c20cf10fb304c81b64ef6ffb73eada14d34214efaac1f1ad5be7a4268156d700

Analysis

user interaction
yes
max time kernel
108s
max time network
107s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PLAY_Voice-+1-360-8139957792.svg....svg
Size 2KB
Sample260729-2ftpnafh73
SHA256 c20cf10fb304c81b64ef6ffb73eada14d34214efaac1f1ad5be7a4268156d700
MD5 b0c0a6f3502ebbf811d2514d0fa18abf
SHA1 279f1887b929cebfe7912be9e2de3caab4a8a35e
SHA512 52508307deb7d4377038d712301531f0d7e66907279a98820818422cbae786ba4fa3d8d2eeb3e60d132c6623bc458e1a0965cb3e275727ca77cc6487060a33a1
TLSH
T1B8516578BA88D461C6A6499671FAEB947CF1D05117A18084C8CCEADEB194EC8FE13A4C
MD5 SHA1 SHA512 TLSH

Score

7^/10

adware microsoft discovery phishing spyware

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
68	1392	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5988_1907700936\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5988_1391785900\_locales\es\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe
5908	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298379672653880"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{F5B2BF96-8301-469F-9105-D57E1894711E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D45F1278-C3B3-41E9-A304-733CDB542602}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 5988	996	iexplore.exe	89
PID 5988 wrote to memory of 5036	5988	msedge.exe	90
PID 5988 wrote to memory of 612	5988	msedge.exe	91
PID 5988 wrote to memory of 1392	5988	msedge.exe	92
PID 5988 wrote to memory of 612	5988	msedge.exe	91
PID 5988 wrote to memory of 612	5988	msedge.exe	91
PID 5988 wrote to memory of 120	5988	msedge.exe	93
PID 5988 wrote to memory of 120	5988	msedge.exe	93
PID 5988 wrote to memory of 2764	5988	msedge.exe	95
PID 5988 wrote to memory of 2764	5988	msedge.exe	95
PID 5988 wrote to memory of 2764	5988	msedge.exe	95
PID 5988 wrote to memory of 2016	5988	msedge.exe	96
PID 5988 wrote to memory of 2016	5988	msedge.exe	96
PID 5988 wrote to memory of 2016	5988	msedge.exe	96
PID 5988 wrote to memory of 3164	5988	msedge.exe	97
PID 5988 wrote to memory of 696	5988	msedge.exe	98
PID 5988 wrote to memory of 3164	5988	msedge.exe	97
PID 5988 wrote to memory of 3164	5988	msedge.exe	97
PID 5988 wrote to memory of 696	5988	msedge.exe	98
PID 5988 wrote to memory of 696	5988	msedge.exe	98
PID 5988 wrote to memory of 5928	5988	msedge.exe	100
PID 5988 wrote to memory of 5928	5988	msedge.exe	100
PID 5988 wrote to memory of 2156	5988	msedge.exe	101
PID 5988 wrote to memory of 2156	5988	msedge.exe	101
PID 5988 wrote to memory of 2156	5988	msedge.exe	101
PID 5988 wrote to memory of 1592	5988	msedge.exe	102
PID 5988 wrote to memory of 1592	5988	msedge.exe	102
PID 5988 wrote to memory of 3792	5988	msedge.exe	103
PID 5988 wrote to memory of 3792	5988	msedge.exe	103
PID 5988 wrote to memory of 4440	5988	msedge.exe	105
PID 5988 wrote to memory of 620	5988	msedge.exe	106
PID 5988 wrote to memory of 620	5988	msedge.exe	106
PID 5988 wrote to memory of 4268	5988	msedge.exe	107
PID 5988 wrote to memory of 4268	5988	msedge.exe	107
PID 5988 wrote to memory of 2236	5988	msedge.exe	110
PID 5988 wrote to memory of 2236	5988	msedge.exe	110
PID 5988 wrote to memory of 6092	5988	msedge.exe	111
PID 5988 wrote to memory of 6092	5988	msedge.exe	111
PID 5988 wrote to memory of 5968	5988	msedge.exe	113
PID 5988 wrote to memory of 4920	5988	msedge.exe	114
PID 5988 wrote to memory of 1788	5988	msedge.exe	115
PID 5988 wrote to memory of 5460	5988	msedge.exe	116
PID 5988 wrote to memory of 5460	5988	msedge.exe	116
PID 5988 wrote to memory of 5312	5988	msedge.exe	120
PID 5312 wrote to memory of 2692	5312	msedge.exe	121
PID 5312 wrote to memory of 5908	5312	msedge.exe	123
PID 5312 wrote to memory of 3168	5312	msedge.exe	124
PID 5312 wrote to memory of 3168	5312	msedge.exe	124
PID 5312 wrote to memory of 3168	5312	msedge.exe	124
PID 5312 wrote to memory of 1040	5312	msedge.exe	125
PID 5312 wrote to memory of 1040	5312	msedge.exe	125
PID 5312 wrote to memory of 4828	5312	msedge.exe	127

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\PLAY_Voice-+1-360-8139957792.svg....svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "file:///C:/Users/Admin/AppData/Local/Temp/PLAY_Voice-+1-360-8139957792.svg....svg"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,2650925769097367518,7700556376342749952,262144 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:2
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15818442950547986189,17438702853992899405,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:11
    3⤵
    - Detected potential entity reuse from brand MICROSOFT.
    - System Time Discovery
    PID:1392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,13427746470039668941,7930866944597765731,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,5372493689707496058,4270713046545494438,2097152 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,30295735406074962,4693924893458406381,2097152 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,3744397537438832835,5270580740452227979,2097152 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,8719468771603333305,6591600337939914284,2097152 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:9
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,7814465070307007425,5899911984949867590,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5624,i,13143427142347874039,569522068464520755,2097152 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,2039007909970191100,9916092463580811693,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,3478123536182563044,12159509023238340174,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17629517773887252919,2304534595191327119,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17629517773887252919,2304534595191327119,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,2086147811184161223,2060879080317943561,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,7993699401343493310,3261393666114457611,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,15166269147179973477,11290107551962452270,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,3992729150485836377,12909757078205841320,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,17371111982855254124,16794277324831809841,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,10103153561474300843,13537285803955840807,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,3617427053652376777,14202468866921632190,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,6540325657456238959,97109678397645179,524288 --field-trial-handle=2996,i,13628290584363028069,8655425210075023228,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,9750581635741435381,160414877366113514,524288 --field-trial-handle=2676,i,16346295220395370958,5468121858146912193,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11
      4⤵
      System Time Discovery
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,11275648005625446041,12190261408488742535,262144 --field-trial-handle=2676,i,16346295220395370958,5468121858146912193,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,13896777307121199477,6432025630394458526,524288 --field-trial-handle=2676,i,16346295220395370958,5468121858146912193,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,5699549662712177037,9965277706155407406,524288 --field-trial-handle=2676,i,16346295220395370958,5468121858146912193,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,5699549662712177037,9965277706155407406,524288 --field-trial-handle=2676,i,16346295220395370958,5468121858146912193,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
MD5 15b32961d6a7ecf7cfd3ed499d358e3e
SHA1 589fb245bb41b29e13242bd8947dc01c5b630829
SHA512 3a094a8184c961e25b25654d47755c2deb772e3e1b40c8e2d156493c5e3abf0dc6eed344ee5135af14f7c22f3d3e81b8799bc96aef8baa0b1a851cef7f08b753
TLSH
T183D09734A536AA91E01A813504A0360021260133359BAB8321A0840C89B000092F6DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6967b295d14519f0b63dd57145c2a1f9245df5d3d661efe1079eb9376919dab
MD5 a043d59a7fc921e2e59f57e11234e508
SHA1 5d35df84af62d890d0bca7e5dd95abf82b5f8ff2
SHA512 47da01e48be3bb0e3658abbeeb5aeb8c4ae9d63f2bfa40f203f259f05ccb77d4ace4a4675c4d9d8a066bcd1a81c0502d745cd98126a08b591631016a175150e7
TLSH
T158D0A774B625A911D60BA1311480B66137634262799EFAA351B1501C59B015492EE4D9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 701f80bb486c54b5cbe0e2474449bb851076bdb62e70d5af1314462135a0cbf1
MD5 7f5fa81edb37943e7c309471ee14157e
SHA1 f630581331e2a6ec1a758366412cfe608a930288
SHA512 78fe35b9dc88906486c4f03eac7cd923f5ce4d3378acd1d7f51257fe7ddd0f91e366417877f6d64517964902dcdb5381ad43b131bfddb20cd8180a0453c88f2b
TLSH
T1DEE0AB7AC920A83B0DFC075920810601F700139A3BC5850B3E3CD10C8FB467F41C191C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 cb66481a40ced70e62c8e1c6318408d7375e020935bd705b76c5badcb72fba68
MD5 ba5106ec44b03d2b702091453dc9e88b
SHA1 1766d7bf909685fa6e69617ead4808ca0d7d97ff
SHA512 ca7ab0bbef8249ed8212a003809d798b3646f60068ab4c5fa09f0085abaf59372d9def4c003bbd368ba91b26192148473cd0733e8d2cbdf90cc56b7aa71a6c27
SSDEEP 192:fWalvaypXt32bPNdnY/7TvhrQKay2RWPJSjadoB2mj3MG/Qov:F7f2bPNdYDTCKdPJSGdM2mjJB
TLSH
T1E0133A3D7A487E16C2DA007F054F8FF69335CB06E2DA6683A2367A565A10F068DCF217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 83f27ea2c24affa8d8a7dba24b6b6ae581bdaa06697da99cbd08836f3887f083
MD5 2148aa044e266f0d671ec59c616051b3
SHA1 3cbf4343c410d54ff913da5545929af5f76071dc
SHA512 39bd1f51957a855ab7e8bd97930acf605b965faa58f520154e5a5341959c1c59b5ff07dd0aad803a213ad4baa441a5a4e1beada68523127fdf382c4e778dcd4a
SSDEEP 1536:aHY18H+L/KBL/N1KhdcikQniucxpGuhNHKiMO66dNjf:31fL/KL/qIeiuc7GuhFD6KNr
TLSH
T1264494F709516017CBA842F6A2033A2DC57B860E7CD1F9A8E57C4D822865F25B6FCF85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 4cae0534ba54f848c4f4f609cff4a25b57ff530cf6b43dc726384b6bc1301acd
MD5 1155dddc4f9e8a7cec76d7eb1f554159
SHA1 7b04e09f1a12b41fb4f6c38c48bc6054b002aa35
SHA512 d5a595d892fab76001e1a5e6f5a5a29986be77427bc4f50bbc03b1563b9594a58e1c7089028b0437a348ad4b7565dcd22e050e7056d37f1fedd94a830a9a4340
SSDEEP 24576:HNOmKktlh4AMbYAkk/M1nLbZ9WMB8NU+:HNOmKktL4AMbYAkk/M1nLbZ9WMB8NU+
TLSH
T10D256DDF8B682C53CFA79BB070D0E8023E751182F699E0C39845C5ED66C5BC47AE926D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 697b263f0544f8fe9b1c48b2c21fb7c5cf71dda38d87b9c594b83a7130e80734
MD5 12a9834d20072f6902b99bf8b39c1ce1
SHA1 e40b8489a8ae534b99062a67cc56c9116557d881
SHA512 fead6e5f35e77d623ef7b9eebad71ff5738237c5f9743850e93a41818566ec818a400409d5cc208dbb72a3a2fd751915142f9d11d09d6c92311e75b795432223
SSDEEP 24576:OHhovDZ1REJpwxceWXjO4Oul03+Y9jaZtluN:OBCDSJKxceWXjOLYY9kcN
TLSH
T137167EEDC97858C3CD639A30B5F0E9877C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 495dcb993c037257448d7c603a7e4bcae8a8be812f011e41a8c55e67fc2a37b8
MD5 e888794844d8e41a0174927f92651da9
SHA1 59e1398dd18f34576a212e39299ced43d0e2ea9f
SHA512 8d29334e1be7c07ec3434cef23dfc8ab1c93f437fc8c7ffc114d3e63605679d91bc89be392a113dce7ac6d9a9232afd30eb84bdfabf9a6b7da9464228daa383b
TLSH
T11651A78203263AC1E77954F28BE844D8B7F9B3A9084B5FFA220C1C7A5E0EF4480D815F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a7d31a4fef63724e7e7686f91339c10b60e4e782946b8552649fc7d7313e004b
MD5 794957e42eb34b70e9eb36244093ae8e
SHA1 5236caa126a439558246d5c7f710892dea1abd60
SHA512 86c311d643ad64d0b2c60f1f5cfdf8b6e4b118e194c3111bd9b45187fcf540efcdb83adb49695f6bab2b12a0b52aaebcd38c4395a4fc068ac38a3dcb78a78c4a
TLSH
T17A51528203263AC1E77955F297D944C8B7F9B3A9090B5EFA120C1C7A5E4EF4480C912F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599ee6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599ee6.TMP
Size 2KB
SHA256 bade0373280f2865447754a962b7f6ac667df4c38d72502d7437d0d9afb0ee34
MD5 d9b08c0e4d065892da0867e6e7e72e73
SHA1 980ca112d5f95e70cf2b2626b04b09061bdc2d69
SHA512 4d181cf0da2b88466a0ab719e5a045d55b0848a576e2ce5bf602dcbc046bff9ccbcc973d238e5fb827fb679ced95a58671542d1f6a29b6f32c7b3e928efdc126
TLSH
T1EB51438203263AC1E77955F29BE944C8B7F9B7A94C0B5EFA120C1C7A5E4EF4494C912F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 1234d994179671a8babddac3d053b7cb1b6b76ed1e625b023194f2f5a60ff71d
MD5 cb0739d15c4112060e0db0d70e862609
SHA1 50b517a019ab16e83282d9100de63e1e346f5d51
SHA512 3dc93fd2bd8d7c2b066e58454535885c1042de213781029abff16426c4f644d09e3c50d3abed1fd81dfc3354d1788cc727b027f9f88a9184dbbc266fa790fdc2
TLSH
T105E0D8A8A5C6C22DA715388B91245B18A199345BDAC6AD03270C88C47B83102FBA299A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 694e1ae52065becd389655f83c9bcc950ac4105880c4cad3ce6ce7acf5678ae2
MD5 ba945af92b49cf6ac78ed77767038619
SHA1 2d4eb930c5784de602c5926c6490f2b440355893
SHA512 88eeb72303553d95d6215e566c65210f7134e6e87eec70e1023f85d341c77ae2839a7e3c1de306b4a3da78e78e2c0dc9907827b49d85f8f555ff977410544b26
SSDEEP 24:TLJHDDNzWjJ0npnyX7yNUs9vb7OkIbzXagfjiVsyW5LYVsDFtIcNVqYpw:TtD4jJ/0UC+lf522yWxY2DFO8VTpw
TLSH
T1F8E2C28D3B11F551C4ED733DA1D2C5E05EBC682C4A4DB2B152389C768C635A2F49E21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 cb0b6ed582fcd7d27476f7b7bc25a79cb0bb19a5b89796dbfd2c5bc690bd96c7
MD5 a3a8e211730482357bb8420e82094b1a
SHA1 a0131320c3e972a11a517f92aaeeae9cf4f7a39f
SHA512 b345b6bdb71eebe1a4bafcf9d025dec5d9cc019271dbdbf6badb23b3457319732b9639f76c913f404d76e11791b7bd5b8a34a4773605e305ba68ad1072482b28
TLSH
T1FEE0260C45ECC32DE1987C9BC278432CE3D0341BEAC83A02270C8C856241A42A3EA294
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 c90fe24d3b0e82c6d760852e1b03ea70b70acb6660aaed9de860ee0a4931b443
MD5 9fa92dd3549b4a5af61c8e2a37b26e00
SHA1 b275d05b4c5773475953bdc7e06b03b02cfc571f
SHA512 bbeee25fe8f0729076a951cb050293a0f9d8d51ec01bd2d3e51165979ee4f8ae8aed594a779ab372f6f94d826f5fc7a153b8b8e609594b88c2f808327ce80167
SSDEEP 96:nywIV9pkJU3co9tejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/8YVHbbEOVpZf241:ytco6H+bF+UI3iWGVoWN3qL/tVVV63
TLSH
T1C324740F5F302722CD7C517639EB45A35D6CF42F8B2326DA786128A4CEE2652701C9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 ac1094b6659b15a02185eeab335518c6f96c91b4d1ad4273c4dd0b4f1f1514fc
MD5 166af233227557a37ffeb79c083dc138
SHA1 539d2a816f8fb208c4cf968306c37ea20751dce7
SHA512 4fb9dbb97b73d612fb0285e347fa2802725d02d6963a69f4a2d31ea1a03e86289608a560b2a439c764bf038b53082e9d0e439ff3cf7d33ee1b2cd939cc875a50
TLSH
T16BE0206485DDC25DB1056847C214770CE3B0345ADACEFF115B089992B185005AFD11D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 5ca55f47bb9447eaffb3096cd9c80781307cb9559ece5ac8b5ecacbed1806ebf
MD5 3466f2ead36fb176722363da49225bc5
SHA1 c972dd737d3acc3a2668d45582af6211fe10fb84
SHA512 6ecd4f76316089a17831a4c64b59bb7c56147b7d22c34f54575d2732ac1ec77f25920882a6b868b251a3c229ded9f1373c3a718b302e0844a30cd098c65cf550
SSDEEP 48:TWt/LopFMaty423w/a9NUuTeywrQojdHqIvToCWwIZBS6O:6DeMatha9Ay6SI8PsL
TLSH
T1B1B2638E2F307611E1F05732EDE145632E7C402D8B73259DAE8820B2DDD267BE60A46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 20233ba8ef7ac74293b8d91128404a4a638c8e50c9efc238824201ca6b7045d2
MD5 2caeae8ad1faefc3d60cd72910aad4ee
SHA1 162ec1006798c1705634687733eb87bf2d5079e5
SHA512 4eed7da96a68f80cf98219e7e148e6eadce7cc1e057bda69656b88555e01f5fbb05c3705e5d7d827c4322d992a46d0ac04455f28b4147a83a8f96d6ad05ed7df
SSDEEP 96:DiudXOJZFThZNgaVNjh1MzScfEiu0Bqwq9o:Diud+JZFThZNgaVNjh1M2cfEiuQqj9o
TLSH
T18591AFF7C3E8866E891156F0A7147E2BCE1D0515432C3C5A89E4AF1FA3E2471D242A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e228e7037c7fccfd2d025c07320f40a7d6e9775bf4e9a4d99b6d7c3e6ec43e33
MD5 7123af1245a85ec410ae94950f02565e
SHA1 0f8f247a105c85ae9ad0c80fe76496fde6ef132c
SHA512 ba34a13307cb342872fa6f6ef9fe2967473cd55652387ffb7846b53b71b461b8999abd1d2d1359fa8561b0a414a5b22b2e700687441741d88f608e1e58ade67b
SSDEEP 96:DiudXOJZFThZNgaVNjh1MzScfE1Gu0npqwQ:Diud+JZFThZNgaVNjh1M2cfE1GuqpqT
TLSH
T19691AFF7C3E8866E891156F0A7147E2BCE1D0515432C3C5A89E4AF1FA3E2471D242A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 25a19b8ffa260d56eb537be554dfeb91857f5c94d5c71ad9177e60c7ac9e4363
MD5 a6b262ca7e40c9c0dd63bab155ae76c1
SHA1 82182d51c5b3effe9078c4dabf18c91225d7ba08
SHA512 dab72f0d75ea475cc971eda8d6bf5898d4d05b3ad476550cc7024040bd07a648ca26e8bad6f19ba6dcad29c9a52955043493fb35c8c6449cf40cde8b79c08f4e
TLSH
T1BCE0D817C4BEE4372068097E1A8878807DF9D4300591ACB4DAAAD37CB0E05F7474B126
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c251c42b3fd8a73540cc9bf1e8dc513d821b41810bf1f69a6047058eca6a813a
MD5 01df8f65d4bfc1037e4fe6bc242fc9e9
SHA1 5c84be7a64feaf9ad35fb72b0eaa18dea6f76310
SHA512 7bac923dc9c05d3ae2b3eb1bc5e44a1bb789af88a3cdb81d89b73cd23d0aa6c043de058ee00e363ca362187b7aaa50cff9744e65ebcff64ec14ef3a9e70eb58c
SSDEEP 192:sxRNR3yM/jK1Ml8VCC/fGsKWpVvaRZ28RWzoD8peS/g6+WNIYGduO9gpIgD8+A8r:sxRNVBC/fGsKWvva/8h/5IxMN
TLSH
T1CD62EA16AA24997BDCCBD20CFA557F53D6F81473A2905E54AAFCCA1C00F6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e653514957c0322ca3dd883b6b84e91d11252a87fcc77bdaee6f3682774922cc
MD5 8136aea7cc353d098a6e1a41b08c962c
SHA1 e0fd9a9771e1913b1961089f9b27bf1bee541ec4
SHA512 afa212d32b6101f120c56eb23dbdb9e8f417ab5d821721d9a9b7a6659e8687ee29212e13c2168e258a9871053750f6c83bfa02f0027be487ca2566ec66d32b42
SSDEEP 192:sxRmR3yM/jK1Ml8wCC/fGsWeRZ28RWzoD8p4S/g6+WNIYCyuO7GpIgVA8hJ:sxRmV8C/fGsWe/8b/5IQwJ
TLSH
T15762EA156A349977CCCBD20DFA557F53D6F81573A2901E54AAFCCA1C00EAAED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3153dda21948aa01363f6c8cced4a2e4a42f224726b2af119a2295ad045dcbbc
MD5 dc8830566b765f1ffde20f0e317d2207
SHA1 4e3cc7ae6785bbc08e257a3e30ffac7225411482
SHA512 fd63baf8bcbf8b10ad27652d16b58aa4c91c260152954400bf82807130081f0b0266dd238aa3dd8aafe9aa0b72977e47acc54e10f530e28bd0393f513301a2e5
SSDEEP 192:sxRNR3yM/jK1Ml8wCC/fGs/eRZ28RWzoD8p4S/g6+WNIYCyuO7GpIgD8MA8hJ:sxRNV8C/fGs/e/8b/5IQwv
TLSH
T1F662DA16AA245977CCCBD20DFA517F53D6F81473A2901E54AAFCDA1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 db9dd6062d8de27f704c07e7217816a2027a9e485011d3cbda263ebbacf689e8
MD5 48b18f208e641fed3c0df19d3c2da9ff
SHA1 6b32b2b9ebd5136407a2d512542001747fda293c
SHA512 b5b1392dd91aceccede2f044bd4ec1c0bbb7a6833390d1e8d81f7aebc99014596dd7471fe4815b052557e5f7d0669f748534d59f4c126808dd864d27fe0f23ec
SSDEEP 768:j/8v5C7pLuLffQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV47MQqqirovs3:j/8v5aEffQWgQ+fB+u1ja77MVq5w
TLSH
T183E2FB7B680CCB7E4F404E9DEC29BE9A6DA801CF9698C95447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 01379da5c61de5b132eec640721ff21c3a411342f22d27b047c163392ad59d9b
MD5 c67df2d16bf036f232746255266fcd89
SHA1 2fb73504e3efd126a9f6129091907a48a40d8098
SHA512 d7c5ea7d9e1cefde7583000cdcc3c7dead945a261c14b5c3ffc44420e56c2cdda2f0f18b3bcd87e9854342fe7c922924d1f86fcce75a6f955c561a5ae1690dd5
TLSH
T14DE0265C4AC8C37DB02624C742388308A3F4742BEACC3D022F49CA646283506B7E3190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 15d026f5805feeb1e791081f7b896a0abb3064c16d07e91d7dc44bd6918a0814
MD5 e931884ab148186f45d5c142067d57f8
SHA1 78b91b1f6a3c5ccf1c3c00bb1cf91d278a2631a9
SHA512 a8a69a51473899feb214305ec444e94b01083437ea87177eaf1269b28dc834ccabd49166a76fae59bfa7d4c52029ab4233ffe47ed01790f0e3678d1d3e864812
TLSH
T107E0D87857C9C33FB247348B8254F70CA1B2B416DACD69226F0CA5906346144B7E7550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 e637081bbb02913679fc62f5424cf6d919dfcd3fdaa8bd2e1b496fe4287e917d
MD5 c03440ecb08bfbf77b751aad0776e1d2
SHA1 44c56dc67c1fb125de9f610a86d7daedad31cc54
SHA512 1006bd0fca7aba3f0e8b267055581985bc378845231bc0c7c9c6670c1a1d2395e1ecd791dbfec6b7f04684d7718450101f2aab421933a966c6ff7f958fe27cab
TLSH
T18BE026788AC8C33DF40064C382B4A71C92F0B85AABCD3A02570C5460A242511B7F6190
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7a293e85fafebead01336474df221b852a6816f73fbe1b3702a7b1385ce6d0dd
MD5 cc371ab9279d33ba63299467045b663a
SHA1 d81ded52e683114e08fa3e977051bbfecde94b21
SHA512 9c1c60c804624dd8a7718d87a0b4b36d036f5a0301006b5aedc8a95a0de065cd80b4e5f84d25c51840dd8fb16c00da743eb0f3134afb2a8d3cfb7ae524b752bf
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unGL+Ke:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowM
TLSH
T1F5C13700B1BB4695383F654882B8983ACAC27067345DE96B3BA801660F37E47DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f2de7bf1334bcad2313e94f60c41dfbd22ae863a7fedcd5c20e463c3327b9c30
MD5 54a4eb782518460507de320d55866498
SHA1 34f0da092d19ab8b18a7d2e7993b1ffcee670959
SHA512 dc3b0672417d55b0f0e7a5aee27ad20dee8c0878b469605bf7c4ba5f4f5194cd2284cd006c2f88fef60cdfac611ba5b13f1ff1f4fa3013b950107a37060411a2
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unGL+KS:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowg
TLSH
T1BC910300B17B4651383E651C81B8982ACAC17477345EEA6B3BA845660F37F47DDFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 d12656b279722fcc24a50dd2badfea3b4bd4ba88e33924a9cd119fb3776023f3
MD5 396a30849ca093bc503d18bd22d57dd1
SHA1 655966d098208cd82d28dbd617654d20430826bc
SHA512 7c91f96ffffaf0abf6642dad0ebc29533b0f79d021e37d71c5baba34e0d2aa376c7a0901ded35cc72df18b50a08d24c8ea452d592e93d95c5981729455dfb3f8
SSDEEP 384:DNrRZyCSDnxTIC4cXMEhIKyll7svbFKfk7:xFZJSDni8cyI1l7svbF9
TLSH
T1AD44740A7B747001EDE6D9725CB080771E3C716ECF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 613499e1ab37fc5efaa422887ec7f6028cd63031dbb6622498a49205043841c1
MD5 1f5770f814e4218a7dd2f0a97da4fcd9
SHA1 35f8670d3fb106f623ad9ca2b1c02ca72715f2d5
SHA512 5aee2434ad71ed62d6ade7839a397b61b15643883aadec5e8504661aaf1b225f131e36e087f6d463423071e2da50ef27058a61912bd26d216ab3ae21379d0506
TLSH
T198E07D14EAE8CF6FF0263B9B41748728A380381BFEC82D461F0CC474B242501FBE6192
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 edbf797a26883b93875978e700a5620ddd86674b2e0f79e2f549e406e1b3ad12
MD5 e3f7877e612ec38f2d1ba26369b5b227
SHA1 c076fb53d6b23f0bf84d79698632b8079fbea6a0
SHA512 ba30a8e26bc424047f7cb382ddedc1753756f223e886e1e7481cde5e44f83cf7a55398f89046804de5d38d36ca8d2a7d0f6d7b834d33defae0a31773022f9477
TLSH
T16521D695F330C049E15D867E507E9B391738E8028FBCEC0F457A20386EB2A140E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 5404e853c38be3ea542110a85a6a41401693b09095d4597347a451c54cf35147
MD5 15904a2d7b9b9658e9acb9149662db54
SHA1 8ed95def9a02cd9f37f34a5efbf64a41cc727a27
SHA512 4bbea523b1b711653d8bec4e8328fcaf5a63a98b37c985054f88f0869a627e8d191b19b87285d15c5259f24cdc1838c0dfddc109743e58bcef7e69639d249e27
TLSH
T1EBE02014E5D4CE9FF016359741A4875893913917FEC42E415F0CCD555241142F7DA191
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 8d6485212553178cfdff416271f2266af9c4f0b6101ca5021e8259ba2df34fdf
MD5 2df3bbacb4ec2e67a43ba50f4ec8722b
SHA1 74be3ad2cafb544fcc9224fe67a7446433814565
SHA512 9abb3985b4767618a9db8c2644b95cda6ed28b4fe1710be6207b9329443c7ee44e42fa18e60edb5574760fb3373837e6c41b584f2cf2408e4e4ec493d9cf6272
SSDEEP 3:MsEllllkEthXllkl2zEEKt:/M/xT02z
TLSH
T18E44040C7FC015C5D500113040D1C3F00371D4510511574774510413FCD55700C01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 dbd89baa1b7a32dfabeec6bde05bcdfd6ebfe48c6100cf4d6104938e39eb948c
MD5 64c656dc0eb98f970d80e1b85fb2c7cd
SHA1 6790f794bbb0c5f90ac87759525ff14a5dbf3893
SHA512 50023f60975da62b16dac18cbbcfa71921a7d583c4aba016c4a0e64b6a833ca574751e6ec90a156c982fdbd49b191a7159b411e60ea5c29703955499bc4e380f
SSDEEP 3:MsEllllkEthXllkl2zEkfGt:/M/xT02z1fG
TLSH
T14A440404FFC03505C50450304053D3701370D411051157C774515F13FCF55700D00041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5ca5d3c60944535e22b1dc03b9672c39dc0a575591662d018d8cbbb151c073fb
MD5 b079723068bd390c1d8727bad16bbb44
SHA1 9e21054238dae43419ce9c359a2344cc36b339b5
SHA512 617ef94bfe8cb6b283e542d52febae3c096ec048a5370b0e97e30cca770faf1e763ef8d4539319f4c9286305a94276c64461abaa0707feb4e958c891803ca04f
SSDEEP 768:Sx3/nA+Xkhp8+p3bd66j+4BRv86aLIWnMjvZm:Sx3Fkf8+p3Z6n4yBQm
TLSH
T12DF2A072FC95DD639CE9D245B5867783AFF420B396C00ED4D5D9AB0D00871AE170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 52e4f82c2356d24e3fccb07ecfe44912d1c41ff43f08550c2a1ae3b6664af3f9
MD5 2cc1eaca55a8fd085d655098b9e06c3d
SHA1 117ccf86365a8ca45abefaea7547d51a926c5968
SHA512 96a3f05efe362f560fd6138d96dbed3e4c55dde2c941dd6eeaa21228e5202549f44897dcd81000944e15c3faed0a6d54488e165eca3cefa89ce5d5b834a6bff2
SSDEEP 768:mJg3/nA9+xp8+p3bd66j+4BRv86aLIWnMjvZm:mJg33v8+p3Z6n4yBQm
TLSH
T149F29E76E8A5DD639CE6C385B3457B83AEE420A386C44DD4D8D8AF4D00C71EE170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 f6bd310a2425e0e6aecd3c9d5795da9649d1577458582bae70e17457cc7701c1
MD5 39b7a846bf8c5e408bbba1163f33f536
SHA1 37c58cfcfb3110db5f41bf7c54b9020e7c7db07a
SHA512 4c7997ebc1a2024a17e6e9fe71f80d40e7268b03883353f5fd16e123d9e852628ffeb8b24608e75ffa56a08c058462848c16a2813838f19578374b1482fa1556
SSDEEP 768:m/g3onD9+Mp8+p3bd66j+4BRv86aLIWvzb24jGzMjvZm:m/g3dq8+p3Z6n4ydff6zQm
TLSH
T1A6136A7DEC65A93F88EEB749624D6A06AEA41073C2F848D8DBC85F0C907359DF707825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 422383a78a17316daa925425212d41193aab5aec62419cf002fa9b86420f5436
MD5 a384f62c219c669035fbe2725778040c
SHA1 9369698b27b604362bd556f26d2e6281491764cd
SHA512 274512f3580a9fd44b23dccc8a0ceca3015a5a5243f470f0a6b7fd3c4c9dd6f02829438a2f06b5e7faed3dc2dd32e127724533e25ebb0062503ea92b2760dce1
SSDEEP 768:sx3knA+Xkhp8+p3bd66j+4BRv86aLIWnMjvZm:sx3skf8+p3Z6n4yBQm
TLSH
T153F2A072FC95DD639CE9D245B5867783AFF420B396C00ED4D9D9AB0D04871AE170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 cf20b28ff5ce359e1b171b679a8fb43aca1779d0d082eaa556aa75ad6c81e63e
MD5 b99bc51acb2ba56457b78af5f53a729f
SHA1 aecc3167825551e48d0d5190fd4c6d0b131ba4ba
SHA512 839e294338a663efdad808009ad17dc7ed5f3ba84c11dba4d81f8be1941af336414bdb34f5c84c6a78661c7b2c4cae5103acefe0c18630d3f5d6b9daa324a8f7
SSDEEP 768:Qrv+4UNbde33fnC+Xkcp8+p3bd66j+4BRv86aLIWnMjvK:QbsbE33Hk68+p3Z6n4yBF
TLSH
T18113AF72F869ED739CE6C244B18677837FB420E395C00E94D9D9AB4D058A1DE270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a2c5f596fb03809ffe7288149428bae5594c829b72114ce5525dbca582f0d19
MD5 f8c8c54c8b17baae535afbf2f5551fe3
SHA1 dfaede353d9c9d188ff413d140baeb645de9741d
SHA512 453a8f600d4f86172fec51008c612580fe0a16cb6247353c11ea575a1ffe2a4c0944f8c60db47448f7808a934a65db5c6546ccc43781b849734db3073fe5edef
SSDEEP 768:Irv+4UNbdD3yccNp8+p3bd66j+4BRv86aLIiW2bwCl1:Ibsbp3yL8+p3Z6n4yU0ww
TLSH
T12903CE73F8A899739CE6C644B2467A433FF851A3A6C00EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fcb5848a6f8e704384d573af3e9bba5a4e767753c926790cd3a793a1f589d6b7
MD5 ed342bbcd363acca3f8d73d2dddf9485
SHA1 78e7405d967ed5e8fedde1fdae2745d68fc0462b
SHA512 4270b67718894b50edeea7404941258147075715b1434ca774f1191e5e9b47b75376d72ac0244ff5215dd069391764ea6c8da3b37ef65f3802c0bb1e36e01a99
SSDEEP 3:MsEllllkEthXllkl2zEP2dl:/M/xT02zn
TLSH
T1A34402446B800506C50010304051877003A1D41105229B4778610C12BC865B01C04001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8b6c30a-e576-4e85-bd16-4eea6483cdb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b8b6c30a-e576-4e85-bd16-4eea6483cdb4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe597611.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe597611.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

30c48c64-a898-463d-af5b-845d651ff06c.tmp

Path C:\Users\Admin\AppData\Local\Temp\30c48c64-a898-463d-af5b-845d651ff06c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5988_1038005257\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads