a2c735ff0199bf553dbe5b2c3b60dc83ba6beb8613f03fdc3429abe7fce3e028

Resubmissions

19/08/2026, 23:03

260819-211npsysdt8

19/08/2026, 23:00

260819-2y95csvfrh6

Analysis

user interaction
yes
max time kernel
23s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ParadoxBetaFree.exe
Size 272KB
Sample260819-2y95csvfrh
SHA256 a2c735ff0199bf553dbe5b2c3b60dc83ba6beb8613f03fdc3429abe7fce3e028
MD5 babe34db9103e8096c0699f52bb3543c
SHA1 b6461cfbbec68cef4dba69c3a1cb17fedaf19676
SHA512 af83300b22580c9cc6d74b0466a2bdd94f64116969e7d463cd164645a0ba8699973425a674f15f5434b274f2486085694a10940597a25bbeb6ca8a7e9dc6c434
SSDEEP 3072:055DMiho+1mG8U7mFOkD2qlBVO4aG7Arq/GnzccKkNFTS67Y5aXEV8XFu1M1Ds5/:81ZC2qlBVJaGMpzccFnjFuIxFI6
TLSH
T182548E59F7A41CFAE967857DC9424906EA727C4247B0E6CF13A00BA71F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
99	raw.githubusercontent.com
1	raw.githubusercontent.com
28	discord.com
29	discord.com
31	discord.com
44	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
6704	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2976	msedge.exe
6336	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3448	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316540504987289"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{3C2041C0-3A17-4943-9D68-F2CAE9E4131E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{45658363-294C-4F89-901D-2A1F203ED902}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1880	4792	ParadoxBetaFree.exe	90
PID 1880 wrote to memory of 2068	1880	msedge.exe	91
PID 1880 wrote to memory of 2976	1880	msedge.exe	92
PID 1880 wrote to memory of 4692	1880	msedge.exe	93
PID 1880 wrote to memory of 4692	1880	msedge.exe	93
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 3604	1880	msedge.exe	98
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 3604	1880	msedge.exe	98
PID 1880 wrote to memory of 3604	1880	msedge.exe	98
PID 1880 wrote to memory of 4628	1880	msedge.exe	100
PID 1880 wrote to memory of 4628	1880	msedge.exe	100
PID 1880 wrote to memory of 1804	1880	msedge.exe	102
PID 1880 wrote to memory of 1804	1880	msedge.exe	102
PID 1880 wrote to memory of 1804	1880	msedge.exe	102
PID 1880 wrote to memory of 3792	1880	msedge.exe	104
PID 1880 wrote to memory of 3608	1880	msedge.exe	105
PID 1880 wrote to memory of 3608	1880	msedge.exe	105
PID 1880 wrote to memory of 5884	1880	msedge.exe	106
PID 1880 wrote to memory of 5884	1880	msedge.exe	106
PID 1880 wrote to memory of 1052	1880	msedge.exe	107
PID 1880 wrote to memory of 1052	1880	msedge.exe	107
PID 1880 wrote to memory of 5396	1880	msedge.exe	110
PID 1880 wrote to memory of 3900	1880	msedge.exe	111
PID 1880 wrote to memory of 3900	1880	msedge.exe	111
PID 1880 wrote to memory of 4016	1880	msedge.exe	112
PID 1880 wrote to memory of 4016	1880	msedge.exe	112
PID 1880 wrote to memory of 4236	1880	msedge.exe	114
PID 4236 wrote to memory of 3400	4236	msedge.exe	115
PID 4236 wrote to memory of 6352	4236	msedge.exe	117
PID 4236 wrote to memory of 6336	4236	msedge.exe	118
PID 4236 wrote to memory of 6352	4236	msedge.exe	117
PID 4236 wrote to memory of 6352	4236	msedge.exe	117
PID 4236 wrote to memory of 2536	4236	msedge.exe	119
PID 4236 wrote to memory of 2536	4236	msedge.exe	119
PID 4792 wrote to memory of 1880	4792	ParadoxBetaFree.exe	90
PID 1880 wrote to memory of 2068	1880	msedge.exe	91
PID 1880 wrote to memory of 2976	1880	msedge.exe	92
PID 1880 wrote to memory of 4692	1880	msedge.exe	93
PID 1880 wrote to memory of 4692	1880	msedge.exe	93
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 2796	1880	msedge.exe	94
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 1244	1880	msedge.exe	96
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 708	1880	msedge.exe	97
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 3604	1880	msedge.exe	98
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 1356	1880	msedge.exe	99
PID 1880 wrote to memory of 3604	1880	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\ParadoxBetaFree.exe
"C:\Users\Admin\AppData\Local\Temp\ParadoxBetaFree.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/rVTr8WjqV
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffc8993c188,0x7ffc8993c194,0x7ffc8993c1a0
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,11855871121863781664,9619061409000971961,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,11459348529200872347,17962940434798803372,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10626403761497176564,12989337223586706389,262144 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,9221829491904252200,8968663979369122035,2097152 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,12821032885896146599,11032932555561985053,2097152 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5334683534954125922,9504466679404492311,2097152 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5109778153442260357,7539899984900502821,2097152 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15426062774704025586,4126224657807237396,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5292,i,111228898106181558,7444369528553754958,2097152 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13065717645081291186,586827718526336491,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,13065717645081291186,586827718526336491,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,12162018729476485837,6490553333324178522,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,1596625059667718419,8338121257805656629,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,4680811079338395326,13574311978349572189,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,12083548749441441111,17778840962774898260,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    - Modifies registry class
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,6615333986855231037,16500258473741118150,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:12
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,17393209241758901308,5776268457183894061,524288 --field-trial-handle=2260,i,14581303199648003758,470042622882505140,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc8993c188,0x7ffc8993c194,0x7ffc8993c1a0
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,10819681980629990065,4059420938942311919,262144 --field-trial-handle=2560,i,10946550373000243423,11498680768328673919,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,4344991906440555033,11763138305191885477,524288 --field-trial-handle=2560,i,10946550373000243423,11498680768328673919,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:11
      4⤵
      System Time Discovery
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,9035349621037482738,6036669023075966965,524288 --field-trial-handle=2560,i,10946550373000243423,11498680768328673919,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:13
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,7210991676602560372,17149605928495568542,524288 --field-trial-handle=2560,i,10946550373000243423,11498680768328673919,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,7210991676602560372,17149605928495568542,524288 --field-trial-handle=2560,i,10946550373000243423,11498680768328673919,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:6184
- C:\ProgramData\ParadoxFree\kdmapper.exe
  "C:\ProgramData\ParadoxFree\kdmapper.exe" "C:\ProgramData\ParadoxFree\ksthunk.sys"
  2⤵
  PID:6668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6704
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" disable >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4752
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Ethernet" disable
    3⤵
    PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:6780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c8f32a144eb654aedda78a1f08ed3379010427c319135c050a4f8d2a6ab8c06
MD5 0c6b8196ce229bcc9192c825894e7a0c
SHA1 32afe5bae744481b0628eb933a40c20c429e73ed
SHA512 55ef3fad5f311d1261d07e7324af778565e2867d90aab8eea17ed83b008e1806b5a8a57298ba7fc0f41367fe2f31b95603aeb3f9dd7922b7dfaa92281267a342
TLSH
T15BD0A9203B68AA84D298207658A04640A2640AA2786E4208A120A52CECB98C257BF9EB
MD5 SHA1 SHA512 TLSH

Submit Download

6eaa3418-8a83-4315-898c-554752f72641.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6eaa3418-8a83-4315-898c-554752f72641.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 58bcaf5d565611cf81aa5dd280fcfc73b62184d9a4c786f268d8ae778470b835
MD5 958b289f44775ac0aaf9baf582c41be6
SHA1 b3c84c58c6ad0bfb20473eeb45df3f96c55c5db8
SHA512 609fd05f614791aa8342472105f9e0f2fd029424b8cdbf8a355b2e47e96c864122b43304c4a66eee994c1aa39c59ab7e207823c753f5fd522c71dca6ace4c7e1
TLSH
T1AAE0E5A6C821AD370AFD175D54505647E75013572A81490F3E3CA10C8FB0A6B8A4581C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2a7a3b5a567f967cf21fdeb434087b080d7487fd28a58b7bf28439e5156ee3ef
MD5 54057d47852dae0c7afd34ffd21eab3d
SHA1 652511db9d60693e6f2e52937c5695c7f887adbb
SHA512 95a8974f65a2972a6252a7c756e9d061ee45e2fcab29df4d5cb2ff94a8345fb3e77b3413412cb3b15d1d3065a162bfeae02806d30bcce427ff7f80eab0c360ad
SSDEEP 768:3hyKLWutVayMiTSdlIiOiYiJi+i9i8itXJQIYIeIMIGIQItIEIvI5IUibjikKshB:EqW9x4iOiYiJi+i9i8iFJQIYIeIMIGII
TLSH
T1E313EB3FFAB8AC22C6EB697D070BDEB59728D8E1DA9020071E6836591215F5F05CE10F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 776KB
SHA256 27ff03a02c19697a2075bd8aedb894c3e62e4456334895ca1181539993fb2018
MD5 c1fd7744795978fde9a9d709d515c1d4
SHA1 29b60764852925344e4e4f69b90a360302db6722
SHA512 e245cb464bdd674d916cf48fceff692afbdef8fa2d29c0a4a845d49610660f45f5722c5a78ebccbcc4c6926841ef0bd0f6fb47e8f67addcf1e05856737cd39d5
SSDEEP 6144:sYL/7L/5TjzbVglaUMVcsC8LM6tZouxdZYY+DF49Z/Wc9K1a71HFV:1L/7L/RHgaQsC8LLZoY0RB49ZepU9FV
TLSH
T114F4B3F784016829CB7C12F953037A7C9337418D3CDAE9DAE5761C996829B33B2A4DD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 4.0MB
SHA256 d3f0ab5adfaaa17115e8d217cac4cb230c60ecec677635fe06f68a656e01c753
MD5 721b3e8ae40702b67d6456179733bd85
SHA1 5b00fb45fc62f0db09136185ef13876702401979
SHA512 0e304ac2b3b1fb17bdcc3ff61b730aea7297ebf6a499e35b1e4e70daadfcc5bc86876a5dd09941e38a21eb706882dd4eec67bde6419c3f6d8073a5e9f0faecf0
SSDEEP 12288:yQac9HskLjkRepqBnJTz9VHnsPNBQOqe53:gQkRepOnt9VHMQL
TLSH
T1A4164BDB4B787A92DBA6DE70FDC5EC693DB810C2AED6E0432442C67910837C23A5558F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 faab51f7f8671e7c03c232bbc1c6e3607ca8df4e189f241de175eee4ec11b64a
MD5 aaa27c7b100e571e5af1f8ed93912825
SHA1 7438c781a9d080db36265ce0d942e384db18b7d7
SHA512 15450eda8416e781de05090757b0bb5955cc94c98fde5f32ea24b2f59126dff29c3bf4d9b57a3ee42935a40cbea97d78fbd1a6d867ad428ca3c81698637f2524
SSDEEP 24576:+HhjgcaZN8eK2Dz7+f9BI+PIEODHxifM6t7YEuJCylh0l3X4jZdfYynaZ31fB0B6:+BGv/VTCpYEuWl3X6QEWl0WX
TLSH
T152169EEDC97858C3CE639A30B5F0E9477C7413C3F994C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 3bcb8add2017f75a256e6d0359f263a16274fe218e4423f0b54d9e196ccc8514
MD5 a25f1f073ffb0da10ec5d7f0307150d9
SHA1 86e6375a02d6aac305709c92a3ff6d3a2c3c2589
SHA512 1396755cdfb518a310de154e3a87aba97c1ec5e79871e84e2e51280da6a95124fb44b57031463653236645a95315286ca7b70a223f31b07272013435da6b8a69
SSDEEP 96:1GFHPkffBCvE9ou6h0eb9UnN0iEFpkBaXNaMjgN/MgbGTI9zrT8s9Lpj2:1cWpCMSu6aQ9G0R+B+zO/7GGzrTNp52
TLSH
T186124017027CC585E757CD32AEE8FA94BAB2828A20072E310EC26D34D625F574CD769B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0234.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0234.TMP
Size 2KB
SHA256 e3064186e36102f0d2e1cbff17a9da2c404a1832b4ca1d05e5d3209ee13e0650
MD5 22d8e792210fef437f97ba553639fe40
SHA1 de923acdbe17e256722fb30444ff3a5c41d869d6
SHA512 25994a659e440b2138904ecc72002310d0bcadaee8753cdf2f2983ff6a1429eab552d678df4b29b960c101204a50e21640dc6ea869843b151e49201cff725861
TLSH
T18A51F82613B1CAC1F7A94477A3EDBA847FF08659220B2F110C437E359925F2760E0ADB
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 bc73a0495e24630257350efc76de4796ceb11ae06637a75b269d3672b1912d9e
MD5 72958f98ec629b96376f92a1c3ce54ac
SHA1 6b755345b3d2439d8ebc0632db7e04894cb63aa5
SHA512 5676046206b3c839d5bd7a814bf4d58bb989883b3df58af92d83e2cc92b01cc0fbbfa02213f0c5f28b06a1f4f4af864cd73a9a5db92cb0582c3ad22802469236
TLSH
T108E0D8A56AFAC15DD91079C35568674DF1D43843D6C9ED076F05CCC47646001F3A1947
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 24a080cb2485c54f8555de7d445eb1d272503d1e8b3076c3b37e2a5a73f2409e
MD5 93daa4952ff735fbc32187f68da4f386
SHA1 18030682a8d1ecebb21b333224850ea28e465a9d
SHA512 cfefd06b24f5ad607dba9cace79785de443d7bf537f69e7c2e958e2bdde3e489ce5d663263728186ca7fdd472132efc783af55e375cea2d87ad10a25bb4ec4cd
TLSH
T113E0266505ECC22AD514789B8AAC6708E2F23523B2C8FD066B0888546202645E396E82
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 ce19d3c040b57810b41a36bd7e5bc0f0679590dfb39200eba6cd8e5014a059e2
MD5 d67cadebeca14ef2d9986b2eef6f22de
SHA1 5db93a27aa13559104467aa9ac3dea15a0802b2d
SHA512 8ece0d9e6f16594ad73b09ae7d539b3fd5f55af18c93fcf14187d7a31aa8ea3cb72f788cc037104f37d36cdee592a004434556e096d8bb926fad87613cdbae63
SSDEEP 48:uzBmw6QU1PzCcwJOrZjrte3FJu4yeRvXRGg12AxyU2y:6BCxzwAr5M3FJu4yYvXRz1Xxb
TLSH
T1DC92C6470E393853EB052B7E262B4879C93BE1ACBFA5CC89302590781DFC656A0358FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 30fe5ad64bfc7835bb802e5a52bb4760b2e7d614b5864bb7aa637b461e4f7d35
MD5 b8d318e3bcf7ada8a8b9b436cad0827f
SHA1 e158142890495d0d8c91991d4223f631adca0685
SHA512 371aa0624a5888f52942eb97a3467041feec0f6544220c40b4e14fded869efedae98e978573a11074f7565680430d0aef296ae20303eaa642572593c90f00153
SSDEEP 96:nVoeHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/2TbbEOVpZf24JkMfXSFR+CFq:nkH+bF+UI3iWGVoWN3qL/OVVV63
TLSH
T19024111F5F752712CDBD813668E744A35C7DF03F8B5326DA686214B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 9KB
SHA256 6f11d1b1b5393606469335c4316842af0aacde53a9ecbb4c246f36f476d06e28
MD5 65ab8312a4538e1d7a5d4fccf99524b7
SHA1 8e3ae66d1c2921604a2a4134168b63affaf26c12
SHA512 0182fda852bbb1d111548a546385156d724aad52c378dda1cbd4121ed72676f47585e4cb3bbb53f9422fcfb2a8787bf06e881d5e01cc200900c89776d033976c
SSDEEP 96:Ko2nwejJYuYQ/GStZpZfEADZXYAyKU3Q2mIAMuYOv3y/KPgpesKXl+CJF9o1uqNU:1GjJdGfuU3Rjyi/Lg1MChWjv2Oa
TLSH
T17012207FD418847E477B8327D18B351ACBBB397E181CF95AD1C61D0C026E6AE1211AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 771abd0fa38f68d18bee8862ecab7ac1feafd3a77b5357fce009bb5c17c47d13
MD5 d9ea1d9567438851e5a7df21d24e4e24
SHA1 8219a1aa311335fba625801736f841a8b0c77275
SHA512 fa0b45d42845cd35965eb85d71d6d89f9047511e7c233795c9393d018f7e869bd30a21d013ca648aff659d352bbcc847350583ce433d99666c01e72e1d8520f6
TLSH
T141E0D87049EDC169D605704792547B08F3B03417D6CDFE052F049CC6B146104E3859C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 a97e5d28e86f54584538c0b4269540f2e89f35f118f9380d1c3303db4b2ad145
MD5 a7fe1d63d80c3703a18a90f9fccdb441
SHA1 2420833714477cad8138c2943054e61707ed0bac
SHA512 b622f0a7a0911146d1fbe60ec82c5e378148135914e57c699229164d23fe9e0691ded6b0b315da8616bbc93ed28760698b86db4715b973e55243dd4f5ab5c07d
SSDEEP 48:Txk/LopFMaty423w/a9NUuTm7fuGvwxr8frIhX3tPdzHNbi/ymHNtFPxEiWoOAJ+:qDeMatha98ZKrlBPZviFP1gF2id1V
TLSH
T197B2D76F2F742511D1F98B77D8E181112E2D05ACA76339C5BA04F0B18EB535BE8128A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4842a92c1edabc307c0ea268ef1c21a7baa4b6848c3b972fa7864d3b14a96f17
MD5 818ae3a224645d0b3f3ae1dbeed310cf
SHA1 6f4c6e3c926480acbaadc171455a6a3f14f55245
SHA512 2897bc69582238def9da5fc57b0c2c767b84b319d5d9c7332300de55e39a1d4ae7c0ec117916d37ff00aa70918351fbb5a775adfdb2cffb4e1d1b688da83be7d
TLSH
T119716AF387E8862DC91156F4AA146E2BCE2D0924431C3D2AC9D4AE5BA3E35B1F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6002249268c870d2fc9c1a1f4a5c1089142d588d1920030be7e62b36c8d622ea
MD5 6456d56627a590b942099b027fa3b13b
SHA1 3aa83d82cac5ee04d1e71f015f42788a3d1e8f9e
SHA512 71b7c65d75fbeb9dca9e6586daa115f63d31e247840de6ae767e5bb629aad2d0e4901e831e5a5ec67b9eb3dc8fe1a6a6069941309c7f6b9c0a8b45adb8f23f82
TLSH
T161219DF3C2E8557D890142F86A143F2BCE2D0955931C3D5AC9D4AB5B93E1871E28095F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 9277f0d6cf8ee5e82d456c4c7c988d3b574a95cefab0b1a3d2f3c451cdc2a546
MD5 7d1074fc8df47fe61b7ede8b8e0721ba
SHA1 c11bcd52159b45abf22d494f54cf581772f64445
SHA512 c0bff1e23a1a77d695993d2c45f30eee65667144576ecf0c12e0dff622e1fab07262b72ec2ce387f8b6feb966db3a76a6e54d0a5c5c62893b503a9d997020011
TLSH
T13BF0B463C5BEA8A3507909BF1DD17905267998341105E0E2CDA6963CF0575B3A702437
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 977ccea5e14742ebfae6a03fc3362c39d12a4ecc571f00f07c4264f0103eb2f1
MD5 14b9b9a88ed99e2fdddfbaad8697288d
SHA1 c15ae145d172ab875c47f3ae8ffa1d05aef3d2a3
SHA512 c4507191cb013a46aebd05707b1b64900cff5897c4eac5ae0d076b393109e474b4c84c1e8cd8fcc8ce22cfadba44ba66f85052f01345680de4f8040009d5d2b5
SSDEEP 192:sxR8RwCP/fPsJb87ZW2rzoA8plo/g6+WNpLQ/eBEb79Z6XGTIgVdJ:sxR8tP/fPsJb81Wva/5e/es649
TLSH
T1D942C8166E28A93B4CC7E31DBA55BF53D2F91132A1D51E48EBFC961C04FAADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e799e6aa234bf1276f5a7cd0d92889b43b058df74ddb97b7f0c3d10169c918f5
MD5 8863797d12816c73312a4edb50cb1b76
SHA1 9cb036e2dacf119f8e261db0b859f23c6423ef2b
SHA512 a8a0c649d291277b3d5ae0c69d5bd63ed98a332aff3b582225e991f91bd965fe8cfa8860d0bbb1a84b57f9b6ed63922cb4728b356d2b9894f717a3a24139c0a5
SSDEEP 192:sxRnRqeP/fPsiWpVLb87ZW2rzoA8plo/g6+WN1JLQ/eBE7R4Z6LgTIgD5dJ:sxRnFP/fPsiWvLb81Wva/5M/eN6yt
TLSH
T15152B716AD28693B4CC7E25DFA557F63D3F91132A1D11E48AAFC9A1C00FAADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a6174f650b2126c31f0e399ae8e5e1c35bc06bfe60317c3c2bf0773852e11c1
MD5 028535d278c575926dc9b64f76fc98a9
SHA1 0fda1a70b19dc674f853f87f02ee95ddf5b314f6
SHA512 b16867db515528b1b01d9481504a6d540074d16f558d863a35b7a486f8db44464697e25ed1d4b0e9888bcc33fcb0767d0331dee9e32b7726cb394d2a8a8760c8
SSDEEP 192:sxRnRwCP/fPsDb87ZW2rzoA8plo/g6+WNpLQ/eBEb79Z6XGTIgD5dJ:sxRntP/fPsDb81Wva/5e/es64t
TLSH
T19842C916AE28693B4CC7E31DBA55BF53D2F91132A1D51E48EBFC961C04FAADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a4a6a8de153692a171fe3e969e1bfd9553967e1362d8e65435873bf2dfe9e80f
MD5 afad143cc5f2d2606006dc6de296d66e
SHA1 128c14369fe41f459798274cdb7b4cec1998d3d6
SHA512 dc24c0b997dcf1b49957954fd23a9c4fb20b136cca9a40288070f4237f287dd54bd18e1ee04c4f9f04f4e8d3123e3cdb2ee3833a2d649e9a227b877e9c9996a3
SSDEEP 768:Fb1p8D7pLuL7otWgikf+48F1+UoAYDCx9Tuqh0VfUC9xbog/OVEApJ8ICroSVDnr:Fb1p81E7otWgikf+4u1ja7ApyIZ2nr
TLSH
T19BD2EB7B240DCA7F4F804ADDEC19BA9E6D6802CB9698CD8447FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 81dfe068f5f79b62ce6d93f76f5adee2d064e0f226e67e95398bb814de5ab647
MD5 a014274c65f8cbc643ef77c5bfc816e6
SHA1 69b8b2d13c0bee9315bd990be185e4a5db7c2617
SHA512 3390ce412a8ca2b022efb6393b86c4bfa6a6aba6d13e50e2759fb234edc7ad3e40e47b191d0c528b2f79b0ae429630428c49a3369ed3bf1435f77f4e6264ebc7
TLSH
T1D0D0A75FD05948C5D5EF8BA1A533502746603CC468888588945119758897B8BA395EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 2bbc5b709cb4c5008b8ddefe974e5123519fd5e2746ceb5fc373e1ea32d39d43
MD5 7f5302bcdd0995c0d8247c80dc80ff1f
SHA1 b72b9ed8295f041e8c785241b99d4da29347d9c6
SHA512 dd146349bcb40d0b890a2a79b764fe2ddc5a6318336fd8f63379a0fdf4c7d86c0a8761db55e6717b24faaa3d75345ce52c7f3fd45b34eeec98ec00789c269a37
TLSH
T199D0A71FD05608C5D6AB8BA1E533505746F03CC8688481889452397958B7F8BA395EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59be45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59be45.TMP
Size 138B
SHA256 f3552a693a02731d6166fd6bab25e9052a634a2fa7f08cdaa69f6b35ecbd0c3f
MD5 da036151e3a4165ba214a11a9061e71a
SHA1 b7e28081fc5a91025a359365088548ffe6d8de72
SHA512 36ca4471e0caf65b097f4e228bcafa8d1e4f0ce4caceb60a0f887f82d586436fd1fa3188ec19696ca84f0aecab68e2fa80f8c0ec193f77988454d80ddcf1dee7
TLSH
T174C08C6BE0044C85CA6A47A08232201E47402CCC4889808C601638241072A1B3205EA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 7457fbfa94b634e3152bd4a2486da39c2770f85609afe51e653ddc763e03df62
MD5 9993ed54641dd7cb8bf236e283b0141e
SHA1 2280741403cd277fae32bab0343f0f73e8e7130c
SHA512 8345e40c589c0687f4085525e379022e1e2b18ae28a5a0876310ef96dae2c6e91d0affc418fa93802d827938f392a94541dc7bde90f9339a6153816aeef642da
TLSH
T184E026205EECC17FE15620470F249B49B2F9B40BE2CCFD863F00C8446342504F296983
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3e938fee7903d7e3f789b7902aaff796e48ff39e11334cda12bbbe11eecbd21e
MD5 35be4dcebc9bc8acca6d1e1753696b14
SHA1 f5274f57988e2dc3e8d42a5baa2e57c9e85cd6e4
SHA512 abac6acc9816a7eaf4abf8fb0acc72687141a6fe85264aa30135a05a18685fd6ddddbb727d68737dd85577a009ba125f395f3767c97cc334a09ff4bc0fef87db
TLSH
T15BB0129437108B2AC885497603E087C05756E05110859503C848CF930F076983E518C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 31ec55b01f3f6d111a5a48fe5f6b2971d974d43a6cbcb0c666c5233c53ed4a4b
MD5 d196a5eba7cd02b22a80bb252bd3b3d9
SHA1 b0012b62d2049630dec1b5aaa200d07e10f96aec
SHA512 716c9086d904f70523ad8d58559d06b0cb4f05620a99b2ab45704ed3d268cd2cb7ce7dc720a0a4f406e86a9960fa42c7061757fd5f6a121aef5ce935961f4940
TLSH
T141E0D83017EDCA2FE646208B9628F708F1B3B513E6CDED157F0894446316140F347E82
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 87f74951fcb93e87d442f380720535a1890c5eb56f56861d6b2e934e285de28f
MD5 af30f18b03b010148ac4bb7d31b87aab
SHA1 ce825063fcd97d05d4d8f7591728ad5a1efc2d75
SHA512 2119c93d9851954c627058535e36b109c9e87c35ad56c5ab5941cfb8f8297ff45d0959512f431625a4bc1aa3292c94ca7f73fc49fe9aa8e06655329f03a8ab5e
TLSH
T1F0E0807096FDC73AD60461834778BB0DB2F4B80B97C4FE466B0844447201254F369F82
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 900102d4d4627cce7192ca8424d2d89da16bc22d833a83fc5b0337169094cbec
MD5 47cb0a2aebbccbf610862823daea9348
SHA1 066f24322a639e41ce37ca02cf451658510dc3c8
SHA512 000a69433441394a233b0b4a1096d565b1d87df899e8481ba6244613e76acb438dd95abc69cefdc2ed7c96d3c7b5d20ed43d370b41a38d3aaf68fefd4eb1c570
SSDEEP 96:KR6/mwC6/masMs6WURJgK6K4PgQ6caS5oqzq4YK5yexwQKlCD:C6/mwC6/masMsFURaKCPgQBaS5oqzXTp
TLSH
T184913A11367A02893D7F690C84BC896BD28130A7751CA82F7F9811A24FEBD118DFD8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 36b184b1707d87dac3b5bf47a71a1ef9cb5efc3a81a9f98fe6d57301a6b54114
MD5 83178471c807f43f2cc8220d00f1833a
SHA1 70e9edde1362e9769860707300070320da27efc3
SHA512 4e1457a1b73dffee15043a492a3ee812697586df713cbb4d23aece781e9969a7d3e0b679b2bd4e6472e7c040e91ec76cfb937fabbe1eb9d3f975f6beb4f6c5bd
SSDEEP 96:KR6/mwC6/masMs6WURJgK6K4PgQ6caS5oqzq4YK5yexwQKlC0:C6/mwC6/masMsFURaKCPgQBaS5oqzXTe
TLSH
T17D912A11367A02493D7F690D84BC8A67D28130A7751CA82F7F9811A24FEBD118DFD8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 30d501518bf9088a3923c9c5334dc7b13154e0e769e085d6de42d59b80a06e8d
MD5 746fcc2514529a35d97a69971e594ba6
SHA1 40c560cdfa1e811b483ed25b3bf90843c36c760b
SHA512 fc4e4ec11b2c43c602b8065557ed809deddb997f78a26868a9b62cb12b0e81fb51b57c4097ed7a22e4a1d1618e107bb234573368065e9d97fb360d5481a43cc5
SSDEEP 384:DNrRZyCSDnxTICPgCMEhIKyll7svbFKfk7:xFZJSDniHjyI1l7svbF9
TLSH
T18244740A7B747001EDE6D9725CB080771E3C716ECF22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 b774a2e239fcf7c83a9718bf477b17814bf1df46fc5494098b2b3ef6edda578c
MD5 a3c76c321e1cfc87df64bca0411f1fe2
SHA1 3ac70e24dedfeff0b8349fb39f736dc60995ecf8
SHA512 ca9131cec0c7dd23674f65c834cb706ad241d2624185092ef0c9064ded0f35049b1c76e8930ccf5c356cbf060c537ef2c4c58d41eef84e190d47fa3fb3a4b101
SSDEEP 192:pQQtFIIIibSMIMcNYcY1zcH/qLL0OC7hAsClup5Q2sMsB0lKJ+K:SQtFIIIibSMIMiBKzcH/qjCms4Z2sKp
TLSH
T1AA42519A26052B77C15E5B3E13B286445BE86CC24032292D76632C1F8EF3FD786D56F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 9b3c20cfb49b9c6489d80e68829bff744d93fc63d89d45485c51c49f684ad4cd
MD5 dead9e5ba6b022779aae507b5a14dacd
SHA1 34da4853a47a21534e2ac47b7d2e1ae9af53d1c1
SHA512 b883b1b94d0d4af71817f4bc548f54e606a91ded0624f1c7dc5afcbf3bbf0c756ecb5ae10a7eb76bbe84e71e2637972b707e0c2e66a090147d75619ba7f606cf
TLSH
T137E02630AAECC16EE45430C7113467C9F2A4B823FAC8FD0A2F01C448A442500F7A6A93
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 502d0ca26373418ff7d52f6d5f2523c92283abebd815bf7784f086ae95be8672
MD5 630fb3cb8281026d877066ace2ac1ba1
SHA1 1fbd6a342784d413241abb735600514d70ed8425
SHA512 be62e080ce82328fa54053843c4be2494f3934cdcf0746d5b5843c002c3670d3a13e0299bf035d9137260df08603465564e80095b44ce6704d5928dae74b8a9e
TLSH
T14421C455F330D119E14A867E647EAB291778E846CFBCEC0F587920646E72B040E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 74c4cd85455a34ddc5048d7dc750bdb089f45fd56ffa53ebf3f4e22b0955363d
MD5 538a90b57db8868ee84354e563c237a5
SHA1 d51eb150117462f07868184485c85c664969afa0
SHA512 303c12b88e2c00268e811d9d47ce5d50e891b0035e6c6cc4fc1ff8ec8256463b8d30e430d30ed9dcbbaf566a44dcb6f6ac0e9823da60a0f7d8b8f7d7ded9d7a7
TLSH
T1D5E0207465DCC15FD05930C31179E749F2A53823FEC46F053F05CC485502551F746A53
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b74d5b779c96a9148cedeed8092d1403ab7b5a634354f7a19c9359592970399c
MD5 f2f524509c59153e49f0b56618edddd4
SHA1 d849151dd800202454c82c765cc4b1a6b9e6fe00
SHA512 8e15503caaf4018bf3a8228cadd9c02902273d8731df5022e4802fa3717d7044cfd6f77e2752125f097b3d9f443cb4c468ffd4332596e267ff9ad8f90be7859e
SSDEEP 3:MsEllllkEthXllkl2zEflR:/M/xT02z
TLSH
T1DD440404FFD1040DD50011704057C3541771F4500531574334D504337CD7D510C04004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9a2c36d0c6fb0318058fe19988008c309cc8f8e119ad09a0a95f8e781c38b824
MD5 05bbc8799e237422c33dfc21dec2632d
SHA1 f1ad69733bcaa0adf30d6c9f1c971e9cba272273
SHA512 becf4ba1da24ecff8156c4adc22b32a450c73c78da423920b891b8343b1d30d0fa49a7c55cf205759f474d8dfc6907e1e5e3bf8d586b1dd49e7dd7d6ea58afdf
SSDEEP 3:MsEllllkEthXllkl2zEflEPd:/M/xT02zJ
TLSH
T10D440404FFC1040DCF0011344057C3545370D4500531574334D504337DD7D400C0C004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 537645b92c270e11a4f2edd102ef012baea0826806b17b5372b517ad2f707d98
MD5 8293a1e42d473e4a59c91840eab9d090
SHA1 1250a45c81c8426afe31ca93ea6992d9ca6e14c6
SHA512 7058c65870bc4c3c6bfd8cc5acc5dda505b92e00d7ab6a64cf57f86c5c3ee62f0a73552f4680e58abc18d11b20855827d14efd83c3257ec3ce562f27b5bbd001
SSDEEP 768:9rv+4UNbdC33i/BqobGnpZu4aWADIidy8LqkeVH1S1C:9bsbw3PpZzaNsuVLHEH1d
TLSH
T10D03BF36FC5A8A779CF7A284B1877A077EF8926386880AD488DC1F4E41DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b6348689c5bfbcdff9ffb0efbb883ca3b7c4b532f44b9be459b091ec91e2f05b
MD5 6b274dd760dd8df47a005369dd9213da
SHA1 4b4dddacbeb88148db6ee94dca3052f94fc70b8b
SHA512 f0f43a589da7813058fe6fb21d8acd5b6d0faa59c5b0ce5ff83c8912b427dfe14cc651e8b558d5bb80d11c1c3468ff11916dac3b85eba1b9b91dcc96ce2d1c98
SSDEEP 768:erv+4UNbd/3gdCPBqobGZ+tZu4aWADIidy8Lux4:ebsbN3dtZzaNsuVLK4
TLSH
T15B03BF35FC5A9E739CF66284B1433A47BEF852A388C90AE4C8DC5B4E04974AE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 302d394cdf2bc36c5c57784a542e836ac5770c60e580f6089a8aa09525a8122c
MD5 d69a2c8ab79723684bbef8c33e2b8dbc
SHA1 0beb76d24b9f9381b2dfbb3867a417acbd43cd56
SHA512 297487c42665dbeee9c26c9813775acb203cdc8e7a5cc3eae1a4989f6238973527e77d4acdec13676a7bba8308b6cb518ba1dc165eb8043a5475258d9bc5bbe5
SSDEEP 768:prv+4UNbd/3gdhPBqobGZ8tZu4aWADIidy8LuRi9sN4:pbsbN3utZzaNsuVL4lN4
TLSH
T1BF139D3DEC15993F88BEB344B14E29166DB84277C5B909A8CBDC1B4DC0BA4ADF306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 676b4a75961f59ceb99830ee17bcb9c54db7bf64da0b15bdd9cdb99d32486dfa
MD5 d3771bf118136642be49e9540c1d5f9b
SHA1 e9a7ab4255a354fdf3c47839459a0a072551af9b
SHA512 6ddadb921f1e80ad055175788734a072a377e6ac4d341cd196095abe84a9fb351dd9c0c5d9043b53d6fa1b4df5f9e387530780e77c65c7f362279200f8a5ad20
SSDEEP 768:xrv+4UNbdC3zd9BqobGZRtZu4aWADIidy8LbxeVH1S1C:xbsbw3ktZzaNsuVL9EH1d
TLSH
T12603C035EC5ACE739CFB6284B1877A477EF8626389890AD4D8DC0B4E05974AE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 8ea8506caff8f53755a1592fdb170d56235ff02d990a61ff13d4cc8b1682a6e1
MD5 970d9e7d9cc6dec2f46d017bd4643e51
SHA1 8d7c416cc262ef27de67d4b27f4171892769a715
SHA512 8dae02021d8e5d98fbcca162551b8d973d54d7c7f215e77f228e8fe5e37b7fad9fa715ca45762c57cbcfcf8355f7c8aa70aec174ed0f6361ea22aed1db889153
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isQQQtyd0vzA7dpUM:TL+j0afDdWec9sJVUOv2q7+jy
TLSH
T1FE92FE3669312033E8DF4B36BC9389910EBC025EC9A778558ED44D310E61BC2F2552FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0762876869e7360e1558b0a252ac41b08c9431cd6b7855a4ea7072b626b6a89f
MD5 d5f27c676c0c9dd90eff929057654008
SHA1 1f938583c60f29655696a2c6946844229dec1b3f
SHA512 d5d7aee305f4275040d9d5ea514bec20edfb87b80427c3f98153e4a46ac016c6a0f6049f4317484762c660b6991afd100de6b2c944c28ad4a123ee8ca0cc3611
SSDEEP 3:MsEllllkEthXllkl2zEfl66/:/M/xT02zf6
TLSH
T1694404457FC0040DD5003034D051C3511370D41005515F4734D104335CC75400D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

207ae82d-7e88-48c3-91f2-b92509a0afad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\207ae82d-7e88-48c3-91f2-b92509a0afad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1880_1758156007\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads