ba7a4c6fe852938a349348168692ef7b76178fcf60873e8b0401dd403c6f05d3

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 2.3MB
Sample260708-mprt4aet9t
SHA256 ba7a4c6fe852938a349348168692ef7b76178fcf60873e8b0401dd403c6f05d3
MD5 13bdf94c056c262660b840bcd4864981
SHA1 4f3da0e1d1ead24f8f262390d10f0700d4b821fc
SHA512 898ff28a2b3b8b665f802c880da1a8f046d3a9baa6424d61b859a9255a75b42df57b0e1180012d5157c4cbf60f028b8a7f504ae8837a63a37ede116fbaa51a09
SSDEEP 49152:0MQ0evY0Bu0eENGHsMiAqrPjS/9vPeBeBefeaNJRCe:PewmUirGheBeBefeaNJRCe
TLSH
T172B5394232953A9FCAFED2F5141209DCD6E011CF0287AA8EBBC536FC86D5B01654B76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2584_149871862\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	2836	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4388	msedge.exe
2708	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279808041554482"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{7BEA772E-FB21-46AC-B02F-7722EA71ADEB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{0288D7E5-6413-400D-92CD-2B648D45CB88}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	taskmgr.exe
Token: SeSystemProfilePrivilege	8	taskmgr.exe
Token: SeCreateGlobalPrivilege	8	taskmgr.exe
Token: 33	8	taskmgr.exe
Token: SeIncBasePriorityPrivilege	8	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
4628	msedge.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
4628	msedge.exe
8	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 108	4628	msedge.exe	95
PID 4628 wrote to memory of 4388	4628	msedge.exe	97
PID 4628 wrote to memory of 5068	4628	msedge.exe	98
PID 4628 wrote to memory of 5068	4628	msedge.exe	98
PID 4628 wrote to memory of 5068	4628	msedge.exe	98
PID 4628 wrote to memory of 3232	4628	msedge.exe	99
PID 4628 wrote to memory of 3232	4628	msedge.exe	99
PID 4628 wrote to memory of 4252	4628	msedge.exe	100
PID 4628 wrote to memory of 4252	4628	msedge.exe	100
PID 4628 wrote to memory of 2032	4628	msedge.exe	101
PID 4628 wrote to memory of 4252	4628	msedge.exe	100
PID 4628 wrote to memory of 2032	4628	msedge.exe	101
PID 4628 wrote to memory of 2032	4628	msedge.exe	101
PID 4628 wrote to memory of 3844	4628	msedge.exe	102
PID 4628 wrote to memory of 3844	4628	msedge.exe	102
PID 4628 wrote to memory of 3844	4628	msedge.exe	102
PID 4628 wrote to memory of 2600	4628	msedge.exe	103
PID 4628 wrote to memory of 2600	4628	msedge.exe	103
PID 4628 wrote to memory of 2600	4628	msedge.exe	103
PID 4628 wrote to memory of 4220	4628	msedge.exe	105
PID 4628 wrote to memory of 4220	4628	msedge.exe	105
PID 4628 wrote to memory of 2248	4628	msedge.exe	106
PID 4628 wrote to memory of 2140	4628	msedge.exe	107
PID 4628 wrote to memory of 2248	4628	msedge.exe	106
PID 4628 wrote to memory of 2140	4628	msedge.exe	107
PID 4628 wrote to memory of 5320	4628	msedge.exe	109
PID 4628 wrote to memory of 3436	4628	msedge.exe	110
PID 4628 wrote to memory of 3436	4628	msedge.exe	110
PID 4628 wrote to memory of 5504	4628	msedge.exe	114
PID 4628 wrote to memory of 5504	4628	msedge.exe	114
PID 4628 wrote to memory of 2724	4628	msedge.exe	115
PID 4628 wrote to memory of 2724	4628	msedge.exe	115
PID 4628 wrote to memory of 2724	4628	msedge.exe	115
PID 4628 wrote to memory of 2584	4628	msedge.exe	116
PID 2584 wrote to memory of 1716	2584	msedge.exe	117
PID 2584 wrote to memory of 4492	2584	msedge.exe	118
PID 2584 wrote to memory of 2708	2584	msedge.exe	119
PID 2584 wrote to memory of 4492	2584	msedge.exe	118
PID 2584 wrote to memory of 4492	2584	msedge.exe	118
PID 2584 wrote to memory of 2532	2584	msedge.exe	120
PID 2584 wrote to memory of 2532	2584	msedge.exe	120
PID 2584 wrote to memory of 2152	2584	msedge.exe	123
PID 2584 wrote to memory of 5232	2584	msedge.exe	124
PID 2584 wrote to memory of 2952	2584	msedge.exe	125
PID 2584 wrote to memory of 2920	2584	msedge.exe	126
PID 2584 wrote to memory of 4120	2584	msedge.exe	129
PID 2584 wrote to memory of 4120	2584	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 952
  2⤵
  - Program crash
  PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 240 -p 2836 -ip 2836
1⤵
PID:3404

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=System interrupts System interrupts"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffab3d2c188,0x7ffab3d2c194,0x7ffab3d2c1a0
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,269490178917309020,16410555836733393442,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,2759568833526850985,3527001711019245268,262144 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,574478014723332077,2232745773029548050,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:13
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,5562310627377747633,8586711673146016993,2097152 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,14553060686380339372,9295514416885038253,2097152 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,14390789101868180351,11116707954548472503,2097152 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,11732479006480472432,2040116072000786852,2097152 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,4203573890947195093,17561555706064564421,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14983725918412933354,17438024786514755208,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1619120770973530910,8016753653388147462,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8345115594104754088,11317630536399910643,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8345115594104754088,11317630536399910643,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8217232308181700133,11465365142344865965,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,13576086565408296355,15878529567096759659,524288 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6660,i,6385944887718983308,13296253292662226089,2097152 --field-trial-handle=2556,i,10921301630411507940,9208071569532926017,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffab3d2c188,0x7ffab3d2c194,0x7ffab3d2c1a0
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5307320396630472012,11955729349264541902,262144 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,13919440956045937751,6243826778317860228,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,4972107190054830575,12532195735756845581,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,13316779612322523406,3293381421108763922,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,13316779612322523406,3293381421108763922,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3852779996314695083,4614759218451665689,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7904557260611182824,10390907253785203800,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,6182364766349266860,658256969435073690,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,766415525873806868,6911559989024688155,524288 --field-trial-handle=2264,i,13054623859758043341,7120867297888337233,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
    3⤵
    PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ad521761c2a4a57d12b6b4f6c05b4c0afd8cf9a5e16500ce20a6aa485489a03
MD5 4d76127fd33feb31a9e49ee2b8800598
SHA1 948622838f9c8c13dd9f160f195785be0988ed01
SHA512 4eb103c9be8d6079b2a15681b595e75864fe59afc3ae7ab7f68d4f843a588a95236ea50b161a4cff6a804062757a2cd2d2def165afb754be1320ddcdfa5cd032
TLSH
T15ED02324BF25FDD7C734147B94304B00757555737D574107E524444C8C754C26B876E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e9eceb5cc4bcc9773dc4920c030963a4771811c48ca4faf24c0bf5cd8d4c9a6
MD5 44fded65e8f23a4e3f0101fc94fba54b
SHA1 07bd2d65cf25db8a9e13cc0d68f444f0edfcfb81
SHA512 20e8353b964c4d39bf2d4d2de5bcaba0b4f428daa14e2e026909f2990aaab0f2b6c3c0ed67c97833c57360ba1b2f8ff0ac1d21c3b1532b7478f9e2de1ce52df9
TLSH
T173D02274BF28FC47CB173872A420CB117BE2A6A1BD5AD423D130444C9C356D22A8F1EA
MD5 SHA1 SHA512 TLSH

Submit Download

4c84752a-adbc-4ce0-bbb2-283f917daea5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c84752a-adbc-4ce0-bbb2-283f917daea5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0223652bf65cbaa3d6727a4ea33974098004bb67f9ec300e7c3cd1ddb6611201
MD5 d3778ae924ea3a11bcfc8afef4e65eec
SHA1 9e9834830b52736e8f8f3b74f5904bad07f5c4ec
SHA512 214d889fd8a2de4128297f293b221bad901f9826162526b4feb48c33711d7d68c2d19557862960800f5eae5f060e95fa897ec914d8f76becf754448473e4f179
TLSH
T197E02BAACD22EC3718FD4B1D64504786EA55235B3B40844F3A3C860D8FB16365992C2C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 592ce570ce7c86d18d1703a978f3b3fe5c78c3c67720e84b949b35a73f6ed772
MD5 81b3bfe4c1c03be3d228d0e5f8716951
SHA1 e15660e23800ac4f9ddb8c9186402379bddb31b3
SHA512 fba2097c92df94e1649f5552324d7ea4b6668eb407a1db68548109d93592edf22a8169ad71c66db2ae20ede623e5454125670d413e7ad072c87212d4aad4b3da
SSDEEP 384:CEorLYMqMV5AhB1VgVG/zxamjeb8YDBcyL5mtWOIu53Ozb8VIDa:wQMqMV5KxLxHjeb8Ub2WfaMi
TLSH
T1DA13A13EB24D6F45F6CB163D664B7AF26330D878D0E256173B327D168724B82A90E607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 9c2d02095ea78c4f1360ea4d8b9e5abf41a65f6f4bdb8d8b5c78ca9e6f67a717
MD5 b0973684014383b09aa2155256b51ae1
SHA1 bf1281f3b20139247c833494dfc75a3260677e6c
SHA512 fb1cd2634eee1ad4a9f9f1ed61087c6fed97d06447996f494d4d7cdcf4aa0b1afb2d0bcebeb0e9a4215d56bb1988b888da372645628b498a31ac195e43c83335
SSDEEP 3072:bH1L/gL/TZ0lxEKrsGgNhrfFeBXFk7Ey29:bVL/gL/elxyGgvkFp
TLSH
T174B4D7F71612A00ADB6D02F696163E3DD237860D7CD1EDEAD5340C813B29F33A6A99C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c1342eca60afb77c8c6468043cc9f9f23bd8fcdef3aaf9463cbfac7809a918c2
MD5 f3fee86baf4e37eacf3cc224d779ff2d
SHA1 f2363861845600d4fb473423f59a1252bd553429
SHA512 8f0446bd7882b53b30380254daf1f9428dc85e08bdf9ca40b52db64cb1a25a18b8c347d798f1c4684451636aaef5da32d2aa547d9ebbb748b613cedebec40a1f
SSDEEP 3072:3v9G+HNCf4DHQ6A6bB0XWGRCDkYp8DNiaj2GqO26pjCTSRSyHGjzKaa:3Q84f4E6A+TDV8DNKnO2PTJO
TLSH
T1AB257BEECB281C92CB6B877070E0D9077E712183BA4CD0D3A944C5D997D6B8576E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 e13cef2baa9fc2d16b633a2102671474b47876ccfef391e61ab41c66de7f7ddb
MD5 6e5c25ab198d9f487567185f1f8e7c44
SHA1 60c4db08590eabb13fe8e3270d17837fc267fff3
SHA512 e72671dae0999f18ec17aff3cf0651c75c31d0c86f6fa19afef0b81845d700eb539c5055e2fce60d50783ab2b3b6050c62138b5ff8198f0e948f991e68b4d2b8
SSDEEP 24576:1H/Z9J/z4BBZJmXbaPVUOmuot0ZuAm0KbwrAnH4LX4ZiJ6:1x9V0/Z8XbXtQhrAYLciJ
TLSH
T103866DDDC9785883CD679A30B4F0F9577CB413C3B594C2E68898C684026B7C5BFAB269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 467KB
SHA256 f018bb462131444b6c74e5406b9503e22e49631da674a992963e660fcc5d79f5
MD5 53025c911e831285b711e08680148cc1
SHA1 573bd8e943319ffea90fc77dd0ff7af645d45f1d
SHA512 90486f640587e3396b276d4d9e202978c1a9fc83ddde53cb4009bebc0b9af3a7f0a4c17fd74e391211e04ca9962055c90a4693562107ed4be81c1bdd0a48805e
SSDEEP 12288:/nNNaJlIn93MtSMitsYEdEZ/tEyogbqkFm803Qc2nIe:3zRy/ieYjZ/tE6xsQbf
TLSH
T12CA42330C844BE309A6F2612F83E6DDA46EC6460FF8A7B4345FC85B17CE175096EE552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e11a0cf8dc22b8a9651d65e0327bbb8555466ab8d7160ca1dce139756f33bb1a
MD5 c91b85624282aea195f00cf90241abc1
SHA1 52db066b7efe48ec2b433252c1582e4475f7db3d
SHA512 7d8f2dc75cfb0c6e7e80461f85f3a01a5b4ae693633ea11d9ee48c8b49e634692747b36c74a77f4e1fd97c31d4aa0269273372da782c8ece45858120d2bf3ca4
SSDEEP 48:Mi/O6QpTmmqefgOlAkmziyRXkutcvm6348Y0MsMm2UPEugq/3muOm2/ZdPxlOYU0:Mi7UntciFNC8BJJAmL5G1s6P7ZPv
TLSH
T1FFA12C84936F6BC3F7A9407510D979F436B0A46940CF8E40BBD05C76BF3638C5A821AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 05e7489f5426b0f796815516ddeadb23a986fb91b3c6893793775a22ff7c5a51
MD5 dca6e1f2c6dae2bf9af9c2a8dd637c98
SHA1 4b848f236197695915b99c9c98bedcc6777ca672
SHA512 1d6d750879e4648f3aecd0e93f7eed3d6ae3b5fbd585d6dab089787520d6a317d2365fcb74a0ef008d79c2fdc159cb07e33462d0c6694cad5bef899542434a88
TLSH
T1C1E0C095F5C6C12D5C1034C7017CAF58C2D73893C7842E132F04DCD83606000B7571E2
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 968a46612988121683cb7786e243fa9072721c83ba5441a818ba4a9ff6a6af7d
MD5 721f014504c9a67c96c17e805d990377
SHA1 899ec8e16db9f2b215a06d95b34cefa4857ecfb1
SHA512 05bfda085239ec7d6f5fc72537bc51f6b067ce036ac11496f11aac694a2d1be6dbf19190a7b8f231a16c56c93909c6bcb5e20141188178ed2073ad174e36e16d
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfju8x+W5LUCFtI8NVqYpY:TtD4jJ/0UC+lf5yc+WxUCFOcVTpY
TLSH
T150E2AE8C3F11F921C4EDB33DA0D2C5E09EBC682C465DB5709238AC768C636B2F49E10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 791116298347af997b31c4cd62ca4f552fa243e78e347de79118ba96d2d135bd
MD5 a600eb50c190ee5686626e0d90559227
SHA1 d802241334efce684ce88f6fb47eb4b0b9f9f8ee
SHA512 ab055bfb9ae10a93c61f5917080286f9fefddccbf132c7c0c18e640003b4c6250d56a22a0eb61fb9c0ab72ee2e0724e327350a7ccbb0ca9aaf67d5b43ba2d1ab
TLSH
T17DE0200497C8C11AE524669BC37E9348C6D13D27A28C3F011B098C907101181E75F5E0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 b0679da77a8511697bfcb0793db846163f9553e06813d856facc520efc4a54b0
MD5 3869f2121a85eceb2a1230d8cbb38dfc
SHA1 054b95df26f252603116d05b8f282202e0e9908f
SHA512 653b96f19b3ce11ba09ea5791099d45b9cfd90fcbf2b8125c3ca0244d25f0f831dca2ba165b78eb13c9d849cccdb4d0fe14c5975f7f949f9c631e6c6eb6f02f4
SSDEEP 48:uzBmw6QU1Pz3scNILRNdGNP4V6KdVRH3K:6BCxiRM4w4VR6
TLSH
T18492A36B4F34B812DB861DBA252E5C35CE3FE05C5FE6DC96385060622CF889394361ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 b49d9b4cecc2fa9a5ab6469e6a477f811f10391e6434d3c7ca9f9cca35fd3849
MD5 38f4b86c2cf69c760be2d5a42002252e
SHA1 ef4f32a2e1d29d21939b6cfc77a9b1f26581848a
SHA512 f49d213dd035e4a8e2f564c25c733d4852b8991d80d472da1e06a78e76df038de263064e2152a085dea7988887cad923ea1dfdf8b66b349a325e78cda36cbd03
SSDEEP 192:xLKafhqH+bF+UI3iWGVoWN3qL/4QSVVV63:7fhqIkUI3ijVoWN3qL/+A
TLSH
T1AA24631F5F213712CD7C81752CEB89A34C7DF03F8B6265DA68A11470CEE3A52A12C5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1KB
SHA256 9db22fe1bbe391fc317951984e9367ca1bc55a5fdc88e179f64151de03289685
MD5 5a69b84ac145bdee0161c22bcaaaf3ad
SHA1 4a621d26d37a11bdc10c342d3153a671644fcd9b
SHA512 ccfa99b93e90f87483adb4afeb8aaa4d952f2dae2ca6574e8f9397438638bbfd1807d4442daf24cdb6d9e243ef3e8aa98f4e0060fb56810f86300cf06c16d7ab
TLSH
T1FF21D9B72105E504D24EF6F92ABCBD18CB6B042E99D0DEFAC0805D445ABA4BD3225CE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d43b86720d90b85ed052d3de431aea2a107098580d835d8f254161a8aeb24ec0
MD5 bcf4ae311138a0d105944253409d6c12
SHA1 9b591fe5cf7dbed4a2cbc6ccdaa6681fa3dea4ac
SHA512 41829c9cd162f35edb3ae72f0d5ab316240c69ffb412edffd593d2b0d6e511442549dbc17ec3a27fdf77ccbc65924015c06266377d33d5f2117d82f16df34099
TLSH
T112E0DFA096CDC12BA608229F822EF70DC7F13C17EA8CBF265F059C81B415045E7A62E2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 0f4939efbbbb3e88bd552329ff68329c754f2733b6f4ea3a7b2701e0a8241447
MD5 1eff500ce608611af502c721f5a280c9
SHA1 9c08c7a377f4269b92af81a5411738db6d76cfb9
SHA512 b2435b60beac9b3fe6c59c7f160433b01bf018e30b89359d201807cd9f4cd8f5681e66c78ab918930b972b7261d9fa25734a705c220af3d05a3d4671a126bfab
SSDEEP 192:tDLaTaTWr0fC+6v5NBBqBqpbRQWrDBS+4:BiSaTBBq+6CBj4
TLSH
T1F6D2190C0F1B2101C3DF2A32EEFD6C99AA2C8456AB63922A75807175AE35757760F4E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6e9a0617f1b06f9d861f62d703c7ec7ed7f446da89f6e8c5d18a9b438e742ba7
MD5 96b14d5c95ee981831939b01f1e8f2af
SHA1 7f3a129039e4de8c67d201c8645e637d601ca8b0
SHA512 ec80b38185af85dfd4c52687c0bedc908d3b30c52acf155a610ab93a5f0e65ad0905235d3748cffc4d383e2b40749eeb3d4c5db5e28ebb0d2243289a76de36f2
TLSH
T18751CDF7C3E8866EC91156F0AA187F2BCE1C0915832C3D5A85E4AE5B93F2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d0c759c6cd6a29d727ff759d332c9eeb107d61c31676ffda5b8cec630edba2aa
MD5 ded16f010c2d5d8b40241eaccb5db2cc
SHA1 de3542aa6ee41de983987257ece7ab4520136954
SHA512 389e317957f0b97fc85afd487de385c44b200e37a6f5639c59786533a14d30fd3588ad26b901cd3a0e370898f10e1a6e8e159b05a2cba711ed5ffa2457031525
TLSH
T19E21EDF7C2E8557D890042F87B146E2BCE2C0905931C3E5AC5D4AF5B93E1871E24094E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 747b62fd364385428549f90a9e729e84f55c7486eb7de7645829a8848cf4c3b0
MD5 f5a0e1406b2c661ee18bdef9238059c1
SHA1 098eb34145a5af1b304514c088e0a924896c5502
SHA512 68c237d86c9c8b45a622b828436da84f8c611e03c36818b7676ebc4ddef541fd67340572f8ce39834e8a89a05f5e0a0ed6b8528b8ef214c5a2d53dd73499cbd9
TLSH
T193D0A723110021B6A5787DA55066AC4EC726212404129D95109469D9173686C45071A4
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 60959a603df49f02770afebb0849e9d259f163abf9c69b30bc4e3131b9641ecc
MD5 f439cdf4829d55a1d3c2bf47d9f48d40
SHA1 f51a5516ea1293e9826806ea940279bcaa28d7e2
SHA512 55b3d7ede56b8f6f92eec9e90bfa63a6f30b8b3c269d5e25acb0eea94035ec26f5fd4d59653f0f9efffb64322de515682d91fd57f4b7cec887ae2fc86b35c646
TLSH
T1370147B340BFA4771038BDBF0E89BD026D38A835409299F1C9FA92ECE0524F75A02076
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b92f861867f8a4672dc49af06ef807279597df5f9646760c755203b3d9086270
MD5 9f1d26146d762244d045fc4df752898d
SHA1 feda3070f6cdb0814c8ace0c42a6edac4baa023b
SHA512 adaa0215f214451af00ff70ab999c27e0202e5314811b5c11ab28ae49c9290494ac3ce83f730a52af6040f554dbcff1e0e122f0e9e869be704ad613ab1d3fe0d
SSDEEP 192:sxR+RKyM/jK1Ml8wScB1t/fNsq/pPjKZig6S8oA8pKJK/g6+WNY7o/Yn5thGsIgb:sxR+Qcm1t/fNs0RjcWGH/5r/+V3L
TLSH
T1CC72B7165624C977CCCAD60DBE31BF53D6F914639A910E5CAAFCC90C01AA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8d4a6c5f795de583366e04b5690de5eeef26d0bdf8a54074ca180b96d46769dc
MD5 d927063a439bcccaff3e026894259faf
SHA1 bdb571032457bba2a20cd39a18bd0f008ab429ed
SHA512 314fa506d2014fb7fc9541378503ab83b7bc710fc7d5091f64e69a4c08cf1bd2cc31a0562239203eb90f6ac47a86819b9606eb330c4cd248feda75fd9e315882
SSDEEP 192:sxRdRKyM/jK1Ml8zScB1t/fNslDWpVepPjKZig6SLoA8pKJK/g6+WNqIK6XYH9t7:sxRdQHm1t/fNsRWveRjcWjH/5xXYE8L
TLSH
T1BC82B616A524C977CCC6D60DFE717F52D6F914229A911E58AAFCC90C01EB6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 31eb25a69edb10fd76ecf90a7d0b7265c119b4641f5367e36bc863edbcf477dc
MD5 bcce9cfad52d30408673b8c59f57ef7d
SHA1 4bf765d558bd26b2ee6d21181ae46b85ba6b14ea
SHA512 3a74ebbf70d58416760c6acf92876576a4b72426313b03aa11c173dce21ddb2e3db070aff852fe4dfd4ed8c01970a911b7fcfc9aa36d6135ed271a696f0b9f0f
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVX3XgunroMv8Bn:Jl6hhQE7b2WgqcfHwu1ja2X3Qu0Mvu
TLSH
T1FBE2EB3B780CCB7E4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 75976e87457dd003d7beb91cf876152d9403c4685516012b5aa6b94797d5b212
MD5 b57da69010781acbfdb74b3b250ce024
SHA1 b149e4350332519eecb389c737ae67b208b3c7a5
SHA512 b67b80912dd0b99b9f7c5780fe56e95e9ecce0b0e340846253f466904f9e4642837cc362fc5197b62e19eedeec4d3112413b07e939edc9645b3d37a7f9fe1782
TLSH
T1F9E0269057C8C5BD7115234B023ED70886F5B827D2CC3E022F45CDD46563545F39B2E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c9e46121bbd4516a10ef9283a015f34f415d0a1a0504b860877be08c356b6d53
MD5 587ff36ca22af8c278f902cfb0f59734
SHA1 c166d14f9dd759022cd63b15cb3228be3640cf98
SHA512 7349ed21672f515555379580844277a7af07571a70be5200b96bb9f4db21ebf6ed63b9373d75e078135c8a1bc31a944541b8410035d3de2c1bc6d4da98fb5cfb
TLSH
T1AFB0120577046F22C0CF5C3217A0E780A7C0E14200508403CD0CAF101E667D96F03CC6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5837607e7d8b86dd9489cbc4bcbb1196ec47f58065c77883bc6e5185d6053443
MD5 acc02d17e3d1ea59acdf1b2db9c8a289
SHA1 94304bafdcf494b4e13ca1856c2cb93852d371a8
SHA512 81c3511023cf65589e184c9869a194b5646018c56845e0f7fd0c25b7cfaecead20e46ba5b3ad45c76d4e0bead0743c37277cec8c38fe5cad4750c4b5dbb73a38
TLSH
T1EFE0D86067C9C62A7146229F823EE308C2E3B823D6DC6A212F099DD4621B140B34B1E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 710dc6f13864424b249fc007e4721175592aa2e43aa642f6f9329821275d0043
MD5 eb475120025fc3ab1c19ca9e85af4a93
SHA1 9886930f54fb24d05678ba232e19b5dd19805ba0
SHA512 4d770e7b1d0d179030f10a484eab6303e951b00ac8ec0b35194bb50c6c1838fb4be276cad8b40df4ff388c85e5e0a60bbf7392bd2699093ea33063c0750a30ae
TLSH
T1BAE04FB09BC9C63D6405618E427EFB0DDAF1BC1797887A9A5B0C48D4A112184F7BE5E0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be197014919fcf69982d36c2d3d693dbd45e702c67d49599a926a56cd1bffd6e
MD5 2faa805a0a79e8905ba6edb931baf277
SHA1 1a1e46cbc747717f2523dbcfd57fc2fd1476a90a
SHA512 ba69d72d0f4ac16acff194c594975567612ae90bcd1ba74e60f55a4444c6545d2d94b434cc5a48c4d0b6b9f8ab93a7e7fb5a49ba8b81a618307925955cfe34b0
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SHm7KmgIIOW4tVgGOK47g0OcOGlkWgRkQiQ:CfItpfd9cJmtR74g/envOR9SHm7KmgIB
TLSH
T138918744347B46403C3D365C8165C9AB96C6B062304EE42B7FAA15E22F67E01CFFE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 52309f00818edb6f1c98fcf9e23add96ff91e3ce131f10600600ccbd3b9543f1
MD5 2c6ab40e98efff746d82fc0ccea0b34e
SHA1 c0aaf1dac8b5bcfd032016d1ed0e5c92066bb80c
SHA512 6941b83c8d7fdf6b9783233072a8be2f97d275c34fe348b767dfe82b72b5a4aaaea17fa3ab91bd85ec4768ab526c5181b6e1b3826adaee265939fe1ecfbd8c66
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SHm7KmgIIOW4tVgGOK47g0OcOGlkWgRkQiW:CfItpfd9cJmtR74g/envOR9SHm7KmgIh
TLSH
T194C16345347E42903C3D3A5C81A5C96B96C6B062305EE43B7BAA16F21F67E02CEFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 33578897649eef1267fa1a2f134dfd1f19ce99eed3a179bfe6a387041eaea513
MD5 b519e1a98469b443599f63594aecced2
SHA1 100e79090fd40cfaab18b7eb4e9b1453145c16aa
SHA512 89aff8b79d090872acf948f9d87af7f12e4fa72706f9d494e1eae401c12f33ef692ca0606f3c8fa4bf18b121160b9e0d48fd86b5c56aacb2d4fa0f370272129f
SSDEEP 384:DNrRZyCSDnxTICoQ/MEhIKyll7svbFKfk7:xFZJSDniVQUyI1l7svbF9
TLSH
T1FC44840A7B747001EDE6DD721CB080771E3CB16D8F22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 c6347625aa8c7436a674caf6bc1c1bf8b7993932f9eaed824068ed12f4f9e36f
MD5 e482d7cdc60da1c914440490dfd21435
SHA1 58eff5620e50c2a7e5ed25c75cbac86b4f43e3a0
SHA512 c611e1a4444946dc213423df67e5e1f9491449a889a58cbfab4696d39924fa8f5cf27dee3312bb42b0bb0026871fee3ee539caf83e918e64150b7f18d4347601
SSDEEP 192:I4QSQIIIGb2MIMwxYcYy8OTOAsrlrMEuswv:1QSQIIIGb2MIMyBxT3sxks
TLSH
T18F42A65E16012B37C59EDB36136282505FD898814132322E72E22D1F8DF7F978EE51FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 8bbffcf190610454c926b230875cb92c32de904578972479e2acf37782ee701a
MD5 c5c03767b0813a136cfc44a4853a270b
SHA1 eb6dc8d8980eb931313ad68754f1877d2571b360
SHA512 f1adaebade5c05efb527dbd011e9e6b9bc48efbab178fd271451e577264ae7ffef4a8a3de42af3f044bbc88121b3b599af26f66da102e4af6ee545813874fc40
TLSH
T18CE0D820A6C4C19EB91521CF013E930D92D13913EA8C3E051F028C846106500BB4E6A1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 770cb37cb54593acceb2276245beeea30ac6d89b2b14689313b537841eafbe10
MD5 bc2c833ae6fcece98614350fcde9ca78
SHA1 badc523d82f5e5492d4fb58baec9ea2aac895b2d
SHA512 166d0c49008503909e9014d0c04907f32680c799ac026d547b12914a8d9818069a5fd414b8887dc09fc3785952e527fda8e7c690125ed79542204341107481fe
TLSH
T11421C056F330C148E159867AA4BF9B360738D8168FBCEC0F55BA20746E76B440E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 496d6586fcd0fbc63ef495285cd5c0c690343d85072c9c6cea1f34929df6618d
MD5 05ea38933a6afe1c28587d1db1d97488
SHA1 3a4dac68a1d2043ba8f72e9fa80b806ff85ffb58
SHA512 d33397453e8d3e69be0b7ed216503513d15b9e2f8ae3f6223f7a4711fc79cae6d03422984f70d0b8578a2141ac1cbaf067fa8cae8b4d2b5cc005771108d02bfb
TLSH
T1E2E0D820BAC4C29FA51421CB017EE74D82E23D17EA883F011F168C845106141BB4F6A1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 e54ca70c8d50c06e967597c18dab9d55da8a9444daa45eabe1323dbb7be9a352
MD5 4fa6c39a4d35dbfb0320744dcd2f438c
SHA1 6afcc4aefd17981dc8aa6386d9c5a2b48abf21bb
SHA512 9320a6d75eea9017ed75cebdfd9a51d46bb60c277a11f7ff9d2dc195197cd78f63f6e3c91b883bc779fc06415d6850e20723fbfd77f4ec25929fb57275c0d349
SSDEEP 3:MsEllllkEthXllkl2zEflWE:/M/xT02zZE
TLSH
T1164404447FD00545C50014314051C374137CFC11CD1177C334D11D337CC75410D00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 128a190d1ab035a90f4984154d2f5754c79398dbb9e82acb3186d31fb4799f63
MD5 d4c1523202ba20314c5697ebc9403faa
SHA1 403f8d9d7a848ac64b15f5e949b0bc8e113dc5e9
SHA512 4913c13ca3ca04c0fca951b89167a98b8440fbf14e4eba2f4bb2752164260b01df243639f7434b7071bfc9ce92080cc1cfcca6d05a6ba2683c6ed86447dba6b4
SSDEEP 768:Bj+9M3NKGYreNSLfifotAfYX7DGFzoqPcNMCNFptKs/0tMj1a:c9M3NmpfifVfY3WkqPabtKU0tYa
TLSH
T158138FBD9C61493E48DEF38D670E2A269DA40337C1B01958DBE91B0EC2BB56DF307925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 60KB
SHA256 e6d0990db05c6fb39cfce378ceb7ac1680144923b608f549fcde12d47a50bbe0
MD5 8e01d363883124e1109ec36e08e0b827
SHA1 18743038221c8f7d22c07912ae10ea1334e9a646
SHA512 5bc045f587d8ae002cd0347e4fdaf3b37bc17893c281b4f1dd3665cfcf5080306581b9c2ca3ecb31b077e7b799ac6fe18f5dffa69944464a18ab1c2c8a3d99c2
SSDEEP 1536:k9M3Eq3WkqPNEK98HVSYrbeisAfQ0/qUSppb:kMEqUbgSYrbeA3/q/ppb
TLSH
T17E537CF99CD3893AD89E9787673D2E0699BCC163B1884994F7D81E0ECD961BFC302914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 918b516a347e6d1863d1fec9adc0f23d793ee216a73798e84608ca00da7696f7
MD5 d1ed1a5e504568cdc477919684786836
SHA1 4b6ffb6ad7913c8e39a10821aed4c260a777c16b
SHA512 74612852355428ff322f824b02a84944722fa602cf713f9e1578383a6e752fce4a179803863c54dcc1aca9bcb1c6b6ce10e842515ebd8ce0c9f05658b468ec03
SSDEEP 768:Kj+9M3NPGYreNSLfifotAfYX7DGFzoqPcNMCNFOMj1a:p9M3NVpfifVfY3WkqPaoYa
TLSH
T16DF2AEB5AC655C274CE6C2C9B71B2B96DFE016A345801B54DCE96F0F86CB2BD030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e2126b16599953b7b127309b9b2af938fee7780d9c5db660ffe9b3910730d7f7
MD5 ce0979797ee967adc94e65f9833b3d56
SHA1 f318c5113dd745c642b63dfca03b2be10449f849
SHA512 bc5cf5ffcbb502278a6dd134f09077432721ab5803d090e664d0f6da50f936208ee0e77384ce2fdd8cbfd8c623f17f0f5215031321a5ed6a0a13a2da6f70c9e0
SSDEEP 768:Rrv+4UNbda3NXGYreNSLfifotAfYX7DGFzoqPcNMCNFOMj1F:Rbsb43NtpfifVfY3WkqPaoYF
TLSH
T18913CFB1AC7858274CF6D189B75B3B87AFB016A344800B54D8E92B4E869F1FD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 73f67ddd6201bce4b9757c87a77c49aa9cb8dd657c89a80fd7822c15d5d78652
MD5 8229c0b83203b3535a48052b1696ab7b
SHA1 ce09aaa61bc15a6c671e58e185984157d8cceaf1
SHA512 4db3cda9ff4dff91cd6e0a97550ea712e7657dfe15e53ac07b3fc4a9e7a823342f9ca13d210595235271391a2db5887e101c7351b544ded5835273eae149de63
SSDEEP 768:Zj+9M3WgGYreNSLfifotEX7DGFzoqPcNMCNWJ/R8UXCp0j1b:E9M3WEpfif73WkqPa0/qUSpQb
TLSH
T1FE03AF7D9C604C7F4CEAE789770E2B569EA0067381941A54DAEC2F0FC2AB5BC5307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 408b7ea042ab4500c33aee8eb92a09ce022ba6404583666e6cfd6affa8c626c1
MD5 5ef50901caabec9c29c7db64c97896c8
SHA1 ff4f3321d48d86f3b73dd6bb023845524e2b9320
SHA512 dbf4955462d5b9d46b6708a2fcc384d8a8585bd55c3cf6073097eadbfc8a8519efcd6bbd37ba3f782ce86bc62fbefe3ee1c689c27096d182afc2dce6fc9c25f3
SSDEEP 768:Vrv+4UNbda3dFYreNSLfifotxX7DGFzoqPcNMCNZbeVH1SkM:Vbsb43Upfifg3WkqPaBEH1Y
TLSH
T1A203BFB5A8A4453B8CE3C6C9B75B36076FF0055746840B94D8EE2F0E839F5AD130BE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 d9c5b3262535c80a14f882da70d35737ce7fb6b2618374886ad300ca85cf8c07
MD5 7876dd2dfcd3d426045717ec96774946
SHA1 62f0d2bcc42b64e566a21cd824614136502b9737
SHA512 b9ec3d88b8d8c76da508136f58b8805affeb1ebcf7d6d4a8683ccc18ff218c83a9467c5efa7e303cd2113e8c5f5f4c8f2940c5682ca94d64fa191ba2e6d14e5b
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isQQQtydDzA7dWUxS:TL+j0afDdWec9sJVUO8nq7+jy
TLSH
T1E392DC2669352033ECDB4B76B89349A00EFC125E89A779558ED448610E61BC2A2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 1d3eb72f05df4543d081a34b5030d56cbb794a7a9cfee953b27d210b06ab6501
MD5 34576462d8559e5700f8a6b7243c27e5
SHA1 6e3b7f0b581e27f47dc41e6d0de6ebadd2bff23c
SHA512 81f1e67f39d891ec0a404e951efe24b25d6fd2aadb224905269875bab150ff9b8245e9a44b73038cf619539f898492a7eac78e087269dab186079e6f462aaff7
SSDEEP 3:MsEllllkEthXllkl2zEfl7Jiw:/M/xT02zu
TLSH
T1114404447FD04505C50014304151C3541370DC100511774334D104335CC77411C11010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

9e195a4e-069e-4a77-acbc-1c90be02a9c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9e195a4e-069e-4a77-acbc-1c90be02a9c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4628_446937015\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-5-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-11-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-14-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-3-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-12-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-9-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-13-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/8-10-0x0000019954190000-0x0000019954191000-memory.dmp

Download

memory/2836-2-0x0000000005310000-0x00000000058CA000-memory.dmp

Download

memory/2836-1-0x00000000000F0000-0x000000000034C000-memory.dmp

Download

memory/2836-0-0x00000000747A2000-0x00000000747A3000-memory.dmp

Download