c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Size 13.7MB
Sample260808-3wsb7swfra
SHA256 c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3
MD5 0ac0a14b20e6cc76f1d66e2d9d98fafe
SHA1 ab6b9d0230c47aa94615c7eb5f372fd5def10595
SHA512 a49ec9e223cfcf8d30dcc39ecf1a9c660c0d35f1b3f6243e8f03ad712896f8dce0e147b7c7727ae7cbba460befe99144a074fb5f06645dc58bf017012809a7eb
SSDEEP 393216:x0jxLnarU8z7zhff4E3npAdtyLc3HwnPp/QgEfZl8:Sx79E7P3pSty6QnPt+r8
TLSH
T101E6331177E68431E1720572D66AD36F69BABD321B32D4CBA3D5069D4A31AC2CC39F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
38	456	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1342683909\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5080_2012157689\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5080_1195098967\_locales\nl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
456	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307067510657090"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{1AC3A180-5BDD-4D4B-9208-9215AA515DE6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
Token: SeRestorePrivilege	3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 5080	3048	c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe	90
PID 5080 wrote to memory of 3204	5080	msedge.exe	91
PID 5080 wrote to memory of 5840	5080	msedge.exe	94
PID 5080 wrote to memory of 456	5080	msedge.exe	95
PID 5080 wrote to memory of 5840	5080	msedge.exe	94
PID 5080 wrote to memory of 5840	5080	msedge.exe	94
PID 5080 wrote to memory of 3796	5080	msedge.exe	96
PID 5080 wrote to memory of 3796	5080	msedge.exe	96
PID 5080 wrote to memory of 4632	5080	msedge.exe	98
PID 5080 wrote to memory of 4632	5080	msedge.exe	98
PID 5080 wrote to memory of 4632	5080	msedge.exe	98
PID 5080 wrote to memory of 3020	5080	msedge.exe	97
PID 5080 wrote to memory of 3020	5080	msedge.exe	97
PID 5080 wrote to memory of 3020	5080	msedge.exe	97
PID 5080 wrote to memory of 980	5080	msedge.exe	102
PID 5080 wrote to memory of 980	5080	msedge.exe	102
PID 5080 wrote to memory of 3924	5080	msedge.exe	103
PID 5080 wrote to memory of 3924	5080	msedge.exe	103
PID 5080 wrote to memory of 4600	5080	msedge.exe	105
PID 5080 wrote to memory of 4600	5080	msedge.exe	105
PID 5080 wrote to memory of 4600	5080	msedge.exe	105
PID 5080 wrote to memory of 4172	5080	msedge.exe	104
PID 5080 wrote to memory of 4172	5080	msedge.exe	104
PID 5080 wrote to memory of 5504	5080	msedge.exe	107
PID 5080 wrote to memory of 5520	5080	msedge.exe	116
PID 5080 wrote to memory of 5412	5080	msedge.exe	117
PID 5080 wrote to memory of 1792	5080	msedge.exe	118
PID 5080 wrote to memory of 4900	5080	msedge.exe	119
PID 5080 wrote to memory of 4900	5080	msedge.exe	119
PID 5080 wrote to memory of 5124	5080	msedge.exe	120
PID 5080 wrote to memory of 5124	5080	msedge.exe	120
PID 5080 wrote to memory of 4468	5080	msedge.exe	121
PID 5080 wrote to memory of 4468	5080	msedge.exe	121
PID 5080 wrote to memory of 3872	5080	msedge.exe	124
PID 5080 wrote to memory of 3872	5080	msedge.exe	124
PID 5080 wrote to memory of 228	5080	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe
"C:\Users\Admin\AppData\Local\Temp\c50937228f760394d81aec5a86b7b96606079d6b872aaea350cb1cf5eb6676e3.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffe3f85c188,0x7ffe3f85c194,0x7ffe3f85c1a0
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,1519804665599239471,8346209400348065526,262144 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,16950297163322669223,2072112706950554760,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,9717453744785344011,14826592600620702419,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3522166986759184367,4883472416941247739,2097152 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10601005656978991716,13215206327012791366,2097152 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,8011162864662682108,14766639850685042409,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,6132563360104352533,1746875866085558719,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14411794530332016026,12212570019950827937,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5460,i,14027934457029946506,3975659575009200098,2097152 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,1894449256102311896,12908961854637952599,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,1894449256102311896,12908961854637952599,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
    3⤵
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,14120802257292708848,3722645002353553124,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,7716749796987033094,17214907508891373628,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,5826672248752537357,17963485344314466489,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,18292410192510117826,3297696630146144390,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,11954986393550395901,14099153678153802906,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
    3⤵
    PID:5124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,2015047179594676287,17237639671596369360,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,15706609609159656458,11562127716786201216,524288 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:8
    3⤵
    PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7016,i,6812894131517662216,14922616141800153842,262144 --field-trial-handle=2320,i,3068225598699322989,4546798070778940622,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 10c173a126713d828a49df0c21a64298d72f8fbeb16a85614b1e02f706c28ed3
MD5 deeac0793712806dc3682ad58ed9216a
SHA1 4a4faed397b11325c2aed4a57b9a0d8363e590c6
SHA512 9ffbf45691762bb6c14b125abf76959cd9ad41db05aebb6184c820ab24ca1b1fe0ec8ddcfba046ddccd465bec1a6309ce43b4a725814619a498648bb9bdf94bd
TLSH
T188E022B6CC22FC271CFD1769A0298A46E71023172A40895F3A3C81088FB0B2B46C585C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 21a318ccccae685c6322740cc3cd44dad54cf8ac7d68bfb6ccee2f8bc886c53e
MD5 cbf462ba9fdd642648f5d168a88eb2cd
SHA1 c33817b5f09517786cd683e11307b26e851bc0ab
SHA512 ddbb1ec401ad7d4ee0134e9c9d1a4683d9629c014b8f4452ca394313ad213a08435180bfdcbb0ee78c1bd8245bb7fcc5fec0fd011f91a722ea21b4b667cdf56a
TLSH
T10641D0F783F8C56D8A0195F0AB18BE1BCE2D0514432C7D9AC9E4AE6B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dab58b2669d091f324a774fce90b9cbbf59cd562f76aa09d31fae7389d3b5bbd
MD5 ff236e190a19e9d42fc1a24fab4a492c
SHA1 e699373e5a4c142ad92d7692a27300e1e64fba74
SHA512 75562135b5912258e5b630087754d7e4fc79a5c8a02d1454c12342902aa606c17d1019f1b4c752d1e73bcb06dd5a0017f0dc423eeecfa61973d06f654d7fbd68
SSDEEP 192:sxZURQyMqZjK1Ml8UQRzI/fisRvZdIaRuvuzodpLHW6+WNGYvr/EP7SIg5lIRJ:sxZUDqRI/fisRvzIKY1LHbGrO8b
TLSH
T11572F806AA349977CCDBD219FA447F93D2F90163A1904E5499FC8E0C05EBBED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c6da18577e980c7d8318b05f4e29ec64ce2b9e82d0e4a9d34b7522c6a8150db6
MD5 49cf26e82310bfc597d13aabd29b1ed0
SHA1 98acbf8b75b5ff987515ecc8a74f378c6ef150c2
SHA512 3668d1af16ca76d9797f1d8427db8eb0a80d589652532cc9e3e437f37cd6a47f81469f9ec3b4366f2daea5156d7c0de0a8d285c76ee8323fc92f4c9e40f6a48a
SSDEEP 192:sxZURQyMqZjK1Ml8MzI/fissvsaZdIaRuvuzodpLHW6+WNGYv0u/hP7SIgjzJ:sxZUDLI/fissvsazIKY1LHbGcOjl
TLSH
T19362F806AA3499778CDBD209FA45BF53D2F91163A2944E4499FC8B0C05E7BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 34aeb031b4e0ecb46bf10345ddbf570b7026317e29380836d83de796021072a6
MD5 1d3dd3b6023a89e8ba5b79ac7f1e0a89
SHA1 2ed453fd5037d885f8b3985a18046765f45f821d
SHA512 2c5ab41b159f4b38e592249a0dcdd365c72f458a1fa7a17a0368010c62f78274773070be8e8c569e3ed6e9f84646218d4f6a5910b4e2a2bab29bb5d19624c40d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXysy10Llj:eY8Od/HEnFhWvFvmXu1ja7t10Lm2Nuhm
TLSH
T1D3F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ab4c1b259f68e30bff292c2921bfa3e7f63339e37430caa4c59a9abac93e0d14
MD5 ae822388c4710c13ab918b0c6d1edce2
SHA1 de7bab436562fa767937395412601a80eeac2feb
SHA512 a96a2818e27f978b78ed9e1ff13bf855cd61e32b36cbb613fa25daa5e185accc9be31dff151a35249e476d96fc71fb5dad7fddeb791736a15f29ed023777b30d
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGx:05ppxnY753RNBvRJJdt7p5J9j6d4
TLSH
T18FB2695A703E0211397E298CB39696364F4235A33058E4AF7FB814A54F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 27fd4458bad79ea8e3df906dd0a5d3b4a35cc4e64aa769863afecae5055d0297
MD5 8331471cc23347516d8efe2da8e7e9a5
SHA1 1651b444b9647668f5c077de6dac2c89be6e3ccb
SHA512 e0fe1f697f61cd5be06d2c343032a30ad0f28bae336ef562f943aec55a94ae3d40a0823790bc3a1544ac51e08838a26d0b52796d63c1a49cb4758c4bdd8a4f1a
SSDEEP 384:nPiFiZcIu43sNT8TUNTUlI4ZQckCrIlWphiftG4WXGXMTMpnnTKwBODNZOCwW1tI:aFQL3ewg8kxIoG4+AMTqnewBKZOdWU
TLSH
T1ECD25B36EC68DDB7EDE75F89AB0A3607DEE4016395D84AE8DAD86D1C00D319D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ecdcb2321fbf598bf1a1f5eb5e0d0119b38e8c6279ca9c79e76430558adf1774
MD5 4ffd6bbcf9f2d29b975da938315b0fbb
SHA1 4959e1ef9a22a773a83b3fbdd2fbac008bff0e8d
SHA512 d03db95ae891f9c86aea7349eabe97bfdd0c4c38210e68bcddbe549ef37222b7f7a5ec6eb8d284b55b499296ec5e079fc52e9487580d2662f99214875d086dfe
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9l0KphiftG4WXGGIpJe4KV8p0nLaty/j:pVFccps3NwgbkU2koG4+pEI8p0nLP
TLSH
T142B24B36EC54CEB7EDE74F99B74A3A03DEE0526785D89AE4DAD85D0C009719D030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0d3172d1469ddee20b81c3404233129d8b7dbf411d11ee064210f458729c8b97
MD5 9f23dae786a106a2c83cf74ae66ce171
SHA1 01f5653bdcda5c62d4f4851933ed292468bd758c
SHA512 0b7a72f6b74b145b2bf48e1bcf75e0e582e0f68a4394e33cb5949d37494211a40b3c9fb255be0c1ed6d51c891d2d7f7c9b36768322c00c053da8cce8e8fc4ec1
SSDEEP 768:pMFccps3ewgakxIoG4+AMgqnewBKZOdWY:Gs3DhLVnevZeZ
TLSH
T1D0D25A36EC68DEB7EDE65F89B70A3643DEE401A384C84AE4DAD91E1C00D719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b31cde906aef8da5b43f9cc99128442afef775bce344e98d4010258caca048c2
MD5 bcb219111d95c6d97372ed9877bf9bf0
SHA1 d48acd277eabd43cfc0211c8d53ae65647206b8a
SHA512 43162bbf7a85e05b188d3e08a126de5b4661ec34212f8d0dc6214e4fdd1694aede7286637a3d380d466698cc46cd05731cef3e36deecdace6991f6579a87e338
SSDEEP 384:nhiFiZcI63sNT8TUNTUlI4ZQckCrIlWphiftG4WXGXMgMpnnTKwBODNZOCwW1tyN:IFQ63ewg8kxIoG4+AMgqnewBKZOdWU
TLSH
T157D25B36EC68D9B7EDE75F89AB0A7603DEF4016395D84AE8DAD86D1C00D319D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9ba6d3d994ab6d0d62b1aadb11658cf48b075636fc72772855cfd317f1aef4ea
MD5 20de49e2d6334b882ee482192fb5a95f
SHA1 903755f993059e91f653673cfa9d2cd2bc0ce510
SHA512 8a43960cbf3e6c24aad77eb798d8c51c08b24d20dae9e867cf8af162898cbac9698a1c9c40b14ffddccf9f4f2055fc217174edf4563f725f4cc299c93d12eed9
SSDEEP 384:npOiF9CcmyWCs3sN38TUNTUlIm2QckCr9HVXphiftG4WXGXMZMpne4KV8p0nLat0:plFccps3uwgbkU1ZoG4+AMZqI8p0nLP
TLSH
T11AC25C36EC54CEB7EDE74F89A74A3A43DEE0116785D89AE4DAD81D0C00D71ED130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c3dd0c7eb21db178e3e60e724af40bc51a3525b6b5dca9bbe25e630d81ab8d45
MD5 c95690d940f92747c2bb9948360e0935
SHA1 b48e5c300c74dbbf8ddd43c74f5e2814945226c1
SHA512 d1511e5d146619f3f216acfb286bb55ead6cd36c476d8bff7c2819703a2528d86c2887967d29878f6712f6bc72dd79065d47088665b712833bb33da302138f24
SSDEEP 384:npFiFiZcI63sNT8TUNTUlI4ZQckCrIlWphiftG4WXGXMgMpnnTKwBODNZOCwW1tI:pMFQ63ewg8kxIoG4+AMgqnewBKZOdWU
TLSH
T151D25B36EC68D9B7EDE75F89AB0A3603DEF4016395D84AE8DAD86D1C00D319D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5f289b9d1aef38249bbc2537fcfee87ccd902d6aaa5a5ecd48a34821b1f15d79
MD5 946c506f3c1e78f418f11893fba29f9f
SHA1 cf264ad7bb6c7f3b6481ee4cf17b1e84833471fd
SHA512 bb4a12081d8f5261057711893eaef7eb36bc3bb301855c37bfb16c647e924ed05b4f071918bd143aaaee5c23b5b6111af00e5695f2848b16776f12ae9442e4b6
TLSH
T17B412948AAFA1149B3B77F5A9FF7A86D487F7C736E0694AD10110D4E0A23E00C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3048-0-0x0000000003E90000-0x0000000003E91000-memory.dmp

Download

memory/5504-173-0x0000016B6ADC0000-0x0000016B6BDC0000-memory.dmp

Download