c349f5b5aa1ea92e5c3ec4306651e974fad286e2f11a53fb6e2adbb51d071e40

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadowEmu.exe
Size 945KB
Sample260816-t7wpbsem7v
SHA256 c349f5b5aa1ea92e5c3ec4306651e974fad286e2f11a53fb6e2adbb51d071e40
MD5 2fbe45345a0fd5df62791b95b0c56431
SHA1 8fc09ea49d2b84719e1a5ad42a034d326d19c6e4
SHA512 30dbe9e62ee9561212a53657938022711934cf683048ce3f4aeba0c3cb2fabab97b4dff3c8f49a5eed1f91ceed432f2645cddd669edf73f86a5dca62ed94e054
SSDEEP 12288:EzWf/bDxMC0EQhe6ri1GR9Uy6rXGkQ+YD8iLH9xmSVRz:n/bFP0E87ri1GL8XGLZtLHX
TLSH
T11C257D2A5E5402FDE0A7C179CEA69D42E771B80A03B19EEF07D045623F676E05F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
6304	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	discord.com
28	discord.com
35	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1184	ShadowEmu.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1520498983\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1520498983\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1998104325\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1154642726\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1520498983\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1520498983\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1998104325\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_1154642726\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_608067722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6304_608067722\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1316	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1072	msedge.exe
3456	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313721608616469"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{6CA1A05A-AB5B-4121-BD8B-B8D79DF61CB7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1184	ShadowEmu.exe
1184	ShadowEmu.exe
6304	msedge.exe
6304	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4084	1184	ShadowEmu.exe	90
PID 4084 wrote to memory of 3740	4084	msedge.exe	91
PID 1184 wrote to memory of 1316	1184	ShadowEmu.exe	92
PID 4084 wrote to memory of 3176	4084	msedge.exe	93
PID 4084 wrote to memory of 1072	4084	msedge.exe	95
PID 4084 wrote to memory of 3176	4084	msedge.exe	93
PID 4084 wrote to memory of 3176	4084	msedge.exe	93
PID 4084 wrote to memory of 1708	4084	msedge.exe	96
PID 4084 wrote to memory of 1708	4084	msedge.exe	96
PID 4084 wrote to memory of 3696	4084	msedge.exe	97
PID 4084 wrote to memory of 3696	4084	msedge.exe	97
PID 4084 wrote to memory of 3696	4084	msedge.exe	97
PID 4084 wrote to memory of 6180	4084	msedge.exe	98
PID 4084 wrote to memory of 6180	4084	msedge.exe	98
PID 4084 wrote to memory of 6180	4084	msedge.exe	98
PID 4084 wrote to memory of 6304	4084	msedge.exe	99
PID 6304 wrote to memory of 4700	6304	msedge.exe	100
PID 6304 wrote to memory of 2420	6304	msedge.exe	102
PID 6304 wrote to memory of 3456	6304	msedge.exe	103
PID 6304 wrote to memory of 2420	6304	msedge.exe	102
PID 6304 wrote to memory of 2420	6304	msedge.exe	102
PID 6304 wrote to memory of 6884	6304	msedge.exe	104
PID 6304 wrote to memory of 6884	6304	msedge.exe	104
PID 6304 wrote to memory of 6636	6304	msedge.exe	108
PID 6304 wrote to memory of 1840	6304	msedge.exe	110
PID 6304 wrote to memory of 704	6304	msedge.exe	111
PID 6304 wrote to memory of 6156	6304	msedge.exe	112
PID 6304 wrote to memory of 1572	6304	msedge.exe	114
PID 6304 wrote to memory of 1572	6304	msedge.exe	114
PID 6304 wrote to memory of 3176	6304	msedge.exe	115
PID 6304 wrote to memory of 3176	6304	msedge.exe	115
PID 6304 wrote to memory of 5768	6304	msedge.exe	116
PID 6304 wrote to memory of 5768	6304	msedge.exe	116
PID 6304 wrote to memory of 4648	6304	msedge.exe	117
PID 6304 wrote to memory of 7128	6304	msedge.exe	118
PID 6304 wrote to memory of 7128	6304	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\ShadowEmu.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowEmu.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/QjraS38MeS
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffc21e4c188,0x7ffc21e4c194,0x7ffc21e4c1a0
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16393048261295254858,9804901615560003767,262144 --field-trial-handle=2364,i,12460231723481590007,11098313431789430735,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3680873942778011248,2457605788491496789,524288 --field-trial-handle=2364,i,12460231723481590007,11098313431789430735,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,5427317666923713149,15675557853277849782,524288 --field-trial-handle=2364,i,12460231723481590007,11098313431789430735,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,2789346920887641104,10468957387044630612,2097152 --field-trial-handle=2364,i,12460231723481590007,11098313431789430735,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,17782896024708664428,9276518204756450179,2097152 --field-trial-handle=2364,i,12460231723481590007,11098313431789430735,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x264,0x268,0x238,0x2d8,0x7ffc21e4c188,0x7ffc21e4c194,0x7ffc21e4c1a0
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,12838272771998701251,3204300138708663524,262144 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,17418609709962554410,9692161085833487905,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,5632340983852675541,14163823804236587595,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,15032146936860829786,14400949575241986432,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,15032146936860829786,14400949575241986432,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,6371002984258892835,16827202262149232057,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,1880511923710479321,13341792448757377840,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,11832731504971021667,16787773099724663430,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2567409790142476660,4412368124828333265,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,17146215385922468092,2540038554773294940,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,4819228713344278833,7452493693549022600,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5092,i,634860520075933628,14967166664444716551,262144 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,16782615699340418205,7768303550189297665,524288 --field-trial-handle=2264,i,16925336397818290636,16549769439984404528,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
      4⤵
      PID:7128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bde368e22c3aaf195bdfc690e580da1a89afa67af4d94cad5a6c61ea77276246
MD5 c9f4200a6961851c53243ffbe1d0d924
SHA1 93f284a20b1a3be1892d19e72e5909d01c221901
SHA512 b25bee805ac1800188c68961ec1ec739df8c2024fee49c742fb1de2440e7f90faaeee8fa93ec08379be8df03471bbfd8d1e0ca5722e876d30cc71a992dd25275
TLSH
T172E02BA9C821BC271DFC1B3861541A47E751135B3B40890B3F3C912C4FB06374286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8b696c606d07171bad72b1effd07bfaf01feb2c888c5a51f4b548745f90a560a
MD5 c44e63d5dc3df72a62468576a4860f88
SHA1 bda02ea66604ce777a2abe37e01a10503c1ddb26
SHA512 35479f50919908cead6195f9d324eec3a28301428858b6c2ad2b246ca42f6c3f32bb93e3747476702ea1fff8da4ac8102ed63c8f19de29ed27e881a5f26b6969
SSDEEP 192:5YS9dv1ftQN0lFCTsOaRFvA5hyZ8vMlJY6fmqLivd1/yZafF3S:ltzlFjNRoRv2JbxsfF3S
TLSH
T113133D7E82B54D92C3D74ABD89DB0FBA6F78C0D5E1C8685B413934801429F6A8DCE52F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 88356fc2d3cce4ca619f1ebb6fd08966c03289552b2aec6136158ee272bf6a76
MD5 b3f55d54e7eea0ea6aea32e46c41537a
SHA1 f4b6e1aaf4fe876bfaafe8fbbfd30492aade3acb
SHA512 e08b05cff2a2c870ef2886a1e75920b9c793a02ffd83ae0507707a4095050d3dcff9f8e94ed63619fd623f6e8f8292f1ae9f6ee57f05355252419384dc9339d2
SSDEEP 1536:tNfuuz+lDL/6wgTL/4XeWZ7Euij0JbL/wL/0L/:LupL/QL/K9mj8L/wL/0L/
TLSH
T16D445EF71A51A00BCBA812F5D2433A3EC577455E6CC1E8A8E27C4C812825F76B2FDE59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 931af39b871ddb915063c431a973ba925b5d51dd1eb023a469e9c2ddf90f6e3a
MD5 4b11bed01aed48065ac66138aad0587c
SHA1 4bfc37cd31443b5e591632e058b61c7f26af6928
SHA512 9e945dbb32d2255b41da24acd0a730f4c95b5f5242cee835533f59583ad693d5cf94381bf9162d524299dd4d303b51a9ae8b17d4e7433bfbed75c4201ddd4665
SSDEEP 1536:gi49G+PNkouMM7VANs7O47u7M7Bjc7cWT757Z7BDz+E7rReg7g7fW7cQ7p737S7Y:gv9G+nNL8IlCbULkCp0JFdDkNa
TLSH
T1B9254AEECB681C82CF6B867074E0E9077E712183B64CD0D3A944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 af710ba4740e657c58df73557204aabe8648a0419b3ff1b78a98b0fdf1ad6214
MD5 b464be8326c4c7958d393cf4a24597d9
SHA1 ca7cd7f9b96bfefc9e05ff56beb4fc886c9cf87b
SHA512 96991a3d0c6f99edf765a89a7f75c5f512606602c7afe29d17c7ea8c673f2a7b63ea3a204d6feaa4ccf662f8ee6605f29bfd8f6655f45ca81fa0aae444644174
SSDEEP 12288:lbtHcgKVZMNr2W0aYiLw2RzVkS8TOFHh9VdVxqAw76Z6lxJfh/LYmd45RAJRuKtR:/HciJ1qBrLtxrlOSSRPVZYmH/6BPO
TLSH
T1EE166DEDC96858C3CD639A70B4F0E9877C7413C3F994C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8b92f26cfd6b248c21e53449365a4d0d1d2e1216d05abe8c64eea6af3293aac8
MD5 8ea977de4ab3201a6137347ba94af9ba
SHA1 4f9898d9261ab2f0a5d38a62f00c24aa4a8e3baf
SHA512 5ae016d77640e65a887eb73fc2a9d64da9498c5d417de69e292ac3bb3d1b563cf28798ceebd2ac8ef771c887dd6f89c8cbd73746ee38f1058c3e365c48e524d2
TLSH
T18651647463BA09C2D7618DB154D105D5BEF0E2F9C257FF0568C89E348A16F94A0E00EF
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

01957bca-90d6-4a09-b6cc-623b1dc8fda7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\01957bca-90d6-4a09-b6cc-623b1dc8fda7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 aa736b2970ff21fb6d313a224b7fd246352e14671363a3298712347c8a0d9f80
MD5 98856173a0f377df70650f57ac87723d
SHA1 f75f010479ba3788312343277ec4bca02952eefb
SHA512 0117b1d1cb71604c53e64678ff4f5dfd33240c9f14685f8195667bee140d6d632b2a0d489b3e94c289dbd6a10e0e0859b1b6dffc5cb8db89432bb37f555b859a
TLSH
T1D5E0D89495C7C15D5D5435C361687B28C1803557E785FD0367088CC47707005B66255E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 9b4ee8c8e159722f281acc60d349ddb393471066fe7f4d6401e119505132f830
MD5 b0a0fa5733b4262ae946618b88656897
SHA1 12d11aa9ed8744350a6f7b0a6777fcee2ef936b7
SHA512 bc894c375e67c69fc3ab3a9b5847f8bc6bf1b4cfcf4948bb95f0af0d1e78c93b2f6462457811dd44f9a5871060438008f8547f88fdd62c70a1df5d11fa3a94a2
TLSH
T129E0263406CAC129985C68EB8368774882E03913BAC8392267489844728338BEB8728C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d616247eadef06532d35584882d47690d55204e2b657718655d60939aa5afc2a
MD5 3752c07af58ef6df3c037689fa3c7552
SHA1 d63288a52f12fec8853d969614c0e4e8670ccb29
SHA512 4080f541746d7da286c9027955a2c0f608027489026c960f70ca2adb1ca689bad2ce26eb11ce4a931ac734de301b1895e0995f10860b54543399e3b979fad263
TLSH
T199E0D87045CDC11A5A4821A79228770CC7A03507EA88BF117B45B840BA83144EA822C9
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 4cf98d47a332c6a665e7c91b829c1314ea44fca88803ffcea0a5541ec0539fa2
MD5 5b489976696eae157a7db8a627ebff82
SHA1 a9b3107b2d13381a46b83046600bf2197ae6a943
SHA512 52873433e8437e98048e42172642b29a6cb6e0052087728ab4f2ab9a4ab8ad2f575d75914db3b3848f4a07f6d4f9d0623e2920753c62af6e5db9a7fa214e4976
SSDEEP 48:TWt/LopFMaty423w/a9NUuThwsov+ywr3UTb7ojcN/o5w+yemT:6DeMatha9X/y93EjF9+
TLSH
T1D4B2414D2F246666C0F44BBBDCD588563F6C111DC7A3368ADD1430B2DDA226BFA0B0A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8ceeec510b9ef93dc9da081f03aaf1ebd681858432e3674ccded6a92296b2b26
MD5 98099c86d9dc55f0be353b207e23ff74
SHA1 213ea0d6f7b526af486fd702fbd0b7746db77250
SHA512 bdefaf90741c7c26cd807c47939f1cf6c27beebf73285b26056dfdc479f0d848c14bf1fd7576a87005311082bb997d6c54247353c58b290a121c896b749352e8
TLSH
T1EC4181F747B4856EDB1196F0AA18AE2FCF1C0511436C7DAAC5E0AE1793E3472E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c2e33cbf87b571fd408454a800d6717f6a024e814e458d8ecfbaaebf56442a4a
MD5 88d3c33d0937abedf2f274929442ce35
SHA1 fddb6d813dcb7582a531fd75e4d23f737893627f
SHA512 f403b1c543cdc30c7f7183eea7af2bf8102825a9c6daa98c9d7b42c2e2e894fade6889d8f28dffde6c7470650842522ba977b7231afd30030b16bdd2fdb3a700
TLSH
T1B15190F783F4856DDA1195F0AA186E2FCF1C0515432C7DAAC9E0AE1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c82ce7bb336380d631a5ff6993d5d3a4c7c58b1ef0570a67581f7fc44b039271
MD5 78df31ade595b4143b9179c15887592a
SHA1 26b787955c12a8022ca48055785e5062e1aec531
SHA512 d5a3a93a59ec954848ebd56a44f8b965446f1c0fd2506d989363c6dbc983802aeb823182d8b8c4411916ece8855007f522e1bb58f366046d728edbc6e3d638b0
SSDEEP 96:eIEumQv8m1ccnvS6fxnDHIRntf6IRWnFPIpYRIv4g:eIEumQv8m1ccnvS6BIgIeXM
TLSH
T128F2F0FB0727A205D99484B0E400AF8EAF16400B47F6B6EC66D49BE3F7921E2B165746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 d21999f9cc8209e513e0e8c8f63dcfccdc860367e959457c3f43ef43d5725ee9
MD5 04000eb5d97f3c6bb7357b9c919c9537
SHA1 8a667fd3ed87da9a98b08e8b977ee18cc2079bea
SHA512 b076cbd59db239eaab5588a58d860ec8cc8b30882872dd58b0abdc1a970550f04c1028c6386237a90d57a541a77227c24cbd50be57ef29b6815d779f2f0a01f3
TLSH
T1A4E0D8D78DBDF837103505BB09D07D852679A435115155E4EDA6933DB0E80B35B02425
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 398eec6a0aab59d8a59a382493e4e2d0f4e3491d6790c0372ad5eedefde06fe6
MD5 e3fd7a5f0544709243a8bb401af4e964
SHA1 b96aa8fe026dfebb338a78ee8019a72946e618e1
SHA512 489cdfbb00c4b7e628d421c3e36e7e0589839df6380c059afe28a6feeaa6e13cc76d160918c2063a9c387002deb61e225e410b8a39a28b2ae25bd724feb6fb08
SSDEEP 384:sxR2eJC/fRs/WvgbLN/RI8wrw/5IWqEsGQfjs:saMC/fcYgdWM/5IWqEsGQg
TLSH
T1BE72E915AA289D3BCCDBD21DFA957F53D7F91563A1905E449AFC8A0C00E76EC210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ab74f3a8afdca698e98a67fdd20be7fc8046fb07b98b0d70c929264209c06fdd
MD5 da89222f34bde19e9d655daa741df6c3
SHA1 bd0f60935bedf1af148761efc092ab0fdcd8d6fd
SHA512 f4faca26e79ba6c4f8f59b5f35752d6ea02565284ae0782c2ab119a22261092271bfa6bc1a79aa1d186b80a146b92012c142ac69707c75d3bf4d36dfcfaf40c4
TLSH
T1C6E0267007CAD17E689A32DF1224B70892F57507E2CC3D227F80E94472C3A45F1A3188
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 52dfd3a5dc562c5c989ebab8dfd54d79a8e89b4b346aa299f06d1cd427ee0b3a
MD5 d2c2cc5937bc49612ccd439521071144
SHA1 84044a16af6679b96d5b9f534e09492dc0da9ae2
SHA512 d628bf8e851d683fd5792f27a17697aba35bb47336762e3e4f27b5dfa8b786dd67cdb0353cbb3edab7f1b13a81ec4578049cf2226d4601d71d81adc3af4079a2
TLSH
T184E0D8B017CDC7AA658931E79228F30C82E27503E6C8B9227B08B8406347540F293245
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 88bbf3585abc753e4a27cfc99c4fd0e718d94806135ab9b12ba0cbc09259c58f
MD5 cbcf520e7eb72c351eecc4d1cfe30c15
SHA1 55a66b74cd5a782f4c1c2d12c011e7fe2c63923e
SHA512 8e0eb4a254b7fd463a807445941a31c899bddb16b39a988fe08c9b4df6af2b76708f143bd7183a29ac684a78ff5d99405cbe741f1c8ab8ebe1313ece6d98b007
TLSH
T151E0207046C8C679A99861D3C268B71CC3F07907A3C53A066B085C406243101F67B185
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 d4890ba1fe994a783e89f9089b6c016585438b80151bcc34113506fc2a3f0939
MD5 4189ac8ce16903cd62220a33504309cb
SHA1 09024c372381aa81c09ba3714fac757147f9a18b
SHA512 b0efa1461052026e8338bb8a4f54e6e52e70a629a64503b3207206b947f0346fb82b83e277e18668b060e0bd74b5c321b0e5ccd6c97d6f2f5010a6e875cd720f
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ99t0:yv+RpPYDDRPbIhJ99t0
TLSH
T12EB24F51713F5680387EB90C8178982F96C2B4637419E52F7B6802A65F6BE039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 abb9368bab06468e5f15f1bde97ba6bcd21b77806a3733a94cda5596906b6756
MD5 c58e24d85363b09b5f2a21b1ab97fb83
SHA1 b9d543603f63f61572b5a97c0223eda3399ed0dc
SHA512 b9c836d13aad1e2b7b91cbe75b28c585d835bba2030c73e0808455d5ba90346d1cf9924d10f272b934afd7448d62b88e113e4a65eb1a9ce8261ec30b8cdc64ca
SSDEEP 384:DNrRZyCSDnxTICOe6MEhIKyll7svbFKfk7:xFZJSDniCLyI1l7svbF9
TLSH
T1E344850A7B747001EDE6D9725CB080771E3C716DCF22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 8df0da52a45ed2d06fd39779f6747ff2fe84425b2382f50c36941a511ca975df
MD5 aa33a1dab169e830c3eea40393b3736e
SHA1 abf0b9115daf1225921d39d4699e4998f50c15fd
SHA512 3fc3ec27f3f1e154b24f2fa3e259ebdab8c866f465ff46d4343958b2b3d482a816da4d545f835890e2e40d1b72c6977826ca3615edb717076302815560ee17ce
SSDEEP 96:cZve89+BFOxZqoQgOX8ZeDWXWY1lD2DseCMAWVtl9wDQHWWVzAhGXI1hBBBBBBB:z1+OCCAstl9wDQ2szAhGXI
TLSH
T16C224196BE435B33E10C89B353B6CF5053E3D48682776A1E76A4345D0ED6A6B87C82F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 df6b9437ec6203b949a16d3bef9133075af59bcb7568e5edee45204e9fc832cf
MD5 510bdbb68fecc9057a7114eeea99a845
SHA1 1d57119591981a9cf37df624885914e9a80ec045
SHA512 722e9a6783b5b224abb316acb73d2a6085ec4164aa13dd81600903734493d9d2dad1874a846bbfa696f94dc28f909dea5298f157089482db953424bd0e6ea2c9
TLSH
T148E02620EAC8C16EA85930DB1138674C83803E03FE9C39062F04EC48A243500F7871CA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 28ddb8cda77df3cd1cd4e872ea33aada461c43165b8d611018ec441bad03f63f
MD5 bbb53770f9f54c721436ab5bbe52d574
SHA1 8f62a9f61f982196731726129ee3d106191d8204
SHA512 b175f04a3601355200acdf8b83bfbe1b32be3174bb6781fdf2bd4bddd74b82a61d70b249b41c7380d0e144ea86558503228623f3c285b21554510de76c43688e
TLSH
T1AC219A19F320C048E54A827E906B9B350738E8568FBCED0F84B920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 8f131002ce09a898089d7f7679bc0a420fe50a7791265d04bb23d77383151f65
MD5 65d8ad6831162a1757a5f5ed77831fab
SHA1 93523c4d394a368ef79b32924e3d510a195f4016
SHA512 b687c587d7600e5d3e9f090b9fa2d28507f7a1b49888293b819813ac134c42a14c971accdc3c972c24434d99b08cfe4d2a5fd413de0ccdb84559f05e13dd33ff
TLSH
T13DE02620AAC8C1AF986920E70164B74882913D03FE8C3F022F04EE84A283141FA8B1C9
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b2e0c42f756b40205eff7e48fbd3ec8afdfeca3948bb4b5f4a610530abcc3b7d
MD5 568597484657b77eb9a883eee423fce4
SHA1 5a9ba4b7d3225f30f4cc438bbeb070f2e1ec8b61
SHA512 fb2a202fd66c2cb1d2162aa9ae974050b32664fa92a018fb192704f55d2a53dc4ee6f20d48e6438e3aecb2a306a9acea90071019895d99bf3cf86134653d3a7b
SSDEEP 3:MsEllllkEthXllkl2zEZlbNtl:/M/xT02zQt
TLSH
T11E4404447FC0040FC5403131C411C37413F0D5500715574334513C135CDD5400C01013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 28adcb0fc5e9b44bc53bb6121ee4e45a92b041eaa8b6a06b80dfc0cd63d84112
MD5 40454e560f643fdec7c36f3ccdadd794
SHA1 443c7eefde3b6480a8863640de83a0a695087935
SHA512 6e0808fef2c5f884444efb1179cd2cf4b8c1f55450880f42183a74f78d1ca7dfcc959f5cd04aee50972a8cfe13bd1d1278f9a421162abb598c758c51e8faeb5d
SSDEEP 3:MsEllllkEthXllkl2zEZlZckhkl:/M/xT02zIO
TLSH
T1C74404147FC0040FC5003531C011D3500370D4100711D7433C5114135CC5D440C05115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a9bee25b0e28f7f937a4fe5d4a23f0245d6eaba9635ec9f65257a315c159adb3
MD5 0c308e52741d4c82989ee1f92920d39f
SHA1 0aa2260f150cd4b1c7d7b9d6927abe0dfa495389
SHA512 00610f318ef5aa33b7d14df15f3e9023c6ca81e84909ec1a9b39b496a76a7acd48575b3b3d428d59ff8589b79c13e365f671e9b6c0532edbe5e405b25903cf64
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuVREqf+GGECXcMsLbOObjI9G6w7m98M:EF1j+9SXOwgUusZGEPhb29Mm
TLSH
T19CC24A36E865CEB7EDE74FE9B74A7A46EEE0516785DC59C8DAC85E0C00C31AD030381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9dc0c168650d3f54e7a00ba18a6638e7becaf5390cb8d5cbcbb53a67ed3a4e95
MD5 9a36b6dc0974239992f85dff51f0a4fa
SHA1 a32d70a1dc6c06a9059ad6b34838d0b67dc774ba
SHA512 8cd37c384231b8194ba106b85584c32e131ae5860add580c155963e22d7b03652819d2f4fba7e0d058ddd13b7284092afcff71b8d410e7715e4bf4318ddc0702
SSDEEP 384:naiFWZcIt8NLR8TUNTUlIRUPvuTwjgjEqf+GGECXcMlZAAttXwRF7Iz0:RFEtQRwgqu0MbGEP0tXwP
TLSH
T1E2B24B72ECA5CD77E8FB5F95B6497642DEE4516384DC9AC8DAD89D0C008319E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 5546fb63c01ae2c71f6038888fe9922d120b25ee885ca388d0e292db77ae173c
MD5 1cec16ea0556cbb4a413f6b6d48fc987
SHA1 f9606ba621b900c1dd068231e96a8339200adc02
SHA512 b8c54cd4bc09b29b721d194b9e6e557f80aa691f657c173bb1fa1b13f8567123e91a1155d3b4b7861eb5b1a4556d97fd17d4465187d906ee9435fdc6482b8b13
SSDEEP 384:nuiFxtNn/s3n9S38NLB8TUNTUlIRxBPvuTwj3jEqf+GGECXcMlZAef8Om+cbD4jP:FFxj+9CQBwgpu07bGEPAu+cbD4jGvXwv
TLSH
T1ABE2173EDC51CD7F98EE7B88634E265699E41173C4B88998EBC80F0C80B359DE70781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 8424ce977a89c14656bdefb89cf0fab972a0db6f70f31bf799f0db9b0f781594
MD5 c50e26cf9133dfbbe3e07e22188eb19e
SHA1 faa56f87cfb752951b84e7284b91ccc74ea05e09
SHA512 d1ce517076ee2e5503f5a1679ba68ecf41c072ab90a08c9e03c529d740e3a96d99be7ecbf1bc8bc273369df87d803ea66bb134055d7a6f340792c46355384986
SSDEEP 384:nXiFWZcIt8NLR8TUNTUlIRUPvuTwjgjEqf+GGECXcMMa6zWrKRZmoxDwRF7Iz0:SFEtQRwgqu0MbGEPqSEKRZmWDwP
TLSH
T16FC2393ADCA5CD7BA8FE6F89A60D7512CEE45163C4EC99D8DBD85E0C00A319D5307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d3252477cee1694b5c304998e857b0309d406ff1dc28a7db6d076da3b26ec0f4
MD5 954f9df0fabda617504013b0d53f01fd
SHA1 f26057f35761203ca033b735b67311938cffcecd
SHA512 dd487e0f3ba1ae27c99bdfa094f915971efb7f4669d9fa73d10735dfd3390fde677af8068d803a778ea044b42dc4a6768e18eb50ff25220f4c1e190b78f57fc7
SSDEEP 384:nsiF1tNn/s3n9Sn8NgB8TUNTUlIRiPvuTRSjEqf+GGECXcMlZAekOOObjI9G6w7m:XF1j+9SXBwgUusbGEPhO29Mm
TLSH
T1AEC25C36E895CE77ECE74FE9B74A3686EEE051A788DC5AC4EAC85D4C00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c90b2a803277e510ceb904778abce36fa16babb0d547cc4489c143685ce65f95
MD5 c2dcc8341bc29a398707d00a2656cce0
SHA1 ec191850f820f4b3372f99f37a15c042944725ec
SHA512 a9c023268a5553828e364942e509ed9200729822f2101f3bdf77acdb122015de371596679dce7ddcda7562654129309761a24e7e347ee66afaae8b8d09649c92
SSDEEP 384:nuiFWZcIt8NLR8TUNTUlIRUPvuTwjgjEqf+GGECXcMlZAAttXwRF7Iz0:FFEtQRwgqu0MbGEP0tXwP
TLSH
T197B24B72ECA5CD77E8FB5F95B6497642DEE4516384DC9AC8DAD89E0C008319E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 e7275bb6ded6d4f5896fb85cf083fcf263124963ffaf88b8711e9e96fc6bc554
MD5 3b8a41212f3c0030169a44655b3fe116
SHA1 1b2c786c96771b91154746d3a86fd1b43d6a92fe
SHA512 2b5597f1665e1b9ead8bfea7817b609b05cab1930b0aee241505db349fb451687a40f9e28d929cf7776daf54e1a59cf3d2ad58fcd8b81cf06f8287ffc2e2d70b
SSDEEP 3:MsEllllkEthXllkl2zEfl1Ml:/M/xT02zi
TLSH
T1454404047FC00407C54011704051D35033F0FC114513574334D57C335CD7D500C40C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download