hxxps://gofile[.]io/d/NOWHAu

Analysis

user interaction
yes
max time kernel
364s
max time network
353s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/NOWHAu
Sample260809-v1chjsv1dy

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
144	2260	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
5712	Aetheria.exe
2904	Aetheria.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
78	api.gofile.io
79	api.gofile.io
113	api.gofile.io
114	api.gofile.io
171	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3296	cmd.exe
2900	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307700576047160"	msedge.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{2F9BB780-75B0-4F8C-B82B-21E9CBA29500}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1000	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 1104	6124	msedge.exe	89
PID 6124 wrote to memory of 5476	6124	msedge.exe	90
PID 6124 wrote to memory of 2260	6124	msedge.exe	91
PID 6124 wrote to memory of 5476	6124	msedge.exe	90
PID 6124 wrote to memory of 5476	6124	msedge.exe	90
PID 6124 wrote to memory of 3088	6124	msedge.exe	92
PID 6124 wrote to memory of 3088	6124	msedge.exe	92
PID 6124 wrote to memory of 1732	6124	msedge.exe	93
PID 6124 wrote to memory of 5688	6124	msedge.exe	94
PID 6124 wrote to memory of 1732	6124	msedge.exe	93
PID 6124 wrote to memory of 1732	6124	msedge.exe	93
PID 6124 wrote to memory of 5688	6124	msedge.exe	94
PID 6124 wrote to memory of 5688	6124	msedge.exe	94
PID 6124 wrote to memory of 240	6124	msedge.exe	96
PID 6124 wrote to memory of 240	6124	msedge.exe	96
PID 6124 wrote to memory of 240	6124	msedge.exe	96
PID 6124 wrote to memory of 3308	6124	msedge.exe	97
PID 6124 wrote to memory of 3308	6124	msedge.exe	97
PID 6124 wrote to memory of 3308	6124	msedge.exe	97
PID 6124 wrote to memory of 1768	6124	msedge.exe	99
PID 6124 wrote to memory of 1768	6124	msedge.exe	99
PID 6124 wrote to memory of 6108	6124	msedge.exe	100
PID 6124 wrote to memory of 6108	6124	msedge.exe	100
PID 6124 wrote to memory of 6012	6124	msedge.exe	102
PID 6124 wrote to memory of 3688	6124	msedge.exe	105
PID 6124 wrote to memory of 3688	6124	msedge.exe	105
PID 6124 wrote to memory of 3688	6124	msedge.exe	105
PID 6124 wrote to memory of 1196	6124	msedge.exe	106
PID 6124 wrote to memory of 1196	6124	msedge.exe	106
PID 6124 wrote to memory of 1196	6124	msedge.exe	106
PID 6124 wrote to memory of 1888	6124	msedge.exe	108
PID 6124 wrote to memory of 2644	6124	msedge.exe	109
PID 6124 wrote to memory of 1900	6124	msedge.exe	110
PID 6124 wrote to memory of 4216	6124	msedge.exe	111
PID 6124 wrote to memory of 4216	6124	msedge.exe	111
PID 6124 wrote to memory of 4216	6124	msedge.exe	111
PID 6124 wrote to memory of 3852	6124	msedge.exe	112
PID 6124 wrote to memory of 3852	6124	msedge.exe	112
PID 6124 wrote to memory of 3812	6124	msedge.exe	114
PID 6124 wrote to memory of 3036	6124	msedge.exe	115
PID 6124 wrote to memory of 3036	6124	msedge.exe	115
PID 6124 wrote to memory of 3348	6124	msedge.exe	116
PID 6124 wrote to memory of 3348	6124	msedge.exe	116
PID 6124 wrote to memory of 1192	6124	msedge.exe	117
PID 6124 wrote to memory of 1192	6124	msedge.exe	117
PID 6124 wrote to memory of 2300	6124	msedge.exe	118
PID 6124 wrote to memory of 2300	6124	msedge.exe	118
PID 6124 wrote to memory of 2300	6124	msedge.exe	118
PID 6124 wrote to memory of 4672	6124	msedge.exe	119
PID 6124 wrote to memory of 4548	6124	msedge.exe	121
PID 6124 wrote to memory of 4324	6124	msedge.exe	120
PID 6124 wrote to memory of 4548	6124	msedge.exe	121
PID 6124 wrote to memory of 4548	6124	msedge.exe	121
PID 6124 wrote to memory of 4324	6124	msedge.exe	120
PID 6124 wrote to memory of 292	6124	msedge.exe	122
PID 6124 wrote to memory of 292	6124	msedge.exe	122
PID 6124 wrote to memory of 6008	6124	msedge.exe	123
PID 6124 wrote to memory of 6008	6124	msedge.exe	123
PID 6124 wrote to memory of 6008	6124	msedge.exe	123
PID 6124 wrote to memory of 2112	6124	msedge.exe	124
PID 6124 wrote to memory of 5524	6124	msedge.exe	125
PID 6124 wrote to memory of 5524	6124	msedge.exe	125
PID 6124 wrote to memory of 5524	6124	msedge.exe	125
PID 6124 wrote to memory of 5712	6124	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/NOWHAu
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa3234c188,0x7ffa3234c194,0x7ffa3234c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,5803855699885616348,4419942582246857415,262144 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13274993392878195218,6323393360848395889,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,6140758773249967582,14832037088323878460,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:13
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,7665288590953016034,11064395457118995885,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,15785665322125812258,4173961986939072334,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,14026634324953766789,15015413568157181547,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,9777705973287002985,16695576380167165692,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,17828516638485764376,18433663147360977734,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,5449165585498342055,11474070165714803630,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,14423980668286554349,4612606343050618952,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,14423980668286554349,4612606343050618952,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6548,i,8580825255516571002,12231583559428098076,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3856,i,4500377374141519015,2771791246960873984,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,8918274888329368236,15712579281635978241,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,11043775489996679381,15282149115435113383,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,9698690832756765319,16757707493850079114,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=600,i,17935554434243780872,16273427224701122716,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,13356783757018875136,1304833293299967609,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4132,i,7312924942990746440,6166356915659845055,262144 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,2159182555103935520,1585132056858495350,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,2255876883300253258,16578958300786984864,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=1088 /prefetch:14
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,17996139784653206790,13002418252303527678,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3320,i,5398394740029861206,5062827611279453646,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,11167928831646237621,8626170215595626255,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,9810654568791722429,6934060153104386561,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6984,i,7503206758687287208,4232224810113133915,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,17869815067587945683,13583796402429688929,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
  2⤵
  PID:292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7652,i,4458748833377020935,1133142026486972601,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,948028770273814576,9459278859013660136,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5740,i,2189820012751677988,17328748307314268722,2097152 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:5524
- C:\Users\Admin\Downloads\Aetheria.exe
  "C:\Users\Admin\Downloads\Aetheria.exe"
  2⤵
  - Executes dropped EXE
  PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\Aetheria.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    PID:3296
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\Downloads\Aetheria.exe" MD5
      4⤵
      PID:3356
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:3020
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:1432
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\aetheria key.txt
  2⤵
  - Modifies registry class
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,5111610276284350643,13773924795826230659,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
  2⤵
  PID:204
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\aetheria key.txt
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1000
- C:\Users\Admin\Downloads\Aetheria.exe
  "C:\Users\Admin\Downloads\Aetheria.exe"
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\Aetheria.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    PID:2900
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\Downloads\Aetheria.exe" MD5
      4⤵
      PID:1252
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:3396
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,5080068065814803617,8306495448970495029,524288 --field-trial-handle=2332,i,7287766279821154115,7152491639706922568,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:14
  2⤵
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1156

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 037dbab5a297e4b4538135d9eee75ab8c134e78a0cd37e5e6e53a20d32839167
MD5 624bced3bd34dedb01bbd3d7217d6e58
SHA1 26b85a4f1d204ede1483adea5b6d39374f3e8de2
SHA512 fc835b2d64056a2d913d9d8c402fb48284db21af39b463aa8027355a6b331c0b648ee772121a71b82b93fd1e01ad4a2090be2e816bf8e1cad1aeadcfb64df8ad
TLSH
T189E0D89C668BC6AA6D809887A0A97714DDB1B10F9D4DC6D62714688D1F0300C96A49B5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 406KB
SHA256 c9ec15f6b284850a9e9c19a7e64a22154929e0f9e15a44f9f7e394111739fb9d
MD5 9216d5af8ede8d6bad7e05785c4f1536
SHA1 6196a652118779feec14a3c1d560d8a85fb296ac
SHA512 4707760777c417037805268bcd345cea67cdbf895ea01a002a157f9442c81520dbff93cee7047922e1513321e90db2bbc4d62365a5cbe51f308f484d7aedbec3
SSDEEP 12288:O+3o7mAmn/5Y8dgX4V+1iOF8MB/noCWnm3LMZT7LDkwFdqM:OrKAmxDgoV+YlMVn3kKLMZTbkwh
TLSH
T1879423FE7405ADD11AAB541F91A0DF9284D045E178637B997EBF4CE8A84CA27C4C8ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 68KB
SHA256 096265551a5ee356be7ccefaa40a7de3929105288e029cda15c965cb65b55eaa
MD5 f6709d44783ca7b4b921437ca7dd2727
SHA1 a0c6e731ea03274fd0420c360b5f8079ca719138
SHA512 34b45e20793f4de99caac1c28fca40953d4bc2902ddf4dac70c55bc28ae28cf01632095b20317c8c661832fc1b971fdc2eb05450ef8fcdafe74a5084589ad52a
SSDEEP 1536:GeXJHPV3M/Ib+Npon9pSlmtHf+SxQBEnhB35LsKMCoNx5p1WFK:GYV8xNan/rp+SxQSnhB3aKMCix5fWM
TLSH
T10C6302D8DB1C78A3B3A11891398B31876F920AD1DB0C79167D7F521E5B623EF4071B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 77KB
SHA256 f6419bb8a7143a2d4aeadfacd1aa7346fad4248fea46f30307556e707e361c0e
MD5 5fee10d43a603d19328c4813ca52f826
SHA1 2da1f3fe5299a70f197637ab7a628d834547abbb
SHA512 543c4b9a60a04697b28ae92589f7da4d61f55d2a05448715d23579caa94e2bb81c43997547af470fd9e92d1108561fbae12523b2c98e3ef385d93030ce313d41
SSDEEP 768:Ih09NbhjvT7ZfAy3U3zCebUBetygauhyJwoDPlxmb4mJXn8nJOFiJ2gun82GC/6u:IaXHtAtHUJwYmB8kFbn+AWJ+zCe
TLSH
T149730273EC76A544A2A9E13484121AEFE279E3C7531C2F77195136AC2C2784EDC31A77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bd67158ca125af7771df6fa5699d6169cb0d19dbdf6d451f795ac009b82eb68d
MD5 8c53eaf75c586da14e72113ea8129940
SHA1 d56414b2b982bab807c1bda9a68ea0714d780afa
SHA512 a814ec79daf34873c5f604985e6a4266e8a9e239f3f0ebb507b4b83a015b8344fc0c0ccad403361120f3f2d7e6e06e24abfc94c95fde5f55fd481d1b4c749ef6
SSDEEP 96:lJBCaSCRjpx2FmrVH5AQCsCxu8rcOLnT7T/iHSODDX:lRWcr5MxXLTX/BODr
TLSH
T106A175C6C39258A1CB2626FC55D84E47323D84FB0F079F4F8A64DFF5A5AB38A1640223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7add205e89404589fd2195bcf92e318c7ab62c3b36aef9a234d6bd5db0412185
MD5 e8f2fad5b38f36e26737585763a99586
SHA1 ba6aff1f1db4e96663220d26be92b99c19cec19b
SHA512 b3679fa241c337dd235b2bc3c812170c0ce30d3397374f201bfae1246e100ed9da953836036f9de834441b2f19b0b0336cba8872f8bb6a42fdd941517e5bf48e
TLSH
T121619BF3C3E6416DDA1196F09E14AF1BCE1C0552436C396A85E4AF1BA3F2861E111B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 83f5e18fca871b30cdcc8c754bb2f65cd614c79cb19ea75b724ce66d9f84311e
MD5 55b23ad2515637af2724273c0d936b4c
SHA1 8ea31e37991a1a30645da3d0575fcbfb450edc14
SHA512 6444370b2b76cee6068f7ef23eae4e94616d60b6be5604e072f564d672fe52b7b43a212a4b2ff8b997e96316c81283ae399140e87a05bad36a17d8183c98d6c9
SSDEEP 192:sxRCRHyM/jK1Ml8wbi/f0sZEsmZk5bqeqVoA8pJdlQ/g6+WNeGrPqIf/YxulswfU:sxRCLli/f0sZE9evq/5hV/xeV
TLSH
T1D172F806A5345A7BDCDBC219F945BB93E6F81032E5905E54AAFC9E0C00E77ED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7d8b1c837e90be45d07bbaffcf83caf30b6f118b041d7e5362f660aea233900e
MD5 12958b5bb4f439489f12c564b104ac55
SHA1 eb3a0df7fcf5c2f7d811d2bd222d498c41fb4e19
SHA512 41126813cb084f387d961b72cda0b8c673ddd0adbe8382096dee755e6c15c2b72863e32fc4584fb87c5eeb03c093d2bbd02cd418958dc3996d67ae3121bd16b0
SSDEEP 192:sxRCRHyM/jK1Ml8UQFOi/f0sZUsmZKu5L5bqeqvzoA8pXHlQ/g6+WNeG+9SIf/Yw:sxRCFqwi/f0sZUPAe+Oi/5+9/ceP
TLSH
T1CC82F805A534597BDCEBD219F951BB93E6F81033E5901E44AAFCDA0C04E76ED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 17902d4521813169a74cf258523f31c142d8e2c5922c02c4d6e3a4b4d0feb0a3
MD5 bda7a7b3ec68e0a62f77dbc900e65994
SHA1 d6f543f8c22b7d89368900a6dc4d3bdc0485ff71
SHA512 ccc930cc30dfc0eaadfe2be0b4cd3d4516af6c0e866c9876132e15beff9799683eaa2177bec38eeed17a0fc630595f6f3c6807d979556952e49ca824201f2276
SSDEEP 192:sxRRRHyM/jK1Ml8wbi/f0sdEsmZ2zoA8pi/g6+WNIYxLlswfGRIgIJ:sxRRLli/f0sdE9i/5Ises
TLSH
T10052D805AA389977CCDBD20DFA557F53D6F81533A1901E44AAFC9A0C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3f9d311f38ecc939be8a31befb83e281d3d12cdcaa2bbcb65e03bb4c299d69b5
MD5 4ca24c65daf87e00c1053b838f6414ea
SHA1 acbc62bb4667f4010a528cdf241eaa6b7f5409ca
SHA512 533ded779875472d160e3689807acb57651291d0ad50640f9920e8370dadf57b954171a3cb3267413c1fb139d7b16bf645b5cb01b0a95646ebca85420b5175bc
SSDEEP 192:sxRCRHyM/jK1Ml8wbi/f0sZUsmZk5bqeqVoA8pJdlQ/g6+WNeGrPqIf/YxZlQwfu:sxRCFli/f0sZU9evq/5hV/EeP
TLSH
T17472E706A5345A7BDCDBD219F945BB53E6F81032E1905E54AAFCDA0C00E7AED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 60bbb0f0102483baa8c7d3103ad5f02b73fabbad664dd6738d20442059aaf393
MD5 73d37b9d28482391944f2b506cbebaad
SHA1 34e1c41468c79270607fdd58ad5db6da908a98f2
SHA512 6027618a7f545a13d168e8f8650f05680a83f2810f4dd94d8dad2eb86722ff56e4b72c45e0959354e37f27fcce2c3ff66ac8e3c13ac8a2a1c9952e1030507d7e
SSDEEP 192:sxRCRHyM/jK1Ml8UQFbi/f0sZUsmZKu5L5bqeqvzoA8pXHlQ/g6+WNeGrPqIf/Yc:sxRCFq9i/f0sZUPAe+Oi/5hV/yeP
TLSH
T17B72F706A524597BDCEBD219F941BB93E6F81033E5901E44AAFCDE0C04E7AED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d58d268339594c492331a5680b155c3c736d5911614157fe1721d87ea47b2141
MD5 333d2aaca9753a99055a3de9c2ea019e
SHA1 1096941b9c2a8fba4110697c764ac74b1a292d8f
SHA512 e6c7e5cd6b49eb1038f49b381063c27dea3ec9ae43ee8a032c7c7e57bf8f5f55722ffd9c82b7a4ad55522f08b9806f7969f292631c0ede632923d7a1b82cb1ad
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAmroJPe4W:0xCyAjWgbrfM1u1jacpAdJPZW
TLSH
T135C2EC3B640CC77E4F844EADEC25AED77DD802CB97984D544BEA880C03C67EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\temp-index
Size 3KB
SHA256 e8f4ace767ffe2fd23d3b6bb070f70382198c1d0c023fb8b1dfe93ea51be963f
MD5 a02c8f1b0660707b77217e7a4f05bef6
SHA1 33fa7b4a13a9df0fd41ff9ca65c16b70585dc9df
SHA512 1ec8388843e5c90bef7bf566e68f63e28dc3d976f98757230fd62fd597b306dd1954553a3ae7791da64b6649601a4ab9d276c50ef6657cda5f0411137521bc5e
TLSH
T1F851174E4C862D9EC8BC14B31CFA2480B73918EDEA898A075ADCA4307DC333F2C49252
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b11dacf623b03754a969282781580f112d1cca57362f834299e1c2a24e97d898
MD5 73266ffcbe85876079b5b6a682f7e6ff
SHA1 73914f08fb7246daf443748fc5d4e3c2bbebe63e
SHA512 bb528fd0b2c27cec86d0f48800fe7137cb517689ef1c4735cffd7face2308d5cdc503b40b2d4503c46f269a392ac646404ffe944ce382fe5a28e1276c3958e1d
TLSH
T1D7E0207B3EF71634F9BFD3D2183089F1454279589900FD4F642592C75071354645AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 735cfcca8ce2f2d878b06d7665f73314cdfdaaa50cd5f94bd1393454e2d40ef0
MD5 0595ff20dedfe7a39828b3a9aa0f4235
SHA1 ee3a453cbca9880723832a4d6160d5c94774ca52
SHA512 6b44cb3c228bb25f7bcc33c2125c00b85aec7a40e6f6e7bf95e83317f808d254c9de9d341cc5e1c8ea8e66c01c1bddd555eea4cf82f54d26c23ed453c37f7ccd
TLSH
T1EAA002B9EF8E9122C08002F02276159C6A12CFD88A092321C9E804C6FC6334451C9021
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f071.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f071.TMP
Size 48B
SHA256 e037e229de5f8709b363630f66ca212191c588e1cc084034891a1c1588db1018
MD5 dd5fe4c499bb5b4dbb0baddbb6c13727
SHA1 1cebcd43bfe12a8b7a140bd005028a1d0f64da38
SHA512 84e99734cebb1fe6565a162d6a4b4afebf66780128c027625459a920ac624cba7a08034e0074ff11e7fecde9379216a53d220792f4ac1cf930d0126def42ae87
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ae650269aebae75740308229a27f7f74c6c4947c77a8bfb319448ac92f2758a5
MD5 21b7a4940c350b9fa4027047bfb00d42
SHA1 7248d6504f87ea1c37d5d8c902691c21e4291421
SHA512 0131d5500ba00046ece8563f483d85c55984c39b6f77a504e8b5aaa4309e8b06ca162621159ffc50accbd83d4f0904c800682b2461605a3250dcf53fcc5657a9
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/m2:UpHGpVP
TLSH
T115C1E896B07A164028BE260C92E4EA17D6D170F33468A42B7FE814F55F66F425FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f9f6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f9f6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 efaa8ca16db98e8d844ba1704e5038e6e9d6096cff618fef5795556f287e522c
MD5 769ece045fb8265acbde6d7a83f6ab89
SHA1 a8d87b24982409ecae854d125434c860b74f0e0e
SHA512 4660d5eb296921417ec5bfb85140f5de8a101fa6755b75c4cb8008b0fcbcaea019904315fbaf6815883c4b9082460e026cb69b414c8c7d113f91cef5949f8b99
SSDEEP 768:Drv+4UNbdV3sPkKL224jF669yrqUjWiIwwxMtoEx:Dbsbv3nVjF66INWZTMOEx
TLSH
T14403BF70B8685AB7CDF2C681B2137783BF74119792C40F98CADD6B0D069B4DD274B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fff86969c2ce73609df3e3d84f210961a4628620d7d58567a9b40b504b257bfc
MD5 ebb06dc3aa9e5a2ee5ddba2cf5476ce2
SHA1 5b1083951cea7e45e5d66d705764feada738b442
SHA512 1a6d483c44bdcfe5bdfa01b1e07528f462f68e3d9f49165feca5a8bf9bcf407a6beb6f3237034362eab8c398429c389b4a6a29f0f1af152827ba7e14a1e25c1b
SSDEEP 768:arv+4UNbdl3DPkKL22ejF669yrqUjWiIwwxMROSUiler:absbX341jF66INWZTM5UsQ
TLSH
T19903CE31AC589AB7CCF2D68672533783BF741093A6C50B88CADC670D469B0DD2747A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 fb186c1a24c5504811696eea4f1e6e8f5f20bd76c9cdcb7d00a98f0c68c4090a
MD5 f096604d0ae0c495607961a7de1ec43b
SHA1 061a603c7a78d2f5a1b0a99ae6effe472b537049
SHA512 b5a28cdc546855fcf0a8731614c6ca7048a29a9fb330fa35caee84ce27052c1db75e51ee19840abad3395465fb82a6216c7c2502ae204a6dd1699b5773c449a0
SSDEEP 768:IF0rv+4UNbdP3DwgRPnkKL22tnF669yrqUjWiIwwxMto2ewBKZO6t:1bsbF3oWnF66INWZTMO2evZb
TLSH
T16D337CF158DB5577C9AD9743B33E2E42AE7CC093B5841A54B788650CCD5A0FFE20B921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 1108b9cb216d3b0eca48aa17aa283ef897215406f8f7a9bf33ce53f30d91cbe1
MD5 e92488e0901ce90ece6f4643b8335476
SHA1 540df0fbb4a185bdd3552f9bb4ca1434f6198842
SHA512 3f81f208bc8e9ab8eb5fdc18aa5d998d7d714d48f39df012d0f46f60a8774b0e6f3d495f0e9a0f56f4764713ba4bf5ed5c17b562863a8af7134cbaeac5e83050
SSDEEP 768:IFWrv+4UNbd23nwggPnkKL22RPF669yrqUjWiIwwxMto2ewBKZO6t:tbsbE3RePF66INWZTMO2evZb
TLSH
T13F337CF198DB5577C9AE9747B33E2E42AE7CC093B5800A54B788690CCD560FFD20B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 b14dae9de8afcdc70743a118b199572763a6e434dac07e3f08a53445f61f6cc3
MD5 062ea5996cfe0206847d0bfacded41ca
SHA1 368fa7ea5f126a108a0843bc56b621a08764b44d
SHA512 444bf2d0afb5d07f1fb5f542467c84119aa8df7810ececde1ce4d6aebbc8cd4baa926bcc116d17a89c829777817164de5bc9837f8289da7b9971ec24feaa12d8
SSDEEP 768:IFRrv+4UNbdl3nwgZPnkKL22PPF669yrqUjWiIwwxMto2ewBKZO6t:MbsbL30EPF66INWZTMO2evZb
TLSH
T1A2337CF198DB5977C9AE8747B33E2E42AE7CC093B5840A54B788690CCD560FFD20B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 fca8c6d993f4aba79b5680dac172258da3e133a0037ecee26ef7a218bfd3bd2b
MD5 52008e8c191edc419b06f1e6c23d84d1
SHA1 188b204eaed27906fa355174bf3763eeb2af95f6
SHA512 5e26ee90d1b872f23f8b0196c9e11f0fadf6b596d3a9317e495202fa6a314612edb2ca8cdf45941348e7a4f682661e7834d67220aa51657cf6d8d7d73d9f1b7d
SSDEEP 768:IFJE3nwgJPnkKL22hPF669yrqUjWiIwwxMto2ewBKZO6G:AE3cKPF66INWZTMO2evZg
TLSH
T1CE136AF158D749B7C8AE9B43A33E2E429E7CC093B1941A58B3CCA90CCD560BFD207825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e333b706bb2a7c2693ed3d06931480e8e8ea782c3eb9ac716d531b180cdd8bea
MD5 703a1ec4a1951ce3cd5d8f068a850936
SHA1 c4258e75416fa455ba1b481e9ca0677bb8a43c63
SHA512 2659f44e00b308a1e68f4264d2163510b63e3b2458eb05613a24f1a6f7520018453c29e929462011ad963d5c95ee01341417af19f77d7c97725f2f058d4d9255
SSDEEP 768:Rrv+4UNbdV3QPnkKL224jF669yrqUjWiIwwxMto2ewBKZO6t:Rbsbv3rVjF66INWZTMO2evZb
TLSH
T1F513CF70B8686AB7CDF2D685B1137387AF740193D2C40F98CADDAB0D029B4D9274BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 e8515a390756f4f314aad654482e99cebca48965770c1c6a2274cbc4e62e5deb
MD5 341708176050f20a6924058d249d7050
SHA1 ff4b066048e01832ee148943a644ad68c525acc8
SHA512 a723d0b658a1d2882754b447104a1be4ffc2fe265d8af7ca6605ac116cd30f6bc752b5a94f02ed6382f5378eaa39d484c6bf6baaafa9c41fe6e0e990f1a9e26a
SSDEEP 768:IFHa3nwgePnkKL22hPF669yrqUjWiIwwxMto2ewBKZO6G:oa3vKPF66INWZTMO2evZg
TLSH
T169136AF158D759B7C8AE9B43A33E2E429E7CC093B1941A58B3CCA90CCC560BFD207825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fa2be5a69d7db71696720c444b220d8aa60d4b7af2c4cfeda5f647b92f01681c
MD5 22d6b274cf1e57865c88788895e723b2
SHA1 798a818635cf6afe4a077ce9bbddf0d6255a8716
SHA512 330e05f9ee5bf3cb11a45788ce75aa03cb4f626956f3444fcecdc1122d805a8978722171c0a270bbef39b89869c8bcdd8a06c08cea54536684e87a12ad5c583f
SSDEEP 768:Hrv+4UNbdl3MNkKL22FjF669yrqUjWiIwwxMAoUiler:HbsbX3ByjF66INWZTMtUsQ
TLSH
T15803CF30A8589AB7CDF2C686B2537383BF74509396C50F98CADD670D069F0D9274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Aetheria.exe.crdownload

Path C:\Users\Admin\Downloads\Aetheria.exe.crdownload
Size 1.7MB
SHA256 a01bf04ffcb45f1634d8d7c4dd9872b714667132509243e624df235bbcd203ac
MD5 f7e6f425910d0ac1bc2a2210975a591c
SHA1 18648190d92be262d4feccaf15a454c9e94686bf
SHA512 ffb5c09e4a2a283c95a627b7ab131884702ed7a04da6d7be0dcd13e01384bd900b9457e465e548cb3cc58cffed4134b29dd8950624865f1c20cf6fd617a401db
SSDEEP 49152:QCNXJ6r76maVX2xvHAm893vNTR3vsy+sRPrtnvCv:QCSsw893vNTR3vsy+sF
TLSH
T1CF859E1AA2B400FCD0B7D178C657961BEB71744D03309AEB27E049A52F63BE1677EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aetheria key.txt

Path C:\Users\Admin\Downloads\aetheria key.txt
Size 49B
SHA256 74d9d4ca6221db6b704339af36d34c3f7ffe17d6494f73de4156045ff1063a6d
MD5 c28892073269942d20d929eeafdcbad5
SHA1 a614751a9496290e957297227eda7e8b84d6a047
SHA512 a7ac4855e0a6cdc4dd405257ae885c24fd9688862d486d3348f1617e42eede9a80d38f628235906108d6cbb03dfe5b9983554210440a6b600a52d294b7aa165d
MD5 SHA1 SHA512

Submit Download