bb1
MD5 df8e4a589732839f80052e898a825c01
SHA1 b696b2c08d190cdbd389f46f981b977eb4a7850c
SHA512 2ae1073b4595de2f15868235c976cddbffbd59d6c142926524c05ce4500e2d052bf90fc78ce717972235acce26eed9ae6feb681090fbc327512e6654d435525d
TLSH
T152D023F16758B583C05204717117D37175E04189374B5155D812C83DDC154E4B7C92D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 757127762d793070f1aaa277f6dfb196b00e77538d7ba4cb9e4660c15001fec7
MD5 0acf9d538ea00393e95247186d13c227
SHA1 14fb9a53d95afa129c3b8b6d8459430825014291
SHA512 81ce27252d022596c44dc255640299bc6cd947d95a3c11f2a4470a7f5d5874ca3a53516d4174e7f3720c40926357d1a81a21476c0bb31c4411ebd5ea52be9d29
SSDEEP 192:yJwAUg0ZOLt1UChmQAq+lbFNIcJrGSzizkHUHh6j0TGsc+dZdqmlkVw5z27LfSDP:2eBCUQglbFdVezUo9pnmi12/fSDi
TLSH
T100132ABE36516C42D3D7543D462F6B78EF31DB28E9C2691BA6373E0117233928A8F805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 fa3f54c670aeec384f4456d065c8f8e3e4ef92c3cd5f8c21774cef4248277455
MD5 1959fc06525684e7443d0d262b772ce2
SHA1 0f04e39da60c9000c5a7bf104206f4afd60373a6
SHA512 bbbf212e84d3c6dedf87ea0b7cb941779ef956396cd22edbc0ab5f9808dd86cf2635478171367c6daf0fe4931fdafb4fe6948392f876a6b3074c024906b1c791
SSDEEP 1536:lDL/tML/kStooFIVJeSOM9L/CL/OL/YWks54V8Zig3XC4p:lDL/qL/sJt9L/CL/OL/J4gT3Xb
TLSH
T16E4472FB1910A007CBA852F9D2033A3EC577424E7DD1F99CE5384C852826F71B6FAA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6a11d094b7b1b98a25b6fd4a73d3c58d94250e97b1a3bd6c19c6afc66b31cd7b
MD5 7e2f202e559071c9714a7db30d2e0786
SHA1 13836ec3806465369f24f7826f511d4cd29e7a32
SHA512 6fa3ab8d414355d92df6cf4944f356ea6af240c9c195e84d8b4b9242c1f11ec204a7967cdeab9da8d5e14a7252362e2aac08d89e9e37a63807583b39d169231d
SSDEEP 3072:Mv9G+5Nb+HQwq3EW8Wz1WyH6VDk/7LOaaD1RwLSGzxV2mP5HtZNf3Yctb:MQaRTwq0gAyGc7UR6lvP3D9
TLSH
T168256CEECB682C83CB6BC670B0D0D9077E702183B699D0D39944C5D957D2B8176E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a963d61eb155b98a9d6cf59e5051e073c55d03a689089aee81663b35af00482c
MD5 ad0b12a0a7ef2e59c0fa50eaca249748
SHA1 8ccc7c5400dfb40510b7ded68c72ee710ff90af1
SHA512 a3e5f5f22562437b5699f0d558a0771d6fbb4e11ab20df473ad37b59444bbc84f88c57c8664dd313a71bb53b6785f8aa4690b2ec5f8b16f354799b3de7c4980e
SSDEEP 24576:1Hg9Gje1GDvDDbvwoZZa1zP0MbFD3kt+Odryemhf:1dSwjnbvez9DUtrdrF
TLSH
T1EC169EEDCAB85883CD63D930B5E0EC577C7413C3F995D1D68858C19401A7BC4BBAA62E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bcf1326a7e70a9c31d0f51a39ed55d41e0e060e2f45f455745d1051c68c341df
MD5 3d3836776d0415a78b19dae44306c90c
SHA1 0c4f4e0c4073ce369e456b1c52b464b30eca97af
SHA512 14b961706c6687b00b83597a104a5e81498813e286b4d0454dc0636aedcb118c8f05bbcf24fdcf99264c0bd96227f2782586d791835b06144245fd58a485ad3a
TLSH
T16351FA398EA4A816CBE672F054ED1A64FF3A9655C8CB3E15C183CC7ACF277C85093252
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 d6341113d160ec067a254f9ec12cdfbceb1509abaca3f66f5c6a9acbece533ce
MD5 1afe0b4322d49cb456cbcaa86c65dedd
SHA1 1529684b7c61451b559fc2da587bc120a22898de
SHA512 314dc714df16ca5e29699ee53b860265de608c2b4638d722104ef900bff8d317fb4a26a5d2dccb85e3b58a2c8508a3130eb8d99a26586301a8acbc7ea46c792a
TLSH
T1E7E0D8D879CAC5ED791034824228AF18C2E03C7AE696AE836700C8E47702541BB915A6
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 f8f0961120b1dd9973b714bc9c4868efcd26c613ce25bd00ac4e4aa6edbc70fd
MD5 6a872f6892125a491752b575ddf1f602
SHA1 32310d2e7797449c42677407cf1ed5d0dffa8844
SHA512 26c8a68b3656db73141c789fb021694bed7d084afb40cd9aa64008aed8145c54a9a3b91ecc0e3e96c15d214fc77754d9de728682e0ac45d4eb1bf5031f4333e9
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjc8W5Lm0SFtIWbrNVqYpY:TtD4jJ/0UC+lf5Q8WxmlFOWbZVTpY
TLSH
T109E2C08C3B61F511C4ED733DA0D2C5E09ABCA82C4A8D75B0923C9CB28D52962F49E21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 19f3de398b953d02ed61f1c296b1f55b143ac8e5519a9fc8035f71174c2261c8
MD5 3ad51cdf8d93135a082ae1a0b19c6196
SHA1 09b964e103d7d504eb5c81e9a1454a91917b7af7
SHA512 4167b43a2353ccd30e1d0e879830983fc0d7c9eb32bf5d5d9ed42c235b92d8ec03c69e2861abbd531da69601f871d002600ca04c13ab7ba58ed3f44bd18b498b
TLSH
T1E4E026A815C8C129D11478E3C26DA388D2E0393AA3C83A82575CC8407102E49BBC67D1
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 554f6a955b1aff821e80038180d4d600db97d1d90cec3883b3c5e84fb61b9afb
MD5 9981d0cf4d0d597699afbadb2c7b0cdc
SHA1 faac45bd9c81c3f139c1ce687215b77929d2d990
SHA512 641fa6e2be7944489062361da54c9b586afdfdb7ad5292ba30e2f5bb94b044ee7717754fcbe429ebb79a182cbe07f717ecaf524413d8933515c45df2c4ef64e9
SSDEEP 96:3BCxV7KXWDQ1DhXQunZfFKF1GsBWWLJ92qJ/1x5ijr34ggq4/:xaVuX1VlZFaGsBrFgjr3W
TLSH
T146B22A4F5AB6B823D3841EB53ABD083ACD3B811C1F93CD8D746A51215DF8C61907A5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 33cb40f7fcbce6e8c61b8a823980f5be67138c3aa9491ed0b756adea403ad7f1
MD5 9e26f3d0cfe9730248ce570c51e83892
SHA1 fec3e7a4e46615c619edfcdd9596a0fbf3f0c145
SHA512 51a4751a60e524815795a7fc847d7c55b4d4d4adbbec51ee531ab3b629ea1951ad24156871248a0b9c673566caf59c8dbd14f008745a63bf1bc97054750ac7a2
SSDEEP 96:reQ+s80fNLs7tejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/K2bbEOVpZf24JkMfV:rh+YtH+bF+UI3iWGVoWN3qL/KgVVV63
TLSH
T18324305F5B352712CDBD817669E704A75C7DF03F8B1326CA686114B4CEE2692A02C8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 2KB
SHA256 dff236542caa3361f1c0cc90ce55eeb01d7ea09fd3d8c50adb9e7535b1f498f3
MD5 5f9457ca494269d51e0011226b0f8049
SHA1 f43c2d8fb8d22b934319fb7cb518477e87724886
SHA512 b0dbffca96373f8f811cd77ca06d7736926ae12802ecdc0c42bfce2b2b1d5d1e9c9cb90d2b321e59074f3e917959bd994c26d413a5f6de34191a73045a48377d
TLSH
T1C15167AB94D67CFAEF411AF8DA807B09B92E703B9A94D5F0C0C84D8C52F89E7511201F
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b72b97fad4d381c49e242335b0e7b65dc01b70f1e39cd901c9d3e4971e2546f1
MD5 5b52ef93a4361f0d530a013bda042a3c
SHA1 668f4fe4ae0ccd5634d0eb1b6a03f12a9b2921d6
SHA512 b973567dd9cd891a44fe19e8f27f929e9e16cc8bbc45c229b845b6c5af01f794235e2933abb0de4b6fdafb5425cc8f6ffa3c500b195f71bce95c7afc1fbfd5b2
TLSH
T1F2E0D8E855DDC1595107205B421D7B08D3F0382AE7892F426F09D884B142084F7C13D1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 30db3f84e20d23a45e63214c6a2b097d11ca9881444d9927bbec576fea8fd89b
MD5 7785420b5d208ee43425a214104ed324
SHA1 1cf110785abd5d2921727e41c5f207f7e77b7f68
SHA512 3c36118049ac2b7737e485af797921d1f9609cab6b5c13952574c6cdeb9a6c80c2770d549cc9aa543ad658b4fddc737d105df5fbb4eb703bcd3d6c621e89ebd9
SSDEEP 96:KDeMatha9KvM6jM27tM6YRknDnDIQrOKUaiUEt1H3GK1hYo/KZX:KDLaTa0MIMWM6YRQAeOKUUS5Nwo/KZX
TLSH
T1EAB2DA2F1B303632C2E7A9BB59D21A2A6D38001F0763969C2C2CD4769C35BAD774B573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 cd2569318a8febf0a0c06cc32baa579d2fe868cb493d3f2d54de6d10c7af5280
MD5 35b578ce96c6c20f79fa4e1183b2caef
SHA1 c3539b60f674835805e5110dacdb56b0d131e5af
SHA512 004fe429ad28df26d49cb1c16e9937bae0f3fb168752d1e73e2c5d725db9739dfd6f22ea29673dc56af994ccc74d72edd0ff3bb0e4d4f692f4bd078814cecc46
SSDEEP 192:D1nQxQseQ3JQiQYQ+JQPQxQVJQOQcJQwQ7QiBeQFeQGJQgJQpQ6QWaZVij621Q8K:D1nMBeEd3jgUM/XJN+hBeIeRJBJu8Wax
TLSH
T1F5328EF3C6D4CA6E9A1196F176247E2ACD1E091C12283C2AEDD5EE4BD3E14B1F24158F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 53871f2778c73b39347aea7bca12381db43357e98175485091a545ca1d366f96
MD5 aff92c12b5341f3796c1ed8649634879
SHA1 669ca215df1a21b9245063a74591c5cb3da59df6
SHA512 91efe94d64ff1530c59174489e59fd6600747c06895c1f929036d1868e4f1a6dfcb1353a70dc420c799f3cbad1a8cbb96aa363d8ea4847981e527b27689fcad8
TLSH
T1A4E0209780BEF0776429997E1D947881277EF4752052A8F1DD92827CB0C25F75E11035
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6bc77e3f54be1bd0b97c0b125b47744d4bfb2c45cea8d21162b5b371f94c0f15
MD5 8bd48f308bd4eb5af1e942f28d192e1b
SHA1 ed02ffe1ecd27f744f5ae21012fd71472d38ecc3
SHA512 41ed5f8396d7a057b876764af47e07c15b2cfb9fdfadc4405939dcf6a96aeac888ab8dd15203802023748541f567c31820a5c1576a5f0f642822ed3a8d0133dd
SSDEEP 192:sxRLRcyMqZjK1Ml8wFa/fdssUvpZsGJlspzoA8ph+/g6+WN3Uj/Ym6we+GIIgjLJ:sxRLBba/fdssensGrjM/5A/Oajd
TLSH
T19362EA1A6934597BCCDBD219FA457F63D6F81173A2945E44AAFC8A0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d623420665b5a7a2ead78cddc0f8e2ca439e7244b35f5e084208f471fc14a5df
MD5 eb0ce8097e28c146d52a13a4c5aabac4
SHA1 98a4fbb2028ec08627640e29cfe99a3604598240
SHA512 70b6f30a287e9e78ffa14d5117a61e36e562c1a4ce384a32af28723d2301431de84b3e2c1ebcc129e8aa3cee58fbc14f147183e3c69dc873c17511b5ec248323
SSDEEP 192:sxRLRcyMqZjK1Ml8ioa/fds9WpVhUwpZsGJlsczoA8ph+/g6+WN/UeV2+ZYqhwex:sxRLBKa/fds9WvhNnsGr6M/5/1JZd91d
TLSH
T11772E91A6938597BCCDBD21DFA457F63D6F81123A2905E44AAFC8A0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9e0efc78091694a6298f429c3b19aa47142de3824e2604799a25b5dbffaf805
MD5 f10f4ee559d6fcfb514805ac8ba57613
SHA1 1358997e1db1e27eef9fb8d0aa32f4fada375b62
SHA512 dc5bca401cab587e3ca15f105ede3673f5833ccd5e17b1c774f9088449d3a114692f66864d50aa9d5792e13c5ccec053d95ac9230035da20aefa727337e9ce85
SSDEEP 768:RGqOArWgzvfsX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5z9wQroPw3/:RGqOArWgzvfsXu1jaEpw7Pw3/
TLSH
T1C0C20B3B640CC77E4F844A6DAC29AE976D9802CB97984D544BEF884C03C77FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 81f84e064b3c1445f4f232bab4104d320a8b0499860080648ef0738b110548f0
MD5 849e9c894196ee36216f4d066eeea012
SHA1 8c2aec81fa11a08a225dfb903915acb027d67cac
SHA512 cb230e217a5a5253ed0e2a428f75ff8fa966f4d2e5779ab9a594fa14d09d1bd5a390290f3a07b5c16d61eda8e2203a26e85ffe15e3aef310a228cb32de61984f
TLSH
T1C1E0869837C9C6BD61167083026DD30892F8B83BD7C83D426F55ED516542554B7D32D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 ad4cc4640d6562e84e1e6f6e892c2fa82e43ad78881097fa8aca0944a6657186
MD5 38e7ef16b741c6e5ae9fe5da21369101
SHA1 245deab5d86e54d98618781fac5409906fce30de
SHA512 d18ddc0191726240064dddbf295b11fa90dc2750a9da508f66dbd547c75d74107f2a9b97d558cadc60597794997106d58e4a4e751cb412f337ef5d90704d1232
TLSH
T10FB0124937006E12DCCC5DF6018597547320E52240814F338A56DF144D05EE87F42CD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 35119db5dce562d829a85d2ce155fa4531b2344f0dbc6e246a4233a0a4ad0102
MD5 d060c9a7cd5d71bd2fefde0f91ef81b8
SHA1 dc294eeb9f361935200a2bede34af771b9f6ec2b
SHA512 66110efbb69a44538ae1fac60a52027970a6d7ae107a278dadb229b7ab9316286c2dae34bbc9d4f61f6d832d46bc332f6aaba6cd30cac5092c31b39384844d6a
TLSH
T142E0D86826C9CA2A71C5E0874218E308D2F3F82FD7D92D526F09E881720628073C7292
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 93b6174d2fcc9ffa7e20c1d830936ad1bd59887797417556ca00fa08aafc2f22
MD5 aa07776f8199660b776dd9d0ce0c7870
SHA1 0fb2f7a3fd862356a382ee66513dd3dd87886734
SHA512 8866b00266b6133bc36f99a1c94e680a83beb2008f29908af822f8153bfeeb4d2b3c01b5c945e421c8443bd1b84b1dbb2eb2bf55e5f19846043d21e69d1e9046
TLSH
T1F2E086B866C9C7B96205A48342ADA70C82F0BD2AD7C83E86DB089856A102144B7E76D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8df6d3663f471bf0bf4b4855d1b616a6ab78026dbf9036e3b122d64d8257d980
MD5 c211af6f67a0ce3479c8ebc6952e675a
SHA1 1820ef39b63c6b56b3349a0e56ef9545246a4d85
SHA512 313d78c81f59f828bce334b1c128419cf50271b9b044abb4ec2e0b0bdf2c7c48e0ffc5f23055b44cebf7baf4419f9ea0e2dbb2d0c1e5fc8648ce659262ff9751
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83MtP:aR55IlHnOLRXxxin93N
TLSH
T106B2805071BA2700387D29099379D42F594630E230DEA87B3BA835E66F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 059edbb2f04334a66d03ac35ce4b92f7d7164260322a75ef42337b4839bb5caf
MD5 9d52830d23c5d35222a69e71babb0842
SHA1 71fe076d5cbb5c3b5116ccc8fe1893726959d1ae
SHA512 eb05ecafed3128552b18fd37e761fbec46e40586dcaf27616eb9668d9e1f92b8cfe2a5ddcd4d3522125896bb430cc9cc23e5ef35c4c3fe2188512ed8440ba2bf
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mtk:aR55IlHnOLRXxxin93td+
TLSH
T121C2AE4070BA2700387D290A9279D42F564730A230DEA97B7BA835E65F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 275227e4b1714abb2b8dde453012dcecdfa369bcd53ad225744a989dff82c015
MD5 89c7a414b0f0dedc2894ba1f4ff0bdf5
SHA1 fe63f45d6ce83f2798c471f647e31c08613346e1
SHA512 73ecc19118aeec6e141f81bf5bf7b342b0add3e5d32432b5c3c08b112fd2bd8fd394a66398f23273b37c3a67cdc6da1bc71aedf0e6ff2a3333a5d772f90969a4
SSDEEP 384:DNrRZyCSDnxTICAkMEhIKyll7svbFKfk7:xFZJSDni7VyI1l7svbF9
TLSH
T14444840A7B747001EDE6D9721CB080771E3C716E8F22E6916DA654694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 849cbd6876d63a66966c087fa1462a643d10953093537a9c3d0557c383872cd2
MD5 01a3322dfff8fd7c65869f39a233cc24
SHA1 ea96662e5353f5012841011b069111684b71be52
SHA512 2f4f0f2cc2963be63723fa07653b3fb0dd8153722418dc1a24f330788ff687871eb957cfe535277143a45b3b8e3521cf86ed0b4bb23ecb59e5adbe61d4532aa1
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgToJ/Q9/W/smJ/Q9/u/i5W:DEtSyGhp22iSmgI9OlI92v
TLSH
T119529CCBE9313222EDEB47724BE011E9DDB6413E8FC2E94214E541056BF9AE0930F08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 1f716aa4f509e09a20a45f563880c9b7b953f206467a6d89f77f991111289319
MD5 27cdf9ecb458ba5a3a6311d270c57542
SHA1 d76cb95218edb4556b913e715945a2cca8d994e8
SHA512 2bb45c83e40a8a6e01fbf695c5ddf53a676453d20ae80b1b373c08eb32b75ced33be684bb28029c831e3c920b03da599c688d00bba42ed3d4c1001db66426189
SSDEEP 3:MsEllllkEthXllkl2zEIw:/M/xT02zI
TLSH
T1BE4404057FC04415C70033314071C37433FDDF5045115F4F74D704135CD55440C10040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 30d528afd3e585a282478533bc1ff319239b6d0e52498026fd4a2452063574f8
MD5 690f1d2bb580d7f88045d31141abb43a
SHA1 4d2b6a0a653810b68af3bf08e039fe32015df412
SHA512 933e1288a95ca9285c05d4a96774136b66a21f46ef5cd7a162b85142066f3ea1c276ca014a68ca95e2daee6b182b21191558a0c22fabb6d915eb886225246785
SSDEEP 3:MsEllllkEthXllkl2zEkQQ:/M/xT02z
TLSH
T1394404057FC00515C74031314431C3D013FDD7700D11574774D105135CC75440C10040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 435c0062ecd1e19d87b17e6c770bdced6147d806ca2cef641d974c4510db09f5
MD5 be11c35bc9bd46d2512734290f338111
SHA1 41bd6d8753ee00e7e46ffdbd03654d83129ed8b6
SHA512 c0915f7b8c6ded215fd517b8f6937d08178da10cc84f50071409a40b73435dbdba91cbe4ba38d2dcb56571bce05fdd4357c6348eb29209d1383ad35acdd900a8
SSDEEP 384:nniF1tNn/s3n9SZ8ND8TUNTUlIRhznNLkhX+foDMCpF797vkBL0f8L+1IzV:iF1j+9Aqwgu9MC797vkBL0w
TLSH
T186B22932DCA1CAABACE68BD5B70A7646DEF44263858C5ED4DACD6D4D01C71ED030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3b42a3f9f084d3b57e8951f4fd656d8a1f2a414075a63736133fe0c69c51bc03
MD5 94abecf322a0b01aeedbc7d853d12921
SHA1 0dab60e30f9007adaf358ab13ae3766371e9cde9
SHA512 2fd4068c45fd6fe28c7fe07d7cc21e5cb4802434fea45fedc68f3d0c673f825dbb3d77fabec89c235b326145bd00dfe4b5b29d184af0a54ec6af60fe86017a0d
SSDEEP 384:nAiFZurQXjZxh6VM8ND8TUNTUlIRlznNPlhX+foDMCpF797vkB34kYhmj/8L+1Iq:bFZur0h6qqwgv9MC797vkBIkH
TLSH
T102C23A76DCA0C9ABEDE38BD5B61A7647DEF00293858C99E4EACD5E4C01871ED130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0117034fcfc1caf4e5b2d00e56aa19f672ee1ad889c949677c7649bafc253bc9
MD5 f2128999c9e5ed36bba2bed99d1003d3
SHA1 089b652a2f89e1ce3a8b015225702e54fc6b075f
SHA512 9a0cb859a4d9601ef9f14a6dd0a8a9c448d5d09656c66c16b546ddb0bcaf171a07c39af8543fcaef635fee7d13ee53799676e252e5ab7c2a22227648b63da6bc
SSDEEP 384:nAiFNurQXjZxh6VJ8ND8TUNTUlIRlznN74hX+foDMCpF797vR4/DYS9dpLe34kYE:bFNur0h6jqwg69MC797vRkJ9HaIkH
TLSH
T1CAE2293DDC60897F99EEAB85A30D25169EE40277C4B888E8EBC50F4D81B359DF703815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 66c7d665c8b6e79602d28cc7c4c92eec932226ef4c287f9e9e9f2b92dea434de
MD5 c5f4d61d530608d9c764e15dfd596ab4
SHA1 3f8e4496e9a729a471e4d4dcb4b689be5c286c28
SHA512 5023291fcf77efe29e1c1d400e6d1d055bbaaa94c36dbf0b50a395657386612a0aff3efb735c8cd023eaf6ab62969d46c8d8f4fe2adfc8b0d132baba6f4f2700
SSDEEP 384:nAiFNurQXjZxh6VH8ND8TUNTUlIRlznN74hX+foDMCpF797vR4/DYS9dpLe34kYE:bFNur0h6pqwg69MC797vRkJ9HaIkH
TLSH
T1D6E2293DDC60897F99EAAB85A20D25569EE40277C4B888E8EBC50F4D81B359DF703815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 096b7e61b58d601efb8e4487e8b79735d393cb0ce87640e7af3848c792414760
MD5 bb41c224187c21c822d561427d4d3694
SHA1 5c08b2c82cc683402703d757cefcc6d65f6e0894
SHA512 232a8a0d5cc24129ad7968d891b5619242e8d607a5ad4b3dcb548eab18704c13c819883ad27bdca4866e217174ed8a44d2232b0a6bd587d00822f7abac06489e
SSDEEP 384:nZiF1tNn/s3n9SsD8NJg8TUNTUlIRYkznNVm9HX+foDMCpF797Pimmn15wbAjEJK:wF1j+9RLwgiLMC797Pimmn12bfJ7W
TLSH
T1BFC23A36DCA4CABBEDE38FC9B70A7656EEE41263819819D4DAD85D4D01C32DD1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 346b51b72d06b876c22f1d86186ad459e6d8666b26c19eecce21dcd171ec0f1b
MD5 05eb06ca526ae0a646f40cbc94b892f9
SHA1 57981a365cd24e6c0dd12e483026e8a523a149a2
SHA512 b02a14218095d08685e75a1da743f59e46660db57d9339eb26e656b0c8ee36d4110ecce98a4930db5357defb6c97efbff282d10ff371a7790bdb7d3eae9d0549
SSDEEP 384:nniF1urQXjZxh6Vf8ND8TUNTUlIRhznNqkhX+foDMCpF797vkB34kYhmj/8L+1Iq:iF1ur0h65qwgx9MC797vkBIkH
TLSH
T142C23B36DCA0C9ABEDE28BD5B61A7647DEF00293858C99E4EAC95E4C01C71ED130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 374110a2503546acd353b156f2eb9f2b2a6eaf068c37cad92fb2d3c3074a5525
MD5 8bcb76f1db5911ee6fb2811e42084ecf
SHA1 a8bbc511621eb9ce45e768fd4dce6b9ea2e1bdd8
SHA512 656cb0c151c27b47ca74d38734ea006f222aca076f6cf215613e2e9bb65691f40522db32d99be4b3ee5ef44e14936fd61ebde9eaf1e0a3ea4525080833fd59f2
SSDEEP 3:MsEllllkEthXllkl2zEPdSWK:/M/xT02z3
TLSH
T1E74404457FCC1405DD0430334035C35013FDF7100DD1574774D104135CC75440C110C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

4af0ba97-f446-4063-b166-e1ef4c360367.tmp

Path C:\Users\Admin\AppData\Local\Temp\4af0ba97-f446-4063-b166-e1ef4c360367.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

HorionInjector.exe.crdownload

Path C:\Users\Admin\Downloads\HorionInjector.exe.crdownload
Size 147KB
SHA256 2d79af8e1ff3465703e1dc73d3ef2182fd269ea2609c8afabdf1b80693405c1d
MD5 6b5b6e625de774e5c285712b7c4a0da7
SHA1 317099aef530afbe3a0c5d6a2743d51e04805267
SHA512 104609adf666588af4e152ec7891cedafd89ad8d427063d03fb42a228babefc59428b0c8b1430cb3fc319a5014d2ee1083ff2b74fa585cab2d86cdad346e8b08
SSDEEP 3072:ckgHqUGSCoEslON/q178+oO3BAE4T/DvueX:cNHqUGSCPBh+7VST/Ke
TLSH
T13DE3E6B0E397D428EC96473D8432BB528A27FD6B5CB0571C541EB13DA9B3316C1ADA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5676-311-0x00000236AF9B0000-0x00000236AFA6A000-memory.dmp

Download

memory/5676-310-0x0000023694850000-0x0000023694878000-memory.dmp

Download

memory/5676-314-0x00000236B3F00000-0x00000236B3F08000-memory.dmp

Download

memory/5676-315-0x00000236B4C80000-0x00000236B4CBE000-memory.dmp

Download

memory/5676-316-0x00000236B4C50000-0x00000236B4C5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads