hxxps://cdn[.]discordapp[.]com/attachments/1501929547841671222/1541524256960159764/watanadsada[.]exe?ex=6a8de7d6&is=6a8c9656&hm=866e2ee75eb1d6e79a89718a91ee93dd78eb13d02a8339e1fde0aee239dd9fa1&

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1501929547841671222/1541524256960159764/watanadsada.exe?ex=6a8de7d6&is=6a8c9656&hm=866e2ee75eb1d6e79a89718a91ee93dd78eb13d02a8339e1fde0aee239dd9fa1&
Sample260824-xsrcvaytdw

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	2464	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
836	watanadsada.exe
1052	svc295080831612232011.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320720443103078"	msedge.exe

Modifies registry class 61 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{A21CC418-A94E-4A2D-AC8C-69B21BC96568}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000008df5a15e1be3dc01d02deb5d22e3dc01d5232ad6fb33dd0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5748	msedge.exe
5748	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	svc295080831612232011.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5556	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3328	2336	msedge.exe	86
PID 2336 wrote to memory of 2464	2336	msedge.exe	87
PID 2336 wrote to memory of 2156	2336	msedge.exe	88
PID 2336 wrote to memory of 3152	2336	msedge.exe	89
PID 2336 wrote to memory of 2156	2336	msedge.exe	88
PID 2336 wrote to memory of 2156	2336	msedge.exe	88
PID 2336 wrote to memory of 3152	2336	msedge.exe	89
PID 2336 wrote to memory of 2764	2336	msedge.exe	91
PID 2336 wrote to memory of 4844	2336	msedge.exe	92
PID 2336 wrote to memory of 2764	2336	msedge.exe	91
PID 2336 wrote to memory of 2764	2336	msedge.exe	91
PID 2336 wrote to memory of 4844	2336	msedge.exe	92
PID 2336 wrote to memory of 4844	2336	msedge.exe	92
PID 2336 wrote to memory of 3236	2336	msedge.exe	93
PID 2336 wrote to memory of 3236	2336	msedge.exe	93
PID 2336 wrote to memory of 3236	2336	msedge.exe	93
PID 2336 wrote to memory of 4952	2336	msedge.exe	94
PID 2336 wrote to memory of 4952	2336	msedge.exe	94
PID 2336 wrote to memory of 4952	2336	msedge.exe	94
PID 2336 wrote to memory of 996	2336	msedge.exe	97
PID 2336 wrote to memory of 3244	2336	msedge.exe	98
PID 2336 wrote to memory of 996	2336	msedge.exe	97
PID 2336 wrote to memory of 3244	2336	msedge.exe	98
PID 2336 wrote to memory of 4604	2336	msedge.exe	99
PID 2336 wrote to memory of 4604	2336	msedge.exe	99
PID 2336 wrote to memory of 4476	2336	msedge.exe	100
PID 2336 wrote to memory of 4476	2336	msedge.exe	100
PID 2336 wrote to memory of 4476	2336	msedge.exe	100
PID 2336 wrote to memory of 912	2336	msedge.exe	102
PID 2336 wrote to memory of 4080	2336	msedge.exe	104
PID 2336 wrote to memory of 836	2336	msedge.exe	107
PID 836 wrote to memory of 1052	836	watanadsada.exe	109
PID 2336 wrote to memory of 3432	2336	msedge.exe	115
PID 2336 wrote to memory of 3432	2336	msedge.exe	115
PID 2336 wrote to memory of 3916	2336	msedge.exe	116
PID 2336 wrote to memory of 3916	2336	msedge.exe	116
PID 2336 wrote to memory of 3916	2336	msedge.exe	116
PID 2336 wrote to memory of 4772	2336	msedge.exe	120
PID 2336 wrote to memory of 4772	2336	msedge.exe	120
PID 2336 wrote to memory of 4772	2336	msedge.exe	120
PID 2336 wrote to memory of 5072	2336	msedge.exe	121
PID 2336 wrote to memory of 5072	2336	msedge.exe	121
PID 2336 wrote to memory of 5072	2336	msedge.exe	121
PID 2336 wrote to memory of 5284	2336	msedge.exe	123
PID 2336 wrote to memory of 5284	2336	msedge.exe	123
PID 2336 wrote to memory of 5284	2336	msedge.exe	123
PID 2336 wrote to memory of 5476	2336	msedge.exe	124
PID 2336 wrote to memory of 5476	2336	msedge.exe	124
PID 2336 wrote to memory of 5476	2336	msedge.exe	124
PID 2336 wrote to memory of 5556	2336	msedge.exe	125
PID 2336 wrote to memory of 2848	2336	msedge.exe	129
PID 2336 wrote to memory of 548	2336	msedge.exe	130
PID 2336 wrote to memory of 3236	2336	msedge.exe	131
PID 2336 wrote to memory of 6020	2336	msedge.exe	133
PID 2336 wrote to memory of 6020	2336	msedge.exe	133
PID 2336 wrote to memory of 5748	2336	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1501929547841671222/1541524256960159764/watanadsada.exe?ex=6a8de7d6&is=6a8c9656&hm=866e2ee75eb1d6e79a89718a91ee93dd78eb13d02a8339e1fde0aee239dd9fa1&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff715ec188,0x7fff715ec194,0x7fff715ec1a0
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,17513517993693285366,5162997338690963806,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12310934144177066494,9054808701810610078,262144 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,14637478666986374651,3025780639216483766,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7495716657149065460,15622218426997825440,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1648371682669050789,8998503207528180661,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,4825487520194019004,12092745570749548025,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17827033164977762370,2730939711531255745,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5994323486628980790,11279452238066835490,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,73944031088621298,8457550367910444435,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,18081966574380227069,5661063446443306358,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5704,i,15052716949989522375,15321007868109287900,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,443018694243306318,5888841055193751145,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4483975108377923004,7066449150076899104,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4483975108377923004,7066449150076899104,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4080
- C:\Users\Admin\Downloads\watanadsada.exe
  "C:\Users\Admin\Downloads\watanadsada.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Local\Temp\svc295080831612232011.exe
    C:\Users\Admin\AppData\Local\Temp\svc295080831612232011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,5974243119495337599,3928297953250715493,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7108,i,7238688878406853724,7186810376131266670,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4356,i,15691854816205355328,4833299037563457324,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3624,i,7353562549569023033,17834316364571160902,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7272,i,16747620137882019690,8703956647402300079,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7420,i,16662548948732009545,6167563548040976227,2097152 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,1613356965901576348,9432525816032864308,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7528,i,4291037912581079061,13896124699838487606,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,14989511329447836293,14978145740542443463,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,16457738832513194766,18096208887344379432,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,8322856570249328973,8935701211484266852,524288 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,7527242797101473467,16153550553112407894,262144 --field-trial-handle=3048,i,5900930125564805434,14994223601042385234,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 39fbc11bd17c5a027a33a7ec269dcd9382abf1d3b444cf2c150bf72782cd0ad1
MD5 f041d55b6603fc2ff93df2f69b99cb0e
SHA1 b09484d6a41de2d2768e7ff1cdaf7cdeb890feeb
SHA512 c579f6baa74f7c8ad9c97aa835b05876d5cc0937f4ec9e1967a9c9c9fc56e94111cc98ca985b7ee7b248562a8ad6d4380c875632504b797166a9d27ce6689400
SSDEEP 96:qMwPes4WJlr1D0NDCv76jMXvc4exKozAYayu7Og7V:3BsP70Jw7wwrexzAYDuagB
TLSH
T1A3E1C83F45EE0661EB1A0E7391C39993797D40E3FC13EEC2526065760B733A28852F8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5933d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5933d8.TMP
Size 3KB
SHA256 063f5088a187b137d482cd5238b8321bcfc5a11bd9d02bf4198033e7248d3206
MD5 1789a066b29fbac2f27096a1323c9fc8
SHA1 383c71b1c18072936a2b519e5222027a14adbe1f
SHA512 3b9b76c27036f317a7891207db48875543b7a9e1af19211358ddea11e53b8eb8a8451989f3d57d040c99c9c83f2ecc561db77b7b5812888f9e84c4072151952e
TLSH
T1477151354B4240A2F75203B162D0D2067DBC81DBFD23EE01D3B4A9BA5BBA3534D69387
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d91c320641aea5ad80c4cc96e3e09516675a025af5b04531d2101e08a26a2e1e
MD5 ce26ae62833f8ad562545723094c943a
SHA1 40c18522e9f470b7fd8ab55b682b402d20ff94f3
SHA512 19903b35f0a419f4bac67bf72480cf2a55929c396795d43bf1c3b7659290d811ede7d62e6ba48014180615ed10e21ff9b2da0b223c3c5e0205506908bd172c1d
SSDEEP 192:DKa5u2ONi1PSSJN2P1bYigegSwhV6zsDp6Xrx3GmVRt:DKa5u2ONi1PSSJN2P1bYigegSwhV6zsS
TLSH
T175F16BB6C7D4C62ED81127F16F283E1BCD2D096452683D2685D4EF8BA7E60B2E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 eddc890b3d08c76d0eb9a118d042ee6f4d84895aed2af7a7e7ed22716d632e97
MD5 edc220edddf003b90c841f3528b15896
SHA1 4ef0946030111c20cd947e65e623ecf2e8714a92
SHA512 f41df685af5eb48da1b725d87456b54235a7dfd7f46846c35c1fc077806df5c84fca127753aebcd6e20f0fd9fd8de3cae9160704eb36572d64757d5304ddaaad
TLSH
T1AED023735244F0BD9A9C3FC150B5FCCFC32A50101C03EDD411D0F4D9053145D0A07141
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58e78c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58e78c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9ce82240cb2058a77ebc16e57d69d4f9f4080ee8e5edaf1219881b24be353995
MD5 d8b0775e2d39e049f779775b22c919f0
SHA1 d9551717ac05cb050aadd2d042870035c1d1681a
SHA512 2b850e5ca3a847390cfd44af9510d02db8829de361d8ee718b40b358878c5272a7769a681a350edc1dd93d33175f18abf9edbd810a40b8824e17be9bbdf80daa
SSDEEP 192:sxZ8RgyM/jK1Ml8M9N/fUsj2xgIdpJHW6+WNGYzcPvmIgrJ:sxZ861N/fUsj2XJHbG09
TLSH
T10E42D7516B34A97BCCCBD20DFA457F53D6F9047292940E44A9FCCA1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b7a59fd8e3d00708c642004e7e25f4bef0d79b4cfab88eac013a3874c7808705
MD5 05dd11d83e03d1672e0cff3dad1400ae
SHA1 eb5aa8507c2560c9283cc214b328f7d75ee48aeb
SHA512 c580d5d59b09878cff5b109666cc5449889fe7a0d9064480fa14e5123e2389777b5cec81f46b0ec39af4806e5b69ea6a39d67cdd18c56ed726e27dc5d6f86621
SSDEEP 192:sxZ+RgyM/jK1Ml8UQ10cBWN/fUsWcBXdpO0eiwMHW6+WNi3k0sU/YzttEmIg5rE6:sxZ+yqmmWN/fUsWc5rHbVM/w6s/d
TLSH
T13782D6526A24D97BCCC7D109F971BF53D7F5042299950E4CAAFCCA1C04EAAFD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1e3f7dc5bad180004bc0fa10f3f063d45bcd8d9e9a80b462a5f8d9826d597958
MD5 1423481a0027cdac1316bcc053bcacff
SHA1 050790fbf94fd2a83f1bd7024695663d7e588d01
SHA512 b0c6e13400b614617b003fb4b09d0b943332adce25563593843cf419f4682c00f9249c2b43f273ca4c9d9dae8db9fdbbc85fa8ac558c686e1ae21e823e929123
SSDEEP 192:sxZ8RgyM/jK1Ml8M0cBWN/fUsW2uXdpTeiwMHW6+WNi3k/YzDTvmIg5iEs/+JpTc:sxZ8ysmWN/fUsW2mtHbV/bZs/d
TLSH
T11C72C6526624D97BCCCAD209F9357F53D7F9046299910D4C6AFCC91C04EAAFD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 6a9b9ec7ca1a4eea6f3f806a7b9e7a287af94c6cdc157d07d5a3e9d8787047dc
MD5 0fcf77226f6bef4e13ee7f51c183e4b0
SHA1 79bb6b5e9692a141d2fd7bdb18e6b1eefe4995c1
SHA512 62372499e8903e5a4982b3331689ea259199ec095ae6d77ade1f2a6bd5d0265f7e90922a40158caa022bf49bcf4f2cf716e5c68cc5a411eabd117fc35a81e1d9
SSDEEP 192:sxZ+RgyM/jK1Ml8M0cBWN/fUsWcuXdpU0eiwMHW6+WNi3k/YzGiEmIg5rEs/+JpY:sxZ+ysmWN/fUsWcmxHbV/46s/d
TLSH
T1DA72C6526A24D97BCCCBD109F931BF13D7F5042299950E4C9AFCCA1C05EA6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 04f72263200766607c3138655f32cd11e460d7bf44bde2b8837ed8adbcfac6d9
MD5 c3fcb0811794bcbe1bba05f02611b701
SHA1 2ad4c30ae41199c1de8deeaaa476fdd44f30df86
SHA512 954066460f2b4a5ac03b6c290640df57c5f682de20f55fc62883fd4830c6e6625d10f5a5ce906c724929cc8f504d943043ec23e91b0875a5be069dca3730e7d1
SSDEEP 768:5gW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjuroItis3YD:5gW7kf0Wvqidau1jaa5LA3jlyoD
TLSH
T191D20B3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bf33c224b67da11edfb3a632c8ed9b49862a318ceb2fecc1c46e37358a8ac9ef
MD5 2e79910fd04626ecc853a0da9c8a8e2b
SHA1 67797c2089d56cec0bb47d9c0c4561ea16b31c7e
SHA512 4b1276f327f66b0a2ebd9ff33ffadefabbf77588696ff3f6b967dda4a1967b3d285ad322b785848c719c2f6885166f9a4467d17f545fa9efee288d1f66502fdb
TLSH
T11AA00211136410F1D4445372904306C5722448224126A32147B8A67989506744DD7448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590a57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590a57.TMP
Size 48B
SHA256 d4ee8490b1c3dcf338234ed85fa31f82fc5e0b331ffafaa2eaccf0f5e60aeae0
MD5 34dc91aace888eefbe3a1d999ba940ad
SHA1 6891c07aefd36d5b30b1a08d4ebc1a4e6a393b96
SHA512 70da85503a23424b9b99feca28887abec5b270c42725413a8893c531efbe96c29238cf22226845fbc88aabc60d4b1f486730b5977d182cd7f7f06ffb6c77cf35
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d25be734fbd947314fcf94cd3c1a5f0de7002c64dd3e86820a2157838b6360c7
MD5 7c2e96e7a9706da1b2e018fec9843b9b
SHA1 6ebdf2124fae3016eb1f56b3932fe844468aa280
SHA512 d0bdf002df22d1bedcce833d4a100dd5ed3787bd187ca40e7487d0c04751b42416b757ad985eb8f94ceba6b41c0515df3f3967563e177de2139fb83bbed59d86
SSDEEP 96:KIbCKcnnGK8siGziKowHJC9p7b7atjEpH5aKfvH3arphMPZTg:sa19+JC9p7b7QjEp5xvH3UphMPZTg
TLSH
T1B3A1411972760641383E2D6CA2AB86372F8271E33418E5AF7FB854710E66E124DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595654.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595654.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 691e606db691f3601260b3b5fc6cbbee0789150e71b49a4193d3e14102d4322c
MD5 952ddff162180f48593a2ddc2960489f
SHA1 2d26d148d1bcc889b3d2cd4adf96bfda758b417b
SHA512 ceb821bc8d8df7bbdd567b222131d31569962747f34cd1b6d7fc5f97358f4e0b9e0192a16ae0e684b731ec58d65d8447c53ae0019d67e0d3fdb7044da53437fa
SSDEEP 192:urEsNd2Q9irBbsFQmiU1+LwB4aGBPKnX+FdG4m0PbFC1SJrEbdN8BqXt4/tyA5+b:fsNd2zbamwuLdXm0CEJre8Kiv5+ai
TLSH
T111626D359C759C3B9DA2A145F4063613AFF8807B9AC92F54E6FDAB1C01EE69C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 85e5e476e45db5de827324b9c9ff2200b73c534756ba44e9927e86dcca6613c7
MD5 3f6378946dc5e9a59ad1aec52c4afe52
SHA1 4b93554aa5047ca22ccd6c9d389f13ec12886c1a
SHA512 83aa6da8cfd7f005dbc0ca32fa295690a2c06de7c38f7871a04abbec9e150b44fdb2e1c1161a84c694c41a858a63e53bdfd75d6e8571cc7b75c75fc703355264
SSDEEP 384:SiFPZcI7sNn8TUNTUlIlQzbKOwP2LdXm0CEJre8Kiv5+avoz:ZFH7Owgo1y0vhe8KiBlvo
TLSH
T1AAC23AF248E7883AD96E9747E73D2D139EBCC027B9846950B3D89A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ba7fa1fdbc99e32ad498f966f3b51cf14c63753f17973b4b6e49c2e99bc8e23b
MD5 ad613161bd48bb4646f407caee8b1a91
SHA1 bf066ebf457ae151f31d7a1ec42be85521f75586
SHA512 2ef07483c9ea8bc590d18fa36ade560b0e5c0ca74ed3ef9e23b90091cc5b7e1d8359675ca17e249839028793ac0b371f278b6508ab5d049122894b529d603bab
SSDEEP 192:MONq64BAQmiUyN1sW5GBPKnX+FdG4m0+aD8WOU6:MONq6eAWaWMdXmg8VU6
TLSH
T12602E935AC786C7B9EB2BE45F4863B175FD8113BA6D41B44EAE82B1C019774C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5972576bf370da4bd57371bf5f4f532ef3dff76d6bd15d12e33ea350f2281e06
MD5 09e5e7024211a6e193b3039a53e2f9d8
SHA1 ccf96befa6b5ba07cac995780147123993423a26
SHA512 10efb0b708c2281003277853a9c30dcad8e4210100255083ea60a1329a9b73f27b38f7c31f4d62499a6a573c50224449da4368392c0afa0e42503ea577fbc1c1
SSDEEP 384:oZcIVsNdQzb0dwP2LdXm0CEJrd8Kiv5+avoz:WVZoy0vhd8KiBlvo
TLSH
T1C3928E719C759C3B99A6E145F4463A179FF8C037AACC6E44D5FCEB1C01EAB981307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 2988a6a7796e1eb16d6e17567ef0f8c785c53ca8a7d45061ed7e9707fe1941e9
MD5 4ae0f5ff7659c9645711a8bf959a8e10
SHA1 52166cbfd86e87f2ba521a50ad3325416a1a18de
SHA512 e2051089fdc80564bb0bbd525a42babbea242ce850598190838b4ad5b79c008adbd5ec2c700dfa0f005b1152c27133c47fb03e453bfc0b8959d282aecb37921a
SSDEEP 192:urugsNdYxQ9irBbsQRmiU13LwP8BaGBPKnX+FdG4m0PbFC1SJrE0dN8BqXt4/tyH:WsNdqzbsdwP2LdXm0CEJr78Kiv5+ai
TLSH
T1BE627D359C759C3B9DA3A145F4063613AFB8803B9AC82F54E6FDAB1C01EE79C1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b1d152e6a170c466d386c318667bc50fd66bacd217e8b14ad656faa23c5ff8a4
MD5 e0f557c7c64a503cf933a00fe6885e79
SHA1 35a3976ff1fbe985d3377e3d2fd1d5086a2f529e
SHA512 621460d218b0d897f0c6ddc966f94be4dd9e9cdaaeea90139e4aed6245c1309650bfdcd94b7208b40a13bb4b034fcee14319a53422a780fc4e5db363ee9866c5
SSDEEP 192:DON464BgQmiUyHsL5GBPKnX+FdG4m0PbFC1SJrElWw8BqXU6:DON46eg9LMdXm0CEJrg8KU6
TLSH
T161122B35AC64AC2B9DA27545F4873A135FE8413BEEC96F44E6EC2B1C01EF69C1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a0ba2dfbb47fb15f7f1774079fb3185f698dd8bcc5d91de39b5a0b13745527a1
MD5 dc5f532a40d6076a1ac632fecc7cbecd
SHA1 6d0c5bd09f054f8a5a17675751a1e70289af772d
SHA512 d5165ab46bed8955b21ac1f97bae93a1c6dc7e4608e33e72b6df857b77fc24e0f1cff2f756b4634ff070816e55dec03b7167c2a9bb9edeaaeaece0c0bbbe056b
TLSH
T152E00285A2041067C018233400C31B103AF180100BF30246572141785D323403920650
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e74e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e74e.TMP
Size 392B
SHA256 329f64b1fe7f8b7257d2279a89ec64519bda3538e76c9a4f7270aabc9a11b51b
MD5 c694af63faef14625f3d987b8c1d4fb0
SHA1 d5d52aaaac40e57420f752070a599dc9785d0bce
SHA512 ffac22b4a3b85f9f8c77511ccf071c231375f4728a4d92e756523eb6e8d951c24d6e80cfa0b690e54a2b9aef8be9fe598afedf9022e965b37c6c4caa4f35f7eb
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e13bf3ca87dde80c24a28904bfdb0a1f08dcdb6863abc4088b6d69f068e1e6ed
MD5 3e7960fee678eed41d6acb8a658d0b75
SHA1 0ca75e3676adadf946ee5acde3a6f4a767e8a837
SHA512 6f73e59399625820c034b0e4eefb284957f5d9eb7f84c22b9f84ae1b5413575efb1a6ca44352d4d38715f33216be686fdbde5ff08134c692f3736223d68277fb
TLSH
T12541179CB6EA1158B3B76F569BF6685E483B78272E0AD09D10110F8F0A32B41D871B37
MD5 SHA1 SHA512 TLSH

Submit Download

svc295080831612232011.exe

Path C:\Users\Admin\AppData\Local\Temp\svc295080831612232011.exe
Size 6.6MB
SHA256 9fb6fe914279231092360fb9bd4b9534cd1607cd4c43da815029d7b923292571
MD5 b57546b424bcdf35be198dc643ba9fc9
SHA1 d763ceba89f149cab89f80326818546245e0f60f
SHA512 2edc47cc481c99313411f6258bd8bb3272caa5c95b7e32859b1b2cd942876d3e7fb9d56ce1a9404dbf17a7bd00d162191a0db5f6f52a8da9d052d7e5d761469b
SSDEEP 49152:gw4a33kL81iyPOnf9d3yR20txOQAg5O1ETW803EPX5otVeIaQPK6K5KqHERma75e:gHo0gOnSXOtUPX9kRLsE2
TLSH
T125664803ECA518E5C0AED23189679252BF31BC495B3163D71B90F6287F76BE0ADB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watanadsada.exe.crdownload

Path C:\Users\Admin\Downloads\watanadsada.exe.crdownload
Size 10.7MB
SHA256 8e352b9f429e37a45214026efdc430125e0814d47ed71ceeb2418d16943dbe09
MD5 4a5208bb346e37570678d70096f53d53
SHA1 222868d16819286d0db934a3b560b97ab8f7e2db
SHA512 700ac44d1414773a4f0b3d72f2aefa99a43ca7628ca0f6ac99051dac810d406feba4b4fd945a4ccda12aae48fed131da619f4bfb0d639db812c80a2816020644
SSDEEP 49152:i+FElXUKYF/hruy2M8DE9soufr4Q7OwH+dDJgwFMoM8ZfS02LMPXgdKdwlB1fz68:iDZj2uF
TLSH
T190B602266EB305F4C0995132066740822F31BD895B601BDB0FD2B6A82FFFBD51D7A7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download