hxxps://www[.]mediafire[.]com/folder/8spl79t3aym5p/LunaExecutor

Analysis

user interaction
yes
max time kernel
260s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/8spl79t3aym5p/LunaExecutor
Sample260709-nj7tsshv2r

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
180	DCRCVDrv.sys

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 1740	4456	LunaExecutor.exe	138
PID 3852 set thread context of 3848	3852	LunaExecutor.exe	145
PID 3516 set thread context of 2640	3516	LunaExecutor.exe	150

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280700234765896"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E10C464E-D29E-4682-857F-7F05B69C5FD9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	taskmgr.exe
Token: SeSystemProfilePrivilege	4960	taskmgr.exe
Token: SeCreateGlobalPrivilege	4960	taskmgr.exe
Token: 33	4960	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4960	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
4960	taskmgr.exe
380	msedge.exe
380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4796	380	msedge.exe	85
PID 380 wrote to memory of 3528	380	msedge.exe	87
PID 380 wrote to memory of 3452	380	msedge.exe	88
PID 380 wrote to memory of 3452	380	msedge.exe	88
PID 380 wrote to memory of 3452	380	msedge.exe	88
PID 380 wrote to memory of 2624	380	msedge.exe	89
PID 380 wrote to memory of 2624	380	msedge.exe	89
PID 380 wrote to memory of 4668	380	msedge.exe	90
PID 380 wrote to memory of 4668	380	msedge.exe	90
PID 380 wrote to memory of 4668	380	msedge.exe	90
PID 380 wrote to memory of 3492	380	msedge.exe	91
PID 380 wrote to memory of 3492	380	msedge.exe	91
PID 380 wrote to memory of 3492	380	msedge.exe	91
PID 380 wrote to memory of 3060	380	msedge.exe	92
PID 380 wrote to memory of 3060	380	msedge.exe	92
PID 380 wrote to memory of 3060	380	msedge.exe	92
PID 380 wrote to memory of 4520	380	msedge.exe	93
PID 380 wrote to memory of 4520	380	msedge.exe	93
PID 380 wrote to memory of 4520	380	msedge.exe	93
PID 380 wrote to memory of 3732	380	msedge.exe	97
PID 380 wrote to memory of 2264	380	msedge.exe	98
PID 380 wrote to memory of 3732	380	msedge.exe	97
PID 380 wrote to memory of 2264	380	msedge.exe	98
PID 380 wrote to memory of 948	380	msedge.exe	99
PID 380 wrote to memory of 948	380	msedge.exe	99
PID 380 wrote to memory of 948	380	msedge.exe	99
PID 380 wrote to memory of 3764	380	msedge.exe	101
PID 380 wrote to memory of 1092	380	msedge.exe	110
PID 380 wrote to memory of 1956	380	msedge.exe	111
PID 380 wrote to memory of 4536	380	msedge.exe	112
PID 380 wrote to memory of 4488	380	msedge.exe	114
PID 380 wrote to memory of 4488	380	msedge.exe	114
PID 380 wrote to memory of 4224	380	msedge.exe	115
PID 380 wrote to memory of 2996	380	msedge.exe	117
PID 380 wrote to memory of 2996	380	msedge.exe	117
PID 380 wrote to memory of 2996	380	msedge.exe	117
PID 380 wrote to memory of 4280	380	msedge.exe	118
PID 380 wrote to memory of 4280	380	msedge.exe	118
PID 380 wrote to memory of 4280	380	msedge.exe	118
PID 380 wrote to memory of 2836	380	msedge.exe	119
PID 380 wrote to memory of 2836	380	msedge.exe	119
PID 380 wrote to memory of 2836	380	msedge.exe	119
PID 380 wrote to memory of 3516	380	msedge.exe	120
PID 380 wrote to memory of 3516	380	msedge.exe	120
PID 380 wrote to memory of 3516	380	msedge.exe	120
PID 380 wrote to memory of 1840	380	msedge.exe	121
PID 380 wrote to memory of 220	380	msedge.exe	122
PID 380 wrote to memory of 1840	380	msedge.exe	121
PID 380 wrote to memory of 220	380	msedge.exe	122
PID 380 wrote to memory of 220	380	msedge.exe	122
PID 380 wrote to memory of 4832	380	msedge.exe	123
PID 380 wrote to memory of 4832	380	msedge.exe	123
PID 380 wrote to memory of 4832	380	msedge.exe	123
PID 380 wrote to memory of 2864	380	msedge.exe	124
PID 380 wrote to memory of 1056	380	msedge.exe	125
PID 380 wrote to memory of 1056	380	msedge.exe	125
PID 380 wrote to memory of 1056	380	msedge.exe	125
PID 380 wrote to memory of 1484	380	msedge.exe	126
PID 380 wrote to memory of 1484	380	msedge.exe	126
PID 380 wrote to memory of 1484	380	msedge.exe	126
PID 380 wrote to memory of 4944	380	msedge.exe	127
PID 380 wrote to memory of 4944	380	msedge.exe	127
PID 380 wrote to memory of 4944	380	msedge.exe	127
PID 380 wrote to memory of 2864	380	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/8spl79t3aym5p/LunaExecutor
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x264,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,8048711609888135122,17343161955408181863,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,3610749598643759604,3272603618549658393,262144 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,13537262196542708881,1038371112039297440,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16870975756773280603,15522941869703632309,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,18253678200619202714,5130835231570275941,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8596274257256211374,4219805208182158627,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12518250026841318046,9968033610937707052,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,10835426692011267555,3479318577664369259,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,12398453280855948972,10718450495512671269,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5516,i,8864657081649251781,5832655457456558054,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17093977109557334472,904116842234026011,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17093977109557334472,904116842234026011,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,5675091828051257806,8998283345330596121,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,17250110521962302109,68256615402925554,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7550838722179760232,5615001232047814075,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,4206447698610298498,10096892129253021227,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5360,i,3181155310676284965,4328960269766110477,262144 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3768,i,5099586373559595377,4091020564982156209,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=760,i,2540509847825737726,4258891019748875963,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4088,i,10775296492356837169,13984763577478807451,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6600,i,1910863019681804973,14467309226893981000,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,9330996069369463608,13698125083370815844,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4344,i,4562966253197829907,8410124156099519732,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7280,i,226824531881396996,12676810357976054887,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,11400644637117758114,11282494132318339761,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4340,i,12564590705140118095,208803498026631555,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3520,i,8080511309087494428,17957983934470976090,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5912,i,5610937937654252296,5189165464940762746,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,2564137164375840169,9721490834534601192,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,11435844970985143707,4571339822504618933,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,5525596226414624412,8898705282947684567,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,8515449265848183562,14944456900703294013,524288 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5808,i,18215977393693799494,6918855285451845214,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7292,i,6852317932232773392,5352230538397124614,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7232,i,8468315296285642690,4343139496274210353,2097152 --field-trial-handle=2196,i,6306308875536105130,5495773357801973232,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3152

C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe
"C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe"
1⤵
- Suspicious use of SetThreadContext
PID:4456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:1740

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:180

C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe
"C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:3848

C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe
"C:\Users\Admin\Downloads\LunaExecutor\LunaExecutor\LunaExecutor.exe"
1⤵
- Suspicious use of SetThreadContext
PID:3516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2deec6a95ec52614194a78a23d73e7d01a237bb1c36f177b2d079e01904bbb02
MD5 1a081c1a44490c52836d469b86ac0024
SHA1 afd36b8efece8f0b6da93e52448b0b0b92b7f2e0
SHA512 19264593eac6e8fc2b1fc661bfd6a9ea2c8b80318a9fd4358c9f04722074d457d449cbd4766b079f4cbed4f9218c79e4304ea56aee93a1d3484cb9deae7c7b51
TLSH
T1F8D02320763CFCC1C628117191218F007B355452315BD14AF2558C1D5CB50C197D6BD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 29KB
SHA256 2f2d5cfcfa90562924e3f961032f165955c49e5ac5ead08755b0f060f54bc213
MD5 fc6c71ed3f33077375aabc5e114fa9e2
SHA1 ef648a72739836c8efeb2b4011e235a051b7ed18
SHA512 63d85c4e715c58c0b5f4f640728a76356134ea264e1a1bb0f23faa3a7088148aab8e47aaf1cb3192373f2218c71a619eb1d0fa45d8cca4aaf58d8a50f9c8967d
SSDEEP 768:vEBNwMyBpc/rz9qvNmaCJcWxBCYD9nQw9q:aPyQdqwK+nT9q
TLSH
T198D2F204CA3B023F602332AE191D7CD5234F0DD932774EEBDC597955253B5A968CB2A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c7b6c10131c0e1623a152f1ea19c00c8dfc8f7e57aa48730792209697e75ca68
MD5 9c54cb5718b0470c1781104ec02ad1d7
SHA1 0ded6eed3c3c859fe773d016806a1b9664403cd4
SHA512 15422743bbeafea85280ea3e8bbd50683ad321e97b41cf3ec4f414ec69912768dfd9ef1842bfd038acbd0e16215f4a02b4283ffd58559d43e43efc91d7e40f57
TLSH
T13181B508056E89B2F7A10F71E4D30650B8314379AE731DD772F6EA7CF91EF16902948A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8262cbf791f19b931c129adfece4d7d16ce361b454aca5fbeb9b5900878ac577
MD5 0c2c86b2c9d6da36590fd701befbc440
SHA1 ccfbb2dc209ee2aa2206aa8c802e05801a96014e
SHA512 4286b35d18c9bd3b5d3797221432d99523b002ee74fdd650040cfa8171e9619e9346a098219947be10141181598c2705ad3af7f4d660388329a392f025a4715a
SSDEEP 96:EdX01AVJO0AfmD/SQ0YVe1zlegabSPa+IHsCUTO5SZx2Jf24x4qr:ES1AVJtB0YVeHeVSjIH6656Yf2W4m
TLSH
T1BED1C70453999BEDF76D0B30D4D30A90BC31533C6E271EC2E2B5D97CB81AF864058C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b91a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b91a.TMP
Size 3KB
SHA256 26f1da27e61db5f888e2acf7028522f22cfd3dc4342020f1d0572e00f3082d7d
MD5 3fd9cdc5926a0cbc8b559a1ec5693fa5
SHA1 a0ca2dcc92e58f33ab8e389178e716b1e22a7100
SHA512 be9f22dfa99d38a7b43241afe6f9acc7bf863079554124776c0dd24f13ee5b5cf2acfca43b0c28bea8b53275bd648ff114aedb665ca4d022ce682ba22fad0961
TLSH
T19871C40402AE05B2F7A20F72E9D00651B47183792E771DE732F6E87CF91EF13812908A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\LOG
Size 385B
SHA256 f0380413fa46e06a0754677c14c578aa511e347acce0df5ef6f0dc48f1898138
MD5 c8139dc687a8934d073516b3f2b99a68
SHA1 93d84c57d76cb4043bf8c04aa2b7e8835831f706
SHA512 b4dcf21eb96434a2d825c641ae2e12e289dfcac960ea77ed8e138bc9a9b5ced9aa8d80f4efa89ea69f422d07bb9707b130b38ba6e3be3c78b736c3defd9d09be
TLSH
T196E0ECA881DED13F6009345301747F18D6D2792BD68DAEC11B028CA065C124567D92F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\LOG.old
Size 345B
SHA256 db041d579019b001dc32404c4903ec1cd9faa26d326032c953707881e936db87
MD5 a6b4bbd6a19b849ad1222a0c3094b3a8
SHA1 f84771df8c832c6cb197afe185fb70f619cf6337
SHA512 fe5212a2c58bf5a36d93277b6a823b2d8964b82954d730d7795b3a75bdd8d87d67f08cfed5b6c4056465e25c5059c9ceb35a98b99d5041611d38d9df717af4fb
TLSH
T1E7E0222C81CAC12F620830D60434BF09D5A3711ED68DAEC20E41C850B146049A6AE1E0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.bing.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 fc7bc0881b9e0dd1a69c238bbdc6c692a34e254132d5babec7d9f163f5708803
MD5 0b45365f8b962710f67c79514cebb924
SHA1 b76a55c830420db13199a8a4ae89e2b7965076b7
SHA512 01ac6621200829dfa02d5fc8e578babb27616a89657c457e58a9434f4a7604d4f55078a13cae3b262d2eadbeb7b651a5e8360c85a88c7301793ae12c7b98c796
SSDEEP 192:DOhLKgv8hh7s4ssImnYytaA/eODrU/ro/4VSAj6y4StHN:DOhLKgv8hh7s4ssImnYytaA/eODrU/rZ
TLSH
T120F16AF382D9C61EC91157F866146E1BCE1D072583293C258CD5FE8BE3E20B2E16A65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 b4f4f8901a19b61ac3e17edd36e1a185decf843e2695f0cb2c3c147f81f2c080
MD5 a69599eacada9690823102fae5fa9dd2
SHA1 1da029a8bd801f4aa324ad4c397aab807e49e00a
SHA512 7888967cff7d44be0d7f2d21b66c27e731df1067e787a7dc61de8d6c4188c00275cf63c84aa73542b1a0e89eacab29a41dc7d70587d690c933cf69d658add33b
SSDEEP 384:DOhLKgv8hh7snyezIaX644Vewg8d5vsImnYXaA/eUP4VcKyK64q4LIYKYte6LLsa:bu/N/tHgE
TLSH
T1D5627CF382D5C61EC91117F4A6146E1BCE1D171983293C1A88D5FE8BE3E2072E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 f5a48a80568e531d483b7d1a834fd6bd5c64b9368024081500b824ae13fd8333
MD5 dbc5ae586107506d46eb554a8242ceb0
SHA1 65dee6ca1843083d2ad3a9a2707083ee3dd5db57
SHA512 255526adcf76867658f749b5041b5b2bd46caca84a4a0d7936e56d17d19a8d8ef60a000023d359e72584ca5cda829b2f1a693d6f6b07b0a3501964112cbbee72
TLSH
T1E9D0235312407176555C3EA5919DEC8FC72610201443DFD511D09A5C05318FD454B141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 a232cb3c4e0bd71626115ea709d6f2256df304b5676b2ed3ee334ecccf913ea5
MD5 6a43eff6995f00994d3a62d47e35516c
SHA1 aa961f458407c9c2a74482b795b153d782cb82a5
SHA512 215c875762477ff963b85fd54dbf7141471bb214ad151121ff430fe154be39309952a10e0a52e26973b419c1104c70dc2d74aa735ff4034b71aed4c75c73a3dd
TLSH
T18FD0239353057075955C3DAAF19EAC4ECF2610201843DDD510D0999805724ED5547041
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5afd3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5afd3d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 16d79cf0404591a44decf2489ec8509273621118d154623213fe3feddca98bff
MD5 a1f2055213f0f21c0921e7af3dc29858
SHA1 09cbd1566e512d91ad53b11a877d51197ac801a4
SHA512 42bc2927d2f73171d4084f42c0b4720a818f3efa27a006de6c98ef1b84a59d16a9b5115c0dc1cbb9822fc6460a8940fee6dfb0c28a88541505e0dd95de51562a
SSDEEP 192:sxZFREyM/jK1Ml8Mkw/fSsENlhIdp8FHW6+WNmqx/YLXsmbIgrJ:sxZF+Mw/fSsEDKsHbZ/w9
TLSH
T1A052E9126A345977CCDBD209F915BB93D6F91463A2941D58AAFCCA0C00E6BED3217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f7b1faa9326e9121bca96be3cfc8bbbded8c023b7ab6dccb501d1c110c041b3d
MD5 c0080b15d2811ae0634216012f43502f
SHA1 2a6ca286c889375bf4b2edde3d974d2921ea79e8
SHA512 36123ff4a1c8d3851ce70dad2f9b7a9acebb86a9c20b0861c7bd21f03983c72e4c0fe2be0560079df4ea490b46096c5a0c3b8a819ae4b73620e583bfbffa0eba
SSDEEP 192:sxZFREyM/jK1Ml8UQz8cB4w/fSsANAkdpN0HtCJnHW6+WNtGvt9J3ZYLpyOYbIg+:sxZF+qQm4w/fSsACEvHbaLZhYKAf
TLSH
T1EA82D853A53489B7CCD7C509BD31BF93D6F904639A911D9C6AFCCA0C00A6AFD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3166559937d5b1eedefc5e83e5bdfd410bd3eb5d12b13863c3c2badddbd58d76
MD5 01b9bb66cf467b2c84f7e602085ea5b9
SHA1 968d370b12a6ceeb8caaef7b9a99de655774b5f5
SHA512 9333e1b3aab3749ba68663466ebab3c376d37d43776f0523c5fa263e39f2812462260535193debef20766441cdc21d53421e07fca165d6943b8c85f88c8977a7
SSDEEP 192:sxZFREyM/jK1Ml8UQzkw/fSsANAhIdpuFHW6+WNmvy8XYL1y3YbIg5LJ:sxZF+qYw/fSsACKqHbWXUD
TLSH
T13252E8126A345977CCDBD209F945BF93D6F54473A2941E58AAFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9012811e56045ea4937b1a54946a4a21250308e525275dd0a2af8a0033745016
MD5 a880aa1fec53defd53da182280d7eb4e
SHA1 3d5d85c80c5a49d3a0d6fe907f5aa655deff0c91
SHA512 26d7f8fa20846644dd3848cef02c9b7cb70011d0afdf1aac5c86357f2ba5b9596f15c63665a521fee472e93e44c431cecf4836726f94ab48f10fd047a283ff37
SSDEEP 192:sxZFREyM/jK1Ml8UQzUcB4w/fSsANAkdpN0HtCJnHW6+WNtGvt9J3ZYLpyMYbIgD:sxZF+q4m4w/fSsACEvHbaLZ3D
TLSH
T1EC62E91366345ABBCCD7D209F945FB93E6F5146392941E58AAFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a1b907d89f2b6178aca7d471823639bec005ac379af8604ef3cf94434b4d025b
MD5 69a87ce4e99a509e2e47d7b01e56d3bc
SHA1 d580e8b3a409dd74fa898cb9d46b35ecfaf61f5c
SHA512 ddd7463c023c5ff891dc508a462c5fa51d7c2d00f5827e7ba9d64bf628cb714f08918580caad0872af8a8dfebc5ac9e7a0fcf8599148cb2375e7f2c7d239093e
SSDEEP 192:sxZFREyM/jK1Ml8UQzf6w/fSsANAaIdpN0hJnHW6+WNtKvy8XYL1yMYbIg5LJ:sxZF+qb6w/fSsACzeHboX3D
TLSH
T1F662D8126A3459B7CCD7D209F945BB93D6F91473A2941D58AAFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 21392f4a0c249a0142e9e6cbc28bf5cdfc095b9a0aa10cb6393fd2d2b02ea794
MD5 a447ab4e1d2f37346447cc1d55522c68
SHA1 b16832a8130ba7ea2601c6e713c98841e1199dbf
SHA512 f881352ba6a5b7757915204f2b9c00b0dc223a572cb5a90b18f6bde893dad61bb9d0415b71066600df88d75a90f5fb909d8f53c83f9410defeb4f83458f7886f
SSDEEP 768:s6s6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNjroqD:s6s6pD1WvxzUju1jahILIsNQqD
TLSH
T18FE20B3B680CCB7E4F841E5CEC2AAF966DD801CBAB94895447FA484C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b68b1a50fe23b113537476494fcae9197159ba4e6e34dab142fecd18e4fa180f
MD5 8034800d644a38f946ae22ca03940647
SHA1 ab9443ac2996b2406bf1a125e4906d5406beca08
SHA512 493699f210fe24d597b4f47a53f16fd6e9e442b57d3adffaa8c5919ec2a2eb22a89904c7e1846d25d706387a722fb3f9d8ca7baf2cf99e6bd2802f3c46989cc3
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabgCXAlhw:iitMlh9HXAlhw
TLSH
T165C1051271B702223D3E291CA39997664F42B6633819F52B37A900B15EA7F344DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eed2f36-560c-44f3-8d73-d544cc9ebfe6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9eed2f36-560c-44f3-8d73-d544cc9ebfe6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f273f0fe6256360aa82b69df9fd44c72866958d191b84f95d68d0aad2a76e8db
MD5 d3e241a66a445711a9229b19def5e5c2
SHA1 f4b64f62942811a3c1362cbd56fc3911e09b96a0
SHA512 20ab6565880d9cdb84ef2de21fcf76b74436767c0623df4457cc2533ee77b2b5d3a5b795e746657ae803cf2ab755a63b214123ce5646c9986fefe17bc0c35175
SSDEEP 384:yltNn/s3n9SfsNUGPFLGHEJla9yO+TQ+2VkOObjI9G6w7dG:gj+9UuFLToIOuQlVk29MdG
TLSH
T149928D366C284D7359E39695F58B3A179FF4417BA6C63F84D1ECAF0C01CBAAC6346806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad6d85a9e43c062b61d55eabdd49ed0d0485e8b7805fb4dbc502810a437fe17e
MD5 470e28bcdf21e969e17b21c9ae8cc4aa
SHA1 28356b7cc7f8c2ebebc6c9599aa5e30a4141d066
SHA512 1a511ccd7c5ee2153cdfbfbabd1d1c785d60bdd37fa9a197aa26b608a7ce0a95a648353bbe9951cbbda071cf11868ef4c14ab5b10af3c66e5658967654b2afd6
SSDEEP 384:4riFKtNn/s3n9SlxsNE8TUNTUlIRY6FLGHFHOa9yO+TQ+2aPkOObjI9G6w7dG:7FKj+94Rwg1FLOPIOuQlaPk29MdG
TLSH
T113D228F248D78976D9AE8747B77E2E178EBCC067B5852A50B3D85A0CCC871BFD206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d8dc9dc84416945a85c6424b8d84dfa4b1f7378ba1e2735222aeb048b4d3cc46
MD5 9a4efcc3b6fcb32489f32dd99f41bef6
SHA1 9efe5f2e8d9d67760edd442c49ded2017cf8afd9
SHA512 4ca6384ef83877977bf67966a19071732efbdc59ca84e275497c15d4e138ee3cfdf10883eeb64d2603097d32dcbcae2119a87d1d8a968e9bbfeaf2f1a1143142
SSDEEP 384:4riF1tNn/s3n9SlzsNc8TUNTUlIl7PFLGHEWla9yO+TQ+2KkOObjI9G6w7dG:7F1j+9GZwg9FLgoIOuQlKk29MdG
TLSH
T1AEC218F258D78976D99E8B47B77E2E178EBCC067B5812A50B3885A0CCC871BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6574ca00e6b645a4dc9199e5501d476686bf17d61da773442e7427cd581343e2
MD5 a36be6c8942d9b6e90666b8511f102bb
SHA1 3a4c3e69787d3756f4178e784a2f8eac11a5971f
SHA512 8526da393f77ad482c36b1719d7d68340fd9d5bbfe9d1ea24d076b1038f25b6c6f75b170f62cb7a5db54af77e2953319cbc75c3a5e0636c9e921d3e26b3228c9
SSDEEP 192:qONT6O7+3hQmiUyQoQGttb0zO2bH3gGexU6:qONT61TGt9yO+LSU6
TLSH
T15502F8356C686CB75BF2AE05FA8727275FA5103BE9962F80D6E85E0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1a39b7d28cbf63b2c9fc43b6d9c703437634ffccfbb8aa6fe04f4f460aff22e3
MD5 ba4a1eb54b04ef653f6cb859618713de
SHA1 ce319d5289fb75a87d47852cc6095d4d6a43cc0e
SHA512 280d00a7a01b917f2a3b4d3167cb73b92f9ef7d0b517d311bd07f11e4753dfdcbf5bc8d5c9af9c37b431285bdef6385165c856c930b2af0ba1a01da62ddbdbb3
SSDEEP 384:AltNn/s3n9SfsNU7PFLGHEJla9yO+TQ+2VkOObjI9G6w7dG:Oj+9UbFLToIOuQlVk29MdG
TLSH
T1AE928C366C284D7359E39695F58B3A179FF4417BA6C63F84D1ECAF0C01CBAAC6346806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5294ff87898a598d02b189fe6a172445bdd0de25f0798fad85a2a3fcd5e54371
MD5 d90393df155fcc070663d6a29a5d71f3
SHA1 80377dc8e1505a0c0fe40b19f44ebdb4eb233932
SHA512 145ecdded4dcbe1786ed10ebfd69d23d181e36de33b57caef5f9ab9fe1658b82a10abc132e09c1bb606ee55c167eb07d86e780f00674a606ad8826e30aa24427
SSDEEP 384:4riF+tNn/s3n9SlxsNL8TUNTUlIlYPFLGHFpO+a9yO+TQ+2ckOObjI9G6w7dG:7F+j+94kwgyFLCOfIOuQlck29MdG
TLSH
T1D7C218F248D78976D9AE8747B77E2E178EBCC067B5852A50B3D85A0CCC871BFD206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c094eec4147ff487a7d2a22ac28eab524ce657252e46a291e6f082acc2b7d413
MD5 4eb53e8651e4fa19b20e3e856f0162a8
SHA1 43bb6de285e0097465403d7f67f4bd7d26b055ec
SHA512 2787b5719037f73708125f750efee93e0a40e780a4c05253aa3ee02fbc4e2f89be1bbe2ac0a03c334a3a5add690e97bf72574e4cdb1d05c45d7e63aef5afc555
SSDEEP 192:5ONd6O7+3NQmiUyQbQXttb0zO2bHTQ+2McN+qRyU6:5ONd61YXt9yO+TQ+2lkU6
TLSH
T19C122A36A8689C771EE3A540F98736579FB50127EAC67F80D1DC6E0C01DF66C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 652f72b25105798a1e7cd4830b7d2857310652faebc7c329d143e15a1e10fdee
MD5 1ff82d73b99cd0c3622c51dbbcda6602
SHA1 1527c67beb6a220004e9a4590eeade781477109c
SHA512 6a51c9d59b1c597aea5055a82a37d656755765026d9d870306d86841ed37ad2fa7f6c3edf0f5b72543a11823ece2da0012c7389190d7494afc9abd078bbb7276
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bd93d59bccc89e199bbffba52790adab6b355b8d05056ca0640df8939fd69851
MD5 d093fda8577e62326128ffa5e790e6f4
SHA1 8a4ddca567471be39705ec5f3b711ffa45e7d653
SHA512 d8269792658acc94690ec0297af99f32dff1263d3acfb4829847808335edb8130de7c09a681fa4994ea90631692fe3ebe70b7a93a7baf046570c6db1567c61c0
TLSH
T1CFE00242930040ABC0AC033004D72B693B77C026438343478F24417C2C61B442F24D80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2e8da93a714cd7221de5a891a7a0314ee144accdf1c425cb1819fa9a0975a460
MD5 cb00efb89badea98e596e47ed29ebebf
SHA1 f39e7b27b3330f77a25a4be1816772679a0be903
SHA512 69d5b3ecf740d6397ee1ffbc9a2cd5efd426731e223960c901975c7151b00fa28be5b2943d372fd41b3ce569c3d35ccb46034e4bfff09ae694bc1fb70cfdb4c5
TLSH
T1A9E00942930040ABC0AC033404D72B693AE6802652A3924A8E2541682C63B452B34E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5aa385.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aa385.TMP
Size 392B
SHA256 36a7953641dbf621f4ba68474362ba4c1d60969648945682a9bd8134e8f9e27d
MD5 67a74c2fe3965abdc5252ff465ac9540
SHA1 f85660ab261213322c7c5291324b9708a869af62
SHA512 4cf6b1230df77ce4e0433119e32e4dc09efc6acc4972ebeb3ee6239243b0c4d49c751bc68b24ed282b46a9447eabdeb7b6f114e13874cbb8fc89002e4dc93590
MD5 SHA1 SHA512

Submit Download

a465baf7-1ce9-4c96-9e29-89ada74a48da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a465baf7-1ce9-4c96-9e29-89ada74a48da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bb41d1dbbab1e0f7ceabcc7c270a0f4508c7d4533448234d57bab64f408bd31b
MD5 d5836dc99a2a5c9aad3118d420dd9ea2
SHA1 e3671f89a65350859308964592b2c055bea0c885
SHA512 277d27aed0bf66cb9609fcbb2575ebbe595fe1c955b68108fa7865e64e20f21bed805d21bbc80e80d808a8a3a2a176d23e55f2080681762fce078fb2176bf3da
TLSH
T1E8411858B6EA1148B3B36E56ABF7B8AD587F78373E0AD55D00010E4E0637A40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/180-776-0x0000000000010000-0x000000000003D000-memory.dmp

Download

memory/1740-777-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/3516-796-0x00007FFA823E0000-0x00007FFA82432000-memory.dmp

Download

memory/3516-797-0x00007FFA81570000-0x00007FFA81626000-memory.dmp

Download

memory/3516-795-0x00007FFA82220000-0x00007FFA8233E000-memory.dmp

Download

memory/3516-794-0x00007FF6A5A50000-0x00007FF6A5CE4000-memory.dmp

Download

memory/3516-798-0x00007FFA823B0000-0x00007FFA823D4000-memory.dmp

Download

memory/3852-786-0x00007FF6A5A50000-0x00007FF6A5CE4000-memory.dmp

Download

memory/3852-788-0x00007FFA7F320000-0x00007FFA7F372000-memory.dmp

Download

memory/3852-790-0x00007FFA81340000-0x00007FFA81364000-memory.dmp

Download

memory/3852-787-0x00007FFA7F380000-0x00007FFA7F49E000-memory.dmp

Download

memory/3852-789-0x00007FFA7F260000-0x00007FFA7F316000-memory.dmp

Download

memory/4456-780-0x00007FFA822C0000-0x00007FFA82312000-memory.dmp

Download

memory/4456-782-0x00007FFA833F0000-0x00007FFA83414000-memory.dmp

Download

memory/4456-781-0x00007FFA82200000-0x00007FFA822B6000-memory.dmp

Download

memory/4456-778-0x00007FF6A5A50000-0x00007FF6A5CE4000-memory.dmp

Download

memory/4456-779-0x00007FFA82320000-0x00007FFA8243E000-memory.dmp

Download

memory/4960-801-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-805-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-807-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-808-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-809-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-810-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-811-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-806-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-800-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download

memory/4960-799-0x0000020B64130000-0x0000020B64131000-memory.dmp

Download