4bc9f503a520e3a307cc50b456d983536806cea6c2b88efa85f032072770372b

Analysis

user interaction
yes
max time kernel
46s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ninite 7Zip Chrome JDK AdoptOpenJDK 8 Installer.exe
Size 407KB
Sample260826-ja64pathnc
SHA256 4bc9f503a520e3a307cc50b456d983536806cea6c2b88efa85f032072770372b
MD5 9f17fa892353a6a05097ac5a3357a89d
SHA1 3ac7f07ee65faaaee5179c3554e5d38a0f4dffb8
SHA512 96789ff516ab0ba1a10b8a2eed827a249cda16571a1bb3279b9bd8ed7e8f49386e2ab661d3efc8ffcd7c08e995c820b671d7920a019e5ee7e293aa394029730c
SSDEEP 6144:RhuGbXZA2zNMPMPwVtiN44zAi5NAOig3TBrCZMszqLi7ksvmacmWnZ:DuypA2hESwGRwg3TBPi7BvmZmwZ
TLSH
T1DC94CF11BA85A433C1B305321B6DE22529BCBC315D258B6FB3D86F2C9E751C1B625BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4488_1629887239\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4488_1166869114\_locales\ca\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ninite 7Zip Chrome JDK AdoptOpenJDK 8 Installer.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1576	msedge.exe
5280	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322029610782751"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{72B041FC-A7AE-42E8-ABCD-37F4F1396740}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{6B27ED2F-B57C-4A1C-B187-CC79313F025C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4488	2868	Ninite 7Zip Chrome JDK AdoptOpenJDK 8 Installer.exe	89
PID 4488 wrote to memory of 5464	4488	msedge.exe	90
PID 4488 wrote to memory of 5068	4488	msedge.exe	91
PID 4488 wrote to memory of 1576	4488	msedge.exe	92
PID 4488 wrote to memory of 5068	4488	msedge.exe	91
PID 4488 wrote to memory of 5068	4488	msedge.exe	91
PID 4488 wrote to memory of 4656	4488	msedge.exe	93
PID 4488 wrote to memory of 4656	4488	msedge.exe	93
PID 4488 wrote to memory of 6072	4488	msedge.exe	95
PID 4488 wrote to memory of 6072	4488	msedge.exe	95
PID 4488 wrote to memory of 4596	4488	msedge.exe	96
PID 4488 wrote to memory of 6072	4488	msedge.exe	95
PID 4488 wrote to memory of 4596	4488	msedge.exe	96
PID 4488 wrote to memory of 4596	4488	msedge.exe	96
PID 4488 wrote to memory of 204	4488	msedge.exe	97
PID 4488 wrote to memory of 108	4488	msedge.exe	98
PID 4488 wrote to memory of 204	4488	msedge.exe	97
PID 4488 wrote to memory of 204	4488	msedge.exe	97
PID 4488 wrote to memory of 108	4488	msedge.exe	98
PID 4488 wrote to memory of 108	4488	msedge.exe	98
PID 4488 wrote to memory of 1280	4488	msedge.exe	99
PID 4488 wrote to memory of 1280	4488	msedge.exe	99
PID 4488 wrote to memory of 3276	4488	msedge.exe	102
PID 4488 wrote to memory of 1492	4488	msedge.exe	101
PID 4488 wrote to memory of 3276	4488	msedge.exe	102
PID 4488 wrote to memory of 1492	4488	msedge.exe	101
PID 4488 wrote to memory of 3296	4488	msedge.exe	104
PID 4488 wrote to memory of 1432	4488	msedge.exe	105
PID 4488 wrote to memory of 1432	4488	msedge.exe	105
PID 4488 wrote to memory of 1452	4488	msedge.exe	108
PID 4488 wrote to memory of 1452	4488	msedge.exe	108
PID 4488 wrote to memory of 5832	4488	msedge.exe	109
PID 5832 wrote to memory of 3856	5832	msedge.exe	110
PID 5832 wrote to memory of 5280	5832	msedge.exe	111
PID 5832 wrote to memory of 3336	5832	msedge.exe	112
PID 5832 wrote to memory of 3336	5832	msedge.exe	112
PID 5832 wrote to memory of 3336	5832	msedge.exe	112
PID 5832 wrote to memory of 1568	5832	msedge.exe	113
PID 5832 wrote to memory of 1568	5832	msedge.exe	113
PID 5832 wrote to memory of 1232	5832	msedge.exe	117
PID 5832 wrote to memory of 248	5832	msedge.exe	118
PID 5832 wrote to memory of 248	5832	msedge.exe	118
PID 5832 wrote to memory of 2488	5832	msedge.exe	119
PID 5832 wrote to memory of 2488	5832	msedge.exe	119
PID 5832 wrote to memory of 6024	5832	msedge.exe	120
PID 5832 wrote to memory of 6024	5832	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\Ninite 7Zip Chrome JDK AdoptOpenJDK 8 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Ninite 7Zip Chrome JDK AdoptOpenJDK 8 Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ninite.com/error/?source=fetchapps&code=1513&message=&error=0x80004005&version=0%2C1%2C1%2C1183&os=10%2E0%2ESP0&key=&date=2026%2D08%2D26
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x314,0x7ff8c845c188,0x7ff8c845c194,0x7ff8c845c1a0
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9103757452946110096,7312913234990939489,262144 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,6048322135634612064,491230428874361540,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,13880858309778756218,6315616174631620057,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,16012108762669245427,12253562981844022366,2097152 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,17355138738987313200,14248773459700104193,2097152 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,13706047042204784882,5896946938392380715,2097152 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,2277709576719080106,4522499480433428590,2097152 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,1622249005383451431,1464477230649917729,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,7263597704013600392,7175711678383303358,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15052834449381964529,883686752788688467,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10468217764634330328,5417763523035901598,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10468217764634330328,5417763523035901598,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,10328709821858557779,17575451399522880199,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,14516291439915026968,11087635664758252996,524288 --field-trial-handle=2148,i,15188666535770293951,1090518882917316530,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
    3⤵
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8c845c188,0x7ff8c845c194,0x7ff8c845c1a0
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3090386391814727616,4539094825128653809,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,8750123986327133722,174078482784987540,262144 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8779406633092512527,12693035060500248179,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2752566064252952143,10767622734554778664,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,2752566064252952143,10767622734554778664,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,10966136411990610706,5282369328734714094,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,911714374224376036,9988717818129947868,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,16412435618976509359,12264679912786889133,524288 --field-trial-handle=2364,i,7716097179528146510,3281983870984430054,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb252e5fb54364dc485c5a2dda234602e8e323796f5ff80a98a0147070de4ecc
MD5 d68a52a125fd95cb075c4dd0868cc829
SHA1 05bf3362891eabd332681b7e1fc6217bb24b6f4e
SHA512 6d381cd8c3d2ab0ea15e2ec1745eb55b76cc7f4daa66bf248299e7661858e1965bbb2e561745c0fde9d1e1fb6840d0df67fff15f8c58d79148bfd50c2e89ef31
TLSH
T1F9D097248128BFD2F03BA23C11A1228434AD1083A902A483684002290C6624202F0CF8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 810f9fbe78489a20648a862d43330e34123767b410e6e4c4f7797a5fde48e870
MD5 cdda5da0bacdb664638a791eb0eb5883
SHA1 68dda50c5005042a961608e83c07cbfbd2d11f66
SHA512 9ea9db3ddc91320a6c9892074d1c0f0f1735e27f99a9f2fac61089c9d14433efbe7b68bfec2057276f28f829fb15fde762497facf5c8180d59ca5b307682f001
TLSH
T124D0A7588249FF52F037BE3951963754B4EB5495EC86A4939590029908962A212F1CF9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 87122935aae2ba85103151a0d9d9d0110bd78f599ff5de740b58cc0965eeb80b
MD5 9acd0ba68b30d4201f90ca4e25da05db
SHA1 454d75e55fb46320cd9287f3fefc35e41bc463f2
SHA512 ecbbeddf40c2f4523351fc6177de87f3898e1addc99207d39470aad5204f156b8e1d24d1d23b137302271fdaf017ea8e8bf22374ffc9a4d8c221a8050fee29ce
TLSH
T11BE02BA9C835EC3718FD075CA0540B4BE650131A3A614D1B373D8A08CFB0637424696C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a5add3fcee27ad9003f8a5893fd5b168cad7d8ad180d00374bfe322dac32c3f5
MD5 4435765138d16679f3346e37e2e03bf6
SHA1 546b473c7da3e5f49a94e95dc858e57d59a0b50a
SHA512 1178d7a1424de256bbe06974b6950d6ca7556346e566c7739c8b637c55cb8ba5a7cb27b467c7255f0bb32eb2320a6895e8550367f9aca1c9bb69f9600ab502da
SSDEEP 192:AfWSaTpLLxddS04Fu/kKPL3LFbCBS2VvaArxvEoHYcldK:7PVfdSxu/L3LFbCBLjx8Qr
TLSH
T1BA1319BD72841D96E7EA283E5197AB751738F57CEAC185235672B3183604F881CCE22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 33590a0fac4a186b731aac1e5baf8f04ddd7283a3ffdf4787c1bc6dde54c7f20
MD5 11803c9815cf327df5d58dca9edb2a49
SHA1 05b4ad2a2e5c4a6ee90d92a2c911b9c308441ba4
SHA512 72fd8808ad77debe576d948b102019e65fc162c1249ee9ff8dd3db34e84afc977b247249842452d3ca03969fc9a31e6da84e7cc0441394123b4c252fa25f293a
SSDEEP 1536:NH3l75HOL/dwL/0nunbrNNHkht9uhqMVA:ll7AL/SL/0uXNn/K
TLSH
T127444DF71951601BCBA842F5E2033E3DD17B811E7CD2E8A9E5784C822825F35B6FDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 56995288a8ccfceed53a4f8a976616d887147bdb9e84c7e42894bfcfce435a59
MD5 f5a60a58c0d34cb71923d33c5f2aa0d7
SHA1 b40fb3f416da47ec369d05eccd0e62f2294c5625
SHA512 3f4cd42536fb66e20b3a5b0ea98f4d81fb26453f639bed1edd517533e53e0b1e7b8bed4c55db3058723c20903a6a7b0c2e0b731c84cf4a44c22fe3bd01f397b4
SSDEEP 3072:Uv9G+9/aXRM+HOYOey7003dDk6twuq/r:UQSaXRMpYyb1m
TLSH
T1942528EECB681C92CE6B867070E0E9077E712183B68CD0D39944C5D997D6B8176EC2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 752791596347426ee757d7fdb19d5007a98cb2ce8012076ed4b7d6e2d7baf0fd
MD5 0141a5f23508dbed0e20b0182b044d2b
SHA1 d4985d530170a7b795ef49d02f54f21cd65997a1
SHA512 0f913b157df5e78c9b71e48f904cbf49e16261035ceae94e5750b4f27c82fb8dab17b416b61372424e5141bac7a5ebf606e857bc1fa3c68eb120be67c15d2be9
SSDEEP 24576:FHgiTwlOKJ4kP76LkXLl2RPTJE7TBZtTxe:FAQmxJNj6LkXURr8ne
TLSH
T126167DEDCA785883CD639A30B5F0E9477C7413C3F994C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 207d9eb25801c284e46ff195fcf0dbb0317c43d8c99cdd332a1bd685e1d99749
MD5 5b2abc33968c989244f41a3817616e06
SHA1 c14292ce64fec2f3d7e1a26ad6a318a391b23a7d
SHA512 b3b7900f12e678ea23d68458b4000e243aa58e1244675ae0e4ec3edecd55d98be1bfab38357ae41fe7df3c32dcc09f9c9b8338f370777406f95868c4ad4e9f4a
TLSH
T1D25163CE8365ADE8DB6298B1D0E4551836F6B4AB02839FC458B33EF01E12F4C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596d95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596d95.TMP
Size 2KB
SHA256 3d1101ecf8cb293a6fb2d822afa96ce8ba1055b651fe1821a2ae1175167e03ee
MD5 465aa1f2ade45f35790d38c1110643a5
SHA1 23fd5ebbe626e091751a0405422c5d6dbe8851ac
SHA512 61e62c1c3a4192f07c6fded64f593ff22fd7f1ecb8133cc0e982ba8b757b15d3eadb526cde0dcfe7731df71423a02cb351e15a84e3c1672af01fac212d94497f
TLSH
T136513DCE5325ADE8DB6295B1D0E4511936F6B5AB02839FC048B33EF05E22F0C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 3783f33d1218b7b7b6557f3bd6c80c14ad0c35a817907fd7f7daba882584d2b9
MD5 a24ec575202c07f9f3b5de91fbbc3e7b
SHA1 5a908072a9d514c73d2d62af3843da2e13be693a
SHA512 7f05728a79af8ebec0019c51e37f71830fdae5b81b630bda0f9733bdf0beee734779221c4ba6540c08e1e1d032942a1e3795b3a4d79e9c76642864dfa3c2029e
TLSH
T1B9E020A45DCEC21DBD1034C7F139D748C1C03566D6C5AD471700CCCC7A42001B245F46
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 5648b36037c87fd767f17c44841540a9546112bccf00458e6e6b144fdc3335b6
MD5 d8df4364ea97e5c9f752befcddb6a8af
SHA1 b7c382334ad88317f6519c4e45e8ef2ca6a0c3c9
SHA512 c735033d2e6dd8ce3f115e5318d2942604cf9ba6ed964e4416bbc7566c9e5de7a4cd7d5838813b515b8bab4fc774c9ac3cabe447b679be8c35706c9ac249e414
TLSH
T123E0266409CCC16DA86968E3C669C309D3D1BA02E2C839425B08FCCC7103242A28A380
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 a3726b8bf4b6fb0ea6dbf8e53b0ae717aa421733b11c184f2a55878bf289c371
MD5 767c51afbc8dfeabcec21f74cecfe264
SHA1 6a362713ad463a874367e413e99970d6512777ff
SHA512 3224bcb7c5c42d5cbb8ca7bb786ad5c614613449749f3f4e263d9a992ba5df4096107361f84f18c42dcc784aa4a635b4d9ac83b3ab9d42bb404c1bda30c551eb
SSDEEP 48:uzBmw6QU1PzjXOpcDtwWH1MbtBb+szBr6zV+K0S484CwiGXOpcudtO:6BCxj+WDtwWKf6kS14CnG+W2tO
TLSH
T16F9219570E387413FB900E3E22291439DC3FD07C9FEBAC867860943688B492A9035CED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 524461ff2c099e57b435423065c262331f464a1c50cff86e846740482c14f4fd
MD5 46be7cedb2d1706437432059fd2afe81
SHA1 f333def671648d1f82682ee639172d978d16c84e
SHA512 adaff07d0baa546d7b13c739cc35caad061162b9ccf9155e8fcafd3cbca829e5ad35baae4016fe04e83c7a0958e1b138adf2333925e8d1b22f4398c452d0945c
SSDEEP 192:rQm5GlWFoH+bF+UI3iWGVoWN3qL/EwVVV63:rjMGoIkUI3ijVoWN3qL/lA
TLSH
T17C24014E5F252722CDBD913669E744A35C7CF03FCB1366CA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a4c913a33313828166d1e80d698bd0a31af71234ce0f69cd16e52b27f7a3efcd
MD5 ba38813c67454458586876c890a1be17
SHA1 ec13a0c26c4e2acfbc8a485d5240e5c97a281a1e
SHA512 07646275b9aa399988d4b9e6d702a2f50e637edf55b844ee324141a10336cfa755e42759c8a4854129d5240b58f1b2ee8dbdd4a3086628406741071ab0f16701
TLSH
T1E2E0207046CEC15D790420FBD715A74CD3B17507D7C87F411B04E849B856008A3823C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 3b9304828a0903efb4fdf588a5feb490961ef8edcc5865677dc4cd90d54fcafc
MD5 db5c2957046a6de585ff0d8d154e3862
SHA1 fc6cafec2e9c5010213557ddca38dac1be8c289a
SHA512 4c86d4cd13dada2004552eec7bcdb358f169b92b90f4df1339de0d93fbb0c5b12cf95e0f4f02a783665404ed1652c51d767ddf28e20ebfe48be80125c92a18d9
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAwn+oSwACaO3InV:qDeMatha9RAbFCN36
TLSH
T140B2318D5F346121C1F05B7AEDD088263FBC111CD7733699AE1460F2CEA2AABF51606B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f093595bcaa2dc3b1e9b8f7c7070db1a15df96149d7174d444d611c9458a24a0
MD5 b58f0607a9a082efad0e9b3dd89b9e76
SHA1 befcd9bf8a642071f01f667c5232729755ea4ec2
SHA512 dda859d135c0eccc4f220f766fa82e80564623e4902819a1bad96ee4bb91568e3ef733c2684320b0a19f8b230deeca9b45c8c75bb00c896504c5976ef103c20c
TLSH
T1A651BFF3C3E4852ECD0156F4AA146E2FCE2C0524432C7D5AC8E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 f30f221f728d82256970650d1274123564bd4a2a426eb94488c994763f2c91c3
MD5 9e390dac60abe96269f966b8e73557e3
SHA1 bd4d95ef16fcf0ed1f649eaccc3495b4c3b57588
SHA512 23b41eee0ef10732df7b14211ad854cee3eaa9eecaea1f035529ccfad485a8b539b8da53980a07275755faf036267797518db4976691458adbc42c3e613ff069
TLSH
T179E0DF6281FAB4B720B8183E2944EC45A67A98B50250BCA1CDA6A27CF0C24F26609426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 338ae826baf46d24b2c88ea321373e995d66e347910b23b5f65d3f05fdab035d
MD5 79bd84b9cde4c88d08902c751495f845
SHA1 4cf9c2df268e80494e53134b856c7ec110afc5ea
SHA512 d7c00530a20fe34a2ab15adbb679b84bc15401b36a4aca77b423da2ca1d8675557ff7a013d6a2ca54d5d720268eda2fbffc37b36bb38176543ff3aa545c4833c
SSDEEP 192:sxRbWRSCp/f4sSIoDde5lSvjzoD8pAr/g6+WN66J/YCbv6uOfGKIgVVRGJ:sxRbW/p/f4sFoc5lIi/5J/sPc
TLSH
T18642C716AE28AD3B8CC7D21DFA55BF53D6F91032A1D51E58E7FC8A1C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d5310d5bc20c0cf0f9b6de3b745f203342934e8c6ea0f1afade3f47148386075
MD5 1b7af995dfe32c96b6cde878c9bbbe41
SHA1 7a310d434117ca0c919228159e45bad4fd92c92f
SHA512 d5eff456b11c27838fa13de55454485f9a2206b5b786deedad3d2855f7a32a53a311346f3e1cf6a85b3ec092445a212caef56f042d255ec994f14a0ed7396650
SSDEEP 192:sxRbNRkCp/f4s5WpV+MocZBnzoD8pAr/g6+WNR06J/YGdvNuOlGKIgDpVRGJ:sxRbNxp/f4s5WvroiRi/59/jBU
TLSH
T1E552D606A968AD3B9CD7D21DFE55BF53D2F81022A1D52E54A6FC8A1C00EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e8b3b2071aa986696f9125f78d8363a5d43c97e50efcd134fef2d09e31206235
MD5 55a206343728e3b035d393ee5caa1124
SHA1 fe4a12216a84596c15ae657f86f754481b0e453a
SHA512 2a37a9863e76b66efb00c95990cc580f37cdde9136d5536e79cd808d6693f8d56b2099446d9df65f77b11a8e904b866fdf1ba3fae68ed403f4778c36dc4149b1
SSDEEP 192:sxRbNRkCp/f4saWpV+IoDde5lSvnzoD8pAr/g6+WNR06J/YGdvNuO/gKIgDpVRGJ:sxRbNxp/f4saWvhoc5loi/59/jpU
TLSH
T12552C716A928AD3B8CD7D21DFE55BF63D6F91032A1D11E58A7FC8A1C00EA7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 aebd128c4d121b6b4133244e3f629fd3077068fe9f1c5c1f0b25afc7801d93d8
MD5 ddca20aed49041ec51a837302e26457a
SHA1 433a9dba8bed544b9cb123ec08f65a4b3c89d48a
SHA512 7f2434185babc80f26329530b6b70a3e4d1a70ec3c701f97a154e217d1fc53df447601d6b7825d717be40c571e94394432937ae257d1891874ad11556e68cc09
SSDEEP 768:jC+v+n7pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmQqcTroZS:jC+v+hEzDQWgQ+f4+u1ja3VcgM
TLSH
T155C2DA7B640CCF7F4F804ADDAC197E9B6DA802CB5698CD5047FE941C02C6BEA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 27f26b7f73a2d4f14d083cbeb9f73eaad40e5eb9dbc1236e1531ac0c7b65fa52
MD5 d5196be2b8abc890a0bb408405b1d82a
SHA1 f570c4639dc6dde3c32b92e4777f7970d064d6c5
SHA512 f6cb49503392d2b3310bc182ead3d1f354631b046eb014619de87cc990d62aef51a06e537e2b1937df7cb57c2e6d32ab6d4f98dc4f7f8167c949161fc739f943
TLSH
T1E1E0866006CDC17D781A20874665C70CE6E8B51BDAC87D922F48DA4869D3744B193285
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 9b7e0e10c429be24e56a81277727cc9c36c447ec18c24f8473de47a50c72f2b3
MD5 3f64f0708c4a13decaf2e0ac13b5d3c0
SHA1 73d72e000e7dfdb6edd1aceb3d7e3c69ee6bc9ad
SHA512 975f7e97aeded365c86044d0b28ff350bdbe0067ee7a4a9763f31cc4cf6e06876cfcc8451c4cc5233d4c540a7581b5dfd399b57907f5c72ff2d3b3c9917265c3
TLSH
T1BFB012507725A305C49B19F34188DFD4E710F00310404F434824CF52AE0AAFC3F92890
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 933cb2c547feea566c0a16d5dd049784cbfb6e7a30ce954c40dbaa0a1462585f
MD5 f9f99e0319eaada58c7d0ca94bb00faa
SHA1 299dc1a88e5d22b607a05629a60dceaaba299397
SHA512 4af8bd306e7af864933810877d4e15f0230558fe87c9c36f2cab4b2c2cca7a50e7fb24335d8477be35942c4159122d9e0bb16f9bc29da1025a3bb817fb688ad3
TLSH
T13AE0203057CEC36F754A74CF9715D70CD1E2B502DEC869612F08E54866471447243340
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 a9e00a20ef2f2104cffad8b9610d6992cf9474025b4d98efeb110043c82e5e5f
MD5 26794bd56e9bdcece1079eba89d443e9
SHA1 62ab04cd34f48787bb1deed6d6e9b65d593af30b
SHA512 d80f06186db3032d7f1bee0554776ad806beaa4ea1708bc1f1ca473949930607c8fad4ace259e0c10e3dfd00bf0e11e4d8bd6a082db01e4a06e5c38c130a8440
TLSH
T13CE0867056CDC33DA80860C79675E70ED2F6B90B97CD7A875B0C5448A547244B2AA691
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7426358b210fadbd66d1fda2eba627b765b4eaccf4c6c74126a770300492e88a
MD5 05f9fdcbe473412d4241e550f1fd53d5
SHA1 6a11e8c784756a29f31b2fce122f607cb2667e5c
SHA512 1fe91466b2a3d5e985cc379fcf916f766f1143ffbad94336b2d94a17cd93dc9911b6083ee68959919e5237cbf92e6ed314fd84f434616d6a68b4cf90e9bd8acd
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOubWKMwGuP+K80hd:CbEBVj5JAdSp9/EgTK7j6dJOFVped
TLSH
T14F91625031BB12057C3F660C80798C6B628271733095A67B7BA813A64F67E4A5DFEBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a13c1f4e20c9b4f917deee6bd8ffa3d1867f15aa016063b16581f45ba7fd1b32
MD5 11987a44a1ba9c229928c747b92d4fae
SHA1 989c6ceafbf5122a0bd09846dcea4f1e5b731877
SHA512 1dbce8632d570ab05704dbc718536aa4250c8cfbfe25740924f49c6d76dcc48b5354fd2309b67289e1db7cb4b7417440277d6f4f5350691da14d1b4c72458fce
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOubWKMwGuP+K80hy0AKJ:CbEBVj5JAdSp9/EgTK7j6dJOFVpev
TLSH
T197A1526131BB12057C3F250C80B98C67628331633095A67B7BA817964F67E4A5DFEBCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 4b8b18a181dfe96ba072149c99e1900dcb5c567e5dae38c1c9bab146853a9286
MD5 813cd241206edba1fa670f210bfcac61
SHA1 ef5f5b3ec96b69127e28b2e9c6e50bd9f4fbd14b
SHA512 52c24b5fcfa836e78e6a64f94ec8ced3bb6fe32b985737cb7f2ca48df345757c1309c88e756c022093d07440929dda241bb50d26b32246536506d0a2a49b1452
SSDEEP 384:DNrRZyCSDnxTICyuUMEhIKyll7svbFKfk7:xFZJSDniKlyI1l7svbF9
TLSH
T12844740A7B747001EDE6D9725CB080771E3CB16E8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 3285f0013a0a2a454c89ba369bc013bd5dfd8e920868be809345743f80818e96
MD5 6f681c5d7db3a800379e4195fb5c001e
SHA1 9e8212c41081cb821deb3b6a6b793fcd307c0724
SHA512 8e0e26f0bd3b5a73cba2d1f2f4746a0f60b50c9d0b94bd9e295f41fe96726448db01575f3c439574ad2f6792f081dbc0f3f963a164ab52ee0dbbe42421239182
SSDEEP 48:DEK3tjkSI5IUltGhp22iSBgXXOpc5G2OCNrqiGXOpcRW:DEtSyGhp22iS8+W5G2OuRG+WE
TLSH
T18052109FAE242133ECE643715BC111E07E7FA02DCFC1EA0368D910265BB0A64571F68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dec5b1a4-2cd3-421b-a34c-5942980c7b7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dec5b1a4-2cd3-421b-a34c-5942980c7b7f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 91464614e13a7a6b4996bfe2bbb0eed0a6ea5a51f6ff3e42b94e65ba5c22bfcf
MD5 fb6588b38d4b627af16a60f4114a8f28
SHA1 0341640a2be9601a92977dab0b0984dec7fa552c
SHA512 d5d27c08f2f4eacf23ca51be815fb5f3909311db0a5a4653877a24c83ab291d35988ffcfb76298ecbc8f5d888fdfee86beacaeb06c51518e673cd0133cc1a9ac
TLSH
T16EE04FE013FB30587E8EAA44C12E2C4370853B5625C989B1235D57A4CBC680E0ABFF3E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f0a0268eb6c203fab4fb9324900c90f7fe8258175225ad676c0b74dd25d663b0
MD5 71d0595dcd9c1a07e130a3548ce32d9b
SHA1 6c9ee4e69ee368aab85212ae775951e102273757
SHA512 fc0e7bd9508b03c6c2f0536ff2a9beeb4db0ce03c57fbf7cb4b935ffaf9157452293ffab37450320336ac96bab6be5cf4235635a3c69648ed7cf5d2baab12800
SSDEEP 192:/91DQ0IIIrb7MIM9cYcYxeOG+AselrzMrs90yAPp:V1DQ0IIIrb7MIMWB2Gns8os
TLSH
T1CF42739A1A011F73C09E6B3A136282745BD8488245B3712D31537C1F8EF3B9787D56F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 dcdb0817b85e5ab3a3a92099b6984aa2768c13eb70a39625f558447323133960
MD5 3e85a7cdfbf5f34840132aa711371da2
SHA1 0cc8a3c8c94e6ea231a0ccce83e7b574c3df3ed9
SHA512 d5ee1c095b143490ccbcd0f13ef7ffaeeb87fb8a6d5751ab5ae00c7057b02b6bec57a2bd8f6824bdd700e048b8ffd9d09995cedf80689215a6744f420233548e
TLSH
T192E02620AACEC1AFB82964D75335830DE2C23F03EAC829875F01E48CA412109B68A281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 b6a4c10bc1b1ae0c040d920089979b9476beb370987d081a94e56c410cc4a459
MD5 d3eb105f2f2adca87079c1d1c76c401f
SHA1 a3668a0c8441b98e3d6ebcb2a543ec758bcae4d3
SHA512 bc86c1efa3b7021c6ea6a2fc9b18f50e6b2649192f6e28c5b72f10e5ebe6255c662c10d23928667f9d227994c43f6eb665309ee8c8ba7c2da534f50900abc8f3
TLSH
T11C21C495F330C049E15DC67E507E9B391738E8128FBCED0F857A20386EB2A140E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 dd8ddfc83265e6d50fb7e88b58adb1e152f5bc0a9e8d80125cb1cece1ea1f8b9
MD5 9d03aff4217278adf1b5240a07ad785b
SHA1 db51fe21d467de8d9cae2ff68a50aae7a148ade7
SHA512 10a2381d220e716af9df7d9a0bac1269da3c5d2f706ae6be61e02c823159dde79143b4dab93f323b5ae87b2771e3517275065e573a436dd29fd84ea9a55bdeaf
TLSH
T190E0DF64B9C8C1BFA92230E36165C748E2D13A03EAC82F425F008C8CA902142B68A381
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 7267f3231e29512c53542a09b0e5b183008536f4cf51eb7512a139acc3c57776
MD5 405788aa5304d6db94eca4fda61e59eb
SHA1 08ce0d3c334e8dcc44d078889e8f2ce8822ae0df
SHA512 bd5edfd869ae1601ab644ec4bece758fbd26dbc35e6cc2a3fc2f9acedac76f97cbca24773a2158bc3170a60d59c5395d283a87a47bae10c09d77b557f1e654e8
SSDEEP 3:MsEllllkEthXllkl2zEflSQvhs/ll:/M/xT02z/Qyt
TLSH
T10B4404447FD0044DC70010744051C3501371D4110531574734D104335CC75550C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 02eeb911c3c068d0f50b8f737c1183049c4a6c6ae3102eb5024e8d5b8fd1f435
MD5 cdd81a86ccef94acd6df4ccb7be003e7
SHA1 16f001a774c2b1d89d710355f1e0b95efc2714e4
SHA512 a46e302cd8111111c010086f5c5aacb576ac3d4892183bbd3ecbfe8beace9df828f92b0e260a90754d7861d70f5379f482a538148e152649ed1e9b4a49efc493
SSDEEP 3:MsEllllkEthXllkl2zEflJR+/l:/M/xT02zmR+/
TLSH
T138440404FFD00C0DC50030704151C7501371F4504531575335D304337CC75510C10400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f3daa334f852c52ab21ceffa2d5828e2122aac328e01979401a99afc8b4aeb3
MD5 88bdfaf4bab19e83248cd7fe69831be9
SHA1 4803a36936db6eba62880edd3f8602e30b226219
SHA512 5dea044f90fdb5cf7fde2766ada9269a42c878160b35e0dbe17c1d2b01f8e5a8f8edc645301c82425468c28656868a08a6492b3d07e23dd4515d99de9cb51d61
SSDEEP 768:Irv+4UNbdD3XcuNp8+p3bd66j+4BRv86aLIiF2bwCl1:Ibsbp3LL8+p3Z6n4yP0ww
TLSH
T19803CE73F8A899739CE6C64472467A433FF851A396C10AC4D4DD2B4E419A29E230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2806a746493ff478b3f8096cc4f931c3729c58c86fc3c2c020e2d705d2e5ea52
MD5 9516d8c6a262307354f464f5173ad80d
SHA1 b9bff52de1e3623929f06b9df991340938810f1a
SHA512 41b0c5764e934401880cd1a97c5b2d5e7dda8980ee9eb4484236d47960c515ac8084bf37b25ad94146ac5e592454555bc8e9c6bdea9c2c24b591dcb7231e9407
SSDEEP 768:Tp3bgXvXp8+p3bd66j+4BRv86aLIWhW9NqFN5bfC:Tp3eZ8+p3Z6n4yreqFNpfC
TLSH
T19B038C79DC649D3F4CEEF344724E2A076EA84237D1F019A8D7D86B0DD07616AF70682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2eda65eca0b2d7b4954a2434563d059fa4bd350e6cf80221442a40962e12f991
MD5 da737faf380ef76ced07375c979aef37
SHA1 20af633de8d2e0eeda14b868519a68b822986806
SHA512 39e617acf0fd0c912c2bbd645cc4f4de781ba6538b04df13bcfc5babf1d9bebce77687dcc63ebed92b6bfec663b44dda0a243616d74cf5befe363e87ff008973
SSDEEP 768:krv+4UNbdD39BvNp8+p3bd66j+4BRv86aLITP2bwCl1:kbsbp3fL8+p3Z6n4yG0ww
TLSH
T15403BF72F4A8AD339CF6C64471867A837FF821A399C10ED4D8D96B4E405A25F270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 cdb210eea7d5b29dc1647d4f7c7d5d1a927b84a8bc85bd6ce610d16fa799d27e
MD5 c7af9ae714bb50439b9884dfc6a1d13b
SHA1 ca913e022308d1e1a3a3c1220ba10edb1cfda385
SHA512 e1c413af15b8b8ec8ca8430f96d66365cbc93a3e3d3f8b5e0f551572998600950913e048604e9755accf6ff4e5e6164095e33d83d3c8d7fb70b608600eca468b
SSDEEP 768:Cp3bMXvXp8+p3bd66j+4BRv86aLIWPFN5bfC:Cp36Z8+p3Z6n4yNFNpfC
TLSH
T18DF2AFB1E8A9DD335CE5D644B6863B43AFF4117395C01E98D8D9AB0D108726F170B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bf49979bb9042338fd45fc9ea7c7f161363510792d27c7096a997ff9e1afac09
MD5 9802d213262faac61d8c5007ccb96fde
SHA1 259514e47a1291fff6832a1e32f1b899c98eb53d
SHA512 38443f232b05cd75ca171ced3f4eca821c56cca450b67b527a250a07d09676f2b11f012502394e6ced2d13eb666d67eaa9ea89ba1d9c8cddbfba5ad2aa18e990
SSDEEP 768:urv+4UNbdy3bwXvNp8+p3bd66j+4BRv86aLIWPFN5bD:ubsbo3eL8+p3Z6n4yNFNpD
TLSH
T1CD03BF72F868DD335CF6C644B1873A437FF421A395C11EA8D8D96B4D119A1AE270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 8063e68131496501c18087750c78630f97d725ac2590d0b64d12fc229674d84d
MD5 975270d678ebff3c5589f7ebcc5292d6
SHA1 90f0529c3fabe08c0809b8785f7f16580c0c20a7
SHA512 9279b8b42925dca3fe3e6de260cd6097ed34d1f7ac59f5eb010ea3eeae30f78e2bc74b48bb0eaf9b3d3a4a5c95f0b075522a82c36924272e1a0125659950d9a8
SSDEEP 3:MsEllllkEthXllkl2zEflp5R+/l:/M/xT02z+5R+/
TLSH
T1B44404047FC4144DC5001130D053C3501771F4100571574334D114335CC75401C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 7b604f2b6370c04b5893469361a84f61874379b2a721dad8cd0cf080013d9061
MD5 fdc56d2fba9069380fd49a709fac1757
SHA1 ca1dbb146c6e130d8b55815762866d0ec24540c1
SHA512 6cbbcf80cd5dd5368a641e8b6268d580c498baab0fb191b8540e8a0e0a0a586ac99ab38e9c43e971890ab4c629c4f594ee2bab3249b3b6544cf29c55dd4e6431
TLSH
T14A2125D43536637B02C34BD5A0764CC45860B885433F6A9CE95B5474FE6CEA1A72E386
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5832_871223926\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads