hxxps://datavaults[.]co/dq47n53tua55/Clip_Studio_Paint_EX_5[.]0[.]2_(x64)_By_Onhaxpk[.]zip

Analysis

user interaction
yes
max time kernel
106s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://datavaults.co/dq47n53tua55/Clip_Studio_Paint_EX_5.0.2_(x64)_By_Onhaxpk.zip
Sample260810-rfpetsar3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308445249658420"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{DAC2D161-3F00-4FA6-867E-3D1233169B2F}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3760	3036	msedge.exe	87
PID 3036 wrote to memory of 1692	3036	msedge.exe	88
PID 3036 wrote to memory of 1816	3036	msedge.exe	89
PID 3036 wrote to memory of 1692	3036	msedge.exe	88
PID 3036 wrote to memory of 1692	3036	msedge.exe	88
PID 3036 wrote to memory of 4500	3036	msedge.exe	90
PID 3036 wrote to memory of 4500	3036	msedge.exe	90
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 408	3036	msedge.exe	92
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 1996	3036	msedge.exe	93
PID 3036 wrote to memory of 1708	3036	msedge.exe	94
PID 3036 wrote to memory of 1708	3036	msedge.exe	94
PID 3036 wrote to memory of 1708	3036	msedge.exe	94
PID 3036 wrote to memory of 3972	3036	msedge.exe	95
PID 3036 wrote to memory of 3972	3036	msedge.exe	95
PID 3036 wrote to memory of 3972	3036	msedge.exe	95
PID 3036 wrote to memory of 3540	3036	msedge.exe	98
PID 3036 wrote to memory of 4540	3036	msedge.exe	99
PID 3036 wrote to memory of 3540	3036	msedge.exe	98
PID 3036 wrote to memory of 4540	3036	msedge.exe	99
PID 3036 wrote to memory of 3780	3036	msedge.exe	101
PID 3036 wrote to memory of 4740	3036	msedge.exe	104
PID 3036 wrote to memory of 4740	3036	msedge.exe	104
PID 3036 wrote to memory of 4740	3036	msedge.exe	104
PID 3036 wrote to memory of 2732	3036	msedge.exe	109
PID 3036 wrote to memory of 2732	3036	msedge.exe	109
PID 3036 wrote to memory of 2732	3036	msedge.exe	109
PID 3036 wrote to memory of 3252	3036	msedge.exe	115
PID 3036 wrote to memory of 3000	3036	msedge.exe	116
PID 3036 wrote to memory of 2696	3036	msedge.exe	117
PID 3036 wrote to memory of 5024	3036	msedge.exe	120
PID 3036 wrote to memory of 5024	3036	msedge.exe	120
PID 3036 wrote to memory of 1964	3036	msedge.exe	121
PID 3036 wrote to memory of 1964	3036	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://datavaults.co/dq47n53tua55/Clip_Studio_Paint_EX_5.0.2_(x64)_By_Onhaxpk.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x24c,0x7fff9a44c188,0x7fff9a44c194,0x7fff9a44c1a0
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,396109175327928589,17889806332057210622,262144 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5780896502894541794,12493868042288500289,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,14301827661302730091,8310178392089141165,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5995644497234263304,7209446294381167398,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11017883747003218307,12890603681385795966,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1672,i,15747835829851221963,4649390992678556206,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,6478540472172927864,8081019487563547156,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15243156071547974533,11890797825211058480,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10112118654463702756,11383749887693991926,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,10142493151178790964,9159886149736030161,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,10142493151178790964,9159886149736030161,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6156,i,2394840668076655998,15432617705373016342,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6480,i,10506297035971174686,12224739352871269421,2097152 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,18439233828346170004,15270875039210766670,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,11859517174464980448,2347616009621678872,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,16023671871113301664,13726047078497781856,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3096,i,18048379053130564214,283163095418408444,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,15959776764967454185,12886450184485725747,524288 --field-trial-handle=2268,i,15759344129429877568,13324551411595935691,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 622f47b1314e32afece5f840df33d588a4fd04231b286d92030e6dbf31d4c554
MD5 b2c1e48c4c5991735a5a754da5c3c3e1
SHA1 2a0ea304e013e29d3282e8c46f3f4beccec70169
SHA512 17d587af7e318c31f4dbc6ae2d1f64c4ddb0b94424e98c9394069e4c88e305f75a105b1ee7c662cd4bddb9c2c266a1e6de4eaabfa0ba5e5178dd6394030be3cb
TLSH
T1667140B405310F61FBD194BF56F3C34531B686CAFA431E7AD0506A786A3FB696016C2D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cd9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cd9c.TMP
Size 3KB
SHA256 d99571169000fac46db47773957d6795e66996aa53d761e375d72c1775214463
MD5 d3ab2cff0fea37b7eb2adad2c10a47a7
SHA1 1be3b9d24e65cec24f2be88f957de602b65adaec
SHA512 b7b99eb185f7829f4b1ffe6a9ff235dc8a52d75b7c31f90b6edfeb67add656f2bfcbae824be69e82428deed635a967e025f3b767a0692a901d02262786f1bb95
TLSH
T1CF613DB449310F61FBC1807F94F3D20A357086D6F8172E7AD05066785A3EF6AA11AD1D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 80ce58a182e76a0e2d780aded2043ca86f433d6101d8d71c469aa64e8e369599
MD5 c76e750a542b8323f02f391a6b01aae0
SHA1 e0734165316eccc412f96687db69b7f36464399e
SHA512 1e4cce32d5e52148d46fa001b582062987fbc6593439b7c574274d54ad578aab94e77dd6831376f5c2fbfae4d13006e95bd6bbb73b547b7a2bff0cde656a9619
SSDEEP 192:DhhbPqyeSsZeSWu/1DH3GQkE/N90LFdyX4kmaqJ:DhhbPqyeSsZeSWu/1DXGQkE/N90LFdyg
TLSH
T1ECE16CB3C7D495AEC85256F16A247E5ACF1D092883283C26CDD5EE8F97E3462D30164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7ffc210-ab7d-48f4-83d3-4713583e6f6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f7ffc210-ab7d-48f4-83d3-4713583e6f6c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53e4f9f5613f77a227b995c0115bfcea74afcce2691eeff9ad9ce19a45b27508
MD5 b5ba0413fde4918be28dd22b49087924
SHA1 c6db4c4c319fae64ac89d4339fa80e22a4089b30
SHA512 e6ba987b17d90fdae1b0b697d0d2da710e303680153ca5bcfd447800be48560d8ebe6a9b957d09dfeaa3654cf710e68cc46057b5623508a72aebc5d6bfeb7819
SSDEEP 192:sxZCR6yM/jK1Ml8Mkd/fXsYnNbIdpElD7HW6+WNB1rvF/Y9I7pX/IgrJ:sxZCsMd/fXsYn6mHbB/N9
TLSH
T1EA52E8126A345977CCDFD209FA44BF53D6F95462A2901E54AAFCDA1C00E6BEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7cf2fb7d8a7d957e00b11fb45fe23c6c5fffeb0a554d18d68cbd9386108644c7
MD5 86a4cae715c22629c533b4ef13481312
SHA1 68a3b4764fc59d83a017f39345c1caa14884e48f
SHA512 9b4a872cdd6052b53efaa7e6d3039da26765622dcaef7218c309905f5c23231c42391eae589fa2f82ff7b2a30af53adf751921b9c726c9ccab4facdba416f599
SSDEEP 768:KLcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNgroFg6e:KLcv21wWvu+Z+u1jaeFLeRNrFu
TLSH
T1ABD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c58a666fa4b01fb202a24d11ba1243039869f9bb36f713fb326b9d566a8c11e5
MD5 d9c1cd70de65e0b4912b3db14934ac14
SHA1 77acf20265d1877d6b361a2e6dcf1b6d5f60a034
SHA512 c3aa8a4e10dad8f30f7a97d09c59e3bfeac9c3c8f2643baff3a8c61cea7097d3f4d200ce35f9af28dea2ffa5246e8e17a0df6c5c6f9f7015867da6a7dca509ae
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKakKDqCC84Kxe8:mT3PTb
TLSH
T197913F16313B038228FD7948A756963A4E42326B3818E57F7FB900A52E2BF152DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf35cf85-7938-4c97-99bd-025f39bde545.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cf35cf85-7938-4c97-99bd-025f39bde545.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 39b01434ddfed920d407ad951099be1307b7c6c6da424917e5d6e28675ca9c09
MD5 6256c7f1565486f80bd2614f8170c0c8
SHA1 2f1f4343ddb85bcb6ea0e49d4ee932386a6a118a
SHA512 9c58bfb1243f73bd226976cc000408357012cff9dbb35db38af6993472c955f8c19fe790c2160dd71d0c9946b6242f2ae5792d61166a4ff36458aac85b79eb3e
SSDEEP 384:ZZcIhsN7aCzicBr2e+C5ddJrap6HlytEDq1U:xhQXrBhzhapoy6Dqi
TLSH
T1B0927D3158B42C775AE6A140F44B36039EFC8137E7C96FD4E1EDEF1D01DA6A8130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d6c2e0af27554ab74a7134ff9bae19bbbd57f929390d8638009d445f9324b100
MD5 5bff129f0e31f13d650ed452209dbacf
SHA1 8407b0d91b034e04661327642aff834f2fff6e8a
SHA512 0316e28f28b5f77e5c7a22e6ee178cb422ee9ad802a44a722aa0e59c2e4d6b6dc6e7cf2cb5f9d489f3eb52dae4ad167ecfa2fff12aa658afdf1b9be664483207
SSDEEP 384:MiFiZcISzsNF8TUNTUlIlTCzicQr2e+C5ddJrtp6HlytEDq1U:3FQ6wwggqrBhzhtpoy6Dqi
TLSH
T195D22AF144E7443BDAAE5743E77E2D028EBCC067B5856A94B3D99A1CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 985ca842d5c6a36f92d949cfead689ad6e729b9d3f78af1a43a216f20b2477bf
MD5 5a446160128e4ef506e8fbf443ae4616
SHA1 83f69e7dca3d083554998780ef22b7dcd6355527
SHA512 86ec377c08004070622b5ffc54a153aaf811db6eec3e87dcf1383613afc503e00a4dfe841e6bf9545b7aec2829805d146b9fd17a4651e929d8d5724f522cb4cb
SSDEEP 192:JONw6v+YLNQmiUyW8GZh+CG3+FdeqmpvusmOU6:JONw6vz/DZh+C5dahU6
TLSH
T18E02FA35A8782C6B9FB2AE45F48737135FA8217BEA923F84D9D81B1D01D775C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 894eab8604b0f1ca85d363fc44910b282bcde5184c72fa06c3f9313e244cdbf4
MD5 832d01f563c15cd25f8aa87703037605
SHA1 6b34caa14096ad406d7fcf9f695b287880344024
SHA512 17cd27a6c6e7025cbd1edbc7d09061fa478ffa626e5993ddf69c8416c45eed3cf780a1c9ac76fe7071ce3adc5f1b2e7d757a267d9143d996119a2c42d1f2493e
SSDEEP 384:UZcIhsN7TCzicBr2e+C5ddJrap6HlytEDq1U:ShbXrBhzhapoy6Dqi
TLSH
T13A927D3158B42C775AEAB140F44736139EF89137E7C96FD4E1EDEF1D01DA6A8130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76d5a74baa9d384414cc1465a2ea3ba60e46f282293613060c723296a541855e
MD5 900019049c4888288df48947c5183482
SHA1 aa336ecb2dfad09fc9a22f14d95ab51c67ea4470
SHA512 8d0b86449082017ebe305dc4106d515d87c5ef107f4075df3e5cf190d24c9d7f9ebd2ddcfd63c31e7c3989d8010296cb62c006a41467e05d4346d8d5c492ad35
SSDEEP 192:6ONW6v+YLvQmiUyWOG2h+CG3+Fdeqmpc+pSJr1CHcqjU6:6ONW6vzNZ2h+C5ddJrCpU6
TLSH
T1B4121A3168786C6F5EE2A541F08736139EA85137EB8A7F90D5EC6F1C02DF7AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0320fb8-20f0-4acc-9732-6f777c2e3b8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b0320fb8-20f0-4acc-9732-6f777c2e3b8f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 261e9865392bc0d4291c5246332b68fc2e2ade969a333af535073cbaa2fe0422
MD5 f1de781fff8c98488e037090f166c227
SHA1 2101663358c4b6704a15e2eb8baab985e66900ba
SHA512 47538c3633c6438457fb14bf0a7238b1320b092d78856a8df0964dd8fa345e14517545a3afa23a2f3581bc576b64df33ec00fe0218edee7aac20c2836bd3256c
TLSH
T1D341185DAAFE1108B3B76E569BF6A86E447ABC732F06945E10010D5F0A63F01C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads