hxxp://tungtunghook[.]cc

Analysis

user interaction
yes
max time kernel
11s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tungtunghook.cc
Sample260804-b7xyaaba45

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	discord.com
61	discord.com
260	bitbucket.org
261	bitbucket.org
278	discord.com
510	discord.com
1	bitbucket.org
51	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4852	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{744070A8-A375-4D06-9043-DADEC2F27B69}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5644	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe
2508	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4840	2508	msedge.exe	89
PID 2508 wrote to memory of 4852	2508	msedge.exe	90
PID 2508 wrote to memory of 4308	2508	msedge.exe	92
PID 2508 wrote to memory of 4308	2508	msedge.exe	92
PID 2508 wrote to memory of 4604	2508	msedge.exe	91
PID 2508 wrote to memory of 4604	2508	msedge.exe	91
PID 2508 wrote to memory of 4604	2508	msedge.exe	91
PID 2508 wrote to memory of 368	2508	msedge.exe	94
PID 2508 wrote to memory of 368	2508	msedge.exe	94
PID 2508 wrote to memory of 368	2508	msedge.exe	94
PID 2508 wrote to memory of 244	2508	msedge.exe	95
PID 2508 wrote to memory of 244	2508	msedge.exe	95
PID 2508 wrote to memory of 244	2508	msedge.exe	95
PID 2508 wrote to memory of 716	2508	msedge.exe	96
PID 2508 wrote to memory of 716	2508	msedge.exe	96
PID 2508 wrote to memory of 716	2508	msedge.exe	96
PID 2508 wrote to memory of 4232	2508	msedge.exe	97
PID 2508 wrote to memory of 4232	2508	msedge.exe	97
PID 2508 wrote to memory of 4232	2508	msedge.exe	97
PID 2508 wrote to memory of 1792	2508	msedge.exe	98
PID 2508 wrote to memory of 1792	2508	msedge.exe	98
PID 2508 wrote to memory of 1792	2508	msedge.exe	98
PID 2508 wrote to memory of 1808	2508	msedge.exe	100
PID 2508 wrote to memory of 1808	2508	msedge.exe	100
PID 2508 wrote to memory of 1708	2508	msedge.exe	101
PID 2508 wrote to memory of 1708	2508	msedge.exe	101
PID 2508 wrote to memory of 5512	2508	msedge.exe	103
PID 2508 wrote to memory of 5932	2508	msedge.exe	106
PID 2508 wrote to memory of 5932	2508	msedge.exe	106
PID 2508 wrote to memory of 5932	2508	msedge.exe	106
PID 2508 wrote to memory of 1096	2508	msedge.exe	107
PID 2508 wrote to memory of 1096	2508	msedge.exe	107
PID 2508 wrote to memory of 1096	2508	msedge.exe	107
PID 2508 wrote to memory of 6100	2508	msedge.exe	108
PID 2508 wrote to memory of 6100	2508	msedge.exe	108
PID 2508 wrote to memory of 4092	2508	msedge.exe	110
PID 2508 wrote to memory of 1828	2508	msedge.exe	111
PID 2508 wrote to memory of 1828	2508	msedge.exe	111
PID 2508 wrote to memory of 5564	2508	msedge.exe	112
PID 2508 wrote to memory of 5564	2508	msedge.exe	112
PID 2508 wrote to memory of 5564	2508	msedge.exe	112
PID 2508 wrote to memory of 5476	2508	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tungtunghook.cc
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffcd53ec188,0x7ffcd53ec194,0x7ffcd53ec1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,7100864279506391767,8946653838933366209,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,7682807721646729384,9017394386204486775,262144 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,12829276343648503080,7512315373535762600,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,13703220112285606304,11369804378339357341,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,191178656797631145,10336898656487912883,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,11780384469004162,6473950469417823481,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,10962547371362307798,8615505789727818762,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3728,i,10849934325100599471,7338066080851501592,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,7098242193614899211,15959279309730568257,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,8387342807716928063,2117914157587951698,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6452331728396692784,18060785970017683368,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6452331728396692784,18060785970017683368,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6384,i,5067628901054608190,5928627764295496809,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6604,i,14914755503325764143,18331884102875079993,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,3862817265299967662,9774561131810718649,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:12
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7996,i,8495041755604197289,123058658374600965,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8056,i,1349931607582109631,4218475836029168212,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:14
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=8084,i,11537984902517610462,96475107936669144,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,15689469806605838685,3133272903868489124,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=8988,i,9149702724366774716,9890671836471840663,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4708,i,17625343241477277833,12961889992421517015,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=9112 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6324,i,10987725555640546703,1099441249246258224,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,12756729688348384863,4263646028932294028,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8164,i,15948375854618073745,8568857196170879067,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8420,i,8027463934147046120,15905331266200985414,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=2500,i,12441872313447028898,10418770653160485078,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=printing.mojom.PrintCompositor --lang=en-US --service-sandbox-type=print_compositor --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,336767334078272986,604349081795674393,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,8341195100118570621,1567140725182957921,65536 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:3
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8056,i,11707916985337657865,6677696206274848832,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2032,i,3463753735494140672,4057493495139745839,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9068,i,8246528536162906004,6121147851468948497,524288 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5488,i,11227468903612990414,9297704773350353448,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5064,i,3437092276070786148,16482246182538648574,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5980,i,302310550634320601,12796119093025437850,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8860,i,14963364183323134300,12903491067925526399,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8412,i,12972863338569833756,12230797624164937424,2097152 --field-trial-handle=2384,i,6840436227357884034,18265687612914079545,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:7096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2548

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:5772

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4684

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:6476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cf3add8a-a134-4384-a203-d7ca1edd2873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\cf3add8a-a134-4384-a203-d7ca1edd2873.tmp
Size 105KB
SHA256 8c605a069294252273e8780cd3583a8ae688781cd3bbfb104da743dbc8ec3349
MD5 a8e7775101a6fb7a72b1d795773346ce
SHA1 b9799ea7687f7095b06e80335d2c8a7bf7ff83c1
SHA512 e8db48802db3fbad8d233a135d79e6cfdbd9060a89d8c721205583699814479e9913260c391aba1592a96d4083787169edc78efabcd0d5d7fa9451747cc76d14
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T1ADB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000027
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2aa0d5aafd1174c43b4d14b900c526fb36a7450620f68a71983b154394ea936d
MD5 bc42aee1b9c714bc12edbb3566286d9e
SHA1 eab7e9c6bf1528a7d854032daee64e9e63cd55e4
SHA512 76da10592673b708f552c7a055ab0678f1afc8028ed9293a37879e3a4969fc9daeb80d9fa163f80e74b480adcdaf7a1ecea74efb431ac51fe53221e4d9848f5e
TLSH
T185412E8C33645AE6DB525DF255F91ED371FC567815031E09C080A33E69B7BA5B94301B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000011
Size 10B
SHA256 65f3e6f2819e44fec302be2de4c71d8040db5e4947b36ea757df4faf907d4f0b
MD5 35c3304767a981f21370676a118529a6
SHA1 e0de81afc1a90f3d08564e304ade1db9c19fe9cc
SHA512 84b6c5c28848df6bee181b224e073f6ebc50d662cf94934e8f9b426083fc0fad4dd0d602cb49b72941af641b0645e5b58063a2e6fad7fa301d5b9cf06436ea0a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_tungtunghook.cc_0.indexeddb.leveldb\LOG
Size 351B
SHA256 75c07d908efc954d2e3bf364c6aba8639a7e2badf74adef3ee4bf500c8f303fd
MD5 8573467013451c562c3314e3d28a9db7
SHA1 9873a62f58a8630016cd6fb7d65ae63bc1df1edb
SHA512 68256194fa6a39f600ef4da0bcf902e15d42febe6bba50f1799bf6d9d06377eba284ce37d044a02390f17911628134f9930a4af56f8ff88b2c8ee789633875ee
TLSH
T16CE0D85485CED62F612450A3152A6F08D5A7650E9B887E8A8F49CD287582044EC6EEF9
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_tungtunghook.cc_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 8c5395e80eb220be57b62e51da87f12d4da5950a1adb3daff4c9ad32000285ed
MD5 624826fa8cb6e7b7860c76492b7ba95d
SHA1 54519a0b74c17e0e7cd17a04f40610c05192d586
SHA512 300a3ce29ff0b3ec2cda50342a96c67920c1e15b74183589955714da8a90f019045c91458a9ea9c72a6db735d53dd5f147cec8d0aed9e14218d98a013dd901ec
SSDEEP 384:Drm8v/QC+8tpnZO4iUrMfVgbBBH6aUJDoJSpamWPeuGU3bW5uS0vN2Y4pxPcqaiW:WGPZx38vY
TLSH
T100C2CDF383E48A2E9C2556F1AB153E1FCE590A14831C3E968AD5FE7B53E2471D110B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3c0fbdf4cc13132d240f71e66ba76fc45301e689297b9b84c33bf5ed81639f7a
MD5 5dc261de9347d7af7f0f66e5f22c2585
SHA1 32e906e9714617f0a697356d825ae6b5220ecf43
SHA512 f66b2ccd0796c5dcbb42f895c95ac364738fd3adcdb578b8b2ec74e2f31f1128a02021b589894e2734a70c122d80a0fc42d3b6d5d8e4683284d3e9dfe5149860
SSDEEP 192:sxRcRTyM/jK1Ml8wziooqjl/fNsOn/KZzoA8piEhVY066T9/g6+WN/DJ5YZ7g1H+:sxRctliw/fNsOnCknhVL/5V5Bmz
TLSH
T15772E8056628697BCCDAD20DFA56BF53D2F95422A1D01E54AAFCDA0C00E76ED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c07b0c60b80116f47829346f966135df61b17b4528fafe787a6e56762f5dd7b4
MD5 931e6a8f667240ff2ad92dec156e1958
SHA1 28ee6795233ea0bc5f319805368a9fdaf6f7ab0b
SHA512 6981943725ceb60dec45da7339d260bc266cd23797835ea6fda38f9efafabd9b75bdb438ae6a9aacb9f583e92f6befae5c676eef1bb6ffb72b528beb6e39d7d9
SSDEEP 192:sxRjRTyM/jK1Ml8wOj/fNswI/fZzoA8pjw99/g6+WN/+0/YZ7BKsLGdIgQJ:sxRjtIj/fNswI3k4/5l/im0
TLSH
T16662D8056678693B8CDBD30DFA51BB53D2F91463A2901E54AAFCDA1C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 150464229265e15261119fe45ba87823f3a3b8efda55ce9cdd4b5390c185afb2
MD5 29157afbbdb6c59c5cc4d98b8969d2a4
SHA1 1c11f05d1b62869e552d1825bd39378384457245
SHA512 ad751f58d4bb80d84b396546f27b8ba703f62b493bfa06d8daacb017eb11ea6badf4f17c934affaa2c7c705444cb711ab22d8bf5905e8d72382c697a7be2ff89
SSDEEP 192:sxRdRTyM/jK1Ml8wziooqa/fNsOn/KZzoA8piEhVY066T9/g6+WN/yXtYZ7J1HHe:sxRdtlir/fNsOnCknhVL/5stMmz
TLSH
T1F272E8056638697BCCDAD20DFA56BF53D2F95432A1D01E54AAFCDA0C00E76ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f5469142036d2af26d38d0d559eddd8a3b8620d1e4b69b18f3e05177e5b55449
MD5 f476a8d0671f192dcb4f1d05e7458ffc
SHA1 7cf5ab8cec8bce6aa877e3ac0c4f055dd2b08e31
SHA512 ae184b6d22defebd9234ccd5e9cfc092e02a80976f707dacf0738bffd4a13322df663d4c1868190635aff67b7410819c65f2997e490bd82ec9641e04aecf7533
SSDEEP 192:sxRdRTyM/jK1Ml8wJiooqa/fNsOI/fZzoA8pjw99/g6+WN/BeVYZ76KHLGdIgDLJ:sxRdtHir/fNsOI3k4/5EVCmZ
TLSH
T17B62D8056678697B8CDBD30DFA46BF53D2F95422A2901E54AAFCDA1C00E6ADD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6c20645ddc92e81867061b49edcfc134f43480042e0ac1979e67d33f890a3f28
MD5 28d7850ad46491a0b7da649ac8d15a76
SHA1 ee7dd9360bd0599d39a428885ca1a4807596bb85
SHA512 730de229039515a98f073810bea4ed87a1103da106fb5f9060fd857b184bf7158751f0b6cc947d32bd5cc03360424795f2b98bb8fdd884b5e98c403135960858
SSDEEP 192:sxRxRTyM/jK1Ml8wzi1F9oqjl/fNsOn/KZzoA8p4EhVY066T9/g6+WN/ZGdYZ7CU:sxRxtli//fNsOnCkJhVL/5kdXmz
TLSH
T14E72D8066678697BCDD6D20DFA56BF53D2F9143291D01E54AAFCDA0C00E66ED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ea241d626bf9defc5e0b7e3043d6a343ec00ca3eaf74e53e519f7758a2550a76
MD5 dab999e94e7d4a8fc206c306484ae957
SHA1 25f110bb0eef4560cc72623cd666c97fb59ef710
SHA512 94d4cdfb0dfcc11ad5b7d3a76d6c052e1e0682b7480717faa874c8145590498ca223de6ee07b9c7d96b3d3a16ff5e22a4b32f21e44e2be59e00b5012934276e5
SSDEEP 768:kfISEvWgd5fMb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMSV2lroHh0wp+C:kfISEvWgd5fMbu1jaBU2eHh0wkC
TLSH
T1D9C21C2B640CC77F4F804A9DEC25BED6ADD802CB97988D4447FA890C03C77EB512A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\06bd3eb3-5e35-4a70-8cc5-37c2e30ce07f\index-dir\the-real-index
Size 168B
SHA256 9ded0d8e8251c4d554ea3b8133c3afe59d27853b39e0101da285e4e5ae9e5d7a
MD5 37d86f393afbdfbf9dd6d03bd6933ffb
SHA1 2ea767fc21347a2445081f93704fe9eb54918a40
SHA512 021d217cf8f411b3894f5b45ff26f0d64b02df696ae3cda1dc7582c4f843e106a7c7a4ee4d9a4c0f01863741e7044ee211ad80c2f90891c2188061dddca6be03
TLSH
T1C7C012B0B8174007F02003F48DE23A0571300AA04BDF623D4CFC497BD4727048A2A11A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59962b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\06bd3eb3-5e35-4a70-8cc5-37c2e30ce07f\index-dir\the-real-index~RFe59962b.TMP
Size 48B
SHA256 95c29fa62efee3cbf3c20bb7a8647a77d086b56389f7b6c0fcf9a1d7a59fafd8
MD5 5078301e131b00eeaeab0adeae9388a5
SHA1 3fbb250133d2623640a0faa169125c5f8633ad8a
SHA512 454c22bff7b4bfb9b641f2899f03950409870ce74624b889efdfa3ff34de55ccb97e98644f6eda1c383887f218f6fed599d8ed67d639c3f550e552a9779488f9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\d181cb09-2bcb-46e3-bda7-63cc8e665057\index-dir\the-real-index
Size 48B
SHA256 8130bf17659c6c79f769a13e8da9f71ee775438a056a7a80f704547e8fee0a76
MD5 224713e32d2d2f81bde32be2f78fc2c0
SHA1 f2c99d6fefec2a7a81811b69c891c7c11460aa25
SHA512 0def3d7300125493dae212224fb26aa48ebde92fe08e358a728fc9ef144c177b0bb35271794383a84761fd8d807ac9418b1f79cf212ce7a6cd3bc35b08a880b8
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59dbfe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\d181cb09-2bcb-46e3-bda7-63cc8e665057\index-dir\the-real-index~RFe59dbfe.TMP
Size 48B
SHA256 ca10cd3ab9edfd5b260ac92d1665a52ca18310a2edfa640c0484ff7c273c0ca3
MD5 49f2a3d421364fdf50f1cc71365fbadf
SHA1 064b99124dbba90b3fb47c477222e9699b62617b
SHA512 0db8662a65cc9352e1c8ea928dd2e4a8ede344fdd6f9f4f5ff4ded0e2af37a4090a0b96c4e5f077e9c3ee0fe13992b28d3198a2d2a4e057a51630b1e4523fad8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt
Size 208B
SHA256 2d2e2f2b154b44d67d92d8e3c2cf4df8a3503ee9fee4da3e514aefec277adc05
MD5 116368f67b262c6dfe470e699f12dadc
SHA1 69edf9b4ce6aeef4a5c9edabe8ded78288fe8eae
SHA512 759a06b26ed4217ea7353a254176fb0dff2f259fa37d4674ffbb69a8a50354c402094250f1d43785df79224454608c7b1e97364560a079de61fd41da94ff192d
TLSH
T164D022FF021A3C097A319A080037A1A0A7678C0288E0F3C2C91078782C384320D86DBC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt
Size 202B
SHA256 ce6b796e13d5b5d2e27dcbc3d6319e113f7bf86dd0e710cc05e3cf85e7eeb3e1
MD5 56ee083544c08282477ce54e7f7c9448
SHA1 dcaa53b51ca2c8fe7b9b154e79f4e762c3bced58
SHA512 a35625b8e2751a6114927eca144e68c9b80f70af9ab01e25207ef4ebde880231feb1168cc45a4ac2ee3c4f5c8b99a771547c739ec2033612d30147da663e605b
TLSH
T16ED022FF02167C097A319A0C0027A1709757950280F0FA82CA0068781C284710C83EBC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59287d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e2f55c940b745a6f4d83fbd753235053ce2a1a9e\index.txt~RFe59287d.TMP
Size 140B
SHA256 8084f34fb41bc6a04d87912d147664bc3e585ec2379bd29a962f4f3aa4eb5984
MD5 da677a0a3c240e2aae999d59dbc1d136
SHA1 ff11859eb810e7c0564428b124500d2bcb0f949e
SHA512 c96b941221a7068eaed1219f05152127c78074a804b2f2ecb25801e88dd78afe5b0b453749792d494afaa43ff7223e8dd46b4570d48509d4943261f759d9c7b0
TLSH
T1E3C02BDF0142340C35300A0C0033B640DA2BCC0384F0E3C3C804747128340124D41C7C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 83cee2680fe989c9e0cfe92ee76947cb22d65ece3f41fdf2e34067b894b0b442
MD5 01123e418045e8dd0b8d6eb8c78ba826
SHA1 22427ff4f89119d85705a47fc76a27a6aaba6cc8
SHA512 7c78d2d3370acd65fb5adf4575b30130ab2bbe280d18336802a1b6ca596a70985cbe2fa64e683a60138b097e193f09cfe9be414287cd69bae6a9350ee8441a0b
TLSH
T11BB0022A38C81C73DA2453B11DCB8F4071366C5413E39A6671FC9155CD26294EA5346D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 a77ba8b3a0f62ad5591be165425b6ccef55a6fdfe2669314548fc92becb4ac1b
MD5 4c1938bd3475d64fea16ad7996980b07
SHA1 c897b6a0c4004a08d8798d2f25f89b6e77dc78ac
SHA512 2201c1b96a2dcee1e6ae92a087660e4e8dfeffe2e7255562568ceefc22822a580ca0cf273f3399f98803818b298097cbd7f445225a18d3d9e196cbc7eb5b286e
TLSH
T19581C9C5657F821138BF294C90B0DA2686C670B37458A52B7FE801B24FA7E124EFD8D9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b43b23eb198c8724f2a187495d6140a805edf744783e39141c747534e9d67831
MD5 952812342b685c694bb6c4898c4240e8
SHA1 07f331d0b1b4c9650b1a667c8ff9187649c4e053
SHA512 07ac52d370556fa0e74871756c8a87f3bd6f23fbf5b0110e160f036080f229b70a684931f73a73b04998b1df1e3ae84627f2313ffa345b89ad29805c6dd1e433
SSDEEP 48:Kc2IfKbiIzytPIVKcko8vIhKowU/y52vQE2gK:Kc20Kbim+PmKckrv2Kow2e
TLSH
T11291D8C5657F820128BF294C90B0DA2686C670B37458A52BBFE801B24FA7E150EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0001.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0001.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 5a011eeaaef365aaf7822209c8b79177b20e58cd4390729e361cfb642d77eaf4
MD5 20156289bf2b8a475b48ccb2fd1c229e
SHA1 ea8f76adb7dc288d6a81eb95b931318b78176c1a
SHA512 380384a6a970476e351091ec061a8a22903f2775ccf34fa45e90d048e64c5ec1e93ce82164a378f756ac9fc7fdf95bd8f630844171e96c6a94d39366a1226b27
SSDEEP 768:BI3CbIq9LLHL2WAam6aQMGdjWca4Ghf9pmO:BI3CqYmaME6ppl
TLSH
T171E2AE315CA899739CB7A699B71A3243BEF0916385C84E84D8EC6B0D03E759E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 069ed6bd431a7645be64679641eecdc748642df51124257e0b227710a5488f19
MD5 03a19ba05f86558d232b4688c11cc6d7
SHA1 fd45443c13ee601ee2a035ecc623f04cdeea4ec3
SHA512 5d2df3add9258901f1b412886eb04a95834bbba21857b57026eadee6420216ae7d3156d21989a35b33b5b338cb57257bcd30ddb00ef6056da3dc8306bc177e28
SSDEEP 768:/FQp38wgnTIq9LLHLWAam6aQMGdjWca4Ghf9pmO:Cp3QEmaME6ppl
TLSH
T127E2AF325C98D577ADB79B99F71E3243EEF04163C8D89D90EADC690D029709D230BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b5041c07191a3eed54bc8cce756075d03ec61b396039e6906db8ce9cdd88b0b9
MD5 d251f11fab8df816386ed2006a04ea75
SHA1 9d24625ccc1fb45998af3cf5a6383cabd70f6ec5
SHA512 b3a454a033fe500ff66f52f4c523a751c11fd21b3ed70997ed77856f1a861b057bb59e48969bff0a9fd153703b7a7a976ff252320742d6bb3334e656f4c4b983
SSDEEP 768:B43CsIq9LLHL2WAam6aQMGdjWca4Ghf9pmO:B43C/YmaME6ppl
TLSH
T114E2AE315CA899739CB7A699B71A3243BEF0916385C84E84D8EC6B0D07E759E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2990bf217cb0f71abc1b56798f651bf5cb9e5364614eae669b0b9efc7f80d5d1
MD5 4cd1fde30829ec05afa08cd0f4c04add
SHA1 fd46c81d499686a61a8836d4301dd10a460c2452
SHA512 7620e8d13fedc8798a1207cad2d19322bc556f75f63370c9015b7961bc693a7ac093dbf4fa32be4ff230199d92dd0f9e8a52e5b33c1b1cfa8de1bc16b39c1232
SSDEEP 768:/93tnmq9LLHL2eAam6aQMGdjWca4Ghf9pmO:/93t4wmaME6ppl
TLSH
T194E2AF315CA899739CB7A699F71A3643BEF0916385C84E84D8DC6B0D03E759E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7a466bdaa8023cee8c88c4ca9b375c0c7409369a33c0a552b056e1caabfdd41f
MD5 4f781ca864bdeb8f899e69f880a9f7d0
SHA1 f27c8d21e74fe7f4dca4aca03c6b07745d2852e1
SHA512 6d055b93f7dd8be77db6077d6847407d8b6d7da4fdf781b890f9f1745fd456a111d366faa7157536c65eb0a35f2c3838b7e5b99e2f4c15f1d36fbb8a1cd52a60
SSDEEP 768:Bh3C2Iq9LLHL2WAam6aQMGdjWca4Ghf9pmO:Bh3CdYmaME6ppl
TLSH
T1FDE2AE315CA899739CB7A699B71A3243BEF0916385CC4E84D8EC6B0D07D759E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1862c4d919b347cb5075eabcc4da4486bca776970f8344f84dc181a72b25a62e
MD5 098a9c708ef53731a4d0b30d92971c9d
SHA1 a701a44060e5fd447171e545c031593b19cfc5f8
SHA512 eba0ba1b181b2f10428262f5efe2733d3a13fa660592672ea3e97b432b829615fe1a63842e7b2aa7daa9cac895fa7987ca58ae5b99ba022ad76d221c29f51335
SSDEEP 768:/rv+4UNbdq32Jq9LLsAAam6aQMGdjWca4GhfBcPeU/:/bsbc3oKmaME6p0H
TLSH
T1CAF2BF31A86C9573DDB7AA99F21B6787BFF021A384D40A80D9D92B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 b5bf1aaae18a18b9539fe8e519079b0f7bb726e995a838b66ec7cdaae5bea4f6
MD5 edd4ef1047b26f48f21b045bff4644e7
SHA1 d68b82b87e197483db9653196f2e690b2a872809
SHA512 da60063067cf126e0b475744d43f9f7836b916b14819a06283811061025bb05f96e064fdcf2e82808dd647ce9bff0ce1a469c8f3924593f7332b87241f15ff1a
TLSH
T151513A850AD112BBABA7BBF00E4195CCA32B3B0FE2E998CF54D04CB565738A355D44E8
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe597296.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe597296.TMP
Size 583B
SHA256 3bfdb1637c346e6ba963f7aba8fc33a2fdcb71b148d6b868b0f47db2c83456ae
MD5 9267f01b9fef9ed2964925a6b9082cff
SHA1 2e245eedfb9c9be38e46be88a9481f0f7aa9e1d2
SHA512 771001a5804f43874e4fd2bdebfa9db96d44bc6bdb3cf1c8d283b95b2533d2a98635b33cfcbb5f732e77390a6d512e78e8034eb18bf92528a4c65f8078bb884a
TLSH
T167F0E131B75644F9F1F1413540DD97C61820E4ED890919DA783BC139E17CF5C61C5B9A
MD5 SHA1 SHA512 TLSH

Submit Download

c98a8d45-f76a-42c6-a69e-003c4b269a42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c98a8d45-f76a-42c6-a69e-003c4b269a42.tmp
Size 36KB
SHA256 21572fec149f104f0fc0db7333052276f694ebeb4696e3580a59058b4c813253
MD5 a994dbe5990d2a910f3f9b82253051d1
SHA1 5ba7211cc1dfe56cd25127de0387c808985405ca
SHA512 faf6a37db3233deaa43519d442781254e3861dc507eca2f621370812233e4ef0a0be8fb2dd94cb7d8d9d3217402d7535064615103d456d890314adebe9aad2bb
SSDEEP 768:Jrv+4UNbdr3Ktmq9LLHL2eAam6aQMGdjWca4Ghf9pVW:JbsbN3K6wmaME6pps
TLSH
T154F2BF31A86C95739DB36695F21B3683BEF0516388C80E94D9DD6A0D43DB49E330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be8c79af-c55b-46ed-bfd8-d5f7872acdb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be8c79af-c55b-46ed-bfd8-d5f7872acdb7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

FaceUnlockManually.etl

Path C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl
Size 316KB
SHA256 fa7d43f1c9ec4f163e09b6427b9eae0cb3c9712c6849a2e4623ee9b7bd311a5c
MD5 8457fd69c379b0352ded998946ebb6ee
SHA1 7009dc76ef4811cdad56366b0946102e8b33ae44
SHA512 e526514e19912f9246d69be195692be266efe90875b61112382b0ce10c6b6b2b0cdd95018608db9e25f4c5dd35d9fcb5fb0d4ec1c86f42f36493da9321b4cb9e
SSDEEP 1536:/WI05PHHRZ7WPeo4eZ2eCFSYN4LprYG53W7ZSlf2Ln9:vZgEw8lk
TLSH
T16C6402F5809C1899D86D2DB4FC2B1FA159832D8709815E354BC2BB3AECFFCD68E50994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads