a112caf081cb3ec2fdd146ac063e85ea8e6bf02eeaf2e94cd6a0bd8c8361a718

Analysis

user interaction
yes
max time kernel
48s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KanvasLauncher.exe
Size 8.4MB
Sample260722-me5cfataja
SHA256 a112caf081cb3ec2fdd146ac063e85ea8e6bf02eeaf2e94cd6a0bd8c8361a718
MD5 47c23ceb02309363092de718f174010f
SHA1 cb1ecb1d610e893db0e8537d1c641841456e6cb0
SHA512 72c30b9691cbb26f3329f3781fb42da24a45c9d21bd437dc1a7a204c46ef818816c0843170256eccc21b0c4bd9d2a1d56fce2243bcd35a4725012c1ce0aa129c
SSDEEP 98304:KUmLAOGCRzOWOrL9qBsEoS0VCb4jABpACNfT0NBv1isJ9opX:hIArxOsCmAPdAi29opX
TLSH
T18396AE1073E85B27D6AF8772E0B0841167F1FD5EA362EB0B2584B6AA1D73B805D113B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
102	124	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanvasLauncher.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1300	msedge.exe
4624	msedge.exe
124	msedge.exe
4120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291894416263661"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{5C128080-488E-4816-9FCD-1334196E18CC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 1300	4672	KanvasLauncher.exe	89
PID 1300 wrote to memory of 4624	1300	msedge.exe	90
PID 4624 wrote to memory of 6036	4624	msedge.exe	91
PID 4624 wrote to memory of 5416	4624	msedge.exe	92
PID 4624 wrote to memory of 124	4624	msedge.exe	93
PID 4624 wrote to memory of 5416	4624	msedge.exe	92
PID 4624 wrote to memory of 5416	4624	msedge.exe	92
PID 4624 wrote to memory of 5404	4624	msedge.exe	94
PID 4624 wrote to memory of 5404	4624	msedge.exe	94
PID 4624 wrote to memory of 1348	4624	msedge.exe	96
PID 4624 wrote to memory of 3276	4624	msedge.exe	97
PID 4624 wrote to memory of 1348	4624	msedge.exe	96
PID 4624 wrote to memory of 1348	4624	msedge.exe	96
PID 4624 wrote to memory of 3276	4624	msedge.exe	97
PID 4624 wrote to memory of 3276	4624	msedge.exe	97
PID 4624 wrote to memory of 2104	4624	msedge.exe	98
PID 4624 wrote to memory of 2104	4624	msedge.exe	98
PID 4624 wrote to memory of 2104	4624	msedge.exe	98
PID 4624 wrote to memory of 6032	4624	msedge.exe	99
PID 4624 wrote to memory of 6032	4624	msedge.exe	99
PID 4624 wrote to memory of 6032	4624	msedge.exe	99
PID 4624 wrote to memory of 1324	4624	msedge.exe	101
PID 4624 wrote to memory of 1324	4624	msedge.exe	101
PID 4624 wrote to memory of 1672	4624	msedge.exe	102
PID 4624 wrote to memory of 3392	4624	msedge.exe	103
PID 4624 wrote to memory of 1672	4624	msedge.exe	102
PID 4624 wrote to memory of 3392	4624	msedge.exe	103
PID 4624 wrote to memory of 4244	4624	msedge.exe	105
PID 4624 wrote to memory of 460	4624	msedge.exe	106
PID 4624 wrote to memory of 460	4624	msedge.exe	106
PID 4624 wrote to memory of 1392	4624	msedge.exe	109
PID 4624 wrote to memory of 1392	4624	msedge.exe	109
PID 4624 wrote to memory of 5836	4624	msedge.exe	112
PID 4624 wrote to memory of 5836	4624	msedge.exe	112
PID 4624 wrote to memory of 5836	4624	msedge.exe	112
PID 4624 wrote to memory of 5248	4624	msedge.exe	113
PID 4624 wrote to memory of 5248	4624	msedge.exe	113
PID 4624 wrote to memory of 5248	4624	msedge.exe	113
PID 4624 wrote to memory of 848	4624	msedge.exe	114
PID 4624 wrote to memory of 848	4624	msedge.exe	114
PID 4624 wrote to memory of 848	4624	msedge.exe	114
PID 4624 wrote to memory of 5336	4624	msedge.exe	115
PID 4624 wrote to memory of 4220	4624	msedge.exe	116
PID 4624 wrote to memory of 2788	4624	msedge.exe	117
PID 4624 wrote to memory of 4152	4624	msedge.exe	118
PID 4624 wrote to memory of 4152	4624	msedge.exe	118
PID 4624 wrote to memory of 1372	4624	msedge.exe	119
PID 4624 wrote to memory of 1372	4624	msedge.exe	119
PID 4624 wrote to memory of 1372	4624	msedge.exe	119
PID 4624 wrote to memory of 1608	4624	msedge.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\KanvasLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\KanvasLauncher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=8.0.25&gui=true
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win-x86&os=win10&apphost_version=8.0.25&gui=true
    3⤵
    - System Time Discovery
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x274,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a0
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12749135114275171280,8752729437249408664,262144 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,5917423676489144736,7064033254572091436,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,11701597491716677937,5401935574307158569,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,10069303838444394167,3671180996734911935,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,13928805905899549118,8917499960280324943,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,15580371184423607744,5153775365439923939,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,15229900455083520526,2782575360807668242,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,10847352583003157734,5727012592312074500,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,13246737926752131535,6014606277408511517,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,9912213638921036105,16003607163786269842,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,8601309837909084369,6940776478312074936,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,8601309837909084369,6940776478312074936,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,2210820957362266240,7340511835712356627,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,4391540903604439037,14400324798162161548,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4316,i,3377074042485867242,15451031783561224344,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5104,i,10912890941085777653,5110821060963549024,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6092,i,5720672252843807499,14609878773895109580,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,1207423126369033779,15977813608372514844,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,14574000836275619172,400350459959678563,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,9726076235120595180,1883186791379480411,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,4513920743602663237,2005888714356956349,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2692,i,17191943315141426284,2304778751427736565,2097152 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,5394373249779155506,9015360704313094125,524288 --field-trial-handle=2264,i,5633260097255550784,13337059692469963191,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a0
        5⤵
        
        PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1799729763731900845,14956576031988262823,262144 --field-trial-handle=2284,i,2295778512972505693,5058672600522525916,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9982144683810947330,6342504005116848990,524288 --field-trial-handle=2284,i,2295778512972505693,5058672600522525916,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,928513774476634168,3269103129146203302,524288 --field-trial-handle=2284,i,2295778512972505693,5058672600522525916,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:13
        5⤵
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,7813674161824334825,1733554652362360202,524288 --field-trial-handle=2284,i,2295778512972505693,5058672600522525916,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:1048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,7813674161824334825,1733554652362360202,524288 --field-trial-handle=2284,i,2295778512972505693,5058672600522525916,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0dc26ad44dc5175e061a2d08aef5a91589a8ff9308a2ee8ef343ae37378c795a
MD5 8c6f4ecbbafb6080d9318e41a59a3fa6
SHA1 77cf1a954ac28102cf4a796250fd3f19af842609
SHA512 da28d7e2e461d8a24e79fa7597d29f9bd997bd1c4803b09831282d99c2793f47709105f2c43ea8adf75be392fa5309c3cdde87f45e9a9e724d69acb11cd60946
TLSH
T1E2D02325762D7DC5D335103254704702F6254553379686066355C40E8DBE4C677D7F96
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 698557b87fb5b8158683979bd4792e59020d62c5c07778c4389780ba2769b5a3
MD5 0c9a9e6272dc922162ee5f9b0760c2e2
SHA1 faeb2d51e7b691f9abe31657b0a4664499d34fcc
SHA512 d3f842fffb62042d421bc2096bad3e021450fc6168c60c096c81fc01b9b9d841286d64b6cf8f8579e038190b214c4e42fd232607260ab9d0bb4af9fbc9535b11
TLSH
T15FD02334332C2C41C30330312010C313B351C2013605C4224221800E4CBA0C52BCF942
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a672b7db87455f172a57be5b94928a5b9a0d593b6470914eaedec74ea980d4af
MD5 bc589b97848a5161cd3daf5a6e44c3e0
SHA1 dfd0503094e6c23e25ea0a7282d3f08e9eb15dba
SHA512 a48936ebb6eee4a9fe584ccff4a89b8914035cad654f68557e3c90a8a3e9fd2321f54692f6b710677a6e49c88612aa000a8eec8b6ffa57cabc591404f1402827
SSDEEP 384:kSebW/9bH6etQqAGgKVGgXb0W0LC5Fja:teKVaAQqcKcgX490
TLSH
T10F13F83E37294C86C6CAA0FC292B4B717775F039DAC056270B763C905E61FAA19CE097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 30bebff8c93c0195006dbd1097fd764761180918d7c29f33cfe1394ade7a075d
MD5 a3b2e936236813ed42888bbf312356a9
SHA1 845e219b4530409c3beebbd8d6dfe5f8f0997d0e
SHA512 cdd9621c83785e7ddf178d92b906a04e2e1134f810279c6250d04a8240f68d36818a5bb9a8c713253f7b1068cb64cabbf8b7d5f38419710640d3fc191f1cb4ad
SSDEEP 1536:Whh16L/yEL/V5ScGvCcNQ3xUBN0VWt4MkRmlU+eRHs/DPL/ZL/PQ7:W/16L/7L/rScf6bWWt4cRL/ZL/I
TLSH
T1784450F74951A00BCBA852F5E2133A3DE17B451E7CD1F8E9E1784C812C66F21B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 b75f7c78d7464ea1d0eff43d64c5836e5adaba0a51fe54a34e86954bf2fcef1c
MD5 92169dd5d6fd4287b6b3fb818443e103
SHA1 d10add02ab33fe15f6c680348ae5d2a5bbc05c8f
SHA512 47c7000142412e6fee670a5caaa72aa70d9ae899647709682ab37a463165c6730b4216f259e848374609b1c16cd26785cd24b18b50a19e13c05bfb8150a33196
SSDEEP 1536:2i49G+PNaMuAN4go7cWHh7d797H7pCC797b7q7I7BDz+Sy7rRel7f07F7x7B7gTl:2v9G+HN4gsH7C6ndoc+0mn3ljDkVnXR
TLSH
T1B32528EECB681C82CE6B8770B0E0E9077E712183B64DD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 23794c008d6f432944ad8d7a02c7ecad694b3eb1a1452604750aa4738ca4d65d
MD5 cbbfa456e09e3adc3cf28bed59ef52cd
SHA1 91fc9109f8681f4b87fa3543c2b8d94cac11914f
SHA512 a05cd266bd0ac5e7ce1df0f48f0e821b31b87c76f2ffd237468ca97a3e5f1467044a68ba7fe0aad1a22184bdde932dc81e313d4ff080c8c3e0fc040829acd71f
SSDEEP 24576:WHBbYmf9MKbaLt1NG1lQQ2XcKX+JbTEZVP15+gt2cq5k/EaHQfi:WhbYKMK2TNQtKX+xa15Zq5k/Eawq
TLSH
T16F166DEDC9785883CD63AA70B4F0E9477C7413C3F594C1E6889CC584026BBC5BBAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6c32f881e61c8597c72e5233f0b6882123689a52c24b4fce85ead42c7d8eb9ea
MD5 9b89c2828e1d233192cdd85094e2c24e
SHA1 29bc14313f321060586ab626c9e193a534bd550d
SHA512 b8c5bc8009f1e053712adde332417aef2c89ee8cc6e5d53e4eda2079d1a9c117750bb5dffa59ca37d7a7494d90d76db8d08e9e3ecef82386f890b339c1f82342
TLSH
T19B71D7E713A209E1D72085BBE0F5245632F0A4890E7F6E018B3CEE349C56F1891F056F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 018f825d8406846787f752a0c36151936746d5f01182f4279b2bdf45ebe0dc53
MD5 52b8b043ad32ba07e2f3bc89170d05b9
SHA1 59c13cef3ae5be42558ed18e8ae3a2454537cba0
SHA512 2a71305cdac722c298f821141585e329886512ca474927b90e9caa7e971d78a35dafaa25afdde583ffd089c8f0ab16f9e32393a227f95064a3fa898d799165d9
TLSH
T1E96184DB072209E1D724967BE0E6245636F4A4954D7F6E018B3CEF745C46F18A1F092F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1231.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1231.TMP
Size 3KB
SHA256 693b9ea2de71817b08cb23fd2a644ebed3e267c6a08e04e8bf7cd77229b1d9c3
MD5 9095f40ebc1a599be105bb394fb3a2c1
SHA1 3034826d8a7d52ed070d59619ee79c5066c25a09
SHA512 7f975e99df6578bd73c8110895b900798850d876998269235a665489401a5eb7b4c3ddfbec3c719d98696b261d76a252e2991872c367e7a082dc03d3b2a09050
TLSH
T1FD61A3DB072209E1D7209A7BE0F6245A32F0A4994D7F6E018B3CEE345C4AF18A0F052F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c148530167ace7a1c33d15084b72c6e2780743c5a65c3c923ee660b3e2f1a5c3
MD5 b9d968905b4795c1cbb19862afb7dd4a
SHA1 5f94c47f7006083eda66d891d1b0521df6ae3d0e
SHA512 ab1eec1f5771c88a2fc6ef3d5cedea96e00a8b82198f3ea8c9fe539572dfb2f9f4a14d7119621c3cef2f71835de8b3b59a723ebcd25206ded83223d786e88a5a
SSDEEP 3:MsEllllkEthXllkl2zEklN:/M/xT02znN
TLSH
T1FF440455FFC44445C50011314033C3501370D4101F51574334710413DCD75400C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ea556a9f78685c94d5785ba067c2647d3dd85077fe59cdf0231537dea764ee91
MD5 dc0b74966af750b81ef0ea004f3d8091
SHA1 c474d8bb427340eab742e8683469f8b2da9f1e47
SHA512 e4efdd0c804f899307951d1fe363217c6b3883af728d4a3c702d81603210b65a622a33c4b293b10e43085685588cb77805ff5ee461c7b1ded73a14351957dddb
TLSH
T12BE086D404C9C13AA96478D383BDB348C3E6749AA6D839523B4E88587101645A3AA296
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 716328340f6fb7df2aecf890def50874e464b0d31a2c5884b3454ade15989537
MD5 7380351857aec69c6cd6e2849dcfc6a2
SHA1 4a4f783aed3ff4107982fd4867c40fc728f98a43
SHA512 4309ca4ffdfb22ab676a03faba8150bb72bf7afbfff64a0494ef225c1a5a218724fe4199727b5295bd22de7dd965ba7861d2a04fdb04996fa0f17c2bc5c10e62
SSDEEP 96:6BCxN4IOUqItzIno4Uq60uXl87A307BYT+QP3IOUqRInN4Uq5j0:waIj7A307Bix+
TLSH
T165926443EE70B403DF101A77276E9079C73BD11A6F8BDED43CB54050D8B22D7A0622AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 3633a8146409fc7a05d4ef2b1481b163d9e12169372d9942b1b465db32aee04f
MD5 3483cb1ba94576caff6ace4e5e997262
SHA1 6517032f36ae407714da19b6bd3cdb7c0197a63e
SHA512 54264693951e33093ee5888330c302383f226379d7fc621afa35837031882531c340b1e1742acdc90cf1e4c66d00d54b0d4feece00777b688bbca7020ca4cd41
SSDEEP 192:km9g8F8LyJaklH+bF+UI3iWGVoWN3qL/DAVVV63:RjlIkUI3ijVoWN3qL/DAA
TLSH
T1EB24324F9F703212CDB851361AEB44A29D7EF03F8B4266D96CA10464DEE3692A01C5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 686B
SHA256 0252900465f4396db23ef2e6a172a98501cff8bc3fa97b91bbdbd9131d2e268d
MD5 9613acc17bc30049038e623d7a5925d9
SHA1 abca04256c4e3ce3002c21bec9c5819845a31149
SHA512 66b0ead0d83c2843364295b305055c7fe7882ee153e3e1459f7b6ad1b3368cb93214a01112138bc97c33adcf98573963d9bb6634f916db317d435923de8f06b5
TLSH
T15B012BA7E00CCC37EF00B3824B54F574B75B7B6A6B98E3EC9499D10484271D895014F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 7610933fbbd14d385c477e458bc92dcab5fb6f35e8a695eead8ba83682ff9109
MD5 c19260d4dbd82c55da00e4066d48acca
SHA1 a508cd5e89e9cd617ebd3f2a81b54f928758a25d
SHA512 9264a2d305cb03f57332dbb940d47a300c9482e882afdc3f5e872214cead89f08a6e2baf42ea879bf825d8274328f5567492d28c31b22192730ad28ad4ffa8aa
TLSH
T12EE0DFA444CDC12A6214B08B82AE770CC3E13547E6C83AA25F0DD889F442008A3AA2D6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 4a34af21740f78fb9957d82dad45e1ca97a8f3efba6588338f770522d45fff95
MD5 9d7159b19993ef95917691f588c18bcc
SHA1 d850f79738c95bf6e2035619a06f75a2a49ea018
SHA512 e0eb6b9658a825a63af1cc5e403bb460949e47e0b35b0e515f51e0fc64a32cdc87bbbd1cb27d2c88dce6061a7f10895065c59787277e0f73f399d71f3f0290ab
SSDEEP 96:qDeMatha9Egx9k8ziF3mncmUmS3ltGyg1vZUGknrA9rV+:qDLaTal2oel4DPU4V+
TLSH
T140B2B60E4B283152D6E62B33EDE0C4627D6C510F675B97D998A8A0B18C737DEBA1A071
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1798ffb35815786e1cf580aa260f28e00926f4bc2d4a1ca099811e9bc1ec5369
MD5 f998a9759f0b516061045da492c6986f
SHA1 2c88c9d4ef9846a687cf042857f42aa38966a2a6
SHA512 659d739eb5de802478571324b1968a6583b3524f9ad8f39de16c15efb864e595da547599fc3ed117f4c7bd6dad2eb7f79e55cf806f72a83c04c804d050c91839
TLSH
T19E718EF787F4856E8A0196F09A18AE1FDF2D0615431C7C6A89D4EE27D3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5c5fa73f18f093fc73343a2b3e783825d9017d87c8bdeb8c92f687727f7abf7e
MD5 32f9ba699fd7b137d6f07cad49d459f9
SHA1 59c1ee2ff16d272aba3f5d5b1b1b1418b5a13c66
SHA512 ba4700a3a16dd649adc4eae229c7f860651007bf127911148b76d59f268299c7aa4f77387daa010b49dbf28949a7a1576e6524aa4fba9b5380d064a6c660a207
SSDEEP 192:sxRwR2Cg/fTsnOBaZESzoA8pi/g6+WNIYEB39Gtc3IgV1oJ:sxRw7g/fTsnYMMi/5IJYow
TLSH
T1BC32B7166E28993B5CCBD21DFB55BF53D6F96032A1902E48AAFC8B1C04E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 546a4dbdb54220c3ef54df08788cbe877d6131e1edaedce444ccdb5e9b4513af
MD5 1ab1c8fb13d4d8f418875da110ffca9e
SHA1 b38f321ebaa3cc46157362b071f569597e753561
SHA512 e049192d9f3bad63d47021f7046de0a11b2b44ab526f0a3fd68608617f1c9f70c886714f453bada2f89dbb60d37d1c13aa5afa41e50abdf5d8746a55da3890c6
SSDEEP 192:sxRbR2Tg/fTsjPOBaZEJzoA8prnh/g6+WNBSw2lz/AmEp39Gtc3IgDf51oJ:sxRbug/fTsjP4Mxt/53Q/iYoI
TLSH
T1F042D85A6928993B6CCBD219FB15BF63D6F9503291912E48A7FC8B0C04E77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e3983466ddcfa99e7483265653c427aea7ef795eda9e2dc1a03c58b1d53874f
MD5 e16cdfe9508e737fbbc048e14f51759e
SHA1 69a70edd636bed9e643abdf1f6e4d7dd6ae76481
SHA512 b6cda89dbf13fd874db66f3bc9b56d072df92e690906ff26d2abe694948c0df9b86a0934ecaa3ded7780301a95503506d8b04b047e0c85b3fa8e28b36f2abd96
SSDEEP 192:sxRbR2Cg/fTsjPOBaZESzoA8pi/g6+WNIYEB39Gtc3IgDfr1oJ:sxRb7g/fTsjPYMMi/5IJYom
TLSH
T19932A71A6E28993B5CCBD21DFB55BF53D6F95032A1902E48AAFC8B1C04E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2b6e4b98a432026ffc5b57765ca2f683cb3ba13ff18fe78082569919c5613771
MD5 3f7634a17e4dfdb8f3d5fbb06eeb3761
SHA1 e030dbc80a0772a2c632e29ae8d407697d2d3b97
SHA512 bc7c6289126cec583997167dbee29c8dfa8ec079f1ad297facf8e578e7c9a515d776cf14740178f704d89a3e8aaf7ea9d94bdd292e8897ce0bc17f31a2dc066c
SSDEEP 192:sxRbRBTg/fTsjeWpVDOBaZEUzoA8prnh/g6+WNyESw2lz/AmMD34gtc3IgDf51oJ:sxRbTg/fTsjeWvD4MEt/5HQ/S7oI
TLSH
T14352D9166928997BACCBD21DFB59BF23D6F91022A1D11E48A7FC8B0C04E77DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d1a38c68cfa92caa7db9340eab77e88c69bd61b7ebc360cb94e40b1d816ada9a
MD5 21801e8dc0bff81cd28f8293d55a29d5
SHA1 8430c075c36ef8cc144a466bd6414ea9ada08d80
SHA512 bf1ff6968443ce629c42a12bd2feeffac90d3d31398ed541939ac67e3f7829979759e110e6e35c45db7504f0e1fd09db3abb5e744fc3d9555b8d8f5f5f267368
SSDEEP 768:40Dk6DJQD83F7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKs:40Dk6DJQD83TE7N0DbWgQ6DjfIQDFu1X
TLSH
T134D2EB7B640CCB7F4F804ADDAD197A9E6D6802CB96D8C98047FE891C02C7BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 848718929db9da60e791ee6013ff4ae0b3e6822d0ad25b84b8d6cfb1a9519872
MD5 24aca58b67b31e822bb53e0cc6d2e615
SHA1 7483ec5ea9969addd02d7741e67e7509eef06780
SHA512 9d6127e5c31111729291e0467c94b5e15d3fb17c3fa6079b983b1cfaac396724d07800c2a0c1473975bf1408f46d986d709fab70d837a449b7b3fff50d3b2772
TLSH
T12FE026A026C8C1BE7029308302BBE788C3E97467D2C83E422F0ACC847146605B2AA294
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 03e5107d5aaa6392cd108c3260c1fabe3be05f65203e7c37ff2d847b92930cfd
MD5 c1f2c4e4b5426384f84faf3f8ed32cfc
SHA1 6a871685762081946580af0f897336df41fcbc38
SHA512 727f9c0d7221a6b37a25caf32197e9b4d4f28231382e7ae36268697ec1c7bb10a8c753cbbe76925972b2d728c33fcfb4bb035e51e1e106a3ead92c0c3e4b9c23
TLSH
T192B01287BF50511AC8CA4D770D849FC17710E05211004403C814CF159D1AF78AF01CC8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 0c1c72973a7af250ebbad738662b17d0e696d5a64f5658540ddb5e3a97ea384d
MD5 ffd93026e3348e15029afd821e30764a
SHA1 0a9102b3d94b552e1fbc86d7227ace37fad3d558
SHA512 929e8c8347ba5dc23ad5f608c3f4c9945605ab41caa15da7bd5491f14c2fd3d21db016ef25647bbe52a2f78b4f4b2f1b57a96e97e161120cd4926257b387ba7e
TLSH
T170E0DFA416C9C26BB15730CB42ABF788C2F37452E6D839622F0E9884B246140B3AB294
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 7cd34aad764081c4107154342f4cd9a65fd00f15c4e07fa5b8af2c9469ea9db4
MD5 77103cbb15561eaea979a5273766c970
SHA1 ff97e7f19104ee68f8e384cbbd560ee39db4410d
SHA512 259a387e314ce447b9b4405cf8dc2d7dbade8951df988ebbbdb0b105a1ef732c8a56f36950f97879112d8379fddec9cdcaccc2b0473f3afe63de902195729883
TLSH
T135E086B085CDC2BA6454B0C343B9F71CC2F1784697DA3A965B0D749CB101145B3BB5D4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 798a0ddca325acf411b850165a32a565c68fc22aaabf635025f17e9e37ad23a4
MD5 f34654e4844c452bcdeeb2fb844dcef2
SHA1 847c59b3c4769fc01e86f4f36c11ad22fa82e310
SHA512 2280bfbfea92c0e4de9ae567e9918a1f69b13bcf070450bfa5e0b33b1ddadb32d88b45800f4c904c498868b2ce8e42147b3aaa7d593547e759091e26220d5980
SSDEEP 96:KRWLa2Q44eWIdFgWeK4rgEec+W10m/ayEK3qW6cAKNaaWkKXKl:CWLa2Q445IdGWWrgEN+W10m/vT/CW
TLSH
T146A14840307A4241393D692890F5E82686C7B466306DBDAB3FE942668F6BE024DFD5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 231ac5875cce5554e997184ca09a3ee0cabcc9406918d3a3325b5ae4f91ce68a
MD5 f312c83245391eced55c2a625ee43d13
SHA1 af5275ddc0280ca30c28ee557bdd64a68ec44dca
SHA512 cf840bd85e7cd3c499e2d6e8224d5fc9ee89df8164ca5a47a962bd2610e2296e514d8e3ea1f6742a8408d151fbf1290b81dc4438b11b5cf564d7e24272793412
SSDEEP 384:DNrRZyCSDnxTIC7JuMEhIKyll7svbFKfk7:xFZJSDnikyI1l7svbF9
TLSH
T17B44750A7B747001EDE6D9721CB080771E3CB16E8F26A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a870e881-6d2b-4afd-8d7c-2ad95d2e7834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a870e881-6d2b-4afd-8d7c-2ad95d2e7834.tmp
Size 414B
SHA256 582adb65c28ec042722d6f9e0e7fc21b2d8dad4effa0faebac010814e43c8bc6
MD5 52e8a4cdfed477f17793578b3787a862
SHA1 5d69fcf6dbf71b9f21f7b5d231a29af389d17064
SHA512 2f3b261da5ba3e02d136fe17def2ecdf537a95a7a94768bcb6f6c8538c66f9a59899003cc91b705ea3cd801668df8df93f2fe57babe02210b28cfdbee9ab2d50
TLSH
T12CE02BAEC861EC2B18FD075C90540787EE4613576A81950F7B3E810C4FB46760686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f9f69331-e11f-4011-ab2e-b3adbe5eaee7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9f69331-e11f-4011-ab2e-b3adbe5eaee7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 16KB
SHA256 12b06442012d2c1a7f6e764e281c2672c33e2eb24cd65b496fa7d0e5d6a81371
MD5 5165c2331dba032388e885c166f4c359
SHA1 41f4952966d8f3273dec71fb4d0ff7af381a6bbb
SHA512 606312754cf2cf7a728296d4e06f360c435348be5b5658bd0832b256b91eefbbb71124641d1d11beb2fe4ae630bb2a8d42f3fb123945c55cb92378348428c76b
SSDEEP 192:L0Q3III2bGMIMAhYcYeKrO4Yi9As4l8+BustEHuY/K:L0Q3III2bGMIMyBDhRs6sstEHdS
TLSH
T15572B95B6B801773C65E6B36077AD244E6F58C474952A26C30A25C0EADF3EA7C1C17F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 007a9c6348cfcd1f8285a3bd2440fcb692b79bc86a670309cb9b9fa1f0d69c50
MD5 92596db1a7b0c1fd1901e127990c83c7
SHA1 11b66b8640a1dc248fcb1318dba9663b66c8805c
SHA512 2f8a8eb4ef96d8c5e1ff75553f9e9448997a06da54e9446dea6e179f72f775f4e8ec23f05463c9939a45c8a6c501af96ab5f696efe1b6f1f2de50478e851e4ec
TLSH
T1B7E08690BDD9C16FB03530C701F9B74893E27D87EAD839961F09C468B102544BFAE299
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 335a5855b35bb9b8cc9fece2c73d472bbadb620acb955cb70452e2db0955f102
MD5 4c43570420946af53fda59bb851b1d72
SHA1 137a28b374b058b4147899792cfb48f4503f6691
SHA512 937efacf37983f8627dca93ea4c90172be9737d7d3aa8694cdc8a744291686c83b85baf0bdcf20ac483080bc5e0767c9dd2d5bb78238cd2883fd51dce21f74e1
TLSH
T1F1210495F330C109E14E827A607A9B291378E4468FB9DC0F447920346EB2F040E4B3E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 915208df8013d067a886e67fddd3be796ba28ada6228c3f5ccb6904f4de50401
MD5 6a366efd4a01f3eb94b99de39a155674
SHA1 b510fc694fa103a421e4a2cb91f983778f8b60f5
SHA512 25fe0eb03e5ccba83b42946e256279555d0028b86254d0afb4ca4f63e2694c1c787f17f0535a6fc557f87cedc78c8aa199ad64ca7d483c3551baf343892bdef3
TLSH
T10FE04F90A8C9C1BFA03534D341F9B349D2D23CC6EAD83E561F09C868A501545B7AB295
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4a57c692138b11138fcfff4b010c834a23427e9003a3fb6e5b438c757b757fea
MD5 42f25d61773e9bc19e2fcbf10d2e175e
SHA1 dd9b82e384c6231c966e1e71ef6c4f02cd0a86f0
SHA512 0fe6060cd4a211dd0cbf5019078c3820952b0d5f16235926179f445cb9a9090e046912643fbf1601529d2e2485216899307b317db55495928c87fef7423054ae
SSDEEP 3:MsEllllkEthXllkl2zEelZ2sK1:/M/xT02zNZ8
TLSH
T13B4402197B845807C5141030422183501360D85006115B9324610C125CAA9400C00110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d6ce8a9fea3823bf8052ef6dea1b134705853e49d1d4a34c982278a1742b4e60
MD5 b87d396b6c69160bec049fc76988376f
SHA1 65ec0d81f35bcdff68cf0f867c8bbf4cd6251a74
SHA512 97e00eb124be28c7d3be23b28da4f469e2c8e5fe121b343b494f96bc06b0de7f2586382aeff6a6df6fe1d94927573c71b6f38a97f5b4566c700eea215e808494
SSDEEP 768:tj+9d39OyDTd+Z5BoeX6+qTko0u229a4vsTkaKRZSnIMjR:I9d3qjvVTVKa4LaKPSnIG
TLSH
T15E139D3DEC625C3F88AEB749720F266A9E6811B3C6B40954DBD96B0CD07356CF307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fb1639fbc9a0aa9689cf9e61e1b134b620d1501c80cf286309e783eeb4a86c13
MD5 e69c142b12c84cb017392216463ed94c
SHA1 6595b9688a5c40bd502062a3b87739c5b8ecdd6e
SHA512 cf61f6848f21f0abc4a716c88174b321a3b0d8cba18e1fe4d7573e8d0146dc7ea9260118b5c60aa1d8b177577fa6be70495fe8e920356e2c160cace341c4f576
SSDEEP 768:prv+4UNbdG3+6XDTd+Z5seX6+qTko0u229a4vsD5eVH1SdW:pbsbU3EVvVTVKa4kEH1h
TLSH
T1DD03CF32E86589778CE69789B14B75473EB91173CB880B90D8DD6F0D065B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 405ceaf98a940a5344a8f1b3710eea73fb14fafebb6761f695e5ef2f115f8fbf
MD5 5e127f827deba57df895609ff6e1188d
SHA1 20bd1da23174d31cc35794c88c43147d8d6a91a9
SHA512 6bacbdd57abc66fea3ac4e1294f3d17a78fce56ebd4dfe6f292f6e739bb173f232fdfddb9e044fd55c455051e65496187a456f1a19acc83f1ef95940502831d8
SSDEEP 768:Kj+9d3OIyDTd+Z5B3eX6+qTko0u229a4vsTIxMjR:p9d3HSvVTVKa4dxG
TLSH
T108F2AE32F8629D778CE6C68AB20B36979FB511B3CB841E9499DD7E0D018B17C530792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fd24b4e277a887cf947ce9a4a406aa5d5afba1d35c83033f8a7464ab20e123d2
MD5 4250ee762a5cc85f29a98a35723ab6d3
SHA1 ef7bf419d28b921b5d83cfc224972bc4697629df
SHA512 68574751bdd722e3db4042a0f5c5cf2e124fb7fcde41b04836af743625095c10272079507b95523cd2c9c62fdd2a048d0be02c09692963fd5289c1525ae464ee
SSDEEP 768:fj+9d39AyDTd+Z5BoeX6+qTko0u229a4vsTIxMjR:S9d3cjvVTVKa4dxG
TLSH
T1D9F2AE32F8629D678CE6C2C6B20B36579FB511B3C7881E5499DDBE0D058B67C130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 03966986b2dea885ebf45ee60a32828f675e82cfb54e6b5c772050ed77036809
MD5 4f24672696923c12bfbfd9eb91b10e04
SHA1 0a5a25c287225fbefbe3ee22f7116204f9ae4085
SHA512 7d674e750a214cc0988a21e7bcbe72e2424693dc948507da1ab56920b67d3774e374d4b20571eeb0ee85c73eae0e5e9460ec6fea0c3de346100929550c8dfc45
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3iscQQtydZIzcQAJmq:TL+j0afDdWec9sJVUOjJ2Vjy
TLSH
T17B920222B9311073ECDA4776BC5349D00EFC166EC9A7B9148DD44C210DB1BD2A1451FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a2e44670131adfb4f2fd311aa9760213a58f1d08f4a9b9d1bec19b46be0c73e8
MD5 78a2644e00a3e42391ffc8558a6f0990
SHA1 c280e81814d29769f345c8eded3267c7f99e8b68
SHA512 dda3818d0d22fb4e81fa2616299e25969ae9b381db2ee59f6c724f47e8836e39956b69b4029c7618d3f1e3e7189b52e6bd8681007a719d4695d830f6731b7002
SSDEEP 3:MsEllllkEthXllkl2zEelKC:/M/xT02zNKC
TLSH
T12344041D7FC41445C51410304035C7511771DC1407115F53757104135CD77C01C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

730fdc31-ee33-42dd-b965-5d45a5c4ae79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\730fdc31-ee33-42dd-b965-5d45a5c4ae79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_1537899803\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads