90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f

Analysis

user interaction
yes
max time kernel
4s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift (1).exe
Size 19.3MB
Sample260707-h4wpdact2t
SHA256 90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f
MD5 0033b392c5624d739c95af6cbb56d778
SHA1 837df1989cbb4887f067d8faf167e13a437162f4
SHA512 0930d1cd2d5baffa8ec2a817c5a9e3ce63684906dbdf63b1c073d013071f7f99b807a6c1116538d1444fbb05010085310c23c76cf497dc7c2eb9b09722ef2049
SSDEEP 393216:H4TWihKOqnU9jpjI9JT4YNIGiapB89/9RQXuab0TlRVnK2UvWiDYY:YNqiI9llNIdapBqFUdDYY
TLSH
T13717332B412AFD95C5402BB6EC226D56708B557C0E462366787F0FF25D8730FBBEA482
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Swift (1).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Swift (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Swift (1).exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4512-5-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-6-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-7-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-8-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-9-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-11-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-10-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-12-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-214-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-241-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-285-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-482-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida
behavioral2/memory/4512-742-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Swift (1).exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4512	Swift (1).exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1740	msedge.exe
1464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4512	Swift (1).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4032	4512	Swift (1).exe	87
PID 4032 wrote to memory of 2224	4032	msedgewebview2.exe	88

C:\Users\Admin\AppData\Local\Temp\Swift (1).exe
"C:\Users\Admin\AppData\Local\Temp\Swift (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz,RemoveRedirectionBitmap --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4512.5740.11743425665385994559 /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd591d5fd8,0x7ffd591d5fe4,0x7ffd591d5ff0
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,16396089338354004766,747813495360157114,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1900,i,16396089338354004766,747813495360157114,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1900,i,16396089338354004766,747813495360157114,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3452 --field-trial-handle=1900,i,16396089338354004766,747813495360157114,262144 --enable-features=MojoIpcz,RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:65dd37dc336f02bb30473f4cd87d80e82711a802 /prefetch:1
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" "msedge" "https://swiftkeysystem.vip/ks/checkpoint/1/cZJRVXOUljCWdLPpBbytszsOMwFJdZbVeVGVYnMpLcGSh"
  2⤵
  PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://swiftkeysystem.vip/ks/checkpoint/1/cZJRVXOUljCWdLPpBbytszsOMwFJdZbVeVGVYnMpLcGSh"
    3⤵
    PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd56bec188,0x7ffd56bec194,0x7ffd56bec1a0
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,7117855232464208045,17537843856113095482,262144 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,17538739007996702276,15059848083315042230,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,15682132124473907686,16041491410813115917,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3958788344910921391,10602288619608620981,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,1152572623050408969,4298730605080597734,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,14918891215974679315,7526521968372473397,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,13623997356175928336,17321548866656252011,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3732,i,9626951507279309660,8209723145331681314,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15094831169451790998,18093231668429811856,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5640,i,4645881742196851441,16797719011597420795,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5796,i,6788611852376714205,14358909114038493529,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,17320769616109818325,13114741984151152908,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,2205733310927254630,11403895299352496554,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11328022839435000006,1216879594669463250,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11328022839435000006,1216879594669463250,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,756339452405879071,6924340433085345810,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8430583561858745951,3076403920638185880,524288 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6648,i,10971928003755491443,14735810974138912032,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2588,i,7661885519250039823,18159890430586316706,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5172,i,1855367009459546079,8358293566737912689,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5760,i,13294087462364388824,5245196236656149352,2097152 --field-trial-handle=2272,i,4004507832033902802,935067553371229429,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:4052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd56bec188,0x7ffd56bec194,0x7ffd56bec1a0
        5⤵
        
        PID:5916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,3270747493038673605,6316051494028451651,524288 --field-trial-handle=1948,i,4446872019568680566,10447845755486817436,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,5000303731406711602,10065959499747995206,262144 --field-trial-handle=1948,i,4446872019568680566,10447845755486817436,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,10827307569775378959,14353812479798190803,524288 --field-trial-handle=1948,i,4446872019568680566,10447845755486817436,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,9248335223059667950,14450187134265404793,524288 --field-trial-handle=1948,i,4446872019568680566,10447845755486817436,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,9248335223059667950,14450187134265404793,524288 --field-trial-handle=1948,i,4446872019568680566,10447845755486817436,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
        5⤵
        
        PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5985c09ea5aba349ed09b6fbc8eb9de203d87b937b3d15e178f9c8ddcbff5fc4
MD5 e9a5ff2b0bd541088cbaf6dbd9eb6cfa
SHA1 60e6975adef4a868df5a5d6f9fb782231278bcf5
SHA512 e573c63ce0ec4d161da9da1b14857404f5c1f5af8b80f751885854997c605c94192d043d14e48d5f6bfbcb5acfd0c3f0babe2845bc5a88fcfea7fe29c0156ca2
TLSH
T1CFD02220BB200808C882B230B0B0830CA220C2E8800082280000FA388EA22820A2B8AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b373b285262d249dbcb9a3049cb52ea4237fe0652081e7e8fc809216bf0741c
MD5 d654bc36905ca65fa089ed6415e1c5a5
SHA1 32d7e4997a7ad3c5350ef0dea5604fb990fb1c21
SHA512 b3861ef455d1d571b80f1b2c3f4170907ac4ef2bccdff0e11f8d8be2450c0e927dd70ff2e49f8dd530aa5a889e7a5d1a3bb70bb176dc5b1cac4c1a3139df7931
TLSH
T188D09265BB555A48D982B631B4B4935DA224C6E9A40486284050FA798EA26820A6B8AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 34de28f5d42e9a20fff4dcc81305613ffce044a37ca2f86c1ee44bc6428203fe
MD5 23da4727845b26d1bce6dd09aa46b5d8
SHA1 2192a8e40f686bcba80161e1cbc612499880bd83
SHA512 545b4ae977cd221481d893e2545a1a0c82047200032a2f19912d9a9d480e433c3be3379e1a8b391fa02465d8b502f4a843d9a0b6c888b4c1e837c9a2d7373799
TLSH
T16DD02324B73975D1D5356175E43043047639C3DB7215C2256100DD0D4D764816BC7A99
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6e5bde3e91299639295154db7ef6f8e8ba9f21a8d9c8c0ba6d58ec23e933ebde
MD5 e7f565f6cd1952ab1b34aa582c22d559
SHA1 064d458c4c41dcd3a43a0487e29b57b7f104cbb9
SHA512 51ff2b112402e9185d8b57e09a275d46cd5a0bc757d2a02d217d4a943307e6f8cb84d16304921afe47df209f92e8d12d895ae4191276349096db356d6dacdbea
TLSH
T16DD02370B7393841C7177530F420C3197775D3D97505C5319110991D4D765911B8F155
MD5 SHA1 SHA512 TLSH

Submit Download

48b3caed-89ac-4df7-8b5d-0ea1c8a95dfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48b3caed-89ac-4df7-8b5d-0ea1c8a95dfe.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8b80972862d96c83221498bba5061f9817db763dc79f04ed8d28f6f3c0c37e9b
MD5 a3a9489c5d61060d83d7354e6c96ad6f
SHA1 e447450317a92c55f8eada265b239be89d33e17c
SHA512 62735a206cdb604f05c1f64181e69c8d81d204dc9f9a6750122a0d276a98e1c7c20b679096204f2767503fd851e8abf25d438fd433593eea6842a609ea3b3ddd
SSDEEP 192:LqjfxJrOrcTkZFwL7cu+y9JzgSdrjBdmrRrKC1Al4l1/DW4OzT6EvDbv4abj:GjfxFTku+CrjT8/RO3v7bNbj
TLSH
T159136D7FF711AF46DBD388BE270B9FB54733C92AD4EA61676A3532440E603451E1E828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e07d7ebe08e15ca446d62a2c6f47678b7e5b9e8f6f54c1bee1790ecbfa5d314c
MD5 62b9b467c19075d6001f6995cc593d24
SHA1 8c874c36964c595e55161b5894be256d4d08c699
SHA512 6b84e84878415433d212970ef058a8cac02efafcb91ac3884faa79323ae3b8acb8d1fa52483fa185dbd9319385c6f44422f887edfdd5dcddd72377fe5ec57109
SSDEEP 1536:PZALEvtTKL/YBL/I2wFJ01NKrxcL/JAgOaEwoC:PvBKL/YL/4bQiv
TLSH
T1AA443FF75951601BCBA842F5E6033A3DC27B810E7CD1F9A9E6784C812C65B31B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 dd81f73a00f47e5b1958f078dd6201232111f2e6d66f26e014fc7da3d07d3899
MD5 a564381f9712fb0a76348f4c5b208859
SHA1 ee6c67ed4cb8ddec5dc3c404aef874bd7e0051dc
SHA512 65c3ef0165e7306ac366e3932f440dbe3ade9b0f68a05a20a8fc68e3cddaf38db0fe3e23f3bebaa90e13d01f58cfedb60d14fc8fb407474ae812722f3d349602
SSDEEP 3072:bv9G+HxN4TfDH3gLmpWV0iWWdDkBn/W5dfpH:bQ8xuTfjgO06a4
TLSH
T178253AEECB681C82CF6B8670B4E0D8077E702183B69DD0D39945C5D997D6B8176E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5bc05e7c6519f42b9f9fc353f0569b02fc2123176236179afbbde4215098db44
MD5 fc8f0777ced85513dddaa8059e5a27e8
SHA1 83d57a865b1a4e50127009df8a3fad8be8f9c37f
SHA512 ca9549a7952d42f412a4a2c0b4b44c119a021f77f323b0e8a8d052717077a3b76855cce7c1cdbd476f8b92599796bb3bda81dafc1bfc4ba93f3c4a4b424c8770
TLSH
T16751EB03E36716D2EF664A7191E754FB367088B60AFFDF5260D0B034A93A709D746E10
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 24ece1fdc7c7b82caa95caa572b9284d067d5e12e55ac16265a3d24eac686f98
MD5 b08c776ab2a7cdb71d3224779bc79faa
SHA1 efec89c7fa4c6bc52bfc18f5cf85612739b4deba
SHA512 d4f896ebde2b59a7fca4e889983c965039aa02b8a3875efbf05a3d68df7eab0b372f6f67b7439c91c7490a43ca242a6e37361a430cb57ea479725e84c5faba6d
TLSH
T1FEE07D8609CCC129DD2468D3837D9708C3D0341EF2C83E47574BC84C7181A42FB876D1
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 eca0783871b08d284baf01a4edf7a8116f31d0afe2810b82724b588ffa1e7364
MD5 cd3ed7c8bee626883f5b51565e8c168c
SHA1 ac76279be5c3f337e28802dadb34f69678cf4510
SHA512 95c44ac1c77e65e7f21811c34523c5667f625706c1dd5da548f1483b3509959fcd529d43b421f6564843f2fe145bacf02c159762795d446fd81c025ba78b3fe2
SSDEEP 192:GrjoGrIiYYH+bF+UI3iWGVoWN3qL/O1hT2i6VQpQm/aVVV63:+U6LIkUI3ijVoWN3qL/uhT6VQ1/aA
TLSH
T16924935F5B693216C97DC03668E704A34C7DF02FCB2216866C6114B4CEE3762616EDBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 831B
SHA256 4c840f8a32fab3a61ce758ae5775be3a3fc91b41a11714de34ff000c83566130
MD5 f17d960c94ea293b0db0e9ac368da08b
SHA1 1949ce93eae210ee8f95fb67a3c08d55fb36cad8
SHA512 f1f2c6ae8fbb985c68f041e6d09e3e1ab829e6f651c3164280671931867eed4795a6fe6a8c093d5fe6a93cc02a35d86b5cfae970af4ca0a0b8efcc8f4e6a4324
TLSH
T1D7011EE364A8AA04BB30C2F8395431ACCAB1A30E8D8842E1DF93F14B58F72F94016D08
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 cf7fab6f6df0e99b12994f830405bfa395396a12094d68bd23fd5d086e0f7c47
MD5 de7dc939ef4ceb6c66443e7be6328d5b
SHA1 31c0786e2e56e74308a1a5400f862d5b593a2953
SHA512 2c2a4c4b61853cfcaed4e9f479f709b7bdef5e3cb996f7d081035bdb0942097123e6b13b2ef78a7b3efd5c3682e3e5b04d145ed52e53886429e2d0830067fb84
TLSH
T1A7E0206249CDC16D5E0C2087D235F70CD3F93426E6883F171F06D858B401404EF931D1
MD5 SHA1 SHA512 TLSH

Submit Download

96d8636f-003c-4631-9bf2-89d243ba57ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\96d8636f-003c-4631-9bf2-89d243ba57ce.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 6d0e4a03b4069ef13f52500db7d2cf08fbf91ff767c6a926d5a28ad8b7942163
MD5 b0be1f5c9e2318873b1d5ce0a84733e7
SHA1 e3c2be021b0008a3452842c99e00e94f3aa28b5a
SHA512 ecb8a513d881ff94ee56b97c510b4f34f1b15934bf4c380c84e34fd0df92d43e51d7177e08346c26ddfeaa4553819fcbf52ffae25dfa52ec2a2c1fe69f3fbba7
SSDEEP 48:Txk/LopFMaty423w/a9NUuTVwYXjFe1l32wM9Dotwr0fQJQOue:qDeMatha973Wl3p8sQJQM
TLSH
T1BDB2934E2F246115D0F18A76EED240632E7C211ED7A32949E82410F38D63A6FF7164F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5f3e228bea34064b01ee3e1d2c3f0a65998d038a194200fb1794512be70272c7
MD5 d61b1ed3ae0de01bbbeaacd6d2ddc83c
SHA1 8d601c4673a6de9a9cfc731bab7a173cdccbb58f
SHA512 f70c934fcc749b5eff20ca8efb0840528055d3e7373f4b957d4765c3b30f38f63151f3023e84b278bae4cd8f2646f8de298bf0251a9c18cc36256215c4daeafc
SSDEEP 48:YALlNKOW3wRW36W3LZWoybC8NgyxzVCZslRs0foKsyzEsZWxsnWvsBC7wBj6Asqt:DEOtxGZ0b/DVh3lzlzBGwBj6y5tcZ/Or
TLSH
T125A19DF7C2E8862DD91152F5AB182E2BCE6E0A55431C3D6EC6D4EF4BA3F2471E10194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6069b0ca45025c37f25b1d0ad4f1cbc1c969bc7a63c9ffa8c15fd9cb10c20220
MD5 191f12c546c83488ec37f1ee3f49a482
SHA1 f1a42beb7c7ca055f8f40b28893e31119ca67ffb
SHA512 63c0a87b955c9c45b848fd0ea1f3a28793fb484bc5dbb92fad0494e4d060483e0d026290c0723a475cce2e90180043d9ea3900f921043e17df43693d0060c52a
SSDEEP 192:sxRZRUyM/jK1Ml8hCK/fbsXJWpVOWHmutWpzoA8pica6k/g6+WNnSrLZ3/zBqyp7:sxRZC5K/fbsXJWvOuLtW0o/5SJ/UG
TLSH
T16272C706A5345A7B8CD7D21DFA55BB67D6F81533E2901E44AAFCCA0C01EB7ED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 719c5d3949fb2b41ee9d6208a1f820ad888498aa448e50f29f048cba627fa2c0
MD5 eb97b9a3478e68a850374edb59dae4fe
SHA1 d27fd01c5dc5c6f693d5b295dec551a12c599303
SHA512 e0ba06d50589a02c2d564a13c8001794ae21eebc9aa509d19203e59ba136b20c0b26f986685881d3ee8b8ea27d6025c4232b57b6bded35796cc79e35d0142d1d
SSDEEP 192:sxRaRUyM/jK1Ml8wCK/fbsJRWHmutopzoA8pGuw/g6+WN0Z3/zlmO2jGyIgtJ:sxRaq8K/fbsJRuLto0O/5i/i3
TLSH
T16E62D9166A745A778CDBD209FA557B53D2F81573E2901E04AAFCCA0C01E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0a5a3c0d80d163a9d61e4aab552c1bf4611cf7184b958e88e0a1deeaa7789812
MD5 9881b2d6784315530ece4a2807270b33
SHA1 dc4e836ac1ca9a15cbed5455d45dac9a24daa470
SHA512 71bd2d8a9c67f23afbf05e5dc2a833ca740e3640bebac6988a9bf0832e5b77a20ca661996ed9f5135e0dc20abcaa5562613f443d795d40ddbc863590f0336da5
SSDEEP 192:sxRZRUyM/jK1Ml8wCK/fbsXRWHmutWpzoA8pica6k/g6+WNpLZ3/zlmO2jGyIgDS:sxRZC8K/fbsXRuLtW0o/5b/iG
TLSH
T17062D91666345A7B8CDBD209FA51BB63D2F81573E2900E44AAFCCA0C01E77ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 63cef0bf502251f41ecabf51b69b92a8acb0f34c414073249de844365ed70bdd
MD5 c6e772ea808dd0b860874f2d27dfc7f7
SHA1 03fab6c2adfd39c2fb419892ca56773f6e218cfc
SHA512 2d00b7affd5cbcccb94c32bb5eadd06a38070f971d9a27f7b04659d5fa16f119a5f8f1cc7afb01bb59102036d4c28e51022fff9af151363bfd597f060f5ce140
SSDEEP 768:zdWTf+7pLuL7VoWg0afHy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWWUIu6Kro3vDmv:zdWTf+E7VoWg0afHyu1jaRWUR6hKdh
TLSH
T1F2E2EB7B684CCB7E4F404ADCEC297D8AADA801CB9AD8C95447FA881C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 f86d3347d1777475dad7a68ae480944b478971e073ba802c9ed0e62f0456d0a9
MD5 17e9c8da2113cb84e8c904c01df72a09
SHA1 563051a41cc5e8c90702d2cbabaf94054b3d7bba
SHA512 bbe0ee5ae2de1c6a6187b10f308c7c3d8c0d462b16b05cd713f642c0b7b900de5e3d53fe995d80545408a7c5625208fe3f85a57b687afa51b53f8f1d353578ee
TLSH
T16AE026920BC8E17D6C25208342B58349E2E4742BD2C83D072F81C8BC7542505FB935D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 aebd34cffc86de1a27b79ab6d7872a70c126eda1e976e31ae9240acf43a84bde
MD5 62023c1e03a5e27d0a05f9c811fdb54d
SHA1 1f62fd48d730766f327015fb8e8f2754da1ef87f
SHA512 b6a36b5b2403e2e347ca526413ee8336d2e1e2baa1f31459c7ed6308391e60419f060be5cbd4c6c2b6667fc252f2fb09e0ab93e52111c33ec9b6b901570b5b86
TLSH
T188B01208B3405015D90A0535098C8F103610F082108109435848EF618C115ED6D80CC5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 e843cf34b73503063c97acff6e75d84d8a7d5d6c223ffae701b6ef57ecfbe1e8
MD5 5e2320fe5b9288b16993d1d26d900c8e
SHA1 d4972d74391c5e187e32c7b99c9958d82ea4980e
SHA512 aa3eb94ec5b249082a9a79a74b15c6267147dcc14c08dad5f6d49006cb46b4fc2c6647d07c74cb50d16f05e54561e425b630e6013d42e6fc66140ee924555082
TLSH
T1D6E0DF721BCDC62E699920CB82B5E30CC2E27416E6C879262B099488B206180BB83AD0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8589a22505fde3a44bda567eec4ec151b5a9980986c827d44e1d0a9fd335f106
MD5 2048a1e78ccba34d84e8d0121dc27772
SHA1 364d54670c67f1f1d3e282a37a2a1f5baf67a28e
SHA512 5abe7cb1e1bee27c99eb36cad36ab491eafd8b4999cbfba0ab43555145b35ec8613eb276db458faf63c5956d008d053c40e0b5115d6780a01f8985133b9e33d7
TLSH
T152E026754AC8C2395D1864C74278D71CC2F0B91FA3C83B0B6B0D4448A501111FBA71D2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 53d3fe215443eecf130d350fe6d9ce594c30b320401ad93c19e281a5c821c748
MD5 7ab2fcd1c838f35edb6bcf8ad32df85f
SHA1 a5dc71c8e82d95666c243aab8871e3fc2577dd47
SHA512 ad1e5ab2c8119138fb91cee5282659d490df23447a2ad0982e8d0bfc024c3bfd6bc6495a2907dc3d241cdd5d841148ca56a073f12f47048f7036de5c24fc5e25
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWH/oNJ/9dRWpGMgxRK4YgfRcHPuxdjsJ9rn:CT8ZNbRRIFKR1nMgbCjbylxWH/oNJ/9s
TLSH
T1C9913305313B07822C7E355C84958C6791C17061712BA96F7BAA03E65BABE039FFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 dc1d307b21de3eff264cebcb8900f850af083bb90c4b251a8377179efde072b2
MD5 924824b2b7867a022b10f54432ee1b9a
SHA1 f897ca40a7536de56eba9d1da2aee570e4d5dc2b
SHA512 66540bd1ec74febc815c21af3eef9cc2305906e4a87e08c72eb9db064e01e15c0f0aee321c37da71d37b80f55423c20d7fa9f840d13588635ae7e6b60ca0feec
SSDEEP 384:DNrRZyCSDnxTICKMEhIKyll7svbFKfk7:xFZJSDniiyI1l7svbF9
TLSH
T1EC44740A7B747001EDE7D9725CB080771E3CB16E8F22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b968a1ca-5ca0-4e92-8b96-4be516b02719.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b968a1ca-5ca0-4e92-8b96-4be516b02719.tmp
Size 414B
SHA256 3aef9e28a6919b31596458f7501218f137fb439fb140aa211870f0bad1fc910b
MD5 a744ff11322db186aae260bd1a5affef
SHA1 c1bbd1e698fb52457a2ec09cf175201885d953ad
SHA512 8dc98fe2dd9f90c562822965f0933aa4bf34acba1a22b6dfca4f5bbb1e3c6b330fca7ab708d121e3fd9cbf9fd20cbaabcae3c8a5550071777243bdea7049f21a
TLSH
T1DEE02B5BCC16DC3B08FD475860144386F710136B2A41490F3B3D92098FF167689C681C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 ac4fc167e9af3bb3465a4b512451ba9c90a23814f7de92b31875c69187dd7bf3
MD5 89165fb4bc93035775ae4d86e82f8a6b
SHA1 fe4e8604c4c8ac0d1aa004e9fc9d1e253283de21
SHA512 d08d6356eb562a24bce26e07cdd331c529a9bc7ea2566a6143a6d526d3b4815c304299245cbd0fbe6995eef062ae5e1db3047442c4937d9e8e50167437912324
SSDEEP 192:hCQSQIIIGb2MIMwxYcYxGO4ZAsblrhwQ2sYWrZlU:hCQSQIIIGb2MIMyBk46sBp2sYWrb
TLSH
T18B42A51A16011B77C89F5F76136282507BD8988101722A6F73E26D0F8EF3E979AD52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 87a6554c19b55b60614b4a19cfc260172ff551af1d2b7112a591a5966a1f786c
MD5 8b568938e05f669a83d1c8cbc316066b
SHA1 977f265175f1768eeed198a88ef257cfa66975b3
SHA512 88c2a75e80dcd725fe7058d5c25492fa63fede8df6f1b77dd861ca4300cdf0a07c46b2145c346289ed9a67e63dea254fa5c217a806cb39add8d47eca9f7bd152
TLSH
T14AE02623AEC8C16EEC2464CB0175431883D1381BFB88390B6F07C48CA446105FF875D2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 533df4e0594fd91ac82621e31fdf35dbde3e13529b0850a1924c55a9e280ccc7
MD5 fc56ad61cfc590831f07155dcb7fb8c5
SHA1 a5a3115c4d47d704941e9a97f48f2289f528e772
SHA512 a999b22ad1f14ba18b714affc2b2c2680896d221df38e4abcde7958f96bd863458d3122278ff096accf49b81ed2af6f17ea4a3e4064a4c67cd5bd8665456b5b6
TLSH
T109212155F330C148E14A863E507B5B2A1B34E8268FBCEC0F457A20746E76B440E8B3E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 56e8bc7889267b6c74f9953d0953c82ce02ec1d47b5e959144486dec44dc2e2c
MD5 c447d215a975ab6af38fbd4c2e013e7e
SHA1 1208d864b4b070cbb981058534ee853f1548baf3
SHA512 9a575853eabf0cae9edfe43e4c7f522e78fc45be74a9f2d25bd2271d4edfff6ee250a3afeddd9f5ed3bd0334e1b1e4e0cf1720cb0db5b0fed9b45bc52565f87f
TLSH
T109E020626EC4C16F9C2064C701B5934882D17817FA843E076F07CC4C550514AFF475D2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 6c6ffbf21973240b56f057078f36d8e23b6ae134e0bcdbf5a97ab8c1c567fa7d
MD5 1e49c1c6b835c0b4848e5f9ea5c589c5
SHA1 93bb432639e2b1eadbbb0349e0ea7d06240b123b
SHA512 e1f98c1ef85a4c740fc7b5169ec535a0b7f3056ab1e7651d3cae6565a919aca65f8d89cabd9dcbccdf06ba9b9288556ecfa94cdbf593d12cd8f38c25e5390348
SSDEEP 3:MsEllllkEthXllkl2zEfl/X:/M/xT02z
TLSH
T1A4440444FFC00405C51C14304051C3505770D4100D5357477DF50433FDC75C00C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 64ab3a9ce065c3a378fc29429a7fc40871d884ba349ef5ad3c80496d6e8e0813
MD5 4cb617ab6adea5dbb5bdfb711a035c24
SHA1 e8f4632f13df6067145eed964007f8022ec24f7f
SHA512 497e13cf278d7a5949fad42b6af05966a56fdc245f88ce141d549e35c20ee0e81b96816aac8ea47ec19b3865749d2a5ede52f9abcd15cf5b4b0b41262f8c6bc7
SSDEEP 3:MsEllllkEthXllkl2zEfl9btRKlt:/M/xT02z0tR
TLSH
T1AD4404057FC10445C70410344153C3541770F4101511D74375F50C335CC75410C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2f39a4dc02ca02f66a1792a640590669804d8cdd329313407649e5d779caf98d
MD5 bd327c4ab9c4e59f9ea12f8173046a9c
SHA1 df786fc998febc292a837ff5179c5cdb04a2ca3c
SHA512 9a92b4cda99a17da5cab02e51adad6611b3958bec91865e12ebc6e8669787195afaf26a0546d1d38523cb6b0b014c2e6dca9dc0acef02455b7335548dc62f2cf
SSDEEP 768:lj+9T32jUaam4xXqsT0uIi/+ap+Xeq7p9zrKNNOLb9Mg:Q9T32jg6RqPI577zrKbOLb+g
TLSH
T138138D399C518C3E48EEB789660F3A269DB44677C6B40988D7E91B0EC2B659DF303427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 73303fa0974091fd7e0f4712ab5884d317d3748c88f3bb569bce9e5794265d1b
MD5 73b80000e51d5be033a9140ef2263916
SHA1 66602f713f1082c0fb97f722f3fabda2639ffa82
SHA512 0106d8d64b57817bd8e5704c111ffdfbec3e419ed3535e7f3b74888077137f069beb504577465f981d42c3e6761391b1f9162c08d61482898e2acf4d708fb449
SSDEEP 768:Lrv+4UNbdl3Mgam4xbsT0uIi/+ap+Xeq7VteVH1SVP:LbsbT3W7RqPI57/EH1o
TLSH
T12E03BF329894CC778CF2D789764B7A177FB8559396840BD0D4E92F0E838B1AD1307967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 80f86252631db7e365b1d87a39359e35958361cfd344c1e489342339acedfe26
MD5 123374c215bd19be2e7e8d20ea28e591
SHA1 dfd3e7a0df78473197f5d8da8a5d8a49edb72da5
SHA512 01693c7785e18287f4cf801d563b4c9284ddce562dd8dc2ad55c0db2d0b4ea89a687e87f4ea1d361f3d0b18531ff2c91df23c6b4e8afc180af86042bf35fe8ef
SSDEEP 768:Drv+4UNbdl32xaam4xXqsT0uIi/+ap+Xeq7pYk:DbsbT32B6RqPI57qk
TLSH
T1E303BF31A894CC738CF6E389710B7A53BFB465939A840FD4D9E56B0E42871ED270B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d2c3df3004ce8fac5fc0ac69eacbdec2cebfd02a19cf100add1f2da353f5e83b
MD5 b72dc21c551fa1cb5d0ce8f5c0205d3e
SHA1 9b288d2556c8f7805f47f7150590e173dc331663
SHA512 f6e564200cea4e87af1cb0e6ecdecac1bae205f24f9ab9e8505c386b4fa9c81ac629ff9cbb6d92693a056dbf41fbe6e4ffce123c064e3af1a92e72115f298bc1
SSDEEP 768:Ij+9P32baam4xXqsT0uIi/+ap+Xeq7pYb9Mg:X9P32T6RqPI57qb+g
TLSH
T173F2AF31A855CC678CE6D799760B3B97EFF456E396840EC4D9E8AF0E02836AC1707427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1686dd2df064bcc384ddf0c6fe8cf1984e382e769613826cc5bb0a949acaa588
MD5 b736078bc9cb30300e8173326e789e4e
SHA1 393b259ab820cffa944542a565d60f3e838dc2fc
SHA512 96bdd965af6e61c07155678fe579199217fc7c45683f9451dde7e500e08b8b0a299ce9e687f4c7e689e07a8bf7eca5ea1d6803aea5e577a9dabff9da899bea34
SSDEEP 3:MsEllllkEthXllkl2zEfl8PKX:/M/xT02zN
TLSH
T1324404147FC0140DC5441130C151D3501770D5110531D74375F707335CCF5400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e3cf42a3-b8d1-44ec-a423-8c31437306ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3cf42a3-b8d1-44ec-a423-8c31437306ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ntdll.pdb

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntdll.pdb\219D0663E9DBAD581E64D9EC8618F5421\ntdll.pdb
Size 1.8MB
SHA256 f1f397540f246d8c5d810fc7f5bb3fc8aa5f5faa2195b3c02cccfc5d98caa77c
MD5 efaf77206dbf74e68d3aadb30439fe23
SHA1 0ed76fb3d538a704df634d50a6c036cdd189395a
SHA512 c8c1fec3d55e579f10bffa5d6e5e2f0c2d37800935363ec31298209f6e91873780a8fe6b01c8169176d5dd1d3d8a152b7756e6d19f21b73af9fcd82b83b0fa48
SSDEEP 12288:CJQHAActPNfytu1j7APo26reH/G7YNbQrLQdvUfXgYOEQFwfzlqGVBu:CPN5DXUzSWUfwYjQaf5Ju
TLSH
T1F09507367786BEF2E80A457FA0451349E7B89E8047A887D3BD8877A64CF2245CF2D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdia140.dll

Path C:\Users\Admin\AppData\Local\Temp\msdia140.dll
Size 1.4MB
SHA256 26295cdc39ec335323a74ee2c5d3df238926cd4e4a53aa39cfc15232165262f2
MD5 da3f8ac9aeea2931c655ca33d0b4a7c4
SHA1 04b10aa54f2f80fdea61a41ffc71efc9c37cf930
SHA512 9e9aa019def12ab343939c4dfcfeda5ef850dad50327f248a507ce19c36ee37c427d5d2a98c421401b63872f7b86ee99b087dfb1e697467a4435eca388fffcbb
SSDEEP 24576:keWnRymMrBp4L+xldZhcJEMm5zGR/C+TAjRKHxdaExC:keWdMrkKzGrTAjRKHGv
TLSH
T150656C5BB2E440A8D56BC178CA1B8A06D7F67805032097CF17A8476EBF27FD52A7D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5604_612486514\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Users\Admin\AppData\Local\Temp\symsrv.dll
Size 193KB
SHA256 51da071bab34abc9db349b471f24e06697cfa65f6f74e4cd995e09cf9e96bc35
MD5 cae67c24308aa631784b44096727f5c5
SHA1 6248ffc8d8b852da4318140480cf1c044fac5ff2
SHA512 0bf3fb2cb5632ce0099cb099b6c10fd9e083c006cbefdb1333c8b7c162b22c31d57528cf4633eab07e5c8cfe4efd13a382f6aef1b7b8c62273cce8ca3df08292
SSDEEP 3072:Dh89cklYH7jh4y7IdvfXpDw0/6+RJa8KNMm9qTuyb/kdR+Hco6Pg:DSfA76y7Q3Xy0iUb8dtg
TLSH
T18414E71273E80069E566B6788EA7CA06E772B9A45771C3CF0160856F4E9B7D0EF34372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6da2ae9d7ccb8c91052fb8e2d87d429a7e5adc807cf76c8e1ef77aad2b6aab4e
MD5 8d99fbc98a5d07a6b282e78ccf3c63a8
SHA1 67ffd7d4a3cab13f43ed89ed6623a50ac6b60bf6
SHA512 78faddd78de39a52a68c2a56865cd77fe7b717a81be216bdc709304d4016c2d0660da6f7bf73d4af53e5926cdb0e12efd60a285f68e60eb013c85bd9f272f36e
TLSH
T117D00451F11014D4C03034314111D3140341C5054317D1140453450544C00113155045
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 826f08a72f9196a1a57bac70b67abb37d81b9b41ed224e3103a6a17aa1a8edee
MD5 cf0c4911da545fc737af227bd571cace
SHA1 12b5518d46098e5fc652c294aaa0f6971cb4be52
SHA512 228fb7b99ed4e7d13ad2b88cb99a8a01ddfb6064d5b7a553af22f9efe3530e063c89a1e351173478536712f527203914c4b4ac3658abb9172f8e45965d930fc4
TLSH
T1B6D01213721105B8C03034330103B30C0541C20F820AC004582ACA1E5A440602A16482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

43e2f556-e0eb-4864-a41b-145238d31e7a.tmp

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\43e2f556-e0eb-4864-a41b-145238d31e7a.tmp
Size 6KB
SHA256 b412ce267a7fbb7119ce74e295504f50b60a41b52957c0313f72200a604300b3
MD5 7543818bf259a8481118f334fdfccce1
SHA1 2413b91e5ffa06af5a6acba0fcf047ae0bd0047c
SHA512 cc4325475b16d210ea4ffa39f69c33fad9022ababb5b37e99ca01e0671d725fa88c696fc7cd128825645cbf608d0b9b4ccc4ee4d957a48f616a0b2b60e5434c7
SSDEEP 96:stD/dDis6Eb9Lkuo5h16Z0ks7/x+6MhmuecJH0j0jeRK+gp1o28XM1C7K:st7sGhonksV+FdH04jLRoG6K
TLSH
T151D1A7026E24797B8CC6E109FA35BB16E3F9607265911E54EBF88B1C09D75CC730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 1a4d8c2b0191e9227db3cc2bac3314c0005e22a3e566175604f8eeab8f3515d7
MD5 ac592d1ec172b337652df06400e11a64
SHA1 7904ef5cf870bb8f6b320e4c53c10cc7d58781ff
SHA512 08800e25fd071fe1cc5e042c21740704435904d3d98aacea18387a5e7f8f5b24cd8c0eab6ecf438509185a0a485d48b0cedc745993b0424f3de5a24147a5e193
TLSH
T1DEE0A951C38214C4DB2363B281CA0660727578AD4AFB3E1812A469FCE9B0F21C230585
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cb26.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59cb26.TMP
Size 48B
SHA256 dd34bfd7aec416d2ad94eef2ab1b94fef8a5286729cd00563654dd779dc63406
MD5 299a102233dd283a3b316514ecaa9a1e
SHA1 c0184f3ea70fba5137de23b98ec9a4b0e9a01fbf
SHA512 de4eb89211c911947462fd0e246d2887cbd6c33f0046b3a8bccb35e6027f51b296d39a2943a744efdcdaa83ae69471c963aa1d5a4a794df5d72219393d919b33
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State
Size 567B
SHA256 cbb99990d3a84481f7277c3cc1e6a62fc60c67660d6e7b8c042d6701a59dc9b5
MD5 b30b117b524637f82e85be0112a7ed96
SHA1 5d8da4182ff36d7e53d993eeb8a75fbc2f1f6c99
SHA512 c2d388e951fb09c27dc394e64c24ef149ca1b267b235a7bda01378accdd4e5fd3ef25bc6ee778c0ac687e36dcb838c4cf2862cce54b58fc37bf49bbc3d825319
TLSH
T109F08193C1D4C5BE8A9113E56B307417C92F050992182D1ADDD9FBB657D3075911244B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4037.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State~RFe5a4037.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 6f96c3ed7d0480aa176241b047fbdf8401bc76f1452d8b7cbcb97c5076940e94
MD5 355df5ed3c9b761b8c2fae32ae586e32
SHA1 9779420d37210d64bcf3615773ac0344d0371e4c
SHA512 60ff7b500d208bfc78aad213c6d1f8483d69454ccbd616942d47cfc2eab6aa0a8418403cc018ecffd3459e2601d273de69c5407e324edfdbd8e91506475b48ab
TLSH
T17EC022B25069A03A10B806294E806F016E3AB030804098EBA1624FBAA0840AA6103823
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59fc96.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\TransportSecurity~RFe59fc96.TMP
Size 188B
SHA256 4f645749978e77c2e939e34f93501a360383a3503932502b597d85dbc2cc369d
MD5 038a0fd95e49a51fc98315e46a33c7d2
SHA1 58f0bc400575c1ca31352aa45f6e8e2948c9c524
SHA512 52291e342af83acfc836943cbc282aa5fa1d554a5b50adfeb9cf4a56d080022d3fc6127a9160f03b848de7fbf3dc60bb36e167701b3c676d9623be68baf64049
TLSH
T1C1C022B6507EE03A107C05298AC06E01AE3EF4308040E4E881524278A1A40AA5223032
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences
Size 6KB
SHA256 856874951706904e43feb0ed79c2d73cdf4295e75754c4d41f8e8337b146286a
MD5 0bb81a02496b91edc9a09bf39512afce
SHA1 35e316a432e59918f6dbbcf4e1fd163fcbfb9c0f
SHA512 268a576155cde9c7bc31b4c5ffe3b31afde07c53e6ec771e87edcfce46faad78b288eeca0c3965459b3a55ed0c31e3e8f8082ee7ce7f14e5fa07c709d6f7fa59
SSDEEP 96:stD/dDis6Eb9Lk+no5h16Z0ks7/x+6MhmuecJ5ylNMFNjeRK+gd4rWI8XM1C7K:st7sGzonksV+Fd5ylN2jLrwWg6K
TLSH
T139D1A6026E24797B8CC6E519FA35BB17E3F9606271901E48EBF84A1C19D76CC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 2KB
SHA256 455d8f749eddaa63713e107c00c00afb47d27c0054a27c86d16932ade276ef21
MD5 bbd6c191bd617c7ff33c6fc5b264d17a
SHA1 e2850087ca8f47203805cffe1a563baedcb7fd34
SHA512 eda838604009f21b52b321cdb6d106bd4d22f36684b5704389d5779bd4b6526afaa6d5ecea0b627fc68a408000882982211450b381e5b149557b26a077f2f687
TLSH
T1C15195B3B9007A3689A2D908BD5A7F639F3550A99B522F50ABDC0F0802D759C2307C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 3KB
SHA256 8f29049d9981b9c38ef0e89352b6aa873183702b6039e6b589ac0a6c31ac5aad
MD5 0e7b9470dff60081a80a70a8306c4cb6
SHA1 9177c1cc23eb1db5bc6ea7b7d4dfbb26272a7204
SHA512 379af086223c54b38375607a0c2d96616a898721b443f3199da417669d8be49f3a25331cb8f01ce6f1057a6d9e99ee4ec2ff0729154c0f3561978a3b18d3d02e
TLSH
T1D771B87BA960B9374DB2D909BD863B16ABA15077D6823F94EAEC0F0C02D72C81353C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 15KB
SHA256 6351b0cc943ebb207d6af5d7b9b8edfaaedb6b93454c25df543fe366d7e74f5e
MD5 e2c4280b979356c0279f15517e786312
SHA1 45a806d759d0ae6e99b5915459839fabdda54a98
SHA512 77a3e59ee7251e1cad94c91057bf60af968c22a8c349a860e182c2756e700227828a3f0b8a639487c3b2521ca485efc5b1ad2693ef6f0e9aaf1a9d8846c001c1
SSDEEP 384:Csrv+89zHqlDNP9oid6NBShPe/+1ZisdXYjNZ:Nrv+4UNbdGm1Zis5ANZ
TLSH
T12172A033E5387A379DB2D905F88AAB173F7860A791820B64DAD85F8C459B4D92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 15KB
SHA256 a1ddb3778ac7d927031cde094ac0679bf0aa97c12326b06f73a7d5c9ed73ba3f
MD5 139b109183e4542607efece40e4b52bc
SHA1 ac95b6abc3c5f54b20979c12147714bd68a603ef
SHA512 932fb7883b118cb2ddfdd979daa3214c4b8f9bed5b45017c514a3b3f1e5bcd32c1213339eded0e194c16eff6c7e307b6acbad56aa76284561203fb5b2ee9b81f
SSDEEP 384:8srv+89zHqlDNP9oidUNBShPe/+1ZisdXYjNZ:nrv+4UNbd4m1Zis5ANZ
TLSH
T19872A033A9387A379DB2D909F84A67177B78609791820F60DAD84F8C419B0D92307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 15KB
SHA256 ee32be470e5ce4de8aef26394ee9186c272ecfdee41dcd622d520a6bcce645d1
MD5 09252770e31c27380bfdc6ef2d668a69
SHA1 e358dbc0848ee38bae4a9d0ddb220a9449d34e43
SHA512 12bcead532fdd344c00f050d505ba1df159905f76bd3276220c99c43e04e4cd80773f179eba9bb024cb29a064c70a0235ea618664b3c42c2fae7467dad495066
SSDEEP 384:xsrv+89zHqlDNP9oidl3NBSh5K/+1RisdXYjNZ:erv+4UNbdlBm1Ris5ANZ
TLSH
T1BD72A033E9387A379DB2D909F446AB177B7860A792820FA0D9D84F4C45DB4D92307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597759.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State~RFe597759.TMP
Size 1KB
SHA256 26a12096af5438cb9570448bb7ffa992a52716e5820d7befb469a6db0026751d
MD5 1cb1c09c266a033d0a0949d67f141c84
SHA1 d8fd99b117a04a7ce5d3d5b9563cd4e5717ee397
SHA512 1ac037983e414d917a3749c729c01283fcf3a540a326dd12c58018c6e3d403e5d3c5ce3f983924a7825e8f3af48603a17b1c56c22b048174cc5cdf1aff24d65d
TLSH
T1593152B7E9902A32A856E5467656BAAB5F3110BE83020F4076DD4B0816E748CA63FC72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3296-39-0x00007FFD7A050000-0x00007FFD7A051000-memory.dmp

Download

memory/4512-7-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-6-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-241-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-12-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-10-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-11-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-9-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-8-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-4-0x00007FF629504000-0x00007FF62AA80000-memory.dmp

Download

memory/4512-223-0x00007FF629504000-0x00007FF62AA80000-memory.dmp

Download

memory/4512-742-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-285-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-822-0x00007FF629504000-0x00007FF62AA80000-memory.dmp

Download

memory/4512-482-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-214-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/4512-5-0x00007FF627CE0000-0x00007FF62B727000-memory.dmp

Download

memory/5068-107-0x00007FFD7A050000-0x00007FFD7A051000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads