7f62ddc035e0b408bbdf46920772feaaa06e65662b67b000da0875bba0949d84

Analysis

user interaction
yes
max time kernel
66s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NOXPBPV2.exe
Size 107KB
Sample260808-2m6msszvbx
SHA256 7f62ddc035e0b408bbdf46920772feaaa06e65662b67b000da0875bba0949d84
MD5 6ded3ef5fff5c976eb6941c3a52fd49c
SHA1 51b8070fb9a026448cd8920c2f52a9d847b5c358
SHA512 30ed1a396c70557460114a5ca0df6310938ac29e25ce8cf98a83413179442fe5a5303cb01aa0f94583c698b1cc69ddbb863fc0ba5a1b7489b9884a70ff2b2d68
SSDEEP 3072:vZ2mAJocBGjHfsT2pl8qidSUfQkHuIxte:vZ2mAJpGjHEib8qi9fQkHuGte
TLSH
T19CB35C17FB1911BDD11E86B8C5534D06DB72B89107A1B3CB6BD08AD60F569E8BF3EA00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	discord.com
24	discord.com
26	discord.com
43	discord.com
48	discord.com
49	discord.com
51	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1688_1704254045\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1688_1448471272\_locales\hu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5824	msedge.exe
5328	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307026408145033"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1B20EA75-107E-4B90-9BA2-FB0AEC9741A0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{E6316E51-506B-4353-BF12-CE09A6B43C58}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{BD78B7C0-C4FD-4FE3-8254-DE061A4AD78C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1688	4744	NOXPBPV2.exe	87
PID 1688 wrote to memory of 3548	1688	msedge.exe	88
PID 1688 wrote to memory of 5328	1688	msedge.exe	91
PID 1688 wrote to memory of 5320	1688	msedge.exe	92
PID 1688 wrote to memory of 5320	1688	msedge.exe	92
PID 1688 wrote to memory of 5320	1688	msedge.exe	92
PID 1688 wrote to memory of 4136	1688	msedge.exe	93
PID 1688 wrote to memory of 4136	1688	msedge.exe	93
PID 1688 wrote to memory of 1672	1688	msedge.exe	96
PID 1688 wrote to memory of 1672	1688	msedge.exe	96
PID 1688 wrote to memory of 1672	1688	msedge.exe	96
PID 1688 wrote to memory of 2672	1688	msedge.exe	97
PID 1688 wrote to memory of 2672	1688	msedge.exe	97
PID 1688 wrote to memory of 2672	1688	msedge.exe	97
PID 1688 wrote to memory of 1904	1688	msedge.exe	101
PID 1688 wrote to memory of 1904	1688	msedge.exe	101
PID 1688 wrote to memory of 3460	1688	msedge.exe	102
PID 1688 wrote to memory of 3460	1688	msedge.exe	102
PID 1688 wrote to memory of 3840	1688	msedge.exe	104
PID 1688 wrote to memory of 260	1688	msedge.exe	105
PID 1688 wrote to memory of 260	1688	msedge.exe	105
PID 1688 wrote to memory of 260	1688	msedge.exe	105
PID 1688 wrote to memory of 3900	1688	msedge.exe	108
PID 1688 wrote to memory of 2604	1688	msedge.exe	109
PID 1688 wrote to memory of 2604	1688	msedge.exe	109
PID 1688 wrote to memory of 2924	1688	msedge.exe	122
PID 1688 wrote to memory of 2436	1688	msedge.exe	123
PID 1688 wrote to memory of 1896	1688	msedge.exe	124
PID 1688 wrote to memory of 6104	1688	msedge.exe	125
PID 1688 wrote to memory of 6104	1688	msedge.exe	125
PID 1688 wrote to memory of 4704	1688	msedge.exe	126
PID 1688 wrote to memory of 4704	1688	msedge.exe	126
PID 1688 wrote to memory of 5936	1688	msedge.exe	130
PID 5936 wrote to memory of 4644	5936	msedge.exe	131
PID 5936 wrote to memory of 5824	5936	msedge.exe	133
PID 5936 wrote to memory of 6048	5936	msedge.exe	134
PID 5936 wrote to memory of 5332	5936	msedge.exe	135
PID 5936 wrote to memory of 6048	5936	msedge.exe	134
PID 5936 wrote to memory of 5332	5936	msedge.exe	135
PID 5936 wrote to memory of 5332	5936	msedge.exe	135
PID 5936 wrote to memory of 4712	5936	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\NOXPBPV2.exe
"C:\Users\Admin\AppData\Local\Temp\NOXPBPV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Tvbjphxnh2
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,11025603015933510087,3739460100177273346,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1844,i,12178409529479584211,7738345099112597471,262144 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,14509017699726546767,18200417994721962442,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1813838162295602282,11393507726956682340,2097152 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,14794779450287510536,18038002778269604329,2097152 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,75645441600406196,4711524351189239462,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8741241012686777776,274064595010754463,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11994160096016611505,11538268464460390945,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11994160096016611505,11538268464460390945,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5996,i,465052963870559037,12481401748018745454,2097152 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,7124046209336538204,13015254327849134897,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    - Modifies registry class
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,17248849677447864122,6049954409880048092,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,5437081171284645650,5248175575870485615,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,3912842061639022461,2466165238373950325,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,11314297349642041055,6499958983931960046,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,7493147421982786558,5763557565805981538,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,3580790430822953563,342979962624087330,524288 --field-trial-handle=2316,i,2290933625554362325,12130498926418076108,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffaa0d2c188,0x7ffaa0d2c194,0x7ffaa0d2c1a0
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,4938915187365402615,7982733965127406643,524288 --field-trial-handle=2640,i,12568176903090431026,3949138367105745522,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:3
      4⤵
      System Time Discovery
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16546885444433743206,15300902433012651988,524288 --field-trial-handle=2640,i,12568176903090431026,3949138367105745522,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,11212702772015315763,2713411718009179535,262144 --field-trial-handle=2640,i,12568176903090431026,3949138367105745522,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,527777451674155172,4656888785311357646,524288 --field-trial-handle=2640,i,12568176903090431026,3949138367105745522,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,527777451674155172,4656888785311357646,524288 --field-trial-handle=2640,i,12568176903090431026,3949138367105745522,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
      4⤵
      PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 406e7c7edcfff381dae0011c6c736d968f75ef9fe94379575d6e7d534fef8a28
MD5 79c1fb19453a711f80a76228aa029ddf
SHA1 cc58c6b526aa44fbf712bd49a5b3d6b3629387cd
SHA512 2b533049efc6deefdf16676e9b78ce0a9da1e25ee089a31db9602002415956d2a0ddd2ffd8374c39023ba7a264569a0e38288723c0eecf7fca83f200c19fd673
TLSH
T136D0A7F8A746A260D12E09316824A610B76946A038A7D722D079680DA99D028A2EE189
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

1c08396c-d84f-4673-b317-e7e518ae6342.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c08396c-d84f-4673-b317-e7e518ae6342.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff1eff77b9852893a9f31177e953c1ce46247ef8aa8b56fc4bb8c5ddbd0dcc20
MD5 4b0d7d4a3666059983d4bc6a99a646ca
SHA1 3224fb1d1dcf90ac2d332a8f41161c563e8a2365
SHA512 07418fe0d6636d3efdce76ecd8980e41fb8a130ee5dd6fbeca63be9790ce24949681a0bd03dc20ad92365665e13c00a93b8ccf2a80ba1ad9bda0284bfc90fb5c
TLSH
T12BE02B76C821FC2718FD076860095656E704135726515D5F7A3C920D8FB473A45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 e4b500ba26cede3e39d7477b582a1f1c6b156a4cdffc25835ca834b4d5d2f133
MD5 c14cd60e1a3877bd06d2dc0cbd60f4ee
SHA1 820dacf6e2b81ace75970a8cd9497b8728941246
SHA512 d75f8de27fd93c7614691154ef4cdb3983585c45868e1d5a90a5fba3b30e8988dba0afe00657c50a3579e033e1ac4d74f4bde541bf4f76e2b5fa07d46355f08f
SSDEEP 768:fKWXlnLthEVTrJ4S7p+VtWarZCTv8s2F9NymzpU:fKWZLtqVTt4opKrZCTv8s2Ff
TLSH
T1EF13193CFE554EBAC9D3003D181B97746F38DC39FAC002676325B02ADA56B1E5ADE918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 834db0691ecc625299111ada4f07d61e52b7c9df16f0e95ffd68947b6def4300
MD5 f6e0d731cafd687ee14338cf47187d8f
SHA1 010c8219c31faa2116607670de9bc2196f49ae5c
SHA512 f22ee83faf8e0299b2d8b57e8e491053d98f56bea727e991c5a6d84520726181c76a31ec2a83b9d7b2bf483c33233aa1bf474a0ab2045e6f10800c87526d4816
SSDEEP 6144:yL/kL/DA4eL/PL/joLRG2oHP3bZq81Jo1VjmRMEho:yL/kL/6L/PL/+RYvrZq81JSF2MEho
TLSH
T126B4B5F78800587ACB7C12F593033A7CC237458D3DDAE9DAF57A0C996819B26B1A8DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 3.0MB
SHA256 5bb10100fd50a9963cc0b46b19ecea446d29bfccd3b7ed92d795014cee0c3717
MD5 90c8636aec7ce652c22eddaf03f558df
SHA1 b7e0facd204d1bfa476cfc283a10c71500b2c6d3
SHA512 f97b0fc68d6727928f3dadc01f084cc189b4d538798c9a288b57d6f6d9edc4a677b053d77436ffd2e32eb8b670da511a81a665d44460967d7fecfe27a4c2f43d
SSDEEP 6144:Ff0v52gQhN3IcGunZRauF9bW7ktwQ7VVE74IuEVgjevIob9c3hGYmtJdEt:WgXj3DjnZ8uPbWeLVl6hJqvmyt
TLSH
T124E54BDB87787E92DBA6DE70F9C4EC5A3EB411C2AEC6E0432402C67911C37C13A9559E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0c50b2456fa94d330a707d10158854a03f31b07ef9a1fae49ff9e04ae90aa9c0
MD5 e6f05acc992006bdf03f5a0446d8bff1
SHA1 f5bec84bd13261e489700aac224a0e9999f76a16
SHA512 b2c3a893be494949707c4057bd07eb1d24106a51125041d7fb092dba1d2f1cb4c6704d453e2ab307cd1381d0db5fa3df742b8ccff250a9ee92ae6f17a2ed50d3
SSDEEP 49152:qY1OmkvLlPTY+Py493sIYA3/EBFKpgGw:qV5vBPTKRIYAvEBFKBw
TLSH
T123169EEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 7cbe0c33180c3118ed975ffb1f65faade38c85bf1d55d2d9504049bbfa89326c
MD5 7e6199bbd5d1911b89a65c9ba8492e4f
SHA1 b5eb73945d809734fbc650b196f606a074264ce9
SHA512 ea8e279cf300415e8400b92d3bb9103b66e1f08a5c1f43ff1cbdc424d20697cc0581a5e8e5469248a38e9e354e4a040bcdc017ca16b40a58b0a2db4822d06304
SSDEEP 96:zaNf2IsSXp2+nVUGISHhtA1ll61I1Y7RMMPbvkonCl2OL3hpnzQeHlb9LOJF6uA:zQf26I+mgA1Y7RMKbv1CLhp84KF6
TLSH
T132F14031CA472AB9EBAA5131DAD021D67C30EDC5FA03BDA523F0BCF1C546B6D00D66A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 69fd7ce950ace612c5a8ea71a901698864f516d694b1f6614bfe297dd25ddfa4
MD5 eb7584ad193858dbb6f6141135a6fc55
SHA1 27092351cbb7f708ca25c2112fe9c1450f58dc2b
SHA512 d4fe353027993ad428f2ef90cce065054844eb003c36b1a9cf3348e87aba8cc5ccff47650dc15c6222e392b17d904c9920f62888df0cc287ebbaf3d559c4a929
SSDEEP 3:MsEllllkEthXllkl2zEklkE/:/M/xT02znkk
TLSH
T1574404057FC00415C7045030C013C3700371D5541531F7433475DC13DCC5DC44C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 38a439caed31ceb8611b71277accc98a423edd0f861be27e7c6c2b055c0fbc6c
MD5 ffe40cda44e227ac555f4a3f5623a253
SHA1 5d84f376824a05e24120ab3f9db18bff2ba8e18c
SHA512 5c37659979b609c186c41da576dc9e3f5e02b00daca9d5b4a9b6853cc0adf41ebb9a0a1e3f773681cd027cec57f638b55069a6ff6c03549dfeea4524638f8e45
TLSH
T103E0D8A4B4D6C25DB924348771385B48E1C07667DF87AD436704C8C17643045B285967
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 d9c0b2beb8d2c4441440a0ccb8ea4d3d7f446a27ecd0ba65a06a51825995476b
MD5 c3b79486cc7bba97963a56f030932f38
SHA1 6235e0678ede664d222d7644ba71597f94784f36
SHA512 6aaea0a1ccc0458cde02b328bc7eedc91c4b5488b72b16ed9479c2ee0d1cf9bbe987f4202d2582195e8166989ebd5a2891e8093b0dec63377783741c42b3f0b1
TLSH
T186E0260414C8C269A61868D7A6E96788E3D2341BAB8A3943271E98857101ACDA3CAEA1
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 51a9cbc7af3d1886272d4b3b6d23f7f582000f4d0d03ef96f64308a66f4a2d2d
MD5 d42eb51c9bdaecb48f051b69d0d57cc6
SHA1 02a68fb7c4fd2513d34cd90cd50d4be37bf10c4e
SHA512 f4ff9a12352305f3c154fe6340d6a778ee8bf8a4b58ee38147549fa20d530a6c7a4e5aa5f799774bb923b048913f54b7a4fc42853ab3cb3e009fa12f93a624db
SSDEEP 48:uzBmw6QU1PzmlwJOrZjrte3FJu4yeRvXDGg12AxyUI7:6BCxmlwAr5M3FJu4yYvXDz1Xx8
TLSH
T12192C6470E797C53E7452B7A2A2B4879C93BE19CEF95CC89302550681DF8252A03A4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1f3e759057105d5ba145198c9a8fc2a73b9a2bd4b02a3483a8a89a06f7fe1a6e
MD5 9847892e104d32e17300bc0043b0af82
SHA1 8c0490d8482b4131dd48d7d5cb2102fbe461679d
SHA512 5bba5b3249e73737cea21c904e697f3309a76a333df7039577bc913114fbc182f7f7f4c89050f0f43439aaa02fde050aa645d3028213e28bfb101af94758a36b
SSDEEP 96:sRMIU+bGz83uy3+u4tgp4DLjGQLBze9z3HrjBHMsDEuspU0wbtqrOQpPfR4J+MC5:sMf+G83uy3Ct7XBBKDZH7DXspU3iD
TLSH
T12A14201F4F642722CDBD517669EB44E35D6CF03F8B1266CA686114B4CEE3652A02C8AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 9KB
SHA256 c095a1d220fefd1e1d633fbdf30a8328bbf2186fbfc5ecaa6cf34f4b489ad60a
MD5 06674be7a74454de07ea01c82e8a6fa9
SHA1 392040228fd99319f9a1108441ebffc0b6dd20dd
SHA512 f15a64bdceff59ea0e62aab608d22824cb0becbc3063e574fa69f2f5f784e3039b83b2d122fbc9de4aea9ecc1138898dbe7da748f3ab91b133380ac45ecf4473
SSDEEP 96:sb2nwejQjQ/GZtZZfEADZXYAyKU3Q2mIAMuUOv3y/KPJKXl+CJF9o1uqNXTZzgTi:UGjQKfuU3Rjyi/ZMChWjv2Ol
TLSH
T1AD12313FD408847E87778737918B391ACBBB397E184CF559D0C61D0C066E6AE1511AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 974b40cd4c44b425633b5cc6ff9c1592237dcf32f673823aa9a69673d211aa35
MD5 16d36fef824b248b34d3a7ba2bf5df21
SHA1 a1414190942da9fdcf28bb2685cc2cf1961efdb8
SHA512 12ed0bb410c3bf1ef5f914a498dce4b967f9f916f88ce7b41a4cfc0ed3ce3cd031a694e3c7c62325dd788856c9e4bb16ade8defd4cb1f7ce9aaec1d0b242d2e8
TLSH
T1AFE0D861D8DDC2D96608204B72A97B08E3E03817DECA6E471B09AC45B00144CE3C1AE1
MD5 SHA1 SHA512 TLSH

Submit Download

1ec066a9-8e1f-4757-a39e-1fa78e3cb366.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ec066a9-8e1f-4757-a39e-1fa78e3cb366.tmp
Size 3KB
SHA256 7935b29b747085a75784f2825ff005f1aa69e009139a67a295b8ec8d07e81841
MD5 9cba950acda8d25bcb3e420d995e2745
SHA1 9a3ce20d68fe2d5cb6f7ed5bee03952943602184
SHA512 ce85f933380e3b58c2dcdc502800ae999e54d4937f7815c924fe56877c1f81a82e2803e277268a3fd8fc09f19dbc913fb0205bd5c7ed0592db471b51022e6ad3
TLSH
T106619EF3C3E8862DCA1156F4AA147E1FCE2D0924432C3D6AC5E4AE5BA3E3571E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 56f73d4839efb7aff8756602f9b9ee2a2967d95e1ba09f0e791c2655a6001870
MD5 e5f43f4088b374845741546d37db2f17
SHA1 cb2d06db56db87f5064d0a26328b1828867dfb97
SHA512 9fb824cc60a8eda36345a4ab04621ef4279ba98a366db6e9962f63def166e82505bc639cdcc083f3e5e1e7f34c6e6880f124c0e4ffc927e5078ee29cf97a4459
SSDEEP 96:deMatUaAAySO88+yL1euygVxckCN8yHY+ymZA:dLaSa07Mu/VSk2hYjmC
TLSH
T1AC92F80F1F202202D2FE53B7EDE1C5951F2C2568D737799A686C51F28CA0B5779428E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 ef812bdf2e855658bece634037f7abc365f9f4e71b73bad4af27de1f81f73ad0
MD5 72da26dd6d9f9e640a655d60d3050d40
SHA1 3dd0fbd08f96a90ac53a8a3dbe81f005f8a21da2
SHA512 d064e4485d60f6c07d46fb6ccbdf5b59878af3fc287a1b063b5a2f0a38cc834e9e4687eb6d79fd9e52ab4ceb3230d97ac7793923d3a721dad55921123d10006d
TLSH
T18FF0E993C4FAE83350385ABF1D807C053D769430015654E6DBA6826DB4E84F7572243A
MD5 SHA1 SHA512 TLSH

Submit Download

d3f96b27-7c0c-49bd-8371-847d18ffbe95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3f96b27-7c0c-49bd-8371-847d18ffbe95.tmp
Size 1KB
SHA256 2e248ff97086628d511e0a796f4bd02730e1b06573222299159b6e4febf47c4a
MD5 c8d9122bdac5e136117d7eed86f19152
SHA1 eda10e7cddba72ce0a920990889aa1bf2e45f258
SHA512 1eef02516a448015096a519fe18c478fc57b5143a66a19f78c8935218f007a94a86e6a7b0b382f0facdc1cbd72a5dab24c639d24095f8fb21e5f50844913cebf
TLSH
T10231D1F383E8856ECA1195F0BA18BE2FDE1D0510432C3D9AC5E4AF1B93E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6ea82dea952f84726aee9b718ee06f09a0fb2aec15982b79a01703e29377ae7e
MD5 bdd5f1d4fe950e652ee86181d91722f3
SHA1 387483b15fbbda57b3c53c3c46c2f25b39870b4f
SHA512 e1573c5fea1d188afc9c5e05efdb4a052caa9b63d92b56017ac82c3a62613fae84820e05e29a07c18f78eee0afe675b3b66501847f86832c141826cfbdbb3fc6
SSDEEP 384:sxZsLtWlE/ffsXWvZUWzIKYORVHbuX76gxh:swAa/fkYZUWzLHbI76O
TLSH
T14C721916AA34997B8CDBD219FA457F53D3F80063A1944E549AFC9E1C01E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6de2a7876ca25d9a8a002bbd42f1cad07da626708c1e3f750491c1f3a9e31b9d
MD5 88b0a4901d0654895c1cf37ce78fdbda
SHA1 12b0443c1f674a25e535d723c75fdb3dd504575f
SHA512 4e0ff5cd8461fe6a21793f4da4b5295b959d0459f831d216842f8a8a8c8f68ddeeadc72c6160fe8ba40856f95187e72c227d0e1f96c79723c33b474dac97dd24
SSDEEP 384:sxZsLt7lE/ffssChazIKYORVHbY/o6Tja:sw9a/f1ChazLHbKo6C
TLSH
T1C76209166A34997B8DDBD209FA45BF53D3F81163A1944E54A9FCCA0C04E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 04afe376c5a89c48c1cb7671b9ca50f9d2ec0865f3e935165c933f8fb6a118e9
MD5 94d3d4b1d1cb3ca0643c943821810da6
SHA1 9b0cdf2d180e23fa82f555eb0c2d60bbf503887a
SHA512 0a0ea813eb191d730be8b0b6bb76b453658f8b73421035c8a726a5876713cbfccfa6e805824171937fd3cca34b5bcfdf2ca1f373491fb9cb15ab6140f92ff002
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeysy10Lld:eY8Od/HEnFhWvFvQXu1jamt10Lm2NuCn
TLSH
T15DF2EB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 419432531a4c87af573cd91999bdf203440d33fb7fdbe81e0ed443c23abcf237
MD5 84c475e574d51a8095fd7199fa2d1ae2
SHA1 a5c3d7131d536ade3334019538a7385322d31453
SHA512 07531d937bcae0f22ddbfe087d20a21deb4420ed454eb53a3927f4bf521e1aea2d8bd570133f6acede10a38aad0a246e2a76705c7268d6709dd0295b59d54530
SSDEEP 768:ZYsv8OdvsG7pLuLfWhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUysy10LlEeY:eY8Od0mEfWhWvFvQXu1jast10Lm2NumK
TLSH
T183F2FB3B6C0CCF7E4F844E9CEC2A7F8A6DE8028B5698895447F9844C02C76EB16175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 aeddbcd26157d30ce8564070892c8ae979151b2ca7048a653b0501cc25301afe
MD5 0cd4c64fbdcd8c59694a5ee52b3e799b
SHA1 05e31f280e0aa7ce86d886e80501e96a8b92e3dd
SHA512 72f1435ca4848cc1643de57487f73125dc5caf39d51b7c2ef3f6164d78e8b5232f76285955e792e6ab9b681e6cf4c7fc22e2d7dff52c31e246637ef520b043ac
TLSH
T16CD09723F46800C0CBBB8BF15231165F8B702CCC145AA088F403203E28B6B93A210F53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 21e37737f025f2db6eef0b5bf15f0f306c5a8d238738402de8dd97dcb2fd8456
MD5 fb80a22a174b3d4635095dd594150184
SHA1 d24f973dca02357bb3bd654f56930dd3cc3843ea
SHA512 653a81fdc9db3804be5d53c1687c95655ff3a9315ddc42ebedc2f0a74d8f3293f713a0466395b489b2291a6a6b698a02ba073391bc06ddb69e1b7d2fa266ace6
TLSH
T119D0A757F45801D0DABBCFF156211A6F9B603DCC146B9188B512402A58A6BA3A651E53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587606.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe587606.TMP
Size 138B
SHA256 4de7d7701db9492a315bf8dc6a160dc2939a4a525da2630111f4a0733dbd4753
MD5 bcd638ede52b11945838e8c9de9490de
SHA1 29980ee46294a127c41f62167bf323a5f9378dc8
SHA512 9543c3329df2434786b12624d143cf3feb2dfd2dc23976efd6e3e910d604dde73c125ec587f552732af6bf80dc3d3848bbc94fa537310f6206e4ee7f5a3ccd7e
TLSH
T1EDC08C63F0880240862046E04322115E9B042C8C08819088A023302A1071B232601F91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 5b0f29818cdd223a7d3e52869a9029c4fd34b5ef3f4bdb9b2d7d663d7614c172
MD5 b3c6995cd14182fce68fe056954a7a39
SHA1 f1e14547c19a6c55d692dfe1d75d6a77d2be3fd9
SHA512 0356183d4fe497e1288831dc2fdd28144803f03512da4cb995c44d5053773e459fa8d5ea4b75bfee080967059f269ca173580cefa4abef891a0b740eff4e347f
TLSH
T1CDE0202065C4C2FD745A704B25D99B0CB2D9B457D6C93D831F01D9477146DCD72D2960
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 70df1bd113f8ac050247a513ebd2dbeac8249f9920c91f104e0d0a826653dfd1
MD5 7e75fdfe4552aaab15351bcf5dbd9aeb
SHA1 5279a4a41b781007abf8fa915ac3280723e7daf8
SHA512 1e8cd5bdcb4328e8b721bee0f0cabb4eae9208471acb41fe00789fdd28138855ce12184012192cd2425dbb5bee5044d0723b45e09508e8673e92f06a14c2f603
TLSH
T1A6B0129C3731C71EC985447203E087D05714E41210819513C84CCF960F45A983E518D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 76fae5a19494a684bad690ba494f70f305836a267881eb783ec12ab07f504fe9
MD5 c202b88f85232f52282efab6bb2c45ae
SHA1 6d1fec7dafb57b42f215632a5eb9a9aa9e4898d6
SHA512 d5d8971b0d935cda96e2955f9ba9ac8f0355b646b8a1a468d46f9564dd7497b00752cfd915afb3f6a53951ee948b8d9f1902e39486591c294792151babfc3227
TLSH
T14FE0D13055C9C37A71CA304F72A6E70CE1E17416D9DB55562B0DA48572055C87387970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3bc7a5c70d04a26d577027b2cad31d73626355c8cf7c739a7bed08a8d3a0ff3c
MD5 f60985d7249238ed8b34d17f0dc77a9c
SHA1 dd850e9fcaaf4ebb0cc53b1dd8b6cba7ea4e7658
SHA512 f630b72efc4d9503c8ad4ca5502ad496f6b14f0f29d5198b0ecbc89da9e80e0d32c34dfbad6fe4f6f13d07035dc90e7bebdde8a7c44786971106302a2e439d27
TLSH
T17BE0207055C8C3B96504708766E4AB4CE2F1F81B97C63983670D644971015CD73E5DE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f2a10957c9c09402a8faff43ca59bec269d0c07a8764711005bfb399a33fb4a3
MD5 bf15bb50fd6e51ecc0035ab7d42b5ae5
SHA1 ab767cd070ffedbefe7f4126c8f4574b373d7dbe
SHA512 d786b923c2541191baafd2c11c584e1c91d11b91c980c6539f4e603e068d042c593e5c159b7c198b3f2df2363293eaa17887dab3904973d2c10c419e7c0cb06a
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGW:05ppxnY753RNBvRJJdt7p5J9NpZc
TLSH
T1AFB2595A703A0211393E2988B39696364F4235A37058E4BF7FB814A54F67E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8640d048d9251786fe5d8d99553132d32d6db967bf16428782f2d4e36202a32a
MD5 517d07496eea4041879b32a1f408a383
SHA1 e0fc475c00c2f2f65241142d56286684ffe4ac24
SHA512 19aa8559ac22a00c2993a2146c3a042b6575bcfc9f7f3d82297bc88813b6f42dbbffecbe714429830f7353cf7d1a40ca99ab74e084cb18c09d24ad56802c7adf
SSDEEP 192:P+xW8MCfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxnfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1BA24730A7B747001EDE6D9725CB080771A3CB16ECF22A6915DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 2ac110eafb56d542f188305f372af42296a7880c76cb475d768c6eb422b7d2e7
MD5 ba51ae27904457b00be34d3c71eef039
SHA1 b73fd139fb3b4c0b2f6d579897ecc682e4c1ae3f
SHA512 f9d4807d2b26f1c4d12b11d094322c7344fc1f49f1c845369bcde62f0c64b736e598e837b82a52608bee9caf19d9da3ff55183165643e9794527d6696be24340
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBglxpHcJGt:DEK3tjkSI5IUltGhp22iSBglxBcJW
TLSH
T1B052DD9FEAB42223DDE943318EC101E1AF7A903D8FC6D60255EA50151EB9552632FACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 3KB
SHA256 73e6f68fbd6f15d9972a99f897c67b7105bac268d3b36a8820145ff0f420474c
MD5 3812f1608fd8682d073f128763397998
SHA1 d14a9c5d5a140ed6d06ccb0a21117c8efec08e52
SHA512 7db2bccbea02959155097216ab7c29e7ac5d79448175ddd52cf887d2cf12ab28065a3536ae436064ef12b3cf144b9af718f6f22787955b1a3f586b040430b73f
TLSH
T1AF7177C1A3E954996F8EA985D30F6423ADE13F67220F58B6632E44F44F88C250E2FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 9ee2fb743f17c97bfb5bac15c99f11d0b811474be3371c9e88d83a2f7d52bec1
MD5 a6b5306677d1e7f58869641d915132d4
SHA1 bbb2aa3e0c04e15ec649f7f4cc0154f4436833d6
SHA512 092d4fc0ca2f994ddeb699306f6f21617933e3abd303c63e0768804fe6357527f1d1d33f6dcff670ed597f09805b198b33d8b400b70d7acd310e2c6d5a42f20a
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flRQ2IIIBb5MIMbmYcYP9D:GAhsBJGscOQ2IIIBb5MIMiBy
TLSH
T1C752732D67017B3BC05E6F77121A8B789BD5E84346B6222E31601C4F9EF2A5387C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f8b5b5935e01dc77ebfe8f17c390865e7a84ed8fc90b47a1dbd918512d43f475
MD5 8fec1e1dc2429b86e16bc809fff3bc35
SHA1 79d8bc138404aa42a5f5519c77f2885698c6e846
SHA512 a6cec72d2fd6adc198aad9308d3a16911f9fc4f82a6578016d38a24bb35b0ad1e36e24a44f7025d1419b15c692fe6614c7818d716d4ab1b0fd70759ae2637fdf
TLSH
T1DBE02650B8C8C2BEB51830CB31F66789F3C43813EE8A29871F01C448B20159CBBC6EA1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c9d7db26bd79e3393952fe764f740bdd731e8b67302867036e6cd820f503fe90
MD5 6754046c0296a61037d1ccf367b0ec6c
SHA1 e4115490a51b730a4e6d21b15ff4d146e35f3cf9
SHA512 a3f72f8f6b3ebb8e29e3638203c4f5e3ed10c874f596399a9a2821d964b63d9f4bdc1b8fdf1a5c5bf3b26db69a2a9cf0f04687517c5459590944fe8c9adcf4f9
TLSH
T15E21B255F320C159E18E963EA42B9B361338E8429FFCEC0F847924356D72F040E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 8269bc21f75bfcc51ce056986590b79b15f1ce2b5886df46f9df0ea252130e92
MD5 05493cd945600e8d250d10df47741443
SHA1 a4c501c6ab4b01ab313e0588ad8cbe65acc97b7f
SHA512 91240dc0e3c110e0be8103823d8d3e5a92488bc33906c0fdaef87b9e4a0571c9767b2cb02528cbd2cf69f03bd75d2d95e790119ba0795f37b0af18e434ea5893
TLSH
T1EAE0D8507DC4C2DF6114208736E59788F3D63817EE852E422F09984971125CDB7D6962
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0ca1addce906544e8f1ac41d48ff312dfd3ec0d7d38729e5cfc20892e1dacf23
MD5 2eba3cc1058f2e41130f77768f900594
SHA1 a29bd31a8f1ebb6780ce6d3b0d3bf79d9cfcd5b8
SHA512 a089202800cd4f2e0c5bd7bbc42642bf6fe7303654c9dfe204b7bd83df7881ffff8b7fc09729545811aac8ba535f18fc52775c8d904e3e589d5fc6d9fef04f16
SSDEEP 3:MsEllllkEthXllkl2zEelDSKlll/:/M/xT02zN11
TLSH
T18544041C7FD41455D5141530C011C3700374DC501711D74374730C375DC7D510C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9c342ac3b4e5cae0c3440c5c424e7193c7611c30da1d1dd0b1fc7aba6f020c01
MD5 9b761f5d2fd9a392feadb9ef17f28e37
SHA1 65f2275c3e1ccacb5c2374bf68a36e195026a6dd
SHA512 ba869675d6085f3c4ce519db6697465d57e33c537bc4c6ff40ac804f391e83b0dbed3c6eceb17d79944fbcca4fbcd348500dd8fdedc67a09e6aac761e43a066e
SSDEEP 768:5F58QwglkyGoGNElsBk6z9sqnewBKZOOe:R8CsvMqnevZA
TLSH
T1E6F23AF1CA55CD63BFDA5AE9A36B3542CFF40213C88849A8FEDB1DDD0C4A189538A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f2063507485faed3c5bcc4b29260cae717734b92ebc394f40b3a9ed6a07a8c1c
MD5 57e930fea9262fbf95d399872ce765c7
SHA1 33bb99e1a7c5fa3322a13cecc861b36a7493a057
SHA512 71d75fe6d205e8947b5f48ba493e4f9568a70cd65b5d3d9c06e5c1958658d8562a83cec767a29990cb593ff8cee8c9039c16ab6e3a090eb28427d5689b220302
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9l3KphiftGNZO0saDsSp6e4KV8p054HH:peFccps38wgbkUNkoGNEssdI8p0gH
TLSH
T1A9B25D36EC68CEB7ECE74F99B74A7A07DEE01227859C59E4CAD81E1D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a8b991b017693cec340ff3f00c829cc9f43a002ca197d5892ac180a8ff668f80
MD5 27fc7e9d77554bdeaccac060a580fa92
SHA1 d31faf4b08b8b21188ec879f37b1a0600f038c79
SHA512 b5687f409a930bc081881468c5199e6acc17a242539514c07587a61fe60811c84204995c496e41be35dc9037ba7438b91183d89b866121496c354ca96528fe4f
SSDEEP 384:nyiFiZcIQ3sNJ8TUNTUlI4WQckCrHDAphiftGNZO0saBkyrBsQpLnTKwBODNZOCi:5FQQ3QwglkqGoGNElsBsWnewBKZOOe
TLSH
T1CCD26B32DC68DAB7EDE75F89A74A76079EF4026395D80AE8D9D96E1C00831DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d56d59e3eaa5753dacad74f6c140c311c8480b97e19b8c75b198e3a35ebb240f
MD5 30c9c953ab78052b86a045c612f81cf5
SHA1 d28cd30cbc4656d86165b21dff5dc47168227c16
SHA512 d0e95b03bca492c8f68eafd55378437d78a7cc303f1adfdbeb4a2d2219f3c6a1693707ad41c80968139d1b3ebd181adfb55181b566ca0871baf89d7672374d27
SSDEEP 384:np+iF9CcmyWCs3sN18TUNTUlIm2QckCr952NphiftGNZO0saBkyr8sQpLe4KV8pF:pVFccps3gwgbkUADoGNEls8sWI8p0gH
TLSH
T1C7C26D36EC68CEB7ECE74F89A74A7A07DEE01267859C59E4CAD91E1D00831DD530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 122ef87268f45a969dbbc9f468075a1251af82c1bd22ee30202d63ce74a013bc
MD5 e404b4faa9f859bb15a5d90d1b467a2c
SHA1 03e48a9e987994293ee410b158e1cd5109b911b8
SHA512 02181d4c85c814ae0ddf1bb352acbc11a9e6cd43ae636b85bd6d1306e107a7df289135eeb7e8985761baf4749e6e3666b4648a4a8951b0b2d4bd8155c1689513
SSDEEP 768:5F58Qwglk5GoGNElsBk6z9sqnewBKZOOe:R8CtvMqnevZA
TLSH
T1ABF24AF1CA55CD63BFDA5AE9A36B3543CFF40213C88849A8FEDB1DDD0C4A189538A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7119ca346921f3ec3c029b0e5891a4ce9280012a5043da9c3b72804c9ca353f0
MD5 bdf4ff1c0545b1d2bca8520d5a236539
SHA1 1c28d3eafd80d470338102975fd8bde541fdf59a
SHA512 49b4884f2a270ca1c16477c3b4fcceb6b6b7ac2068afb1573c2845083df7cfe0ae160a5b09854325fbf001570d5f4463d0a5ecc4fc43e9f4a0145cf138e61c76
SSDEEP 384:np7iFiZcIQ3sNJ8TUNTUlI4WQckCrtDAphiftGNZO0saBkyrBsQpLnTKwBODNZO/:pWFQQ3QwglkAGoGNElsBsWnewBKZOOe
TLSH
T1BED26B32DC68DAB7EDE75F89A74A76079EF40263C5D84AE8D9D96E1C00831DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 cb5a968fcaaa65020429254619d9e5dd851820f42d65e2be08563c46b0678008
MD5 ce9242564c93c0b21db7b8f369692d00
SHA1 b2f1c51e9d736398bb814e38bbdd7076dc52a612
SHA512 60e162bdd186cc3890063d14f3f2aa4cc4f0b254be0a6c08ab6f12340e1658202265645c2c5d174dd726fb3b07aba7b882eccc752d001e8dbdb26fdbc259d530
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isQQQtydazA7dwlgUY:TLyT5UOl0afDdWec9sJ4Kjq7QB5fc
TLSH
T1BE92CE67A9262033ECDF4B36FD8345910EBC125EC9A7B844DED089611DA1BC1E2991FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 90bf848fa533af5a0763569062dd3a7961245f4157a43ddb8bad0835782e4196
MD5 805b34b5729d709a231604e4e1559a1f
SHA1 cdeb5b7383faf1ffd7f89abaeeb2758fea798953
SHA512 2f48035db598c77ba074cb14ab9297e2fa844ab0a185cfe5f9ff143e7972dbe7bde2f50def17a730fd07adb33596f28e67e0cd8a2ee6ffc4d78bc005e2dc94d8
SSDEEP 3:MsEllllkEthXllkl2zEelaVAst/:/M/xT02zNaVAE
TLSH
T1934402096B841416D5141030C16183904360D8545512974324621A625C869400C01011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0f5e57b082185590e056b5777075a63f6667ec91545e24042924a2cfade81247
MD5 63af20153393797285d928edd4fd8cae
SHA1 39e728837e6ea9b5f76bf61974b9767b87ff08b9
SHA512 409063d6ed6734ed63038fde119849e8695d7225584a7baf1a41a92632bc07cc66a29c3892df95895f119899659133a7a28694f04dd1ede96f9bd0fa1b845ac3
TLSH
T18A411658A6E91148B3B77E5AABF2A46D487EBC773E47C45E00110E4F0626A45C972733
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 4a2bd7f42e095321205a5243ed5a74e14c11aef1bfd2061a15169c2a1a3178bc
MD5 5fe4dbc704867895345309fc2ade101e
SHA1 bcdfe58cae0f7a23648c069cb6f0a74e9f8cc4b9
SHA512 045e65f2a2cf9716652e0618124f3f2d1166f0a9cf0b212b40145159185ef1589305f084c285ae5de3bbe4696053659e0802365e8c358845b7aa2362d779ff4f
TLSH
T1A1514D58BAF91158B3B3AE5A9BF6B46F487F79372B06C49D10110E8F0622A448C62737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3840-535-0x000002694B4E0000-0x000002694C4E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads