a3a162f3056f2e74967df54159a206536585219e8ec5c59c8f8d85c60f610642

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ea329f0dbdbe790125a6c8c1b77b65f4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 37.1MB
Sample260720-kdb86abv8k
SHA256 a3a162f3056f2e74967df54159a206536585219e8ec5c59c8f8d85c60f610642
MD5 ea329f0dbdbe790125a6c8c1b77b65f4
SHA1 f6bcad061ab1247034d87a67d23e55a60667aedc
SHA512 5b1278fd850c506a2fb8972b1da59bbc871c244a8610034302d7cc2c06b6c765de133a877550df6c8113e05a0cfec3483e2e71ebfb93dfb7f27b83620bd2e7a1
SSDEEP 786432:cfz19YjQj+7+EcAlSZWQrM80f3Dd9MD+sNT1OMjP0E6IbS1ZcS:cb19wQjXqSoKMJvB9MD1ROoFAv
TLSH
T137873398C2D458B9D4A6E2F44953560AD77A3CC64771C7CF03B8392227B37A5983BB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1304	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290097487851597"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{323339AA-330D-46A4-A9AC-50588EEAED81}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4156	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4156	3048	2026-07-20_ea329f0dbdbe790125a6c8c1b77b65f4_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 4156 wrote to memory of 6020	4156	msedge.exe	90
PID 4156 wrote to memory of 1020	4156	msedge.exe	91
PID 4156 wrote to memory of 1304	4156	msedge.exe	92
PID 4156 wrote to memory of 1020	4156	msedge.exe	91
PID 4156 wrote to memory of 1020	4156	msedge.exe	91
PID 4156 wrote to memory of 5568	4156	msedge.exe	93
PID 4156 wrote to memory of 5568	4156	msedge.exe	93
PID 4156 wrote to memory of 2132	4156	msedge.exe	95
PID 4156 wrote to memory of 1248	4156	msedge.exe	96
PID 4156 wrote to memory of 2132	4156	msedge.exe	95
PID 4156 wrote to memory of 2132	4156	msedge.exe	95
PID 4156 wrote to memory of 1248	4156	msedge.exe	96
PID 4156 wrote to memory of 1248	4156	msedge.exe	96
PID 4156 wrote to memory of 2560	4156	msedge.exe	97
PID 4156 wrote to memory of 2560	4156	msedge.exe	97
PID 4156 wrote to memory of 2560	4156	msedge.exe	97
PID 4156 wrote to memory of 4316	4156	msedge.exe	98
PID 4156 wrote to memory of 4316	4156	msedge.exe	98
PID 4156 wrote to memory of 4316	4156	msedge.exe	98
PID 4156 wrote to memory of 5728	4156	msedge.exe	100
PID 4156 wrote to memory of 5728	4156	msedge.exe	100
PID 4156 wrote to memory of 5728	4156	msedge.exe	100
PID 4156 wrote to memory of 5080	4156	msedge.exe	101
PID 4156 wrote to memory of 2020	4156	msedge.exe	102
PID 4156 wrote to memory of 5080	4156	msedge.exe	101
PID 4156 wrote to memory of 2020	4156	msedge.exe	102
PID 4156 wrote to memory of 5832	4156	msedge.exe	104
PID 4156 wrote to memory of 5900	4156	msedge.exe	105
PID 4156 wrote to memory of 5900	4156	msedge.exe	105
PID 4156 wrote to memory of 5476	4156	msedge.exe	110
PID 4156 wrote to memory of 2460	4156	msedge.exe	111
PID 4156 wrote to memory of 2352	4156	msedge.exe	112
PID 4156 wrote to memory of 3120	4156	msedge.exe	113
PID 4156 wrote to memory of 3120	4156	msedge.exe	113
PID 4156 wrote to memory of 4388	4156	msedge.exe	116
PID 4156 wrote to memory of 4388	4156	msedge.exe	116
PID 4156 wrote to memory of 712	4156	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ea329f0dbdbe790125a6c8c1b77b65f4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ea329f0dbdbe790125a6c8c1b77b65f4_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\RarSFX0\- Manga Comics +18 - Affair Hidden In The Leaves (Naruto) [RaikageArt Sichan].pdf
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb1129c188,0x7ffb1129c194,0x7ffb1129c1a0
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14144535877724435383,14970068940130189959,262144 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17901732541189937245,10873968654655430133,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,7464519587122374983,15479612971868183932,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2552230790229786864,16661177942901867534,2097152 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12035611131759574527,14320202441087606177,2097152 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,15826162638781434307,533387825510344021,2097152 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,7370306648163657369,11156472986260928553,2097152 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5364,i,9459732057050263736,7112054858788974640,2097152 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:9
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,6117420930831824029,1296752831868912163,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,11833987432539137389,6387238043634925285,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,378015022098852793,11819436010260212755,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:428
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,378015022098852793,11819436010260212755,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,1281953752921496495,12936136030349530996,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,6180171536099510115,11745814024482034786,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17522930179850769052,15000311358905689089,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17014453128816206344,1635280544288665707,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,7219652589641748957,11577197251702951138,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,5018500279312563061,14930074482791623657,524288 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7244,i,4807345248490011667,5410121443045406964,262144 --field-trial-handle=2364,i,11823589558668869381,16747447445205831628,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:10
    3⤵
    PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c35d2290107e901f7030050330a99ee171271b867a82c490c406ebb202198a27
MD5 b30794b7b58ffe7d5ec02b5306016d2b
SHA1 4e34b581b01c7e8504eb045fccacce27befc0311
SHA512 b965abe7a5be1cebcffb54ed3ac786a1b126d64d2baed3641bcd2f4c0354344a7bd8d796c562c436f958bdb120c0dc0f5be78662323a7e28a77088343e9a5a09
TLSH
T156319CF7C3E8963D890196F4A6186F1BCE2D0955832C3D5BC4E4AE2BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e1632ed244daeac4626ecd579fa395553f58e4e1ae23b97d81393b3700e46a2f
MD5 8096890e8eacd300d064b2cd0eb78698
SHA1 2ff735e829a09e22f192197f62ca4c9ab92ebd9b
SHA512 470aac67e9ca3ee635a3cc4b3640e6f77df1a6808685f86413e1fe601479521e4eabc1e306081224cabd34021ca0502913f327ce2836fa90275dd43fd0746797
SSDEEP 192:sxRc5rC6/f+sLE+ZprQ59zoA8p4W/g6+WNIYn83hT+GUIgDUVJ:sxR6e6/f+sLE+ZNf/5ITRTGC
TLSH
T17F32A71AAE68AD3B5CC7D21DFB55BF53D2F95032A1D45E48A6FC8A0C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3feb9bfdf0f7b93d6016e5e13605a105bf946af214c0b1f0f3400fd896bcbb26
MD5 fe58883f2875b9e1b8aba932cd74edd0
SHA1 4a906757d18a68921c8cfa00ac2cd8db8f3ee58d
SHA512 64968ea89bfb1a4f00fdaef2678db18689991f2830ed5bbcf7b7b263a94cf1cf6a260f290b861044ee5329ce2163c6d7efe1550ef3eae751447422f4f4ad604c
SSDEEP 192:sxRc5rC6/f+sLE+OprQ59zoA8p4W/g6+WNIYn86hT+GUIgD2VJ:sxR6e6/f+sLE+ONf/5ITYTGc
TLSH
T12542A61AA968AD3B5CCBE219FB55BF53D2F95032A1D11E48A6FCCB0C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 86ed17ee8301c01260d509fe4b658d51ae4f981fcbf25279a7961b6cefdf88c1
MD5 f98d4f6e67efde6bc2f7e15d5b9f0bca
SHA1 04528d5aae56f7bb2896f39c5078f1f1d1a6a00f
SHA512 7ff61075a4135997f9b4bf07aed741a9ffeafbd1aae6548952e63a508c9cbbbb2499c897c60d849152c1e1992c2d679d58edd925181970859f5acbed2cbe3ea4
SSDEEP 768:wb8dFg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUu4Odrohsv5+:wb8dFsE7r6Wgouf6Mu1jatVOWyQ
TLSH
T1FDC2DA7B740CCB7E4F800ADDE819BE9F6DA802CB5AD8CD4447FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c87164bc-643b-4495-b831-a6fc9005143e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c87164bc-643b-4495-b831-a6fc9005143e.tmp
Size 11KB
SHA256 56cca03d701b1866bc8ae7fab350b1e15c7040a13b331f8176535a391138e16e
MD5 114b8c539dff9171bd997dcc8b396a1a
SHA1 ab9f186c34b25564004ea4eb817447d65f0db8c5
SHA512 7f965a5d9be8921d71cfa62c3a41a70e3f7653b0ad7ef6d56866eb37394982f6054290361512557500bc62e1913f5eb42cceda6fbedaa0bf611498bd06e2846c
SSDEEP 192:sxRcOrC6/f+sBE+ZprQ59zoA8p4W/g6+WNIYn83hT+GUIgVVJ:sxRFe6/f+sBE+ZNf/5ITRTGN
TLSH
T1D73296166E68AD3B9CC7D21DFB55BF53D2F95032A1D45E48A6FC8A0C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6ef7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6ef7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7a955cbeb12b4d5833d802a40f423ca07cfe2a1721d5a02c97eb589f1348fd17
MD5 fd7069fe22167fb3a3661027fb7d6412
SHA1 78beaf01a977fa50b5248c60db585a4008b166b9
SHA512 f822b163128754af00c896c1a7ab597d3593f440bf0c92e68a53483b6d528aa2d5f92086d836eab9d01d4d9ba35640c4ab943381bcd9cce7b2a3a7e52a6f0187
SSDEEP 768:5rv+4UNbdX34hyDZIO0mFNzc4ReyIsPCo:5bsb9344tc44bsKo
TLSH
T13E03AE32E828CD73ACFAA646F14776937EF81167C2C81A94D9DA5F4C098719E170F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 659e85705aa3c67a8875e43bf6921891225290e1ce473f021223fe46064b4d06
MD5 5da86faa3048118dc58b613a48ed74a8
SHA1 d329a7ce87b4b5c902672649eff18f92510ccb33
SHA512 fc5430c9e4e9a69342f13908e77462708afccde1c07ea77f9f8c1c37977b0a13d0cfc01fb74d1a3bf2db8fffa5440cc3c85530cb97626dbbeaeebb892fd94d8f
SSDEEP 384:nutNn/s3n9S+38Nie/uzOC5nsJDZNfNoXOVSUU/MXZXnUXETRzcoXfK86sfxEZx5:uj+953W4yDZIO0mFNzc4ReyIsPCb9MC
TLSH
T10BF2BE36E825CE739CE69656F64736967EF4117BC1C82E88D9DE9F0C09832AC075B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1bcac08cf92cb2ae588e2175fbdc3f15745fc1874de641ec0ec70312ce73ce0e
MD5 0bcb29f60243b0d74b4671b9a88ee8f8
SHA1 a548606330019e28a0b22b82e71ad2f4dfddd53f
SHA512 83ac69a6153b2e38f5bcf697c45fb2b38492a7ea929f1a5d9fc568f0f436ff1c7b53ec13f92f81349e4ea6978490747f596c78ebe29dcc7baf8bcb7e3686e7b3
SSDEEP 384:nitNn/s3n9S+38Niv/uzOC5nsJDZNfNoXOVSUU/MXZXnUXETRzcoXfK86sfxEZx5:ij+953J4yDZIO0mFNzc4ReyIsPCb9MC
TLSH
T18BF2BF36E825CE739CE69656F54736927EF4117BC1C82E88D9DE9F0C09832AC075B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 86276e1fd86c0c77a080d40aecaafc23c434a31fa14039b0bbe708cc015088e5
MD5 c9636962ef12b3be00fbb8de95a4f150
SHA1 e67610a918d21e9b33913c301f0991d984604e8e
SHA512 24b879dd39e6ce533ae5332dd20915ae8cb471dc55bffcc3cd3a2d3c90d5b626e54f6202fa2a0377c13130886299aee071ccafe25a4af880ed734c82f8e25fe2
SSDEEP 768:zF1j+9Yg3lwgD4bZQ5O0mnNzc4ReyIsPCb9MC:i9Yg3/utc44bsKb+C
TLSH
T149039D36E865CE77ACE65B86F7063696AEF011ABC1C86DD4DAD95E4C008329D074BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a517cf93b21ab041c283c9ad22956a5c054ecda8cfa36cb8140f089a46ac0f8
MD5 49d527dfa50394843a9b3079278170b6
SHA1 21aa3cfa083aa00739ffcb97cc3e80c84d37bd1f
SHA512 84ce0e15e09b4bc668d43f2a78d53658cebb721565a416bec23d3f45cfe9e327aa79e169ca8d7b3fbf60565786861285c64ce9eb5fad3ef5d0f1b5a6b647a6f0
SSDEEP 768:6rv+4UNbds3/tDZIO0ENzc4ReyIsXaeVH1S5D:6bsbS35tc44bsqEH1Y
TLSH
T15203CF32E8788A77ACF66686B14776533EF8912BC2D81E94C5DE2F4C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88020a4e-f0a9-4363-8f5b-ee129296b172.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\88020a4e-f0a9-4363-8f5b-ee129296b172.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4f067702-744f-457a-bbbb-499e21427a69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4f067702-744f-457a-bbbb-499e21427a69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

- Manga Comics +18 - Affair Hidden In The Leaves (Naruto) [RaikageArt Sichan].pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\- Manga Comics +18 - Affair Hidden In The Leaves (Naruto) [RaikageArt Sichan].pdf
Size 34.6MB
SHA256 b4524126383bd801f5e87f26efc58610a19962f23bd45b894b9d5a76f4b1db8d
MD5 71aee1be089034a1dda98fa69dcf5a56
SHA1 2e683b65d8f5ac60ae88b602b137e595a6d3cf10
SHA512 37e0fc866c0a152ad40c990e5641100e6cbe5274b124c0de329fd698a42a59ff0b7a058be5be6159b5d338d1ce88e320bf48e7aa17adaaba03adb584cd325093
SSDEEP 786432:EzDyilvLT3mzZvnduI89UTdQxh5HGA/b+BLgCu4q:EF+1l389UTytGOSJuv
TLSH
T1528722174C03CA27650EE4709B05324D2642582426E317766D3A6FBFF27CAAE9CDFDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads