hxxps://gofile[.]io/d/V0cVrF

Analysis

user interaction
yes
max time kernel
60s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/V0cVrF
Sample260806-eec9ysdj51

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
72	5064	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Essential.exe

Executes dropped EXE 3 IoCs

pid	Process
312	Essential.exe
1592	essential.exe
2836	Notion.exe

Loads dropped DLL 1 IoCs

pid	Process
2836	Notion.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	essential.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
115	raw.githubusercontent.com
116	raw.githubusercontent.com
141	raw.githubusercontent.com
143	raw.githubusercontent.com
156	discord.com
25	api.gofile.io
26	api.gofile.io
30	api.gofile.io

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
99	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
6128	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304618646101731"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{7ACEBCA4-56BC-45DA-B097-43FD534D9FB8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
1592	essential.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3556	4372	msedge.exe	85
PID 4372 wrote to memory of 5064	4372	msedge.exe	86
PID 4372 wrote to memory of 3944	4372	msedge.exe	87
PID 4372 wrote to memory of 3944	4372	msedge.exe	87
PID 4372 wrote to memory of 3944	4372	msedge.exe	87
PID 4372 wrote to memory of 1724	4372	msedge.exe	88
PID 4372 wrote to memory of 1724	4372	msedge.exe	88
PID 4372 wrote to memory of 2300	4372	msedge.exe	90
PID 4372 wrote to memory of 4140	4372	msedge.exe	91
PID 4372 wrote to memory of 2300	4372	msedge.exe	90
PID 4372 wrote to memory of 2300	4372	msedge.exe	90
PID 4372 wrote to memory of 4140	4372	msedge.exe	91
PID 4372 wrote to memory of 4140	4372	msedge.exe	91
PID 4372 wrote to memory of 4500	4372	msedge.exe	92
PID 4372 wrote to memory of 4500	4372	msedge.exe	92
PID 4372 wrote to memory of 4500	4372	msedge.exe	92
PID 4372 wrote to memory of 4828	4372	msedge.exe	93
PID 4372 wrote to memory of 4828	4372	msedge.exe	93
PID 4372 wrote to memory of 4828	4372	msedge.exe	93
PID 4372 wrote to memory of 4788	4372	msedge.exe	96
PID 4372 wrote to memory of 4788	4372	msedge.exe	96
PID 4372 wrote to memory of 4788	4372	msedge.exe	96
PID 4372 wrote to memory of 2740	4372	msedge.exe	98
PID 4372 wrote to memory of 4892	4372	msedge.exe	99
PID 4372 wrote to memory of 2740	4372	msedge.exe	98
PID 4372 wrote to memory of 4892	4372	msedge.exe	99
PID 4372 wrote to memory of 3536	4372	msedge.exe	101
PID 4372 wrote to memory of 3536	4372	msedge.exe	101
PID 4372 wrote to memory of 3536	4372	msedge.exe	101
PID 4372 wrote to memory of 2680	4372	msedge.exe	103
PID 4372 wrote to memory of 3592	4372	msedge.exe	104
PID 4372 wrote to memory of 3592	4372	msedge.exe	104
PID 4372 wrote to memory of 3592	4372	msedge.exe	104
PID 4372 wrote to memory of 3948	4372	msedge.exe	105
PID 4372 wrote to memory of 3948	4372	msedge.exe	105
PID 4372 wrote to memory of 3756	4372	msedge.exe	106
PID 4372 wrote to memory of 3756	4372	msedge.exe	106
PID 4372 wrote to memory of 3756	4372	msedge.exe	106
PID 4372 wrote to memory of 4576	4372	msedge.exe	107
PID 4372 wrote to memory of 4576	4372	msedge.exe	107
PID 4372 wrote to memory of 4576	4372	msedge.exe	107
PID 4372 wrote to memory of 4548	4372	msedge.exe	111
PID 4372 wrote to memory of 2244	4372	msedge.exe	112
PID 4372 wrote to memory of 1768	4372	msedge.exe	113
PID 4372 wrote to memory of 3636	4372	msedge.exe	116
PID 4372 wrote to memory of 1512	4372	msedge.exe	118
PID 4372 wrote to memory of 1512	4372	msedge.exe	118
PID 4372 wrote to memory of 1512	4372	msedge.exe	118
PID 4372 wrote to memory of 312	4372	msedge.exe	121
PID 312 wrote to memory of 1592	312	Essential.exe	123
PID 312 wrote to memory of 2836	312	Essential.exe	124
PID 2836 wrote to memory of 1672	2836	Notion.exe	125
PID 2836 wrote to memory of 1672	2836	Notion.exe	125
PID 2836 wrote to memory of 3264	2836	Notion.exe	126
PID 2836 wrote to memory of 3264	2836	Notion.exe	126
PID 1592 wrote to memory of 3536	1592	essential.exe	127
PID 3536 wrote to memory of 4244	3536	msedgewebview2.exe	130
PID 3536 wrote to memory of 1040	3536	msedgewebview2.exe	133
PID 3536 wrote to memory of 1040	3536	msedgewebview2.exe	133
PID 3536 wrote to memory of 1040	3536	msedgewebview2.exe	133

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5960	attrib.exe
5452	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/V0cVrF
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa710cc188,0x7ffa710cc194,0x7ffa710cc1a0
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,5732818345889160341,1615553147108072904,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16422191448984827001,18236798823471233879,262144 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,5363964549403678365,1607868824149206712,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10062360443903320944,15712977873983854986,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17519787742734384868,2759659302348635924,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,15786843267306422337,14368646079629303370,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,2940464857426912908,5543025642985440085,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3560,i,7972552006624625686,3474817755180456585,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,163815205114927914,3996113871687808591,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,9570387582170603723,6971692144079136881,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5904,i,16629569862668414021,4795325518455245915,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11926989274302671649,8523034899802007596,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11926989274302671649,8523034899802007596,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6380,i,16646180450153053253,4957173068797981336,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3104494437798606670,7499864632669834448,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6632,i,15553727990351586176,1280414988553742051,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4308,i,6901483737264391844,10965827556894127899,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9740694880155984072,12656787457279411869,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,2570742357126397149,14741116727040789202,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4851056462568371835,10304158019115063309,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,8809451392146683313,18364211399024915601,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5260,i,822972297257686451,48626100317511977,2097152 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1512
- C:\Users\Admin\Downloads\Essential.exe
  "C:\Users\Admin\Downloads\Essential.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Users\Admin\AppData\Local\Temp\Essential\essential.exe
    "C:\Users\Admin\AppData\Local\Temp\Essential\essential.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=essential.exe --webview-exe-version=0.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1592.1104.4092778214553849041
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\essential.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x114,0x188,0x7ffa5d39b078,0x7ffa5d39b084,0x7ffa5d39b090
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=essential.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,12839203613076280039,3998900148474842151,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
        5⤵
        
        PID:1040
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=essential.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,12839203613076280039,3998900148474842151,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
        5⤵
        
        PID:3208
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=essential.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2424,i,12839203613076280039,3998900148474842151,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
        5⤵
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\essential.exe\EBWebView" --webview-exe-name=essential.exe --webview-exe-version=0.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3612,i,12839203613076280039,3998900148474842151,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:5544
  - - C:\Windows\system32\attrib.exe
      "attrib" +h C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Essential\lsp
      4⤵
      Views/modifies file attributes
      PID:5960
  - - C:\Windows\system32\attrib.exe
      "attrib" +h C:\Users\Admin\AppData\Roaming\essential.exe\v
      4⤵
      Views/modifies file attributes
      PID:5452
  - - C:\Windows\system32\tasklist.exe
      "tasklist" /FI "IMAGENAME eq RobloxPlayerBeta.exe" /FO CSV /NH
      4⤵
      Discovers running processes
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Essential\Notion.exe
    "C:\Users\Admin\AppData\Local\Temp\Essential\Notion.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,5819352267938119790,14621054208526416240,524288 --field-trial-handle=2252,i,13314851541824878412,2942213177620308539,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6ac1610274f1a1fe7efb487499493de9e02abb0353ede585200d27e7d566ceb2
MD5 9aafd3c6a631d23d2fc5d16d5786b9fd
SHA1 10c1e74766f4f28594e9176e3314d0468398b076
SHA512 ef9b3fe910d4bf60d05f218e85bed9b85b78b05fbdbf92c9c4ca899b3f0468f7fedaaaa159758ab5ed7e1b6e7be9bbf9c3bfa7b175e3267150fc3e925ed76223
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T182B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 57414ffb20311ca9387592517fde1af68fd144971d47fbde06708d07404fd0e9
MD5 ae669b4c66d4ef4bfa9f6b165fa31368
SHA1 f7e94078a4d8d3e468ef3cfdcbdc48c484d716c1
SHA512 82b5819b952c4c50c5a163d8dd1193eb82577775623bb6b9557ffde93066e35ba1f8b507aee98b8e02b1eeea50f17961f82d81d9bb695f2777f1aa4214d75cbf
SSDEEP 96:wyHDCpsVng0+KrOm8TRsbgEyw8MfIeQQp2:wKDCIng0rroY1fIeQQA
TLSH
T11391FA6241B34593E3EDA330D1F1B645B27EF6D0060B4EABF0DCE4BF9A1D7258A16108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ce09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ce09.TMP
Size 3KB
SHA256 67ebfd455d30df2dc3e441d6ae746a4ce14488cfc6b98758dbe73d066d2a0b0e
MD5 58044019033810f32af525d6705711ec
SHA1 54eafb34b31b7e83cdc95b03a64ae751130c61e5
SHA512 86f84e153165bb6886d26eab1219a831e25d6f347d2122c231cfaaedc6e89c313d386bcff12804a3b03e317ceced260d1675aaf9923853306a013118c34e7d52
TLSH
T151714FA241B34551F7ED2231D4F13646327EFAD50A0B8F6AF0ECE47F991E725C816008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bdd2f9b5e72b8d77df3bed60927d183e6e87f4025c19d092ddf9dec70dfbaeee
MD5 7c9a5dd369127db58548d63d9cb1008b
SHA1 9086cf4065e5f673d0f8600e11726bd48b7e051e
SHA512 53c47a90cddc5fdfef21e671199ec7275743821b101815799dec70821ff282a1cd8b72fe54991243000da19e3024939ab3db586d12612955ba83f5b9a62e59fc
SSDEEP 192:sxZaRRyM/jK1Ml8M9M/ffsGRByiIdpjl0HW6+WNexX/YLw8rRIgrJ:sxZar1M/ffsGbyL2HbE/69
TLSH
T15852F7116A346977CCCBD20DBA45BF53D6F50573A2900E94AAFC9A1C04F6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d2b3b4ae48dc917dd8d786241cc2a22ed22a3b9f9a91f073c87813034b9bb137
MD5 92578d5921a97360c10bc0e5edb85908
SHA1 368cc1e550f8c54f305e132a49e3b591b7326ecd
SHA512 0865d46a8cf09ef19ddee9859384bba0c6eafd77fcef0801bfc7d8dc0aa8806fabb83bf08ca46276098dfadd3a9ecd5991d88dd9e230bcba022ba1d86b70fc99
SSDEEP 768:lxs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNCroY8:lxs6pD1WvxzWju1jahILIsNZY8
TLSH
T1C8D2FA3B680CCB7E4F841E5CAC2A6F967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 e3f5039773f63c1e18057ce038b8a8041b46405a95d5df6e5378c656386ff460
MD5 99c7706987ff52223fed38ab67293282
SHA1 945cb2a21602e28e5822d85f0aac28d156f4e03c
SHA512 441cf796b3024231f2f329cecb5c012385e145cd19867787b9cb8025f1b45e4bd4b79dbd7a0fb7f77f4d3e6f8e37b582b8a8f5d586aaa16042793e2bc5adc5ec
SSDEEP 96:KUAAKtePWNKKu0S+FeKWchsAK9aOy+YKT6w27:iiJFxhjn8
TLSH
T140E16B5673BA02023C7D3B0982D497678E82B1637118E46B7BED14738E66E218DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2bff508-a431-4b70-871e-5e5da209ea76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f2bff508-a431-4b70-871e-5e5da209ea76.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5384c6f497a2ced4399f7caeb1d1b3c1133830032d155714148a928570c77d6e
MD5 dc13ede702aff421fafcac63c2595cc6
SHA1 14151da3da7bd34f0488eff9eb239c2f3523f7c9
SHA512 e02c80b53ba78d942ba3a91c50961ffefb6dc8203774879f2f013ec4430772ad53153f55269acadb375e42c077e2574801b8fb16f593cb6c02b29e4115b46221
SSDEEP 192:uNWLsNwGQRQlb7+3vuPQmiU1Kq74atb0M+Fdsh2ue7N5LMRq7aU8:E8sNwGkQKavka9OdsMB+/U8
TLSH
T137321931AC786C775DA3A145F58736139FB44177CA8A2F94D2EC5E1C00EF6AC231A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14874269f562a1fb6a5e6a4a4bbb54a7fbe35b28bfb829987e2e35c3581eceea
MD5 8006606c3329fd366e3c6c4ce2ebc80d
SHA1 f657bb9f9830c3effb2453ea9801c23bc0b14888
SHA512 93e0d25b5e2cbac932b736e39787c163714a381b66f97283a435e1d9a4feb10b56bc0849eb184a092005ae2b2699079391dc5bb7bbac25e64e4e99a3a35b6e91
SSDEEP 192:qONq6O7+3hQmiUyOFGttb0M+Fdsh2uPgGQFU6:qONq61HGt9OdsMUgU6
TLSH
T1BF02F835AC386CB79EF2AD0AB58737135FA5113BA9952F80D6E81E1C00E766C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 52cf275d0203ab98250e9b11c03071395c723b5f78ed2ea6902ca738cf2cde1b
MD5 7e328d912ba89707a40f9fb7994d4206
SHA1 adc1d9916b6d53ad43087c04524aa8a30cc39d04
SHA512 a942a80b263ca11e9eb4345cafa0cce532433b58b326a6cb62134796e3f2b3b1bf27767eefa00d4f4946a0785af533ac1946eb4d9218c4b97cd3bffa8f0d3719
SSDEEP 384:6PiFaZcIEbsNw8TUNTUlIldkQK1vka9OdsMBA/nTKwBODNZOCsWOP4:TFYYxwgYQetgU/newBKZO1WOP4
TLSH
T1F8B27D725C689C7BADF7AA44F95A32078FF441B3D9D5AEA4E3DC9E1C00A61D8130BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e22e4871abdd9e12cbded388b3ecac1684938336d9725934b2c5f7333baf6cc4
MD5 5b8f4a6e35eaa540db39691953a489c6
SHA1 addab6d67ee157231dda446f624d42c7d6376296
SHA512 1055b555573612cf6687999938a178e82f956c085f3ea75a35b14d71832f8e7b674b4797c6ea608e7966f735436d1eba1b0b19cc4f0233cc6a93a9780d635483
SSDEEP 384:yFZcIdsNwpkQK1vka9OdsMB+/nTKwBODNZOCsWOP4:6dCQetgC/newBKZO1WOP4
TLSH
T1AC926C716C386C775DE6B505F94732174EF88173E6D92E94D2ECAF1D00AA6A8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 97f5a72d02f6bca14021f9a10c0e11fe08809503b21d2f0408a085d18cc1224c
MD5 85f6a4f0838713b79639befbbe2fc686
SHA1 84293cbb69cba7555f799dd8c8b248257e560f6e
SHA512 808e59adf4fe810f97c2e92f3196016d0361db71a4f7f0a133da4b7955fbdd7dc2425bdc61d4da30a12cc12becdb443b88e90b511c15057d87a2c3987c7e3a00
SSDEEP 384:ytsNwnkQKQbvka9OdsMB+/nTKwBODNZOCsWOPEa:usQPtgC/newBKZO1WOPEa
TLSH
T105724B75683C6C635DE2B105F55B32079FA481B7DAC92FA4D6EC9F1C00EA698230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 399d6be4654a6ea44f7b616af5c1b468c96cdc2ed02c55a79a154a11f906df64
MD5 7f250deab71e16b22993305153c773b2
SHA1 99196089170302a658d97a2c78b5bbbdfe746fe1
SHA512 bb11c97fca43a5db842cdcd5ede01e439dc5d29dca84c1de0a794fe95cf5a10017680da2261e9779230f419c396db7e24871bf0e15971c626b4485d4d0e2d6a5
SSDEEP 192:uNWTsNwGQRQlb7+3vuvdQmiU1Kq74atb0M+Fdsh2ue7N5LMRq7aU8:EMsNwGkQKubvka9OdsMB+/U8
TLSH
T1F7321931AC786C775DA3A145F58736139FA44177CA8A2F90D2EC5E1C00EF6AC231A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3e8c46ca72b1722f127d6cc145e872e6580d80f2c48aff4a344ab1edde14eff
MD5 cd45860625a47dbc41272e4e9b5cca61
SHA1 e1c8785c69386b6c9a9edd7db0d81b6e302cddb9
SHA512 8bf28a46b021cbe1f98138b2a5e0bbc055466cef7edcb793c4cfb4c24ade3e59cd6889b3981617c81064b0987892054a9f6c25605c5d78371fd12a83c4e72598
SSDEEP 192:2ONh6O7+3yQmiUyBFkttb0M+Fdsh2ue7NKcNRq7aU6:2ONh6Eukt9OdsMBz/U6
TLSH
T1EE120931A8686C675DA2B545F48736134FA5427BDE8A7F90D6EC1E1C00EF6AC2346C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2bfa941-1796-4c7b-bdfa-8d4c6ed9fba3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a2bfa941-1796-4c7b-bdfa-8d4c6ed9fba3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 adac8ddaf458dd67933cdc238e67053d7dce22680a9f072d497e6eae3a30b216
MD5 bbc187aa2163b541ab028d4b983c665e
SHA1 341e340674feaf05314aae91c4eb7dbac205e000
SHA512 1f610c7061c5595b68e1a86383c50886d6a4b61729b3ecc89d0a7040ecd7e3fbc29ec73782469b9c32d64b78ea66da37f957291b95858abeb5186b86dca9e3ad
TLSH
T1A7410B58A6F9110CB7B76F1AAFF6A46E447BBC773E06C05E10110D4F0666A40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

DWrite.dll

Path C:\Users\Admin\AppData\Local\Temp\Essential\DWrite.dll
Size 13.8MB
SHA256 b6143a728028a2cd2e12c13b271b02305035def4a40bc0e27d996637bc6ddec2
MD5 2c1a7777d23510d9cd8e6f5681f55649
SHA1 50bd66340ecdea8f313940f03217d70fd6d9c4b3
SHA512 2326d1bbb004be9ff6aa643d5da3f1fdd5dc493fb1f6565de590eda59b1ec4e4fcaca99c69f8d48069b046f263a28714a18d9657c0f3742a001f924dc4026c43
SSDEEP 98304:5ioDvvLqzB0qvsBMJ4kqBvVMyrUx8PSDcefrY/bx9f13xDWpfbgXxWegdi:HCZTmTVwXY/bx9frDSgXxb
TLSH
T1DDE66D43F25205CDC66BD636CB67A336B635B2946621BBBF0E488E31BD52BC14B0E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\Essential\beta.log
Size 158KB
SHA256 a08196f7a2b8c0019fbd985a76ee40a3f2fc07b62bba990a77185a6beb5d8bfe
MD5 df13194f84f82c65a220b5e8cab5a24d
SHA1 dc66ca1e324806071f269f7f55ce29e8e391375f
SHA512 53db09180fd84679f207263e856781b47efaebe1ec359d743c5ca955b7a057d73d809bbc7a46cd780765d32d0fcc1c4846be8313301fc0751d8a8c12ba981b86
SSDEEP 768:XPivXhT0ckqKzEAoJQKomMdOYtFlQJg/UAFwxy96/IPG24tZ1H6/LsyuWGi9b8hT:0XR0ckqKwc4n1H6/LsyopG3W
TLSH
T195F32D9B85FF006FCE6B6649E70C75D9BE01B64316A78233F188344C36A920729DD9DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beta.log

Path C:\Users\Admin\AppData\Local\Temp\Essential\Essential\beta.log
Size 159KB
SHA256 f1d82e75fe46bc9fdc1cabc5580d8329f8f1bacd484e23c042e2c696803a84bc
MD5 853c023953c1e9853eb898589c3f9ed1
SHA1 bd2e40348cefc5d030421e19231c762748a751ec
SHA512 0281d46d83cb6d4479709d18602c3a1ceb1fba5a8c025df9768d5c4b03b54adfb645fdedd9b398c8a2af2684a1c6071e255a9528a1e8dbbcfb80c32310709ea5
SSDEEP 768:XPivXhT0ckqKzEAoJQKomMdOYtFlQJg/UAFwxy96/IPG24tZ1H6/LsyuWGi9b8hE:0XR0ckqKwc4n1H6/LsyopG3x
TLSH
T18EF32D9B85FF006FCE6B6649E70C75D9BE01B64316A78233F188344C36A920729DD9DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

essential.exe

Path C:\Users\Admin\AppData\Local\Temp\Essential\essential.exe
Size 22.3MB
SHA256 643aaf0c44d1c01b224b2a0e19e17dfb0fa775c4d5e965f4b08a24cdbd48ebc6
MD5 9499e54f1c0fd3f0a6388b8bcba563c2
SHA1 4dc6ea97d3bc2dc6ea1e0e04bd60b7290c7d0571
SHA512 654e03a19d5e5520d646fa7efea67182e3fefb8ac7b669e9b257c817956c06a5df9d9f28a76d5bf0f0022111979bf3d60635f819ab1df7a0764be74437bf22cd
SSDEEP 393216:LxDHeCzZa7DWxGAvHurXBeFtpZzz0pamnfj4RH:dDHeCzZYDWxvOTB+12Fnb0
TLSH
T1DC378C157A5B99ACD59AC87083474AB34E2170DF0A36B9BF44C482393F7DBF46B29318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\Essential\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Temp\Essential\v8_context_snapshot.bin
Size 696KB
SHA256 66acb606e8194e2fc6ec42e6c627ad67461e8fdcb258b05ab07b28eb9bd8efcb
MD5 53f9978dc1dd87b42416c4a16ed5cc2c
SHA1 68efce248963a568e5bdc2c0ec33fe9f7b7b0594
SHA512 2f5d11c4db382fd1c2d4b9bbbeaef1f43d66a40a4341f1420b6c3260fcc0f04cd692278b7bc2992e3189881961c8b63e14a5760b15dde9119f076eaca6b72da9
SSDEEP 6144:laf8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:laf8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T169E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies.json

Path C:\Users\Admin\AppData\Local\Temp\browser_data\Chrome\Default\Cookies.json
Size 336B
SHA256 5d4be64e74535733948d08ac134ba6f65699f3e1447d45db6c0e9da64121a97e
MD5 ea0ca0c964bc7c1e94df031df191ece7
SHA1 c0162976af11ad68937716f76eebab330b7f2c3a
SHA512 7359b86a5da94189acbed8ba343af405056d3e3425bfe675741ae9c49d2b4b296673b5922808a98e1a8905336a5e55cc8c67b6c9050dc89aac50c33bd96c4055
TLSH
T122E026EB6EC10830CE554934A8916B5EAD75252950AECE872BDA4288B8547892202ACE
MD5 SHA1 SHA512 TLSH

Submit Download

info.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\Chrome\info.txt
Size 477B
SHA256 90bdf7f8f521ec291d38517908b54a5d8e9ecaf19296d115f040f8b785729dd9
MD5 bff931af146cbe3ef9d660233303a79a
SHA1 947840d16caf56e2714fafcc7f68cffd4aa8f928
SHA512 5a8590564632785b056bece32aa84eb385c29551448ebfb78d86b8ddece675edde940f87b2282abe2ff3657b3c8d14c3343eca0b1e9f63cc0422e59a44b6171b
TLSH
T19AF0A74579C6C63F2070D0F72360F34DD8D09A18EFCB6A0B6B069808A6DB80DB9D4365
MD5 SHA1 SHA512 TLSH

Submit Download

info.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\Edge\info.txt
Size 480B
SHA256 bea0a928ca0a5c7996de13277c012aa02e7a6d02b29b78d1bface4e45beefed7
MD5 45f925587cff0b23140d13bc98c83621
SHA1 d8b24c8868b8a7f593f6bf942d0eda30a475ae1d
SHA512 1aafa83b46fe8dd594e40f3ea86707ee3ed3264afdab6d0d3cae338aee85062632dc2f4c1490b7f1673628038ec89ee4e7a22cb957a6bc333889769f3d147b4b
TLSH
T180F0E914F9C5D63A201074E60261D34C90E09B1BBAC17E0677048D04BA4748FF5EA296
MD5 SHA1 SHA512 TLSH

Submit Download

browser_data_0c9b19db-25f6-4394-87f5-1d973edbc80d.zip

Path C:\Users\Admin\AppData\Local\Temp\browser_data_0c9b19db-25f6-4394-87f5-1d973edbc80d.zip
Size 1KB
SHA256 27473a44ce578f7951a7416b91a77c8ca29cce524ab57362a65339c5894828b9
MD5 fe93cbefee714d25f0cfdb651cf687c3
SHA1 22a7dd1b12b7d115151104bb5d51c3ca0e1441af
SHA512 3ab551d45a7c987437a6e698ec9b9eecd2340694dbafb5595f2b84cf3df1fb72d12f04e18f24599991229dbf37fce788aae7a93d6ed151dc8533b1c1163b639e
TLSH
T142313210BDAD0ED9DD9ECD38554F56012C3ACE5968CEF1AB340E202D5793AC70D58AE3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7f6459ff46bb3e7f0f045ac040476d4c0dc29a7de4dfbdd640c088df9dfb0c62
MD5 ede443ffe70818cc060e1a71b4088721
SHA1 51256cdeb660e5bd9cd716d1007c333214e225bc
SHA512 dd1bb1dcf32047952fe99cadc95c80551de3025c164feb753f3bae96b8ccd1fd554a99fed9e1a25d698d14de9f85259dd9dae0f14994abc5b87d662f149c9e49
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5369f0b5e0a5a5816841eedff70e0b59e7de2d7d7ac0688442d826b565bfaaae
MD5 1ed74c96bbcab5eb56e9ccb98fb7fba3
SHA1 a49f764c10c55f27d10e75b44ed90dc7449bd84b
SHA512 4f6826e5cf8d438bd0c87d9e5637319ad566b6048d68a20af85637533fc514f13cbb3869e70c84937a1a7ab5a1f5c1af87a282e104744cbcf2c21b07a31967a0
TLSH
T1B8D0122232010934C01024330042B10A1400C60B80454000B529E56E2A580901D12881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 1KB
SHA256 c3b2fb450098c006e6451f63eeb34558d89361a7ac25f40db4e1f46351f4f010
MD5 02b4bbca3c6e608be77e03af7b357e28
SHA1 e2eced64f3944599f10e9270d51fe61d4c88b848
SHA512 919995f067b0b33a6f623c62771c1ea744e1fb49ae59394dc84114f217cb2b25c624e243ca3155f1e6592335a6653bfc787117d846aadbbb05a2cad48cbc46db
TLSH
T1C9318572E8A43F367D83654876637AF76E215137C1009E44A1EE0B2816E7A9C562EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 3KB
SHA256 2ab4b250d99a6d33774fee31d4971bc05cfdefaedd317eef9402b0ddabbf6f91
MD5 7cbc16ea416cbb66444ead18b0817816
SHA1 cb4b824ee8445a30a8f104b8198afb88aec392a8
SHA512 343495f92da0cafa826b48510a603e2c51070ee3ca4e685826965dd0b5231c3e5beb2652566a33419c3fd1ede75f7e9a49617b222ac427488939f682ea15254e
TLSH
T10871E732A9A4AA375EE39904BC963B26BB614233D5C17FA4D5EC0F1C02D77982346C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State
Size 2KB
SHA256 62d18774cde8d409a352971ed32a6964d47badf33810b78a007e9bfdb1a47deb
MD5 e3fc95ad233daf3724d8dd5715808397
SHA1 1f3b6b10debaed7df33dbde4447d71d88646f0a6
SHA512 7104c94b0f97f68ba52c9ed1abdfcf724ec961eeb7c475eb65f552c4383a1988e668f5ab38b383fe49fb5d2b1be9c2174c7c6b43b11e305234c9f788e1d60657
TLSH
T10651D672BC046B37AAD346087D663F73AE364263DA526F6095ED0B2C02D765C230AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe594944.TMP

Path C:\Users\Admin\AppData\Local\essential.exe\EBWebView\Local State~RFe594944.TMP
Size 1KB
SHA256 c035c8334826a5f31c26a4e7f40058e9b4811db8ede7d24cd6f345ac80c8c6b0
MD5 12f5124b120b75a9b71469fa27bbe4b2
SHA1 a164fa9213ee8ed986dffd0685c84538f4ed0e08
SHA512 971878a345f928ac18a27efcde5a5c9306d7e28c78922ac44070420f4629582034a7c930f6cc08f446054c8ca1ec4f840fb41512cfba54bccf19bdeacc1b3ee0
TLSH
T1B6219572D8943F367D8254447663BBEB2E105137C1009A08A1DE172816D79AC462EC33
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\essential.exe\v
Size 8B
SHA256 e3121abb19d064148aa27a37c91ba2eee99940accea3eb1adea272c5a555df70
MD5 07c487b441fc294e19d48094b23ca80f
SHA1 e43cc175c7a56c5d600924ff63763bd78bbb2aac
SHA512 fb33f7b3d9dd2a2e79bfd1f5b5aa2bee3fd9d3ae467344dcc0e2079d084b8ed4ffd6aa33367b5f49562ea82230770800fe8acb813fba58e6d904623cb87c07bf
MD5 SHA1 SHA512

Submit Download

memory/312-341-0x0000000000320000-0x0000000001320000-memory.dmp

Download

memory/1040-435-0x00007FFA7FA50000-0x00007FFA7FA51000-memory.dmp

Download

memory/2836-647-0x00007FFA58260000-0x00007FFA58C23000-memory.dmp

Download

memory/4904-507-0x00007FFA7EB90000-0x00007FFA7EB91000-memory.dmp

Download

memory/4904-508-0x00007FFA7EF40000-0x00007FFA7EF41000-memory.dmp

Download

memory/5544-537-0x00007FFA7FA50000-0x00007FFA7FA51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads