Overview

overview

9

Static

static

3

2026-07-28...at.exe

windows10-2004-x64

9

2026-07-28...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/07/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe
  • Size 19.5MB
  • Sample260728-gprlfack2w
  • SHA256 c618e135af43dff4f2d33457f0cae98177eb8436e1c1ad4e5cc30dfee1d345c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3440.4928.3320780969804925781
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcbb4ab078,0x7ffcbb4ab084,0x7ffcbb4ab090
        3⤵
          PID:4844
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,7554712009004574018,1968918065675793617,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
          3⤵
            PID:2428
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,7554712009004574018,1968918065675793617,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
            3⤵
              PID:4812
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1744,i,7554712009004574018,1968918065675793617,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
              3⤵
                PID:4548
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3696,i,7554712009004574018,1968918065675793617,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
                3⤵
                  PID:212
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msSmartScreenProtection,Translate --enable-features=msWebView2EnableDraggableRegions --mojo-named-platform-channel-pipe=3440.4928.10049859554552506020
                2⤵
                • Drops file in Program Files directory
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of WriteProcessMemory
                PID:2672
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffcbb4ab078,0x7ffcbb4ab084,0x7ffcbb4ab090
                  3⤵
                    PID:2552
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1828,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
                    3⤵
                      PID:1068
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1840,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
                      3⤵
                        PID:1208
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2320,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
                        3⤵
                          PID:3952
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                          3⤵
                            PID:3340
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2216,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
                            3⤵
                              PID:2888
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView" --webview-exe-name=2026-07-28_0aa80693834e22ac5c284f04f6e84d33_icedid_mespinoza_njrat.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4740,i,14364579359968682327,5018514198377655098,262144 --enable-features=msWebView2EnableDraggableRegions --disable-features=Translate,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
                              3⤵
                                PID:3420

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                Staging
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2672_1344151854\Sigma\Staging
                                • Size 36B
                                • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                • MD5 SHA1 SHA512
                                Submit Download

                                manifest.fingerprint
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2672_1344151854\manifest.fingerprint
                                • Size 66B
                                • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                manifest.json
                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2672_1344151854\manifest.json
                                • Size 132B
                                • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 8f0d969f9fcbeae0bb26819e0bff747141c6316b1ec72bdb064c6a74d2442490
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 33f5783f1d0e2598d3325d465c2f0e32cb679f0b161fef1aa6f228de44ef53d3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                • Size 72B
                                • SHA256 f2b8f89e8a8d89922ec163bb2c2b7e3967f433cdd917ad9015f61ac25ed012c8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index~RFe58bec7.TMP
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58bec7.TMP
                                • Size 48B
                                • SHA256 24c0b0847a8d0128f2a561a04126dcb1c9f16b38087f71d7dfbb3b8f983afb0c
                                • MD5 SHA1 SHA512
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Code Cache\wasm\index
                                • Size 24B
                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                • MD5 SHA1 SHA512
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Preferences
                                • Size 6KB
                                • SHA256 145841f85870858b3c3d991b89a4de9fb77de0b0d6b4f14dde58cd8bf3310d17
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Preferences
                                • Size 6KB
                                • SHA256 5a476f594d71cfee38ecdf7c8452e47677088f68c5220068818de7875e81d5ff
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences~RFe590b41.TMP
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Default\Preferences~RFe590b41.TMP
                                • Size 6KB
                                • SHA256 5bfe4196cb2454ae49608c530699c56ccc6f7560b24a49e10531c8c044d2ea7a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 17KB
                                • SHA256 17305749ca122474159e087a5474bafead65d06c4db8b0ed7e25d062cf8cee07
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 1KB
                                • SHA256 71a1d0625b98b1c8997133a6e8d9c6389d79c230fcfd2a5f3d68111a7ab5d6ab
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 2KB
                                • SHA256 547a99c971b0863f0da3dc82ea284c93e62d5e9a2bf591503542d0bd8fef32bf
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 4KB
                                • SHA256 24b4f7c5b2c274211d63fd9598aa7619264f1b734c5f5fbe75e8f8864ed051f8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 4KB
                                • SHA256 09bf4c88ee0eb98030767808c8a702ac2cd373bd0f6392bf61e3e5d31a154c33
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State
                                • Size 3KB
                                • SHA256 7645a9c319af04d3328a5cb59c577aa2b540e94a192a0bb862f253b1abb408ef
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State~RFe586e45.TMP
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Local State~RFe586e45.TMP
                                • Size 1KB
                                • SHA256 108972d617284ababfde582341c6f0000be00fd819b02d6633664d4a35f2e13f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Advertising
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                • Size 19KB
                                • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Analytics
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                • Size 4KB
                                • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                CompatExceptions
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                • Size 689B
                                • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Content
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                • Size 4KB
                                • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Cryptomining
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                • Size 668B
                                • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Entities
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                • Size 68KB
                                • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Fingerprinting
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                • Size 1KB
                                • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                LICENSE
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                • Size 34KB
                                • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Other
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                • Size 34B
                                • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                • MD5 SHA1 SHA512
                                Submit Download

                                Social
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                • Size 754B
                                • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                TransparentAdvertisers
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                • Size 105B
                                • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Advertising
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                • Size 20KB
                                • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Analytics
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                • Size 3KB
                                • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Content
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                • Size 5KB
                                • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Cryptomining
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                • Size 32B
                                • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                • MD5 SHA1 SHA512
                                Submit Download

                                Entities
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                • Size 106KB
                                • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Fingerprinting
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                • Size 2KB
                                • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                LICENSE
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                • Size 66B
                                • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Other
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                • Size 198B
                                • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Social
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                • Size 3KB
                                • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 ededfb1a0262599878b79ad00b6454f3c61f654b240976311ba44b582ef2d300
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Crashpad\settings.dat
                                • Size 280B
                                • SHA256 d59b63e4d09e24fd60c1686fb51d7e48ca2ec85a4d0298f74ed7279e03a0dd5b
                                • MD5 SHA1 SHA512
                                Submit Download

                                throttle_store.dat
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Crashpad\throttle_store.dat
                                • Size 20B
                                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                • MD5 SHA1 SHA512
                                Submit Download

                                150375f1-7605-4900-8de6-1b3d1154dfea.tmp
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\150375f1-7605-4900-8de6-1b3d1154dfea.tmp
                                • Size 6KB
                                • SHA256 7430e3674f940e3fdd8fb81c58985010d67ee2380ea68d975f2eac15e9b65260
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\DawnGraphiteCache\data_1
                                • Size 264KB
                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\DawnWebGPUCache\data_0
                                • Size 8KB
                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\DawnWebGPUCache\data_2
                                • Size 8KB
                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\DawnWebGPUCache\data_3
                                • Size 8KB
                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\Extension Rules\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\Network\Network Persistent State
                                • Size 111B
                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Network Persistent State~RFe586da9.TMP
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\Network\Network Persistent State~RFe586da9.TMP
                                • Size 59B
                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Default\Site Characteristics Database\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State
                                • Size 1KB
                                • SHA256 5f00af51c202b5826857f7eb72042db57b45f9377290e9eaa05c29b7dfbad396
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State
                                • Size 2KB
                                • SHA256 9b07b3c1f3c352d8df86e216aaf1765107b6fc25c99c3cbc3c81804d5385c72e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State
                                • Size 3KB
                                • SHA256 5c632bcab772d7e05f58d905180b632decd3bc616b3b619e0ac61a25501cf6c6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State
                                • Size 4KB
                                • SHA256 d22da688b16af9a87725b99738d583ac8d9574700fa39978df37d63a02700e33
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State
                                • Size 4KB
                                • SHA256 659126a853d37166991f77243f08ba84f667359e30a2110d75605f7cdf6a2281
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State~RFe581e12.TMP
                                • Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\Splash\EBWebView\Local State~RFe581e12.TMP
                                • Size 1KB
                                • SHA256 e0e69dfc2708a73bce99cd4d194ccb473fc1c6ce6ca2bcbe300519d720f5d333
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/212-141-0x00007FFCD6C70000-0x00007FFCD6C71000-memory.dmp
                                Download

                                memory/1068-501-0x00000172990B0000-0x00000172990B4000-memory.dmp
                                Download

                                memory/1068-531-0x0000017294010000-0x0000017294040000-memory.dmp
                                Download

                                memory/1068-496-0x0000017299090000-0x0000017299092000-memory.dmp
                                Download

                                memory/1068-498-0x00000172990A0000-0x00000172990A2000-memory.dmp
                                Download

                                memory/1068-502-0x0000017299080000-0x0000017299087000-memory.dmp
                                Download

                                memory/1068-495-0x0000017299080000-0x0000017299081000-memory.dmp
                                Download

                                memory/2428-23-0x00007FFCD6C70000-0x00007FFCD6C71000-memory.dmp
                                Download

                                memory/2428-154-0x000001ED9DFA0000-0x000001ED9DFA2000-memory.dmp
                                Download

                                memory/2428-179-0x000001ED98DA0000-0x000001ED98DD0000-memory.dmp
                                Download

                                memory/2428-159-0x000001ED9DF90000-0x000001ED9DF97000-memory.dmp
                                Download

                                memory/2428-158-0x000001ED9DFC0000-0x000001ED9DFC4000-memory.dmp
                                Download

                                memory/2428-155-0x000001ED9DF90000-0x000001ED9DF91000-memory.dmp
                                Download

                                memory/2428-156-0x000001ED9DFB0000-0x000001ED9DFB2000-memory.dmp
                                Download

                                memory/2428-153-0x000001ED9DF90000-0x000001ED9DF91000-memory.dmp
                                Download

                                memory/3420-777-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-788-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-782-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-783-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-778-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-784-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-776-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-785-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-787-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3420-786-0x0000028DD48A0000-0x0000028DD48A1000-memory.dmp
                                Download

                                memory/3440-305-0x000001FEAA720000-0x000001FEAA72E000-memory.dmp
                                Download

                                memory/3440-286-0x000001FEAA720000-0x000001FEAA72E000-memory.dmp
                                Download

                                memory/4548-47-0x00007FFCD7800000-0x00007FFCD7801000-memory.dmp
                                Download

                                memory/4548-48-0x00007FFCD60B0000-0x00007FFCD60B1000-memory.dmp
                                Download