c6f0efba0c21539bf9b385ad27a747552916ff28c2b635ba1e6d820fcab87bf0

Resubmissions

27/08/2026, 08:55

260827-kvfmxa1sex

27/08/2026, 08:53

260827-ktswva1sdx4

27/08/2026, 08:52

260827-ksxhmssbme4

Analysis

user interaction
yes
max time kernel
46s
max time network
49s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc-n. (2).webp
Size 115KB
Sample260827-ksxhmssbme
SHA256 c6f0efba0c21539bf9b385ad27a747552916ff28c2b635ba1e6d820fcab87bf0
MD5 9f4833966a93b59891193cabbeca7159
SHA1 61415a10c62cd058bc3df9ae818b0d5022f062ca
SHA512 a9701cd9d297557c980a9340eec252b07c28dc8f0fe1e48d916ba5b28014ebdbcb2bc744e56703c5b3a4c75690484a4d3fc659cfac6ae4090813ad8927d48783
SSDEEP 3072:eV/BMd0Brna8rBGhD95dGuqIpJVhs/7DrshyIz:eV/DdnIhx5LznVh23rs0s
TLSH
T13FC312218B6A3B77423171F3925A84F059021C01C98AF767E9D1CDDE5E7714EAFD2A8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4876_1152902940\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4876_800698514\_locales\sr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5880	msedge.exe
1144	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322943596581821"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{911FE42C-9761-4221-9366-3C9898F121E4}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{85478652-F2F9-4A8C-A3A0-92E38099EBA0}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1360	4876	msedge.exe	87
PID 4876 wrote to memory of 5880	4876	msedge.exe	88
PID 4876 wrote to memory of 4440	4876	msedge.exe	89
PID 4876 wrote to memory of 4440	4876	msedge.exe	89
PID 4876 wrote to memory of 4440	4876	msedge.exe	89
PID 4876 wrote to memory of 3548	4876	msedge.exe	90
PID 4876 wrote to memory of 3548	4876	msedge.exe	90
PID 4876 wrote to memory of 6120	4876	msedge.exe	91
PID 4876 wrote to memory of 6120	4876	msedge.exe	91
PID 4876 wrote to memory of 6120	4876	msedge.exe	91
PID 4876 wrote to memory of 5024	4876	msedge.exe	92
PID 4876 wrote to memory of 5024	4876	msedge.exe	92
PID 4876 wrote to memory of 5024	4876	msedge.exe	92
PID 4876 wrote to memory of 748	4876	msedge.exe	94
PID 4876 wrote to memory of 748	4876	msedge.exe	94
PID 4876 wrote to memory of 748	4876	msedge.exe	94
PID 4876 wrote to memory of 4044	4876	msedge.exe	95
PID 4876 wrote to memory of 4044	4876	msedge.exe	95
PID 4876 wrote to memory of 4044	4876	msedge.exe	95
PID 4876 wrote to memory of 1460	4876	msedge.exe	97
PID 4876 wrote to memory of 1460	4876	msedge.exe	97
PID 4876 wrote to memory of 1460	4876	msedge.exe	97
PID 4876 wrote to memory of 4884	4876	msedge.exe	98
PID 4876 wrote to memory of 4884	4876	msedge.exe	98
PID 4876 wrote to memory of 688	4876	msedge.exe	100
PID 4876 wrote to memory of 688	4876	msedge.exe	100
PID 4876 wrote to memory of 688	4876	msedge.exe	100
PID 4876 wrote to memory of 3060	4876	msedge.exe	102
PID 4876 wrote to memory of 2620	4876	msedge.exe	103
PID 4876 wrote to memory of 2620	4876	msedge.exe	103
PID 4876 wrote to memory of 3992	4876	msedge.exe	104
PID 4876 wrote to memory of 3992	4876	msedge.exe	104
PID 4876 wrote to memory of 764	4876	msedge.exe	105
PID 4876 wrote to memory of 764	4876	msedge.exe	105
PID 4876 wrote to memory of 5060	4876	msedge.exe	106
PID 4876 wrote to memory of 5060	4876	msedge.exe	106
PID 4876 wrote to memory of 4232	4876	msedge.exe	107
PID 4876 wrote to memory of 4232	4876	msedge.exe	107
PID 4876 wrote to memory of 5476	4876	msedge.exe	109
PID 4876 wrote to memory of 5476	4876	msedge.exe	109
PID 4876 wrote to memory of 4172	4876	msedge.exe	112
PID 4876 wrote to memory of 4172	4876	msedge.exe	112
PID 4876 wrote to memory of 4172	4876	msedge.exe	112
PID 4876 wrote to memory of 1696	4876	msedge.exe	114
PID 4876 wrote to memory of 4580	4876	msedge.exe	115
PID 4876 wrote to memory of 6088	4876	msedge.exe	116
PID 4876 wrote to memory of 4512	4876	msedge.exe	117
PID 4876 wrote to memory of 4512	4876	msedge.exe	117
PID 4876 wrote to memory of 4512	4876	msedge.exe	117
PID 4876 wrote to memory of 4152	4876	msedge.exe	118
PID 4152 wrote to memory of 3160	4152	msedge.exe	119
PID 4152 wrote to memory of 2400	4152	msedge.exe	120
PID 4152 wrote to memory of 1144	4152	msedge.exe	121
PID 4152 wrote to memory of 2400	4152	msedge.exe	120
PID 4152 wrote to memory of 2400	4152	msedge.exe	120
PID 4152 wrote to memory of 4696	4152	msedge.exe	122
PID 4152 wrote to memory of 4696	4152	msedge.exe	122
PID 4152 wrote to memory of 5984	4152	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument "C:\Users\Admin\AppData\Local\Temp\Doc-n. (2).webp"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5364135160318975384,4725621117364557812,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,7018616872364744311,3066723780240301277,262144 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4274941203252981120,5052816223150002772,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12482295635676851301,11140718717019575522,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,5484890403830734581,16106593872064322243,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,1686832332870522701,3586688231962030172,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,12714829614441824571,4675230275167792386,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:9
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3948,i,10003372294418373474,9149321516804228178,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,6579582772858878424,17774060701745943785,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4052,i,17052866721239831850,17937851018622737067,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,1885975100658154980,6292211717449767628,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,1885975100658154980,6292211717449767628,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,6951285632515572584,11325156517331228485,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,8346574148396573023,7373360246484348590,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,18091247860260218153,9903509041608301599,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,16349806717555203374,8542260044051831895,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,7313949806354038555,10288453553724102287,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,6447415761634017242,1136088895539862611,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6580,i,12037197499450941809,10477475853506192467,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1442476687732959923,1175291391957945335,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7657858938489628501,3039420804911836459,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,12485742638129694963,8523998082046178736,524288 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2560,i,16177550791136574573,17046625576822416818,2097152 --field-trial-handle=2688,i,2624849615667738977,16451671284472820616,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x234,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4623527565995828112,3777051578134685464,262144 --field-trial-handle=2260,i,18402707427612170603,8651512687416679630,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14683995950471267896,18190588185918857664,524288 --field-trial-handle=2260,i,18402707427612170603,8651512687416679630,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,16512354188407000190,179544643776690633,524288 --field-trial-handle=2260,i,18402707427612170603,8651512687416679630,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:13
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,13819384604324724061,7244658259565539203,524288 --field-trial-handle=2260,i,18402707427612170603,8651512687416679630,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,13819384604324724061,7244658259565539203,524288 --field-trial-handle=2260,i,18402707427612170603,8651512687416679630,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad74352c4d598a54d1b49d4b398946ef449549dd3b58dad836f6278bb311892b
MD5 f827b3a54a2209dafedd56478d2199df
SHA1 f3050b1103ed09ece8ea3fe4a21441ddd69caddc
SHA512 78e9abe350676685dee36c7966e7ee6d17423c02551624c9394b61910dbfc3444a6c9515fa6a48aae1cf78af9f47aef10e35a57971cd6d859070c674fff124fd
TLSH
T191D0A76055E9BFE5F02A253CA2500154649D69919E032157A540052E5E3E1C305D98B9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 478fd6709567b8d306088a89b88adf89314ced08c9c532f3b16ebfc998de508a
MD5 e7dcfd1bc557b3a59211485b06f3ca10
SHA1 4db7ab99b4be033ba60bd261a8b6d2cf2498633d
SHA512 0f7989ee66709c4323919fddbd787652e2fa31fc361c7b236c1787620f70f9b77ffbab33967c7917186684c7d2b8f3aeb4699c523bd0b846ae5116b7c62da9bb
TLSH
T100D097A042C4BF21E02A3D3CA2110214B0DAA880CC422023C240025E0C2E2E301CA4F5
MD5 SHA1 SHA512 TLSH

Submit Download

508ebef5-f8f8-46b0-aa53-d0f44b01b7bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\508ebef5-f8f8-46b0-aa53-d0f44b01b7bc.tmp
Size 414B
SHA256 6221d591f869a98a062f8d86492d0e2b6c5af945aaadfb78799ce644bc492894
MD5 ec43463f765dde6c70a47308e857e24d
SHA1 767d20fe100e7af001aa893c22c561d961e321a1
SHA512 1a96ffabf734e3120eb00b36f6659fdd5c8a2b4d0a5572cb7acf03f13de740ee300e5c24bd1ae0631f027c96223878476a41e56650d65fbdf4208af8463c74e0
TLSH
T1DBE02BB6DC51FC2719FD572DA5640243E74153162B60845BBB3C810C8FB1737454E81C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6a930b186d26b33b661a52a27db6d7fd56057b6341ea16986880309d13033342
MD5 3d4397ba99d966ef59f1be553a19f5da
SHA1 2bd52eca42146ca4eadffd7b77985c723924643c
SHA512 bd789b3dbecb2b0754b4fc1fad870aff6702c8b4712fd1f865a5ba86dc44b2a9df991404d6c3fd341a0bc4aa588f2c67db5a070ee6f69886e52ddfab37c9cedf
SSDEEP 384:2vMO5xhQPCSKGrHNmE2pmgwpYnUsRPMylPixj:2vXUC4rtj2wgwQdBMylWj
TLSH
T17413913D72730E17F6E647BD46BB0EB16331E4A8C9C90EDF4271710542627A39AAE942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6c3813c74159110f75008119046b9022a25183d1f7ad766adb4ff7dfd35f3c36
MD5 3eee8abdc17a3ded5f33a18257bee742
SHA1 f8e37b675fac651300def4abd42420ace44677af
SHA512 e3b465116d481862942ceb738813829ce2278a6f364d67dd0a553e5463174d31f7c8de0d1614b18f603031fd54abb8adf6870c322ddd8db3740bf5639d991915
SSDEEP 1536:Y6L/7QL/oSA/pCtOJ+jBuWXt+KpNL2hCJwc3YT3SGOf6RW:fL/UL/lASQi
TLSH
T1FE4482F71952A00BCBA842F696173E3DD17B454D3CD1FDEAD1784CC12929B32A2B9E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 a2d32ce6e8bc05ff5819bbc4543659e7ad95cf6bca6329e46ab877f0eb303068
MD5 28a2c0715993a70e3f28f94e05b40319
SHA1 29934c2c8f58486eef2d09f2d19241f9d10c281f
SHA512 34e200e55ceefcdff0cb55d075f8697e24f384b53467d2ffe303f4c5731d60624f4ab73d02f33ea7869b3d54c1e7e7140cf18b7634031a7353a499c3b155e149
SSDEEP 3072:Gv9G+HN42FBiHK1LOLa4j069Z1NquajXH2:GQ8u2FBF1LvAx1NqvH2
TLSH
T1712549EEC7682C82CE6B877470E0E9077E712183B68CD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5a7a71396b9f1f4ca6badd75cbc6f56a07cfbf1811ff2c9386fbe0c8abd90c02
MD5 fc3f503792168770649a122904f5c004
SHA1 4869b96200c6713be8589f8e76c454fecd39186b
SHA512 827a8e6eccaf97e35644a0824b77247c49d348493b6050ff736ba17ea24671029ef88bf6ad6d6a33d5c762b74118ccf4ee76f55b9e422404991d22158edaed78
SSDEEP 24576:KHAIZYfNbAojX3W7lB6KXxQeZztH5fF/eJog5:KgIyFb1jWD3XxZH1F/emm
TLSH
T101165BEDC9785883CD63AA30B4F0E9477C7413C3F595C1E68898C584026BBC5BFAE669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67d969a54ec2a98d2f7c1867f641e1d7f24178123363bd9b4e99c6e552ecc5e9
MD5 7f998423201ff7023e125f9fd833b309
SHA1 ffd8c50b0defee60011c0f8f21c5b64b1ec4d570
SHA512 ec1ca2e2454c0b1a98cd5d8498bf92079b99010b00d1844fa5f217764e93cc4ead0d4b588f87d5a99fb31c947af776905cbe1933350631f495dd9e63a800ab2e
TLSH
T1AF61B86C477F84C0F71B6FB106F381AA32F5E4C6290B1FCE084922F4B02AF4D59528A1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 07cdc1f73293af7ec50a834c965b332bd287374bd32318b9923767fde92f0948
MD5 3fb0b4dd184aea482b804bffdaa968ab
SHA1 9a1c64f1a61a9290cba521f6afd24e4c79e93ef6
SHA512 cf826ad8b431a991c153b6a2fb445e75d4e2483cd58ba6a64822993968a8cd9f70159a117e70539e5f7747b83da3a315a51e51b70ffc8695e798620d9d696cb7
TLSH
T1F75182A8477B89C2DB2B97B10BF3818A32F5C5D64A076FDE4C4860F4F04EF5C9142151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a31cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a31cf.TMP
Size 2KB
SHA256 321683a78641a1d00d8258cb312b0336a6d8fc584e9ca436cd49a9adca27404d
MD5 c8b678cc005e0bb7026d4253f8f76e06
SHA1 7ce0ac6cc7e2cf032579b22f3077459d34932895
SHA512 bdb77b165eab31ae150ae7431b4bdaaf08f49b909975d9388dafe373dc59096fc1f37f84fe7feacbd52b2cd768711f6575ee81d9c976943e757b5d4250e91579
TLSH
T1E05182A4477B89C2DB2B97B14BF3858A32F6C5D64A075FDE4C4820F4F04EF5DA142151
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 3413455ed887b7d2f88b5501ea368adc1870faec059b8ae40ef000920083657f
MD5 97f77bec0bdb03d3434c7b8e3fb8d7ce
SHA1 1b560dafc36bbb2240eadf11ab149a296e5ab244
SHA512 0c7d1f6baa375416b489457a2b1be75107069c78b7a0fb3259aa25f78e628f5743ce1034e8e3799905a06ed3a959ac1080b83af5ae40fc8248e4f59b98d9fe65
SSDEEP 3:MsEllllkEthXllkl2zEklQ3:/M/xT02znQ3
TLSH
T1FF44040C7FC00415F50010344115C3500370D45007355F4734F10433DCF55401C35500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 a67b5bf4e4ceeb7f0b555fe5a5a27a55b791a00f6c00536f61b5daa4c4bfc18f
MD5 19f98768aab6fb3162bb82028f567ebd
SHA1 d9f1c9668b814937e6afdc02062f6723ff905dee
SHA512 abe6f1d3e02ae04352318a2a55ec31e66fbacee36433ed4e6b893efede16f170deb9fa8097fb71009a2d304a36ddc8daaf8e813b808f60dc2503110a7f37f59c
TLSH
T1EEE0260814C8E16A95946B93976C430C82D03603A388F9022B0A98486903A42EFB6384
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 7285958e52d0c6e88e40fe5952c26808e10a983e1a854ec29e98dc231840bf47
MD5 166986583f9b99f286744a3d7a81aa79
SHA1 acc0b3c347e1f0afae4e30b0c240d540c8b5fc1e
SHA512 ad8332da52c816901081e79f1e6d2571caf8685102b43c9484bfd7e14d7b721ef7341e735bca140879e5e33f46a34de847b93cdc3a74620007f2161058adc7a5
SSDEEP 48:uzBmw6QU1Pz2t+8LyyafzBtO2/PoP/IpZDbz7VTBf01xWBQHlFYbcSet+1z:6BCxsALB4P/a/NTBs1NH89k8
TLSH
T13D92E9674A747C03EB656E7F3D1A287D8E3FD2898FA7DC503860906248B94568139CEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f994dd7b07c83126a469e38c4d7a6116ae24ce1e6f71e29782c398aa807be726
MD5 331e7a74790c2208fdf912d1639b1419
SHA1 d192586f278cffe319b0257d2d384152acffe3b2
SHA512 e44037cfd5d58f7685ef87a003fa742c99d7a0982fdd75d3433fc938bd0a43511ae180c92fac7cd4ef961ba46e7912c755ed0c727bf85028066d048e0354cf63
SSDEEP 96:rtbjAW/HtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/tekMbbEOVpZf24JkMfXSq:rtbpgH+bF+UI3iWGVoWN3qL/7OVVV63
TLSH
T11624200F5F353712CDBD913668E644A35C7CF03F8B5326CA686114B5CEE2A46A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 29KB
SHA256 d42a4163b4815814a273768f519d218be6d7f67e62e7fd1e057c46a4aaf6296c
MD5 e869cf18bd639980f2cb718e157f3d4b
SHA1 97c339616c5a18149a1cabbb5fe88ffd48a3ec40
SHA512 04f12d6aa2c65dc19032bbe4fe9fd397e2e7497ad3f3cc24058111761dfc6164ba9a57d4e81dd3303806611b0d7ee1d5e7efd18dfb98fc764663951cf4dfa0dd
SSDEEP 192:1wSfifTJEj0qv8AFai1DgtMVRHf2fC2B9znvxOB9+a1jhLpmP0/7HRnu1NyjWZf1:+VrOgMxsmgtsHfA9znvxS7xvo40/1as
TLSH
T1A2D275293A256C4C8BDBFBEB265EFF24C7FE553624C99E51C0942E08D44E49B3364CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 3103b43b0163d043790afb1f41031658df681b75d5600d443d29c5774791174f
MD5 42b0342c298c6faf9a625d5015e4dc5e
SHA1 d8ed298d797728c3460a06af744b6d188dba8827
SHA512 b932589b6b6b266e2f84943a827611f3bc6c5dab149aa85e975390b159732b383825d380b5de7d9aea5844eaad09c1c22f4857a9ef03ca92d2131152782c1582
TLSH
T1C4E026654CCDE22F6624224BA22D670CC7B03707E78D7E422F05998CB003408FFA23C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 71933f50226c72daafbf78242bc10caa84182d1b83a9b50466a26fae5bd3131f
MD5 c5da46d1faf6d978db4ad1ca889937f6
SHA1 b1533cf216a151f38260163fa3c9e7ac8c99a458
SHA512 76a40c7bb646281acf7c31a6ab4231324a04399e67d27b050cc77c79f32a4eb740ae0de8b264833ed89c24b786ae75167b6d04c4f4fb27fded5f8be6067ed7c1
SSDEEP 96:KDeMatha9dymp+MHsCh7TjbtFuUnes1Ce/nVVpWL0PGXbCfU/iqmRPQmKSmr:KDLaTaWMHsq7TftgsgGnz3Ij6qmt5mr
TLSH
T17EB21A0F17367053C19F6373BDBC9CD27A2CA0698373A6AB54BAE0710E79593A5030E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 052d0c75a0c7918360cc0544e9f88305e15afddad260d3f07aba922ba653611a
MD5 eec6554ba637656ce059c3b451d0bd58
SHA1 757ed3f252fe56adbff3c6b41f66a0306aea530a
SHA512 194852616f3e91b9b3ab1fd24a92bcc26388aadc1308a355c82b9e61bcefbe540964274cd7877684424f1a609d8f46909993d7b1b1e3ef68d202a85105a5f4a1
TLSH
T13E51ADF7C3E8866EC91155F0AA186E2BDE1D0955832C3C56C4E4AF1BA3F2471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 75119f2bbafd0a0826dfa8feecc80a67665e6ff5eba6c54d55b9f38286ed1b0b
MD5 3753c610a0a10d404dbb84ac70237b89
SHA1 5bae8c9fa32c3f20e82112cb01dd93206d2fb827
SHA512 2ea31104e1e9b17101886bacda6fd93b20653099446b086159198fc8947535801c1817a9f078d4722813969cf5769d5aeda352938ffe01a3323c5d3f1d8646c9
SSDEEP 384:sxRlFAcmzA/fbsfWvWWCyvS/56k/oS9Nh:sJF7mzA/fmYWWpq/55okh
TLSH
T1E562D8556924AD778CCBD618FE257F53D7F9102295921E4CAAFCC90C00EB6ED230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 445fdce5b5d22e59cc64b0bcd1ceab5fafa326c3a1a437d9fb74d11fc3149bdb
MD5 ffc53ec6a76ab73be643f0abe5baf3fa
SHA1 e6c99d074adb7cc9215b281cf52b06b43a87d8d0
SHA512 f18614c7e5ecd6a5af911dea23e2af4f9af74a57de4a07309b52ca8f84ee8efe1e93153fb4242e6cf34d0b8de22b4df6ef90ce5f2d608843cd6912b24e946a13
SSDEEP 192:sxRsFRlCA/fbsXlJ8ZycAzoA8pAp/g6+WNIYo5HCYJGrIgVsIFJ:sxRsFmA/fbsXrCyQg/5Iwft
TLSH
T1AA32B8166A68A93B4CC7D61DFB55BF53D2F91032A1D11E48ABFC8A1C04EB6DD120B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d9d573b5f84c0ffe86e0897f70b029a2d9a9600253c86d65f01deba84f2b2592
MD5 34543b4b49bc537c6c8ab1ac63b19cab
SHA1 fa624d2421ffa0760d284a47641fd870aaff1ac6
SHA512 e80ec91c3a7cc299633ca9c68afe877eba1f46b676a854a7e389f4bb902beaf504d0fee9cae4fc3b51c85302b06975d61a4d418a2ee369489fedee5cf487eceb
SSDEEP 192:sxRlFRlCA/fbs5lJ8ZycAzoA8pAp/g6+WNIYo5HCYJGrIgDRsIFJ:sxRlFmA/fbs5rCyQg/5IwfF
TLSH
T17842A7166A68AD3B4CC7D61DFB55BF53D2F91032A1D11E48AAFC8A1C04EB6DD220B41F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 af79f9d37e03d95991d76be357ed957fa040244c868cbb1519772005a1a76ed9
MD5 697649cf3f5cb4ff81f20baa6979457c
SHA1 690fcf2f033840b140d8c5c696139802a8c1ce6e
SHA512 65811558bd5f71033fa8a5985880b6b4ba4b130a0856a6ff6aaa727241ba0263a4e541f9a3b9bc7d98193c5af5bf453a272587404b8466b73c82dd9de3dfe476
SSDEEP 768:j26HmC7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ3BVuwGro9ze0c:j26HmaEz6RWgs2f02u1jaz3B4w9yX
TLSH
T1CFD2DB7B640DCB7E4F800ADDEC197E9F6D6802CB9698CD8047FE855C02C6BEA511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 73f101f39068b1849d006adaed97b93c3e35c471572bcbae394dfc91ba8ef9c1
MD5 0ee6353821a60e66c8d0328641a86176
SHA1 b5848200c5a5f3136df3034b16962ba046b6a9c0
SHA512 ed5d8759f525f85472e638608409ab362fea07d9cb0828dbb375fd9db44c8f6f3e1dcdedecd7ccbdd5729ca591ee32a08502fa91086e82fba8aa694b5d90e0ec
TLSH
T155E0262509CAF1FD701921930739830C83E5BB07D2C87D023F01CC487557908FDB2288
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 100B
SHA256 1fec2550b2caeda1f2e1aebc865bd8892d40b4bb2924d32a8223449b7bb6ddb8
MD5 6159f079599465e3baa1b3d878d68aed
SHA1 b9d5ac31447affdbdab7f64bc7f63a18eb8a5975
SHA512 abcf7b5c92458d7cd8fe3935f5ad2e34d1aecb21212963aab88c09b865c97c58b578a28c8b0a5f0a0fab34301d8a6d9cf91b151857427b0bd2bc7048dbacc518
TLSH
T1B8B012D07F00400ACA402C754940DB946704B0010174800389B0CF314F182E82902085
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 d11c8d9b84ae98e86c762b4aa13ab0ffc5865ae0221ba21d6ad8efc02de2cb00
MD5 bbc1a142fc176c3f803b4e6fe1dac498
SHA1 40b523a109e481598da265048ea3abb9bb770606
SHA512 4d07941e6ca7f6fd209ea968b0636753869b2e0bfa87cc350ec67f1673547cf5a902f77366b8d6d124c26e48f2bdc09f6dd6a1d8aa4e838b3ffacacd7a633570
TLSH
T1A5E0D83525CAD26A718930975229E30C82A3BA07D6C869513B0D9948724B640FE63244
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 94ae982494a06518dcf96bd5b48592faa41465a58af53cf37884b746eceabbfa
MD5 0872b5a37bccbd2ec648598b444880a9
SHA1 27194f0055caf27e2cdb491dad5e15b3d78c1d88
SHA512 ff91935febcab742235eaeda88563265fddea1e8a22033ee973655f559f96e2d3dc384d99b677f293f0b09002b9cad4098493411799819db381c51147292a00f
TLSH
T153E086F485C9E239548B609746749B0C92F0BE1797C87A8EAB0C4458A103544FFB6689
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b3b7f4227c89eb120a8c36d1a2ae0dba743e626a02e04c883637f698653f2a1c
MD5 39027fbd04e7ce83b76e2f98d392a355
SHA1 97af46a2df7be488ae5d93f02cbf1a59aedd7561
SHA512 868f0271f25df3fe88dcdbe9d8057028c0c568eb37c2f00e50809892b514cc0af874ae93654abc1b851913f6a9b03596e8ed5a61b77228937fa9f0e2bf332399
SSDEEP 96:KQZaKKcy6qEKnKl62IFsYa2C0CWX/cg0K0xcC0gYYX64p/l273VnDXCL8Oc/XKJ:g1vatp
TLSH
T1D5A1CE5670FB12402C3F2B6C84D694A7628135727318A52BFBE812E64EA7E114DFCECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 45b73ecffccc09948f43dbd02c316c43d93f24a5479e12706a1751ba4f1d1653
MD5 c51d3d91c3ecf1c49b9df099d7db0671
SHA1 8022767a49aa91f92cc1309ddf8c7e5f9ccf7ce6
SHA512 80ac83138954a4f85ef8e4b440081b4f71294bd8df08ad66f5907ff66750a8cdf1de3b7e659177274eb63c88b49b41d8d25058f5acde99eeecdbd5aaa8977f8e
SSDEEP 384:DNrRZyCSDnxTICopMEhIKyll7svbFKfk7:xFZJSDnioyI1l7svbF9
TLSH
T1C844730A7B747001EDE6DD725CB080771E3CB16E8F22A6916DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 f190b64043cb7bee8b33e9313919b006220eb6e3c18b927a6873e15860ea4994
MD5 64e41bb2eca79bcbd7d2aa3941c30462
SHA1 e3a38be8b2b268be8fb31e2a96d0331818c737f0
SHA512 d237a90e3bccc6326e2c3e529c05af1217e10f2a97f746f30aeec42caad80fc6d122ab57b845bca9c64aa13eb9759c86a5a57aa70208281d3ef3611cef1d034c
SSDEEP 192:+eQYQIIIKbqMIM0lYcYljecOnWAsPlrhMQ2s5B5BXYB2:+eQYQIIIKbqMIMiB8jKnfstN2s
TLSH
T15842846E260B1B77C48F5B3623AA86545FD948C28132212D72972C1FDDF3E9782C56F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 487eb0e9dea29bc1cd42ec29e53005647b4934794239a96502a737f5d2194bc6
MD5 f408fbd1ccc0064358a452c1d40bfe60
SHA1 4350adce533f15fc879f3c72152dc14a98e1a0e8
SHA512 258a21dde1a698b4d4215e9f1f07fd282fa7041ac9da75e59580c0de25da664efe499caf8adb94a6134ee1a98988e434ebb33616a3e1d22cc84827791d1f2195
TLSH
T1F3E02624B8CCE1AFA71C22872128430C82803F43FA88AD062F01C48CA803501FEB6781
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 bc4cb086fc3bd194d2574b494fac7d8fe6505e63e04a840634f9bb4ebb740692
MD5 e9a0ec42a9178d241bf38f3ed03109d5
SHA1 e5b933d7b841fab38713e6785ce960e80e9fa175
SHA512 84214aa0912895349b3b106563bf5d2bf238fe00c2843848a73cde580416a4876b08e49fced2c78d0e117977f680dfdfd0da2dcca6643c40315e9e71a9d8f547
TLSH
T13D212255F330D109E15A827A607F9B391738E8128FBCEC0F847A20346EB2A440E4B7E9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 0f8538e705ab09814b32bb684eb26fc3115b2ced9303c7646ea66cf367ab991b
MD5 c53db997136e2abbb5e762a94ffce24d
SHA1 6497c9caa961735e0d110433589d9ce59b055432
SHA512 8e6e0ce9cdab21795e0da842914ee44589b2acaebca6d100f1ad4d48d1f77668c227bea4224ed338b4a2c58bf5b5895dbd18d93767b996bc089bdea517b918bd
TLSH
T1EBE02614B8C8E1EF915023832368834C82913A03EB88FE022F01CC4CAD03542FFBA381
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 7b99c0edf98c6fad05a38b130c2db8947fa5264b6b9b1c8f65bbce53030e945e
MD5 ce536f4833fcb179d17f1ab6fc392405
SHA1 456e2561ad5b3ec3e4f3bac0591678a6d27a3377
SHA512 7f2a7abc3fa357daf8760295de67cb1d5ac42e1b8dd6d7f695d99e8b86eceeff113930c842d64568585c0ad69fd26e309cf052d4e45178a130bf51dc541cf262
SSDEEP 3:MsEllllkEthXllkl2zEel3a8da:/M/xT02zNHI
TLSH
T12844040C7FC41405D53C34304411C3504370DC500515DF473CD104335CC7D440C10D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9349028e84f2c37c433f405b8fd7d301edd4f1f0b25fbdbaeddcaf5f5af80415
MD5 d98ba0c344ffc56879bfc3fc03f75e8a
SHA1 bd26c2da4b76d63a63d44a3cbb8fa09903bd10c1
SHA512 5a6c19c67a1d1840783e60e0ef288ed42f97bf56d2177121c9520f1e99724fde68eaaa8053d4df3ac1dc322f6c61678380c4c11c503d0c94dc1f29b7f16e0f34
SSDEEP 384:n5ZcIf38N2xX6sABbIb6uhf3RTpXOVc3V0x7aGrYGgAN8SyrCZr1IR0VhMxAREYK:Rf3nXb/TBOWSeONXyer1IRCzni9hR8N6
TLSH
T18FF2AE70D899AD374CE5E292F50367837EF85067D9C44A50EDE9AB4E0493A6E230F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5b318bad9b70c7614ad1ce57b1d31770656a035d57f179207f017cedcefce4f
MD5 9d5ec0c6e04b27417c3d6f7341b63100
SHA1 d7c0201959b5418d048c395605639848313542d7
SHA512 0ef03e19a496a88ff11bfc743da74678b243c8c3aa46e1fa8f7cf8816dea6333cf5b0ac49890539961efbff658eda2b3c1890649bc1e6d2d6aed04d81ab589c2
SSDEEP 768:Yf3nDb/TBOWSeONXyer1IRCzni9VGbCjh1R8N6:Yf3vLSIqn8kCN1A6
TLSH
T1AF038C3CDC946D3F88ADB746B50E6A526EB8113BD1B40990EBD95B0E807396DF30B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 03988774675c5d459260273af8fbf135e07e02c4f24003a35eff91ddfc07df9a
MD5 c022b9ab4c85a06d3394f6a531b41d0c
SHA1 2fc12779e314eddba418ef216e43555e499a1919
SHA512 a8c3f0ce69bef3b516f06e81e5ab7cee085a6456354c5539cd72588e6bc83bfec030a1caa7ba93e92c2fdc0417d33a3bf83953694571fe76a5aec8e42030f676
SSDEEP 384:nuZcIf38N2IX6sAB7Qb6uhf3RTpXOVc3V0x7aGrYGgAN8SyrCZr1IR0VhMxAREYK:Mf32Rb/TBOWSeONXyer1IRCzni9hR8N6
TLSH
T10EF2BF70D899AD374CE5E392F50367837EF85067D8C44A50EDE9AB4E0493A6E230F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 068b46d7efad8b4eaa58775d9997cc1c8f8e242fdd0829a742230791ad0fe0b3
MD5 8310e00e77969c8f8451b156fd1df4fd
SHA1 493bf9d67d7c86bee72c301f149fb9f3d7ceb8c3
SHA512 9f734a59b11f8ecffe24d3dc99dca7d40cc51dd953a1c389cc6b01cb14fb4fc678b77dc39accf0ce491e0c21074e6f52a1529f33c36cfeb9723f415cf77343a4
SSDEEP 768:hrv+4UNbdz3KF/TBOWTONXyer1IRCzniBmeVH1SK7:hbsbV3sdSIqntEH1l
TLSH
T18903BF32E4989E338CE2A395B047B6437FF86057DA840790EDDE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 222c1f569bf1c7dee3f3d840ef9b7b3968258e768a8cd924d205c77890d09a00
MD5 bd24141338e9f53e326defc75408f793
SHA1 da8cc22ae76b45baf7dae4fc3ab6172a5df69054
SHA512 c9a3f6bb3bf71f0f8cdaccf95b51008f95895cbf5976c10e29bc9bbdc5d8dee9574e5a11be34902d6ba3122b7d9c22e41d9f48ef319dc3a586e15c296b4de39e
SSDEEP 768:wrv+4UNbd832Jb/TBOWShONXyer1IRCzni9hR8d:wbsbq32cSIqnWC
TLSH
T11D03BF31E598AE338CF5A296F00776837FF8205789C10A90EDE66F8D04975AE230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 eeee3722406ce2dc284bc375aa15266dc018b9140c27b7dee70a7ba494f5153e
MD5 99b9c273aff150ab4d6a85ac872a7346
SHA1 2a1f21bdf4b3f150eb1e83753bbc43646e26bd6e
SHA512 d31209b61b46e5092248cfca12f8f71c5053303855110a9f8683bba68c954ceff4c78ac0a1a1bfe1adfb35f9dcd4bcc930eee41d15f8af0e1d525b90c8033b2e
SSDEEP 768:8rv+4UNbdz3NJ/TBOWSkONXyer1IRCzniwheVH1SK7:8bsbV3LlSIqntEH1l
TLSH
T12003BF31E0999E334DE6A395B047B6837FF82067C9840B90EDEA5F8E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0420b1627294ef97951f21db7edd4a8bae9c6b3bf26c0cb46a3a250ed3f5c1c1
MD5 291552df41469b895580fde937e9580a
SHA1 b17f64353ba8a9c9f643c59314ed28b045440a1f
SHA512 ba1fe9c76b9b62f33243ba26d7eb0d0e2c67361072f5dceaad0b2822b5764280ce64dc3fe597e38453c3f86749dfd2dbccc0ca732289cf6296aab38b397c9b6a
SSDEEP 3:MsEllllkEthXllkl2zEelj:/M/xT02zN
TLSH
T1D444040C7FC51C07DD1410304011F3505770DC5007115F4734D104335CCF5405D04400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

9443f724-1956-453f-a535-ee3a70da9838.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9443f724-1956-453f-a535-ee3a70da9838.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a08cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a08cb.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

8fa6af94-b485-442b-958e-ab0740a6e1c8.tmp

Path C:\Users\Admin\AppData\Local\Temp\8fa6af94-b485-442b-958e-ab0740a6e1c8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_1356236200\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads