cc6932d5036f9a702a360252d34abdaa9ce51f47c3b7846fb99cff701c31305a

Analysis

user interaction
yes
max time kernel
110s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Benscookies-296000.docx
Size 5KB
Sample260820-pswcsscl9t
SHA256 cc6932d5036f9a702a360252d34abdaa9ce51f47c3b7846fb99cff701c31305a
MD5 b550d06e60e17b8de7abb7c70b5d01eb
SHA1 5e4e7a847b3609c58cf44265220b2bfab6d6592c
SHA512 c2fa84bf7ab62e19667602d314f00a9218c1fe269028f07689957f6385f4ef0e7631b2c4b3ef47789b4cdfb04df6a43eb2293933f57e28bbd374025e602bc7eb
SSDEEP 96:slkfeuYawAFTuoO3Vk3ilFhtbQwaQRPDx3nzirfI6HpQKE/WjTsjp0vKeWt:ekfWt3Vk3O1amxafIEp5Q2ep0Spt
TLSH
T1D6C16B84848D4C1ACB4BD235E1652B25E34C3617B52E6FDF75AE20C4978B2F88F63B09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	msedge.exe
1368	msedge.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317030315727064"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{4E54C077-12E1-4DD6-B18D-741CD82AF617}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{5060CA25-0738-4586-B122-58B2E7FD46C3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4596	WINWORD.EXE
4596	WINWORD.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4596	WINWORD.EXE
4596	WINWORD.EXE
4596	WINWORD.EXE
4596	WINWORD.EXE
4596	WINWORD.EXE
4596	WINWORD.EXE
4596	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3392	4596	WINWORD.EXE	106
PID 4596 wrote to memory of 5944	4596	WINWORD.EXE	108
PID 5944 wrote to memory of 5288	5944	msedge.exe	109
PID 3392 wrote to memory of 2848	3392	msedge.exe	110
PID 5944 wrote to memory of 4516	5944	msedge.exe	111
PID 5944 wrote to memory of 4424	5944	msedge.exe	112
PID 5944 wrote to memory of 4516	5944	msedge.exe	111
PID 5944 wrote to memory of 4516	5944	msedge.exe	111
PID 5944 wrote to memory of 5436	5944	msedge.exe	114
PID 5944 wrote to memory of 5436	5944	msedge.exe	114
PID 5944 wrote to memory of 628	5944	msedge.exe	115
PID 5944 wrote to memory of 4360	5944	msedge.exe	116
PID 5944 wrote to memory of 628	5944	msedge.exe	115
PID 5944 wrote to memory of 628	5944	msedge.exe	115
PID 5944 wrote to memory of 4360	5944	msedge.exe	116
PID 5944 wrote to memory of 4360	5944	msedge.exe	116
PID 5944 wrote to memory of 2360	5944	msedge.exe	117
PID 5944 wrote to memory of 2360	5944	msedge.exe	117
PID 5944 wrote to memory of 2360	5944	msedge.exe	117
PID 5944 wrote to memory of 1520	5944	msedge.exe	120
PID 5944 wrote to memory of 1520	5944	msedge.exe	120
PID 5944 wrote to memory of 1520	5944	msedge.exe	120
PID 5944 wrote to memory of 5140	5944	msedge.exe	121
PID 5944 wrote to memory of 3700	5944	msedge.exe	122
PID 5944 wrote to memory of 5140	5944	msedge.exe	121
PID 5944 wrote to memory of 3700	5944	msedge.exe	122
PID 5944 wrote to memory of 4440	5944	msedge.exe	124
PID 5944 wrote to memory of 5108	5944	msedge.exe	127
PID 5108 wrote to memory of 1996	5108	msedge.exe	128
PID 5108 wrote to memory of 1368	5108	msedge.exe	129
PID 5108 wrote to memory of 5164	5108	msedge.exe	130
PID 5108 wrote to memory of 5164	5108	msedge.exe	130
PID 5108 wrote to memory of 5164	5108	msedge.exe	130
PID 5108 wrote to memory of 1348	5108	msedge.exe	131
PID 5108 wrote to memory of 1348	5108	msedge.exe	131
PID 5108 wrote to memory of 3028	5108	msedge.exe	135

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Benscookies-296000.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dravelo.vu/CYkQZKkScV/.536BLQdxSz/teTlY55UyI/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://dravelo.vu/CYkQZKkScV/.536BLQdxSz/teTlY55UyI/
    3⤵
    PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.wikipedia.org/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x29c,0x2ec,0x7ff837b3c188,0x7ff837b3c194,0x7ff837b3c1a0
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,1147535555009544653,7838500508080645012,262144 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,8094032748360389242,851675700253468189,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,12920798676023790214,8467866574273557476,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13046966086670779056,11778618884392947940,2097152 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,2913975655033920882,1417171601472146303,2097152 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,1238291653460935400,15330380385823261739,2097152 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5040,i,8435320499657685542,12377106635554198707,2097152 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:1520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,1268641103737801942,10719440417063400194,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,8881786033030907556,13826325722129567662,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18014532190844775925,8161525006620739988,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18014532190844775925,8161525006620739988,524288 --field-trial-handle=2296,i,6578834963146926237,13208210469847539923,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff837b3c188,0x7ff837b3c194,0x7ff837b3c1a0
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,17133068727149134391,6130126509980342758,524288 --field-trial-handle=3200,i,2771303116516162918,4718813212281404720,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:3
      4⤵
      System Time Discovery
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,3262196139158296763,12144859495429432531,262144 --field-trial-handle=3200,i,2771303116516162918,4718813212281404720,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:2
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,9459010286617967995,16872857996354918070,524288 --field-trial-handle=3200,i,2771303116516162918,4718813212281404720,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,251434276838270370,5742645679440262572,524288 --field-trial-handle=3200,i,2771303116516162918,4718813212281404720,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,251434276838270370,5742645679440262572,524288 --field-trial-handle=3200,i,2771303116516162918,4718813212281404720,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
      4⤵
      PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd7796929e25b7481ac9bfb39d0ff633f397d26802b1bbce3ed377f96986e8ba
MD5 bdb8bdbd572dfe712d2385875aaaa438
SHA1 0816733137bca4f5625a5c3a81998c6d4da2849b
SHA512 1c865cc89d10b2713358f4d3229e03e8ba233a4258df3b01ab531111e475c7f8541e1c407894555474cac356b9ae57aed4083c61e4d1af12dd955b9fc8d33046
TLSH
T176D0A7E8599DF5E0F03A1D3A61244600B29C1AD26D53A30AE16805099D6E05222D55DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a2761ab1004bca0d9a8d9233b727e94a6c7901cb2bdb7276874b7886fc94b50b
MD5 557b02eec0da5e609a4fc3a34d3aa346
SHA1 db37c775559f12079afa0fc47b99db6daffb629a
SHA512 54464dd247c89be778c3a91bb29483867b2928f78787f6ecb6a485b747e5f8eb994a1a2ccc96c09febb796553fd138d45db56c6fb548ced9b2f7d05f488d1461
TLSH
T165D0A7F8569EB850E06B0D36A4249611725D5AD16823E30AE1A912499C5F15172D818A
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b299fbc6dba18b1dc5a65aeb887bc265249bd753709b0a562b6ab1b036f7b96b
MD5 474ebcb00df2b7d34f154cbce2b33659
SHA1 3da9bf3e0ab47c614ae60e3e0767f5500dadce6b
SHA512 f71f9adb4c13799927a44465c487c79df7498da073fd14bf2e1197697898142fe1b9cdf7b5c8aeab432f2e6e97fe0bde614e4adf016399a97119794f3ca273ca
TLSH
T1EDE022B6C826FC2B08FE9768A04D8746E75123172A50894F3A3C81098FF876A46C985C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5c7c03891ff8d39f475f26adc587b68ebe9661e3ef29ad0a08227a9f3f9b141f
MD5 3e9e8213b3c0d30fa933949f4e9dabd9
SHA1 d115c64420ffdb4b5890aaf82d446e15c7789a26
SHA512 c7edb7269834d9ac7fc710629397197737616736f86b475fb4074567e52b536228e514009e1897463c00bed3798dbd8145cd16241ca6447092ad09f6f10a68b9
SSDEEP 384:0KwHGbj4LgS1Lex3TVxrJbIi9m2HzAdvmeyUp2K1Z+i9hdGc:0FGP4LP1+jVxrJbIBjdxyUR3+QhdGc
TLSH
T14713D53C3E585D95EAE704BD480B7AB2273CD9B0F1D60B977B36312A13B970A484EC95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2b7b305a964832cf9ff7b25186a2f241e24912cd876ece4d494d60d8c0c488be
MD5 067d54eb8601f622317ce8009c9763db
SHA1 151d88cc0fbca39247952d8793798855d511f414
SHA512 7a56ffa6e3f0cee64149f4c0e298e99e477ea82b5f6f763ae8bf130f6182ac2b23bdf651f5a2d8acce2a7c5fb29ec7b703e89aa764eb590a78527a8a6aaed6c6
SSDEEP 1536:5mL/cl5L/+h+enPSE7SjuHL/C8L/Bwqk6zsRpBMUFOLsU/P+xdHvJt:sL/uL/mnPSr6L/PL/hNsXF+L+xdHx
TLSH
T1754460F70941A05BCFA802F6E2133E3DD177055D7DE1E8E9E6780C952825B22B6BDE84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 705317bbc030b914143db4b1d72d1a9ab49238056a5f6dd35bfc913d48561ec5
MD5 82503498e86fa53030cb32570830932a
SHA1 be6d4db167ed9ad153b7f2f183a7ffff6039a6d0
SHA512 8888fd171b06c7163b27ae2958609054339ce6985c00e100a83bbd2c6b33a50f4f7801c3b9202b4be409ddd5ea8a1a9e1007cbecd02883b85eabf2fc85eb6efc
SSDEEP 3072:aDf9y+HI5/uCBL9C2b6aJN3QnlcZc9nvy3rZF:ef0v52gx3hN3IcGcbZF
TLSH
T1FD2508EECB682C82CE6B877470E0D9077E712183B69CC0D39944C5D897D6B8176E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 733c85c500a4b8188651a6baa37978eb9f9daeeca511bcb348bb492032d4831e
MD5 46f9ae82735ce3eb46c8a33e7f8337e3
SHA1 4fed788d5901ecc7e576b5fe6682bf122183af4c
SHA512 b34b8678c9ec20a31619d9ee76f2b23f7110517c62d90a77c120fb080efa68439d1565ee796cd82f1b70d948e5800fc6ee35915c46a97a23df11a8c3ed94256d
SSDEEP 24576:dYIollX7YmkVoA59FLLlPygYWAM9PJhe49JVs6uYYXLDOcL5H+tN9:dY1cmkxLlPTY+Py493sIYXXF0N
TLSH
T1D0867DEDCA6898C3CD639970B0F0ED477C7413C3F5A5C1D68898C684026B7C5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4a733f71bea0497fdf27624cd13c45cc6c2acf9a905792b60eaaea4bea9e3f8c
MD5 ab4de2d7dfdb9d1199c97e1f0da852e7
SHA1 3b6edc70e29ad336c71acb8d700ac7b265f37c36
SHA512 f1ffb7251ad34883f25673a5fa8233d0d10c578041ac25fbe6e3b7496081a3ef3474a0055e6994fb66e3bfced43ac0e8d51bf26066e9a201fbb3943617b61c31
TLSH
T1C5615D35F902C878EB63433195E07E18B8B482D8FFEB5EF219A444753CC6B14436D298
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 7aa8f92f1a6dcb8c7a2a96c0c5fdc15a2caa60d5b1bb5ca66de3b9f3b456101f
MD5 25202411b2d987f82b08bc3278241a8e
SHA1 4d94c9837127dc264628611516458d7ef43b4b57
SHA512 42e49a397bf4b4aa797ff9688abc84ca57716d69f0c0dad629976a6b40d7908842e83dbaf928064e3f56cdf44ffd20cd673bde4b7df2858cc935d87ab2acf9bd
TLSH
T11DE0209CB7CEC16D9E913CC351786B1CC2D13453D695ED0B2B0CCCC57642141F24A546
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 d146878b595d643fb603c2b6c4ffc57e42ee5582c683da15f282c3c3b63c435c
MD5 044b98b6c058dff94ca7c0a28d8c4443
SHA1 b96cb3bcd43bd169597f7645b4453fcffaf52438
SHA512 96effae8ed384442b6cf52e34d881029aa3bb899a12e213a4b05cd9376516e541ef3d0428473de59ecd85402ec274b64baf4e2f90fa617df1d2de4a2624ea0ae
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jwpW5LvK5fKFtI6DqYp6e:Tyi+7f+UZD4jJ/B8pWxvCKFOiTpN
TLSH
T11BE2D18D3B11F512C8ED733EB0C2C6F05EBC796C4A5D7171923C98768C62AA1F49E11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 5d83d370e742e2fd8bb7e6c595768d9ee5c0c5f763ab5658dc971bf0b0a13c70
MD5 75ad71ee7d146ac463fb0ad2dfbd77d5
SHA1 6c8d4b681cec6107fd03abe39ab7c0e3d51144dd
SHA512 70e56f662c901c9637704f2ff64367cbd3dea0106481105c35efd775f44ef449543fceeb05def347dfc13e7a2728b7f4649c4a2cff3ccc5f8832622d21c9a9a6
TLSH
T1DBE0264814CCC16ADD1A6CD386BC634C82E23412F388FD0A6B0AD8846243682B6B6280
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 261f61029fe82faf656b2943ef153e87c88c816de51bc583c2904da3fce95b9f
MD5 31c67bdb62877588beb11bd61ef357b4
SHA1 97ee231e8549837021fbd2368e011886dff07334
SHA512 e18d6f383047aa811d0d9129dff0664f3c202365b1a2a71d40c8b9c8700d33aad673dcf4220d562c1d5291ea87ee06e6cdf40398f52f473184c2d8685c40afff
SSDEEP 48:uzBmw6QU1Pz2VU0xdrHNeZ5MjOaZXxpw49Rayd:6BCx2VDr4Z5M6Of91d
TLSH
T12992A6476E747803EB512ABB26362839CA3BD01C5FB25DA434BD54315CF8940917A8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 f0b67e65bdd1e5dbf8516dd19dd6787e511e6bd1834e21e67d32cf265bfdb786
MD5 8c0dbfecd3b76d67e295a3b16b42d820
SHA1 7f55890d3a0f81dc9e2c251ff33cd9d79e3beb8a
SHA512 2909da6debdf6adb91d5b4dc51848da2ff13dfb8c9df9ef83a88bd6384fc8bada03c14a5afa4a5d3b49c8362574852fcb2f528e64f248cc3a66ea9a29d9512a1
SSDEEP 96:nADgIU+bGz83uy3+u4tgp4DLjGQLBze9z3DLixJWPHjBHMsDEuspU0wbtqrOQpP5:nXf+G83uy3Ct7XBBK1H7DXspU3if
TLSH
T1A414515F0F202722CDBD517669E744F35D6DF03F8B1266DA686114B0CEE2A42A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 291B
SHA256 a5ff7b1e2a1adff88908aa3aaaace31591c4e033f9ea177cfeeb7411a01dcf0d
MD5 8f3f73afebaca445b470a8246d6c135c
SHA1 b91ac8212a86b672bdb299c40d652fb4ef8e7aeb
SHA512 fd07fbab498fc2e866644a9d74619971aeb76a54e7d8bce3dcdfe260663429b11d81ea6e0a4a6b89043d6a48a72def231d1d32a5f699fd7c482a0a76dd0a43b8
TLSH
T130D09EB325117552F70A9DF61A106BE8B327F02E9BE70B84D112B44D4E418B8654F586
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 3d48987f9a90c30048f1c68d6a1e37976a346d58fcaf6138b10c63eee2f14bb8
MD5 2af7c56023a0d424d5face501965f758
SHA1 520d2d9c0ba9ccc5bfb4ecc0b070f2a7c275c33f
SHA512 5ec9cfd866c7d00705ba25620b8c8822ee59ccbb9879a8643ab28e14578cd33c0471c2d11c453a411bb69a930384e137cd3f993a6caae56b18b0fe1816a766c9
TLSH
T16EE0266854DDC12FAE04354BB3AC770CC3B03416F788FF16AB069842F292284B3822C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 7442fe0d33e3bd79e4c6aa8974da460351f4fc19afab4733ea10e424b8dd0a0f
MD5 0ce77891e928501eac72f56bb92ee385
SHA1 2237da3f215cb68f6e523addae1bfb27e11f8d70
SHA512 b7a3420579ad7205ce0f4ba16b9b30496377aae798dbc52f6b873231552985783792031cf181cedc83e9326e308c56291f366250716f6b35495ed71a92607a71
SSDEEP 48:T2SLopFMatSaw/auUOt81orwvCx8XXo7y+TssFrZnTKwFCPnDRF+IovIowYyvqUX:iSeMatUaAL0Cx8XNfW1TKDDRjovIoeV
TLSH
T16C92740F3F247520E1E147B2DDE045272E7C206E9767365EB925E0B38D626E6F1062E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b19688994f6ebf83f0d60f942db65a4e85eab4d86f0dfc7a486123be2a83858d
MD5 b51d4af81c0d46a2d12a305a3be74a34
SHA1 1832184e816580611b9134050203dc3f07cbcced
SHA512 5c762338ee1b0aab0566667ffae41ec19781afb7c25797a754b25ad27278a2e4851716d3d798d8f9d97ee32c2a318b05598ef98758acf276297e36d0bf1198c0
TLSH
T14B41D3F783F4C56ECA1196F0AA14AE2FCF1D0515432C7DAAC9E0AE1B93E3471E141A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 8ee9874b5005e571ffbe55c2d4d023f6a46ba7c2fb4c96ade57e71d10b2e14e3
MD5 26f5861a2c36dd3bf285efc93b978dd6
SHA1 d966bf7f56c0b52a388c9febd243a482106e56bb
SHA512 40d52c4c725872e4b083cca009af4537aedca19a402be01e3a9499750a4dd93e53eeb3ad8c52074d613cb19ac509dd65d220c047fdf280a5a89ca8eb49ab85b4
TLSH
T137E0D852C1FDB066107949B92D44F845A777E57404039CE5EED9927CA0454F72712026
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8a0c7bbefd632bf1317258e79b068682a8793d419f9474509d224fd0dca424c9
MD5 515e93b884044348aea02a0498e803d7
SHA1 4c34bd9fe8ee04ae71a7d0aa47ff717fbf60b3fe
SHA512 a3c96b48b762e6f5c76141f86f1c2af9cbc1a863abff721a87d7e12616d025989d93bca9e9a9e077cc98f726a6d3773bcb9847730c84d5566b07afff284b235a
SSDEEP 384:sxZntMQE/fesm9Wvh82azIKYaSMSHbJIh0X//l6f+e:sftZE/fiYh82azBxSHbJIhaHl63
TLSH
T1E272E906A5349D7B8DDBE219FA45BB63D3F9142792905E445AFC8E1C01E77ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 645654d9eb5d582a9e306811c40f8346a60638ce6a53ab10d7ff4954ec735123
MD5 ffe1efcb5a00b25db3d50cd69667d5eb
SHA1 8a07709c3eda58a86f9a6aab56adac426442c61c
SHA512 ca46c86c0b2416c08d8b186866afa731a63aa998592a821a8132c347c42e251feada5e60ed4da36fdb66c26f56939b4dafd6d6c63b2c3bd0350d19979ee18f43
SSDEEP 384:sxZntM7E/fessXK82azIKYasMSHbsh0X//Y62je:sfteE/faa82azBjSHbshaHY67
TLSH
T17F72E9066A345D7B8DDBE219FA45BB53D3F91563A1904E449AFCCA0C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 82e362bf178a0a7bc2b818f25e7e414bed4292b97cda77d6e26d035e9056a691
MD5 444c911e3b9e1a520cc3bbffe4ccf59b
SHA1 365e7aa0b912bbc14bbf3b3455246df04036d049
SHA512 a4b4d08db048ac1afb5186102150a00f32f4cc6ff54882cea80b4a0fecf256d8e250c002a659e2b4b05192290f74cf8ae885c6cf879a9b6e09c3fcbaa0fba69b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEysy10Lle:eY8Od/HEnFhWvFvmXu1jawt10Lm2NurB
TLSH
T1FAF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 9c6aff54a8120c52fd50d7bf1a5bbbe6a15e2598f0b969d4c73deb1bfbd52807
MD5 14d7d70c39fa62b52f13f2e30e6496b0
SHA1 d1fe188cfc52a7a0f2a420c910cd0c93087105fb
SHA512 8e8560023a0d5637153e523684f56910cc7ddcac178fa155965b2e3f1ce1a1f41b3888b3107d0ef400791817e72f558ab40aced726eccda535a140dab91bd9a0
TLSH
T12FE0865819DDC2FDE816259302B8B34C93E47427F7C8FD162F54CD4065D3555B1E21A5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5d3524d7750510a94409d638f43f7cdb9816a5e0bf1f6ba966a1648a47c72fa3
MD5 4daec03d090581de5681eb2004aa5577
SHA1 6d62539a1bb9ce27cf9e8fd81bcbffaaa88baf9f
SHA512 0917284c56b843972b7b8a69fd6d4a208d0835baa73ae184a758a3f46f30270d02c74e51da095b6428e46b6acf300f6617dc27eda21ddf34b50b114c3d1b386d
TLSH
T13CB0124D7344B512C8880B3E1D58479C5740E31311548373CC058B140D807D77E21289
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 8714ee6be221ffa1dc8d8d1fd8fded7a1ce4063289da016b1e860657af8d1dfc
MD5 f7aab3c76b7a59994700f7c91d115318
SHA1 1cbf30ae8c176246bd07dd86a78f6f3273f17638
SHA512 dc32344f3d42f2556a0798da22fe68b4153d4cf0726e9c30ff0ff7d30b487c8c9e6d8afd6390ded31d52ec1f237136ad6bb55f40cb4d96b7e74d5a6150d2d008
TLSH
T1F4E0D86435CDC27EB5C7249B5268F34C81A2B416E7C8E9156B0C9440A3875807243150
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 dccd762296130c994f9b9d9b53610cf433c6899d8f91ce90c7696e288691e79a
MD5 9058ade586f22e6a8906c453aefadee2
SHA1 258bbe6629780c969323ecc5a1df7d834823b1ac
SHA512 19c33068920822f620214a580c6bda313a02e0a0d59bb9cfc863d27182e3a374f7b56197cb42291e29821794d76f5553a720f45f28a51ebf053436f573809c06
TLSH
T12CE086B465DDC23DA80A64D742B8B74D82F5B81AE7C8FA4E970C5440E282544B6A6581
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 81a73b5499384a7562d5c4088aab46e2e7c4fc713189a5bcd940523c6aa6edc9
MD5 79cfe426ac6cd6c1e97373530c669b0a
SHA1 e66df77a1daae5b10f22eef2c07a2ad2b8ed2b49
SHA512 cac7057492664cee4b0d398fb00bde42917b70771b783dbe8afcc70a42cf2c5b6482a046d0afada38ab846e26a4043c229378b7fca7fe58484ea31a5696e6bcc
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGv:05ppxnY753RNBvRJJdt7p5J91dXT
TLSH
T1B4B27C5A713E0212397E3988B39696364F4135A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 7d16d2c8a2b27dea5a85d00a130eeb8c99a7eaa5443a1fb5b1061ef5dccb8579
MD5 224c6ee3aa40d2d9851f9b014d5ce486
SHA1 74e7edb7579eeedf05cbef05a5b76cd97cf59425
SHA512 db649955e500a6e462b5371bdbe17c2816f0316e22bfe73c8e9e56efcce8d07153a479d397fbf4ebee232ffabb5aa5cb4b286d8f95cc48243eff0fcf093d23ac
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J91dXQBHo5b/:0LppY93PBZJPtN5319QRol/
TLSH
T15AD2855A717E02123C3E2988B39596365F4235A37158E4AF7FB810A14F6BE124CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 425fcd444e1b83be39d3741dd6fc6951f09f25c8caf7c5a4b260d8aee6287682
MD5 61005ebaa8f8ab054c4bbb7d98c5e55e
SHA1 f64bd8d858b1456b235be1fd0f6fa2eca8e659d3
SHA512 50d9ccf1df350f59b11207145cfcaea222a9c19af411d71b73dccb38a120a21338e4b42c1f0e606a819ee9821f7514caef36b24b48944c17611fb1725e126a2c
SSDEEP 192:P+xWEnAfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxvAfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T13324730A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 5c996205cb30f1cb2355043b53a42e8fec8a1d18c58f50f3b962ecee4dda52a2
MD5 610ce098cd4b292e193c0e8bfeca4938
SHA1 93e2a207b5ecb4529e252afdbccab6384ee8ccff
SHA512 3e7b20abdcafeea7b8f987684c55494614a927f8d113f2175197b40c3d120d10cf261b4a8096b2485baa88ad2a817d09f3e2d71fd402dc0bd9c6256841b716d3
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBg/MtWQdRoaKnGt:DEK3tjkSI5IUltGhp22iSBg7QdR+nW
TLSH
T13352E09FFE342252DDE943724AD001F46E7A613E8FC2E70254D614119AB4950A71E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 ae51d6e54e74c1aea8d0ce113ba4de15aece3944732d71db8e542bf89cfb76e3
MD5 c1f31e518908f0a10324e47034612238
SHA1 6f7837d8c7e6a238fe5de8e3097fe5ccc8602004
SHA512 716e41e14af78e34ddb0467107f0b129304599865623049c34b2ee3987b6ff4bd8a705abd8a0178d428da6a4616179914cf733fefdb3ffcf6d542012f1e7c540
TLSH
T13B51F8C5A3E814996F8FB985D21A5413BDE13E56230E98B2672E44F44F84C250F7FE35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 2a919b8b95d6d3616409673e4c615c7d32e0dc8e1eb8f28ed53a4b784c73c5eb
MD5 70c1fa0d52a512d399e1f11e8d4f56f3
SHA1 1bb42ab6462bc2db23e0c42f3b7853cfa0626bb5
SHA512 e4a74b7165bcb4aef16d12feddbddb7734054f6462ccdad8d4677601a24c648687974632de80849e5e9bf9c133e0e9e4d712a6b09930ff4c26c4da3fcff410a7
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flNQiIIIBbxMIMbyYcYQu:GAhsBJGsceQiIIIBbxMIMGBHu
TLSH
T14752722D67017B3BC05F2F76135686589BDDA84302B7226D31221C4F9EF3A5386C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 69bd0e7ba4ae66f22d9320ba1180601de861d08f3e561c864203348e3a05a817
MD5 77e9480582e1d1a37a87a409eba83aba
SHA1 9278bf541887371a0b3704c7bb19cae159d13566
SHA512 23fff4469592399805ea066e83851182ad8b345bb04ecabf2574fe2f7d60006c23ceebf77ea94ce702dc2c69dece82bfc2463ec33b791f64f0cfdcca034ea0b3
TLSH
T12AE02614BACCC2EFEC2538C711BC630C93803813FB88F92A5F01C844A082A01BA962C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 53d9b03050fd9f51701049d9b959328797db9fe23a5e495a7b9173fb4cc61b01
MD5 1ed949ace634974825124b2c1f50bb50
SHA1 0d9893f83d82ae3749097306dca7e2a000d52263
SHA512 64e81fb7fd1cab7602e247f463a5412db9a138401e0de806eeaed1d35147094d3b63c6db9d2a6c70f65985aba141763f1aa7c057e0032ab0995ba9621c540eca
TLSH
T182E02658B8CCC1AFDD19348721ACA34C96963813FB88EE0A7F01CC48E263641B78A181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 48bf11edca354d2269bbd8b6a65bc51a35b69d6d18736c25e865aba37fb69e87
MD5 d5b7ad3f0b512a1b3f9bd20a014d52ec
SHA1 5389d83a7b280599cb2024a85df0e68dee1f1899
SHA512 bfb81920619c743db09090139c958f5c9bb2afb269b67719cd2bce62522e3c9945d08b43dd3eacc92451d1acfb182a1465d759ff8cafc859edb4830cdb21cce6
SSDEEP 3:MsEllllkEthXllkl2zEflYtVKXl:/M/xT02z5tg
TLSH
T1044404157FC04445CD0010705051C35033F0D450D551574335D50C335DCF5404C51010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9cd2b0bdf593aaf82549a4cbf362b4cd02a2a2c4905323906cd7b69b31e3f41a
MD5 9db0984568335b31cf7872dc36e8a73a
SHA1 426adef4699c8b6559af2fab180e26c01fb6c721
SHA512 c98b0e4e1849b482a642f382c702ab8022e724ec96666b1cc01c212cda9a6a844aa4fde3435a0517123cfb76f062cb8be4bea1db291f3c09b61fe477b4e74a17
SSDEEP 768:p+kFCrj5wgLkuVooGWOtnSLlCK4GHTivjS:IVrfS0NMjgTirS
TLSH
T15EF23872D8959DEB98EACAC96746F607AEF05133859C898CD6F8AD3C304F5B80307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 95913bcac29ef832047d331f902fe1d41762c6400d9c4300b844708d8428fc09
MD5 65890c45c2d4fd3e4aafa7cc9e54fb3b
SHA1 b7d82dd01070725082ce2fff1c02ab460873365d
SHA512 3b355ef0e037d0b5d9e191aeb133773cb209f320f744a1f9f9658880cf3a580084f573ddb0a08efe939f1dd7799a2a6344e51f71e46eb6bf87d1626b4a755bbb
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9l6KphiftGWE3jy+phe4KV8p0xHDty/8:puFccps35wgbkUckoGWOWqI8p0hvV
TLSH
T1E2B26B36EC68DABBECE74F99B74A7A07DEE0527785984AD4CAD85D4C009719C030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c2b20431a73a956910aaf28ea7195a125071dd2416947a151c3becaa51c67e0c
MD5 e9160cde7fca7861dde3802101db4823
SHA1 11d5787c6913fcefd2f3f77d914d21dcdbf2e821
SHA512 6b07cc1b817b7f43c87fc30bc4e27a6ae0172b7c560ffba65a20c8b79890bf7ef60c005589de03627c7fa083c8a700442e0b2f59b3f732b3a1b6ea10b3245d7d
SSDEEP 384:npAiF9CcmyWCs3sN458TUNTUlIm2QckCr9vcRphiftGWE3jYY3e4KV8p0xHDty/8:pbFccps3z5wgbkUEvoGWOV3I8p0hvV
TLSH
T1FAC27D32E868DEBBECE74B98B74A7643DEE05173898C9AD4DAD84D4C00971EC170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9bf102c0bc0e116acdd802ca2fbb698a5153fbbe9015126ed29b044f55e541d8
MD5 e0a45abad4ec97d7aae43b04bfd6a449
SHA1 da737fac488e2d8be7efef80b7e2ed39ec31383e
SHA512 be0bec00aaf9759e82c7e047882a792a252ed530c42a21536a40108250cfaa757098dbcbf567e4a999a66f34357e1e8ddb7e4306a1137cba5d95029f8cf7edbf
SSDEEP 768:p+kFCrj5wgLktVooGWOtnSLlCK4GHTivjS:IVrfr0NMjgTirS
TLSH
T1F2F22872D8959DEB98EACAC96746F607AEF05133859C898CD6F8AD3C304F5B80307825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 147737e411d0de7767b7ff70167850abd0d326783af3f15e55e5c472ddb71137
MD5 c9fff50a43a3f71b8f2151f3b19b5ec4
SHA1 1ba3592b1203b951a475452e6cbdea5526446b46
SHA512 f6ce22631215278e77c1a6257e754849f934f54491f023020acd5422dea30f62e99f2ee1316838afa4ebb31b6830e36c4e148fa9b4c3b9114269d00e6d0eca49
SSDEEP 384:np+tiFiZcIusNk58TUNTUlI4rQckCrqb95P2phiftGWE3jYc3ivHety/7IgJot:p+kFQuj5wg+kNRVooGWOt3ivjS
TLSH
T1C7C25B32D8A4DDBBACEB8BC5B74A3607EEF0506389CC8AD4D9D88E5C009719D070BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 81e9e5d0c137c6b3ee7b4cd108eb6c8f159c61a85b9f5c6344477519a3ed4e45
MD5 98d58f7a2312fba3940231854511a418
SHA1 1c7c81d4408877c1c35b6ddb5fccad71b1a116dc
SHA512 e46837cfcef3fa7dfce1453d69ba4c8829e0e987caca55708176841076d140d79d4620a0471d081135a8635c98097d218c8429818f2c35867f411579ec700e16
SSDEEP 384:np+tiF9CcmyWCs3sNk58TUNTUlI42QckCrqbI5uphiftGWE3jYY3e4KV8p0xHDtD:p+kFccps3j5wgtkNsCoGWOV3I8p0hvV
TLSH
T1AEC26D32E868DEBBECE74B98B74A7643DEE0517389889ED4DAD84D4C00971DD070BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 c9f4672d394d1c4f0c488227d7f8b43544ed13da03392e203ff15c82888fc0ec
MD5 208c88eaa06224628029034b2e066154
SHA1 c8aa1dcbc52c046968ec4d961eee7e555ed37861
SHA512 fb987a047aeb19bdfa6b8b0986f669e4a84e8cbf1eb8de08165bc7b771500a7a7b114022a6a0277d732870e0cb3e0f8f0dba8d915ab8e96ad36c184ed535c74e
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtyd4lzbd439vX:TLyT5UOl0afDdWec9sJkvpejB5fc
TLSH
T1AF92A2276D351033DCDE873AFD4345910EB8135EC9A7B8449DD04D620DB1BC162955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 76a94e3c332e6f9c57dba3384d298edf1f0ed390b4bf22bb0f16da75a16ec41b
MD5 bae5beaf9e053851ec82b472c62248a0
SHA1 ab874a8c5f791755e4e12faca5c0def22e7b490e
SHA512 4f03f4badff4ea0016706aea154e52a33ef322719283690fd4a80d011dc5a1806f79837bc30dfe46ff30fa44790d96cb72098947e9b4296ed4f87936b43f7bd3
SSDEEP 3:MsEllllkEthXllkl2zEfloL21V+tl:/M/xT02z52V+X
TLSH
T127440414FFC00515C55010754073C3503370D4F1575157533CF104335CDF5400C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 81690bb4bbecad7e1c4da169058cc49a71ea40385fdcccdc98ae87f094e407af
MD5 fe37486dd60f6b74613b66f8f66e37fa
SHA1 efcf0b40a6e3f84dd85b54060cd9c02815be2791
SHA512 50f77529aa586a165c649e40605423246a15a3345a9f8c9373f885e72acaa739f07e0393dd996663280738caf78785b6b73de50db3a934b60681cb037531e392
SSDEEP 24:oNv4oC5fx2vqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Ug:o4pYqp/IHRH34kWqB1kQnjhHmr6ITmUg
TLSH
T1E542766EDA2CAAA2FEE00B3ED7D1D0127B36AA0EC2E4D9F1095B505747C440405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d26bd8a8346f2d5d5f91e44a6ba51201628994c8c15580d44e331ebf144c1e37
MD5 9ed89eb9a1ca44994407f66545c7fb69
SHA1 3b2310c669cc4d7686e6a98bc81da024ff3d9914
SHA512 d15351caed431e3e4386935a230baefd1649d9322ca965582348341780c3d39e06650c4059cc648198f31d977db2bbaa6376e62ebc10aedbfbad67dc371f5300
TLSH
T1C7412959BAFD1148B3B76E5A9BF6A97E447A7C731E0695AE00010E4E0623F40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 bf5c8cc5e5685f6cbdae401720c25e133548120a391db94ea106373f291e7453
MD5 09f0249e4fe9382968a54cbaa5ddcf5f
SHA1 9236013b4f44e74fdc7cd85cf122d869a4d43dff
SHA512 76bb0d569a79555eb5ba32fbd6ea62c5ac305d5127ce8d03243699b70cac09f3b173dce56f2172fbbfd985ce702da694d3c8e8177c0e182758fcb031b9e80b77
TLSH
T189515E5CA6EA1048F3B7BE5697F6786E887B79773E06D49D10110D4F0A23B40D8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

iso690.xsl

Path C:\Users\Admin\AppData\Local\Temp\TCD9E96.tmp\iso690.xsl
Size 263KB
SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
MD5 ff0e07eff1333cdf9fc2523d323dd654
SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
TLSH
T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExcludeDictionaryEN0409.lex

Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4596-25-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-13-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-12-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-11-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-14-0x00007FF820910000-0x00007FF820920000-memory.dmp

Download

memory/4596-0-0x00007FF822A10000-0x00007FF822A20000-memory.dmp

Download

memory/4596-8-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-10-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-15-0x00007FF820910000-0x00007FF820920000-memory.dmp

Download

memory/4596-2-0x00007FF862A2D000-0x00007FF862A2E000-memory.dmp

Download

memory/4596-5-0x00007FF822A10000-0x00007FF822A20000-memory.dmp

Download

memory/4596-4-0x00007FF822A10000-0x00007FF822A20000-memory.dmp

Download

memory/4596-3-0x00007FF822A10000-0x00007FF822A20000-memory.dmp

Download

memory/4596-1-0x00007FF822A10000-0x00007FF822A20000-memory.dmp

Download

memory/4596-9-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-7-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

memory/4596-6-0x00007FF862990000-0x00007FF862B85000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads