9c7d820f7ed0748212f5bf49d6396d701228427ed430a9c6186d992bd4c5c1dd

Analysis

user interaction
yes
max time kernel
58s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
666sysEmx.exe
Size 34KB
Sample260828-tzwpcsdf58
SHA256 9c7d820f7ed0748212f5bf49d6396d701228427ed430a9c6186d992bd4c5c1dd
MD5 2f5f9024d56f22ea99f9bbb23ce66275
SHA1 bfd0374ff915c7b6f84fc0b5fa374728d0b973fa
SHA512 91b7fd7b3a216c7670e11ca85abac73f2f2ffbfe9cfc41e033a44ed45933ecc89ab602dfbe30308428394a5d0206375bd387b4c971d9c25dc9f193e96716fba7
SSDEEP 384:Psv/KDP7Wt0FU6RlGHHEQ7zOFbGC55bbUIFjy8hm3KgflutQKXLenrhzS6K:mCmt0yW8nEQ72bjxygKlyQYLcQ
TLSH
T184F23D443FF14CEFE9EF46B65CB1D1841731ED426E60E71EA021A2990D677C0E8A6F86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
80	discord.com
81	discord.com
84	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\page_embed_script.js	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_556_538807538\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping556_79329096\_locales\pl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe
4360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324082367110351"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{D24D4B1F-EED6-40E9-8DA6-7EC25E6A6AB1}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F6C6872B-4528-4E5F-B95D-7ED922548CC1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 3604	5856	666sysEmx.exe	88
PID 3604 wrote to memory of 5476	3604	msedge.exe	89
PID 3604 wrote to memory of 4360	3604	msedge.exe	90
PID 3604 wrote to memory of 2548	3604	msedge.exe	91
PID 3604 wrote to memory of 2548	3604	msedge.exe	91
PID 3604 wrote to memory of 2548	3604	msedge.exe	91
PID 3604 wrote to memory of 3908	3604	msedge.exe	92
PID 3604 wrote to memory of 3908	3604	msedge.exe	92
PID 3604 wrote to memory of 5380	3604	msedge.exe	93
PID 3604 wrote to memory of 5380	3604	msedge.exe	93
PID 3604 wrote to memory of 5380	3604	msedge.exe	93
PID 3604 wrote to memory of 2984	3604	msedge.exe	94
PID 3604 wrote to memory of 2984	3604	msedge.exe	94
PID 3604 wrote to memory of 2984	3604	msedge.exe	94
PID 3604 wrote to memory of 4856	3604	msedge.exe	98
PID 3604 wrote to memory of 4856	3604	msedge.exe	98
PID 3604 wrote to memory of 4856	3604	msedge.exe	98
PID 3604 wrote to memory of 1860	3604	msedge.exe	99
PID 3604 wrote to memory of 1860	3604	msedge.exe	99
PID 3604 wrote to memory of 1860	3604	msedge.exe	99
PID 3604 wrote to memory of 700	3604	msedge.exe	100
PID 3604 wrote to memory of 700	3604	msedge.exe	100
PID 3604 wrote to memory of 700	3604	msedge.exe	100
PID 5856 wrote to memory of 4216	5856	666sysEmx.exe	102
PID 3604 wrote to memory of 2552	3604	msedge.exe	103
PID 3604 wrote to memory of 2552	3604	msedge.exe	103
PID 3604 wrote to memory of 2552	3604	msedge.exe	103
PID 3604 wrote to memory of 4080	3604	msedge.exe	104
PID 3604 wrote to memory of 4080	3604	msedge.exe	104
PID 3604 wrote to memory of 4080	3604	msedge.exe	104
PID 3604 wrote to memory of 6080	3604	msedge.exe	105
PID 3604 wrote to memory of 5088	3604	msedge.exe	106
PID 3604 wrote to memory of 5088	3604	msedge.exe	106
PID 5856 wrote to memory of 3932	5856	666sysEmx.exe	107
PID 3604 wrote to memory of 5548	3604	msedge.exe	108
PID 3604 wrote to memory of 5548	3604	msedge.exe	108
PID 3604 wrote to memory of 5548	3604	msedge.exe	108
PID 3604 wrote to memory of 4728	3604	msedge.exe	109
PID 3604 wrote to memory of 4728	3604	msedge.exe	109
PID 3604 wrote to memory of 4728	3604	msedge.exe	109
PID 3604 wrote to memory of 556	3604	msedge.exe	114
PID 556 wrote to memory of 4500	556	msedge.exe	115
PID 556 wrote to memory of 4952	556	msedge.exe	117
PID 556 wrote to memory of 2124	556	msedge.exe	118
PID 556 wrote to memory of 2124	556	msedge.exe	118
PID 556 wrote to memory of 2124	556	msedge.exe	118
PID 556 wrote to memory of 3176	556	msedge.exe	119
PID 556 wrote to memory of 3176	556	msedge.exe	119
PID 556 wrote to memory of 5704	556	msedge.exe	124
PID 556 wrote to memory of 3764	556	msedge.exe	131
PID 556 wrote to memory of 3344	556	msedge.exe	132
PID 556 wrote to memory of 5408	556	msedge.exe	133
PID 556 wrote to memory of 2248	556	msedge.exe	134
PID 556 wrote to memory of 2248	556	msedge.exe	134
PID 556 wrote to memory of 5500	556	msedge.exe	135
PID 556 wrote to memory of 5500	556	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\666sysEmx.exe
"C:\Users\Admin\AppData\Local\Temp\666sysEmx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://666sys.org/
  2⤵
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fff6effc188,0x7fff6effc194,0x7fff6effc1a0
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,1546175952282910222,8751851216960882470,524288 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10028339093270580764,8062002016641013325,262144 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,16718344628496442651,9874232056277959898,524288 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10857899591402071365,5138372918578507354,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,16265984339666864135,4915016155535927700,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,1188809568085850421,6072412049509095102,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3576,i,8553602034718086685,2628607542772122279,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,6727792694836972383,15438427333437890608,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5480,i,11970910157790737758,10666317346792548620,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5004,i,988053029724132268,4628359271482232194,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,11917332240785467032,15517683762868284658,524288 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6084436863139693142,17428311776806628895,524288 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6480,i,3714007588323758275,9109316436759214600,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5560,i,17075655828462904913,17138929928195737249,2097152 --field-trial-handle=2276,i,3792122582031429327,2854473498396528470,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7fff6effc188,0x7fff6effc194,0x7fff6effc1a0
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17690911778537146669,1655525657049427857,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:3
      4⤵
      System Time Discovery
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,5804936689813191535,2453213825330656713,262144 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,11402085180993310365,9379464487127493067,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,125175532948959879,11640439807823266540,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,125175532948959879,11640439807823266540,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,8447612132351251447,6679626587616196602,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,579536847894685615,18227606525353406802,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,13925924565541316007,14053912389466089431,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2984,i,16597995341913879231,17253117997728593137,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,8324280762471082221,10867385744425938246,524288 --field-trial-handle=3048,i,7017906167032109104,2954765739313747824,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:8
      4⤵
      PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/UFuXahYH
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/0x0
  2⤵
  PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dc11075c551882102c7527fb4b0d7a4b5965f8fc8f508a2dfaefd0f06a737f33
MD5 59eeeace3eb65166fce087fd1893d2b5
SHA1 fabe7d19a9846e4c8a4a39296eb13f4fc2e92e11
SHA512 afd20bffcbf229fa56bcc1a265654a78d532ea6a72d8a55b0036aff5d3297cd9d9980df13190a49c06062fbe66ff2342c000f87ce6693561080364cc28212d18
TLSH
T1F6D097AB0625BAE0F93E4E32B125C200278C26A34802131CE30C58108CFA09100C2EC0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 905b263dbe33f763dc0b405661f41bd4cfe58ec7be5ec473475d2b7e6db6896a
MD5 0ec75018979e27d3442c9c126e76cc8f
SHA1 7c90d2bb104dce38abcf4e916fba2e89c5d07bd0
SHA512 45e677cc74c94ab28cce516a7278af8466756a9800f16fe81f3b682eb317bafcbdaf6d361953f532859f10a58c73b512cd54971c3cea7baffeb68d534ec00657
TLSH
T1FDE02B75DC21EC3708FE0729A05946A7E74113173640494F3A3C920D8FB466686C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 80KB
SHA256 38ee9552da576b67517e76a475f003772a98bef48cdf55c7d7762dccc3213102
MD5 b4aefe8b456e0a59e468ddbe056e976d
SHA1 b932bdea0d916ef14bb140e8e2395b512f392d9d
SHA512 74197c569db5c98a6e1aaaa29a9cd24c47b16b38002bf65b6d35ec73420bc15fb219dae27f57386815a5c87bf4f0825528d7cb89ca99e3faba88d3b5ad45ba83
SSDEEP 768:tMRsmXnU/VxrJ7OIT0TLTPz6hXe9/FIFr/rWOPzw0twfhcteKonKIs:ebaVxt7O7fNIFrp00AGeKonK
TLSH
T11D834F7D699A2CCAC9D6587D080B9EF4772C84B2FBC1033B2265775D322578E04EE91E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 776KB
SHA256 50132f87c39999cdcc468c52f3150530c4aec763ed953cfe7d88ada4695b5387
MD5 52163e386d4fed241bd67359ca1e63d9
SHA1 108a5590271bc3734935002769982380443ce189
SHA512 bf9e75fc286814981a002f1703d16b590f3112125435bc776e551d355dfdb02554254278fdbbec4e059fb92697e0603f4525e419d4a74e0773d45f245c39a662
SSDEEP 12288:FL/uL/xL/PL/DL/9TLhkKZsSJi99vz72AF9GSpH7:wKA5Ji91pF9Ge
TLSH
T178F4C6F78440582ACB7C12F953033A7CD337418D3CDAE9EAF5760C996829B22B1A5DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 4.0MB
SHA256 e7d9e4d17939bd0ef57df87ae58514e71e9bf834e1ef8a5c9fd077e4711ee5a1
MD5 8b5d5ec26bbef954d12bce673e3b6c00
SHA1 2164fa2ca7bf9a33f3b58fed5d5e5f1f7eff3cc2
SHA512 669a1a12a9c775bec0153c08ba982d1182d64ef4ec0072a1acb4b69e00837c2aa800938780ca90af1df502ece194b681301db9305cf38b45af8d709129de5591
SSDEEP 12288:Bg/j3DvlZjU5asLy9gk9Ae1Z2lNqMAKC8EAOqOb7O1IbVroo:a/TD9RIasLy3A6svEn/b7o4V
TLSH
T116163BDB87787A92DBA6DE70FDC4DC6D3EB410C2AEC6E0432502C67911937C13A9568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 62f660d64aca591829b3a66282276d8bba5ff568d3e4ed26db2ba5b3ce8070fe
MD5 5637869cf077c7df25b643fec10362f7
SHA1 0e1cb559a4beec4e30782a601c1fac6eb8c48878
SHA512 e97e4d51309f1b3a022428665a1a20930463aa193c95693f4255e335d4d7eb873e1a88bbcc1d691f79c230e1d70b3e13261e8969a8736cbbc23de201172d78e2
SSDEEP 49152:pYehmkmLlPTY+Py49NsIYZecpTnkx71OHrRXrx:pN5mBPTKfIYZRIzOHrR7x
TLSH
T145868EEDCA6898C3CD639970B0F0ED477C7413C3F995C1D68898C584026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 9aa223820ef5795ea57ba03a91674c9288287d3af067451d07a3e9bc1045809e
MD5 2fff274d78a554ec6a921ce8b8d584bf
SHA1 b0622f15e60eaba13f0b25573c38d67fc945ad0b
SHA512 cfa378586ed05ad9bf57fafd89655bb12b52163042abe1d80ba079558b70b4bdd17ecba47f4b5315cf44efd253a308c893d0544582e26a6550645bc8b6bbbe7d
SSDEEP 192:/iCM5q73RhjgRNS2oomkcyc17nWWF+6psUz12sPZZgsR/L8kZzFV8GkFw7ZHyFNZ:/iCM5q73ngRNxoomkcy27nWWF+asUksm
TLSH
T164320F350935FCE3F7C466B888B6188E7DBA4AECFB132F190588A3B9650571116CD88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f652.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f652.TMP
Size 3KB
SHA256 bfd43dbe3bedfe6346d5c4a10aa3dc729fa8a09378dc49acc38fe87c2292110f
MD5 df22671f16bddc23e5614fd2d742a162
SHA1 02bea3ae9442fb9675768086c079e462d1fab5a4
SHA512 27442e16d355ec2f1a0392cabec75dbecd059be4b2d82bc911db14c035171ad3764a0fcdcc22bb33dce7ce2621798b01c2bf25617394f4698f0e36c6a95f79e9
TLSH
T1CC71823D4A82DEF0D7D2223155D131C73EF195EAFA337E9E008024723119B209D9A9DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 f52852cdef3441a596c7446068ce50883b7bde5a6ad85a4d44ecc70c20796091
MD5 feb394f0afc6979374647dbb3ece65a1
SHA1 66db15474e62a7fd235599e6bb103060bd66da2c
SHA512 b3fbd7f75ebdf7ef3008eae2cca2780fa7c35a0697464363d44a97f9df004287161831208d141f1b8b57dfd34839467c82a23ae7429378615cdaaff8e5d67c3d
TLSH
T197E0D8D565C7C21DE92539A3613C674CD1E03493D686EE471B0088C07A43401B653987
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 53032a0048ad6b5bde492ea0ad42d7cc3d938eff5f5e8b38673a168f5133c411
MD5 e73e46defde2f441d7ed67fd5336c49c
SHA1 c9f1ee1fdcb339ac6073403334db0a9f9f447539
SHA512 5bab7f1d8aea1dedf20f4618cdccc253a9a08c8c78591901a76e4b06ea62b3af09da44c0dbb97c0c78b30c5bbd8cd7a62b5bb080785e65c108a3eadb00cddd76
TLSH
T1E8E07D4456DCC26BD81C6C97CB6C6708C3F034D2F288BD03970ADC4071812C2F2C7685
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 59f2a305000b8589cd4253b95640903ad163a9bee9cacd080755132ed45276fc
MD5 49f72f66a4f5850b9acfee18450ca2ac
SHA1 d2931a616ec4123ebbff7ba2dbff0ce13a15a28f
SHA512 8a8267b3a8a8ace9e5861f94159cd710f3477f1315186f6452958bf693eff528ec35feaceac122efec3ea5a198333a45cca4914eae529734b6a7bd7bc1049d67
SSDEEP 48:uzBmw6QU1Pz8ewJOrZjrte3FJu4yeRvXaGg12AxyUJu+J:6BCx8ewAr5M3FJu4yYvXaz1Xx1J
TLSH
T16392B7470D783C53E7451A7E262B443DCA37E1ACEF95CC89312940A81DB8667A4358EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 608650fb061cc839b5cb70ddf794959e916b0b4f8e8bf05db32df7550d1674c8
MD5 3b9638a97560075dd9d6c95a810536a6
SHA1 f00018ad2769a9189b019477c9bf94d42ae1e159
SHA512 ae2941c63529cc35ba69e924f1fc656ee157266a4e18163ff9f52039987d069fb2f553b5e894599189f70c881fc60d710a91977c29752f9c91c00496f8ab315a
SSDEEP 192:koSQtf+G83uy3Ct7XBBKEYnoH7DXspU3ip:55t/83uICtTBBEnk7DXspU3ip
TLSH
T19614635F1F743322CE7D417669E754A36D7DF03F8B5226CA68610474CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 10KB
SHA256 2251c3bab56dd20d6b91912fdaa65092add1a6771bef4e8a3aa835aadf491c0d
MD5 a9aebff40a17919f0555078c940f6d4d
SHA1 53a0aa632e4e650df75cdb8a0703ef7db550a559
SHA512 1ee792d2d9c5e0824c2aff91243ea2cd0f7df1850b0f42005d6e2a31aea2aa64805cecbaa8f8f8376dd7d3593cb5da10a4dfd72791f1e3fc066839d68c8e2683
SSDEEP 96:x9OHxWGU2nwejJYrXdADZXYAyKU3Q2mIAM3Ov3y/KPYKXl+CJF9o1uqNXTZzgTGA:wWNGjJotfuU3R3yi/cMChWjv2OcR
TLSH
T16D22207FD41884BE87378777D28B351ACBB7297E184CF559D1C21D0C06AA2AE1211AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 54540e4483ac870f3822530cfc21852ad50e24563e1955f15280ab002a8d715f
MD5 8b27e399e5bb1c39ad5d632b0e9dfed6
SHA1 5e99f96770a64e125bd985d9334f1ead62008ea7
SHA512 b80926d146a045a12ba51940f7c5602974086cefe7ec8bfe36c7d166777d244a3ff11587410bc60454c8af06e1e0e2bb72f952df0641929156efc071da358336
TLSH
T1CDE0266596EDC26FA60C644B932D7B0CC3B03546F689BF032B06A880B8220C4E3876C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 9427d975e3273fe82ef1df0371949229faeb576becae2a58dd694a54d1d76436
MD5 4af91b7e65fc356c3171b3c8d519b43b
SHA1 651e0817a21f4b608d80534848a65daabb407290
SHA512 3e94f63195ebb03a7ec454a5287a8dcaf6e2cf636c2ff26858da8e87b0b1a822e7d123cdcdf3e12356bc96fc822fcc074afb30648875e60804b332229dc6bc74
SSDEEP 96:iSeMatUaAKcsAyMdk72eHaSQcPXz5uw20Pkn0ZA:iSLaSaHdMdk736SjPkn0C
TLSH
T18E92E71F27202113D2FD4F7998D946162F2C215D932769DBB884E4F29C26B1BB8064DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 22b288b835667a2f274a6cbc9ce28b6d3c7c523b2a7684195ce2c7af538fd298
MD5 4fa812a82e9730fe25dce6d938c6fe13
SHA1 a9570e4c8d1d2cc2cfe83b0442e9d849690a0ee2
SHA512 d9944540f31a1afb6422740e7697d149c00557c0eaf81de28c29dfd114e571d0db878cde546b4065b9e10798cc9d5cc842beafbcffd9cf973bb0e885898961fd
SSDEEP 96:D/O15SFzucaaij6VwHzrmt2zGSpOueuu6pud:DW15SFzBaaij6VOvmtkGwOruf4
TLSH
T1AC819FF3C3E4876DD91156F0EA146E2FCE1C0958432C3D2AC9E5AE5F93E2871E28165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 1c4831ef7b3b4ef7556500b13188c3c3787b2f4fc818036582d9c8cde56513bb
MD5 7ff539902a2fc3bbaf4e5b157474ed03
SHA1 db9d86fd96ca7875849b4ef45ce4a2802576ad6a
SHA512 373bbe8632dd5cf013273ab9bb09e2ab73a5b3535c7191047b83d59dcc05785350c646b2da63963d92124c8021823346f4e611f5b3c34cf37478fc1b4596b88c
SSDEEP 96:OIEumQv8m1ccnvSa8P/W5Rt12FOhrSIrqriRw6fC1ad4IrlriRwGnFFB+IOm0rkT:OIEumQv8m1ccnvSY1SnmEQ+umlkTW
TLSH
T1E4F224FB06279209DA5404B09444AB9E9F02444B07F676ECF6C18BE7F7921E3F1A9B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 d89a4e33b6d35bf63552d7050cdd2dff0afdf86ec6907d3ffd0de84fd2dd666a
MD5 b1acab72e9ee648ca8e3169d2ef01e9d
SHA1 b3e4b366de43b1c360510972b8d12a22eb92fabe
SHA512 9f3d38aa4ca670797fa06cfffecc11eb1f4e61b3d2924205042a9fb04bb404c8fd78f3a7390dab4561006a56cee80ce8eb6779d0f1d03797f7c0f8000b166887
TLSH
T11EF05997C5FDF8B320B90D7B0EC0BC0479BD98380041A4F5DD56CA3CB0A89B74B12826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d81409019b865daf36d263c74da7515ae4654c452d6a51b49fd9de3e69e7f7ac
MD5 2ef92cd57f42cb796ad377901bac6bd8
SHA1 67713f08d4ac9a382d22a8f3525969f99cad10ad
SHA512 71f1977337a564dc85cae6af905181cca6a9929e4c384bc2abcb870e531740195ae1dd020d2201fecc02f50c68db3a4d93a55c03702d045a34ad3e281ba7ae22
SSDEEP 384:sxZRSqH/fnsPWv/TazIKYAJHbzDrfM8UjdNx:s53H/fQY/TazPHbPjM8UjB
TLSH
T171721806A934597B8DD7D219FA45BF53D3F81662A1905E44AAFCCE0C01EB7EC620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1b873aa06516e36f552c5a0cd52e65c7e5278e1d1aaa63bbca786c0db1f04aa2
MD5 7b5d1486ef68dbf79120bdd63f582750
SHA1 8bd01bd5659954eda93c9705bf2ab70fd67625b3
SHA512 1a1fbbf7ae3a5058ceebf9fa37a0b15369f5b944f6887f07c5b244c078714b60f874aba0d611e6a133f7aa739fd052ebce4f95dbcd4ff594aaf09214c7adc141
SSDEEP 192:sxZRRByMqZjK1Ml8MjH/f3XssuTaZdIaRuvbzodpo13+HW6+WNrWFISv/zpv2pfC:sxZRS7H/fnssuTazIKYAJHbkZ/3Uqjx
TLSH
T1B1720906AA345D7B8DD7D219F645BB53D3F81563A1904E44AAFCCA0C01E7BEC620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ffc7698f1d57c40a1df0404ec9193bef2654c881d7c769ac923b0a47f4287583
MD5 30c128e10b4f5f7beb00a0cb3e32e36e
SHA1 c0c98afb0cda15a5aad0f05b006a34ade3cba14a
SHA512 b1681a1c9a3fd9ac2626bf297862b333f9e158c9c6780c92c3a4ae7e2aa61efefcc3d9c12aab45fafecf6ac31b46749f417172fcc23eb171db4be73e7fee6017
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZysy10LlW:eY8Od/HEnFhWvFvQXu1jaJt10Lm2NuKi
TLSH
T1E5F2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 232e4001fc2abeaa1577d299be6450d5ecfcd2d296f1b9206fa72064886d39d3
MD5 1a21b1d952d404192444b5345175f0b4
SHA1 7ca7b41b10bf5d1b26f85751190bba71401b9d70
SHA512 6a0815bd169d39bd73a9aa96c0c4e167c0cf2e7e45979bbc930701fe642fbaf74876fa06eb3b81897a4d3817bf751df5cb3891b09382212e5c54a54f35d6ccc2
TLSH
T1D3D0970FB0380882DEA78F41072210A7163029CC0060949CA003482B0500F939001FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 37ecb71e2d19e6ff7a28c9973cccc3e4c9919b256bd2ee45b9320e4883bbb3fc
MD5 010512b3a995c569b8b49e0e1e0c1ea1
SHA1 770913ff11ab5295c27fe51fc3a78fd1c661e76d
SHA512 1d1f46afd7cd3c344c43407ff45a4edc36cabf80746a617b93a2174e62cb65b0edd89368823f1599d07791eeaba557d8f8c5d2714f8824a6efa48ee9fe622811
TLSH
T1D0D0970FF0380881DF634E420732109B16302DCC0450949CD003782F0130F83D110FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58cec5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58cec5.TMP
Size 138B
SHA256 0d59be7b2e44b0d9749e9412b9ebb230c0e27a72077001c48571ae85af5e9b7d
MD5 202ddc6c9ad725ba0f14e6bd3f4fb2d3
SHA1 7153213999fb0ee5a69303772efbfcd8e30c6137
SHA512 026b469c92a1606e3d535ef258d55ffe2e652b68f0fbbde456e77e9b17e91fbd2e3e52ddbab19f5488a6e19b60a968a8d87e9e41ccbb6c6bae1b6c2b58097476
TLSH
T100C02B5FF4380C11CF160B524333015E53342DCC0C81D84CA10732AA2330F232101FD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e29ce13c44a17b44b6814c2e6be0b91f7e7aec617afa4694b2467066597b983f
MD5 355f514243c8797e9075787598b82b3c
SHA1 7ce074c979ac973b5167e99324adf6d4b1bf9a65
SHA512 3d0fe9a26057f5cc15014ecf4008e40484152ee784878986cd39854e7dc09207f6723b2e3c82aeb9d2ea793764747d9c94f8376d1310d9348922d97444497a6b
TLSH
T1D3E0262016C8C1BEE25D244707ACD30CC3F4B567E2CBBD032F00E8806582584B197E80
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f8de0b66bcb6439dfee3463567d54017e64af615f6808aaa7a9d3a7e2cb27860
MD5 57133153a82d970824beb18c0ac96f47
SHA1 b91b8eaa18e82fa4b769b1fe4582314df1f8c30d
SHA512 b00815b66bcc1f24889a9fdb02157ba763a665193753c74db8a2d12ded5e38c40b86cd6602b74f74cfdd96b84ae06851b002496cf612673fe27a8117e1b97306
TLSH
T139B012D673338A12D807553203E7C7405704F05200D29103C808CFE30F417BC3C010C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 63cdb5edc25239149f5e77933ec1da251e5971b51aba1043413add0871c7dc89
MD5 2b1dc6a484ec5b3d9d75995f7f97bb82
SHA1 c065d3d88258631722afebb2ad6cefb2aee36faa
SHA512 8190c9e71e8de0469f3370e0d4ee6e022fa1004174c3ce7716f01d87bdd29ee6e6b0ded65b156c694ed3504253a15b2bd0ffc6d01a5635fa5b5b28ad48e67ab0
TLSH
T1D4E0D82066CDC22BA14E258B931CE708C1B2B442E7CAAD222F09E8407256180B2C3940
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8b20a2c0a3be6be2f082f2c337b6114ffe9e032763f32a22ba412ecae223027a
MD5 39030dba29d79369ec971438d99f6a0f
SHA1 9f57b3c5a30e1b78e6dffe6fe9a0dbb5bf398ad6
SHA512 bee4a096d9789fd004655a18c17fe06bc12e7fa1c9be9ef1a85ed5da9735932c86f819b680457dbd3619653a3b1ae77e300c99a89ecc1069164d3a109a414ae2
TLSH
T1B4E026B196D8C23A964CB487E36CAB1DC2F07C4AA3C9BE03570C5440A501280F2E7A81
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 6f35c7371e948fd44925afcef5ffe95f305ef862dacbfcf69b50de1cf24d40ec
MD5 1060f1da51e0181980de08105a73f4f7
SHA1 4e4a2e99510252ab2916b600f1a90f15652c19e4
SHA512 58b828096b94dcc1a5886b7cb0f70adbdd5099fd49ba9afa33575e41ac34cab29da6593c343207d50efb6f24cb1c80ebc866933637c36ec6d51098644fb37422
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9DTxf37yJg:0LppY93PBZJPtN53D9fry6
TLSH
T1C0C24416713F0212397E2948B39696365F4235A37458E4AF7FB800A24F66E225CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 b92d3a747c7e786fb0a5e6e81569af817a06ce9cfe0e32729a7a940bdbad4606
MD5 84b66b1fab893245a1ef754a441d9414
SHA1 a5cb86e17a7b3d07f6592fa1b5c52389c5594ad2
SHA512 805f6665315bcf58a5513ce59b0af21e8104a34d8dcefa6f35ae2d7ef6ded8d00e919f77189939df092f2bba4fcd93e894504f24d211f9bc4c384e626ea6d57c
SSDEEP 192:P+xWpY9TJfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxxfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15124630A7B747001EDE6D9721CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 d22e34e8a14ba546e4bc978e445b34e38bd60523ee68b4dc970b95c9cf5ff816
MD5 01dec12e52d835c84f11da3009cca396
SHA1 0e2f538c0be26bec16222b79a000e10d8d0f7070
SHA512 8ba56bbcb5e61299cadace18789e1459a664ecf9e6d7f3d0d1d3824abb8af59cbf5d1a5911198622d19ae7f6d17e14fba00f3b48f7ad242f5ba7bf6916dce6dc
SSDEEP 192:mQOA4AsBDl9HNCsMFP4flxQ2IIIBb5MIMbmYcYP9:GAhsBJGscCQ2IIIBb5MIMiB
TLSH
T12052832D67057B3BC05E6F77125AC6789BC5E8834675222E31601C5F8EF2A5387C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 15ce05d8501cfadccf1c7f54b5f80aaa60368a064b6067d55278223aadf70aa5
MD5 22858dd71e04b75c8a879e175ef5d2eb
SHA1 c973c5c3ad3967d90d9bed30d70a44fe0b9bd4cd
SHA512 a12f8386176160bf78b14055c5c7eec26e138bc3534663432126743eba3fe22772bfb2afb48c841f16ba16985dbd098c3d2ff6d47b4994afc5efd4a48e9a36af
TLSH
T13EE02050F5CCC19FF41C2887131C5308C39034EFFA85EE07AF00D84864C12C47247551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 8e52f2fc75ad009eb7da2c1d696f795c169d1f5dbf175a24e728624c5fc559df
MD5 6b58b6adf85992e70d7a257be0532b8b
SHA1 1fa03c0fc35198ec8dba3fe49a6f72225e7a43ed
SHA512 9416c940abbce89a851ac224aa83cac230071c28dc4c4146e2742ad67f3dd3df133af48421b96038ecc8148ba943fc36954fbc6492b6746d615776a655acf710
TLSH
T1E121BE11F320C159E18E863AA42BAB261338E8529FFCEC0F447924362D72F045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 0875ed049d9e7f4d19545675d66be2ef75014d57847e482fa83d36b8b36a1bad
MD5 8d365788a9905e46a0a377c928c18235
SHA1 6a97f313bff0351f28b034834e2242cd58d10d26
SHA512 76fe8878e8b527cac8c3bb8354a45caca23f69b78d53882c9b4ca63ab49bdc9ad799afb4d9cf13612a938d92a5c4fe33d370aec28463fe334471e5d3aa7cafd2
TLSH
T11BE0D810B5DCC15FA01C2483036DA388C3A13C66FA86AF026F049C4859912C1724B551
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 a1e20b8e275b390e8ec926a67da16c9549e5f64c6ab79ab0ffe655c5e7128759
MD5 18f232a0e74f679247a2a6c37b1f529b
SHA1 16dcc5b6434aa1c87d91401fdedb48edb5347f79
SHA512 373d61e40d241acd69392921f35866a185a920e4217d66b98da2c3c40335510d631396d0397a44ff535b03527d894fd51d86e4f924893a24a76a20d336b6f763
SSDEEP 3:MsEllllkEthXllkl2zEflWiltl:/M/xT02z+1
TLSH
T17C440414FFC00407C5401030C1D1D3513370D4705D13574334D104375CD77400C04440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9d12a253984b36a7c55b7fa067cd27d9c2fd8da805934098ee3f446529f3c09e
MD5 48ab45d097cc01562881f3259c4f7130
SHA1 955bc01864d151857751fd2a13a5db4f2b3774ea
SHA512 2b7efc943cfaf6155b1040714490407fecbbcde3ae2908464c43414e5ad8767a04b4ba0a3a1c7dbccb90450d955c21ab107e1d3fd8fcb50cecdddefc6a9fb1ea
SSDEEP 384:np8iF9CcmyWCs3sNQ8TUNTUlIm2QckCr9l6KphifWGZsjl/nXvdpke4KV8p0GLxw:pnFccps3hwgbkUAk5GZIPXvkI8p0GLC
TLSH
T199C25B36EC58CABBEDD74F99B74E3A07DEE0116789AC9AD4DAC85D0C00971DD030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7bc2509483a08ff18c3f34ba42e59e8507cc33a55cab0eef77ef3afc92529dc2
MD5 50d87a8031bda11aebd901a7ceacf30c
SHA1 63c16ba505666ec71deaa0c11623f7a63bb66be7
SHA512 1f4c7e29e661668d53482e89e9b1de8726cd5ca48212cb9e6740da50c445756108b629f4ab6cb62c5978d516177667d782a61c50e35ae44bb9a47ac22b741147
SSDEEP 384:npkciF9CcmyWCM3sNc8TUNTUlI4IQckCrc8LnP4phifWGZsjl/nY1lvaMty/7Ig2:pQFccpM3Vwg1kIPu5GZIPY1lvau
TLSH
T1EBB23932E858DEB7ECDB5B89B35A3683DEE011A389989ED4EAC81D1C00871CD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6e014c38ecd42fdf2df48383169aa3eab6bd215dcc8659d124c29e678a3d5ac9
MD5 cd30d57fcfe67e50bfaad725149d75da
SHA1 1e02789d34043644e3d1630f7786b5835f760a56
SHA512 bb3ecb3495abea11518b4081eb5444769db2d66def1cace331abf784515dd68275904bfeed2eb0b2cb219f098a3e6cdf43045c1a670461a2071ca13027e317bc
SSDEEP 384:npkciF2CcmyWCd3sNc8TUNTUlI4IQckCrcULSPJ2phifWGZsjl/nY1lvaMty/7If:pQF1cpd3Vwg1khPJo5GZIPY1lvau
TLSH
T19CB23932EC58DEB7ECDB5B89B35A3687DEE011A389989ED4EAD81D1C00871CD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 27615f0809c536f92b7adf0a96dce8a2ed88adb2fefcc289648c6f88b35a088b
MD5 f37d42345ad422f8c7ba0351661337d4
SHA1 c00d6b23790cdbd2105a0bdc8065b4e3a5203014
SHA512 85d4b9d74dfd6ddf9ca18d6eeab93bb4a415b4e7ca26bceabc19a1c23b364017372e959b2ba418fe90195f1ef84107fa227089c89eca252bd9e3f3cd9d1239d5
SSDEEP 768:pQFhcpXVwg1k3PC5GZIPY1cBFSGWCK4GH4u:lXRN9KWZJjg4u
TLSH
T19FE23972D894DDE798D6DAC8A39AA543ADE01133899C8A8CE6F83D3C305F1FC174B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b6dde07a5b7824a7ebab4e6c92d8353ef5fe0d56bec95f854ac6dcce07427f73
MD5 28b03d5f829db9fee6f7079251e808b0
SHA1 4f51b8e3f30c2ccbac64f1f8b5f214a83618c77d
SHA512 18eaeb34b8df5f5fdd9c861375330c36ea5cd22d56413be2ab845b5899f3914d4271628d2ac4fd4dbd3f06cc2fabd01ec7acdfa7c7052b7421314c3b2742d69a
SSDEEP 384:nNciFZZcI5sNq8TUNTUlI48QckCrc63GPkphifWGZsjl/nY1M7MF7Iz5Noc:9Fx5vwg1kNPC5GZIPY1M7TN3
TLSH
T109B23972DC58C977ACEB9B85B79A3647CEF411A3899C9ED4E9C85E1C00832DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9efda7cb0e8064f5e573816a521afe73266ccab71c9a63405230aaedc4f5453c
MD5 a2f88e8407af671259b1bde5208615ea
SHA1 9c9b2e55da3fa1832a23946c7012626bf8352922
SHA512 765e8acede51fa553faf292274925f5d0e5dfadfde0c12852f9563368dfa21625d6cc9f9e18256e30d8e48ce62fbd84b83f2450894c2fb1034e7304477a2bf62
SSDEEP 768:pkFccps3lwgbkUyz5GZIPY1xvaI8p0GLC:ms3fk9KtaI8p0GLC
TLSH
T126C25B32E858CEB7ECD75B98B79A3647DEE021B3899C9ED4EAC85D0C00971DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 22e93b80e6b419a448a2aba942087fab169011e0b295f9b186e58925485002e1
MD5 67a1941dea0226378f3edf3074c8c1bc
SHA1 71b87aa98cb8385f8c1fed626e1cb2080bee085f
SHA512 65226d35536c587d4df576378df46d59da374a1123732035dea1a980bbd25310ec4a3be46454ee254b49a0977d011c5d4ed2ee20c48851d71ad27c2e849c5514
SSDEEP 768:pQFhcpXVwg1koPC5GZIPY1cBFSGWCK4GH4u:lXRI9KWZJjg4u
TLSH
T196E23A72D894DDE798D6DAC8639AA547ADE01133899C8A8CE6F83D3C305F1FC174B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ff27b108972c2e56c4f99bcd714008de39b733de527bbfbe3b1996f0a52b9bf0
MD5 cf8f329bf20723258da54320c6aab746
SHA1 7124fde0627b698258c5d079e3ace9f382ff03e7
SHA512 53f13905a3367a40fe736f0d734c809ecc8016500ad11e487327d6f2c830aa054984c712b452e56379fa8b531afd7f4328b016af6d8971c562eefba7fc86989f
SSDEEP 384:npkciFZZcI5sNq8TUNTUlI48QckCrc63GPkphifWGZsjl/nY1+7MF7Iz5Noc:pQFx5vwg1kNPC5GZIPY1+7TN3
TLSH
T1D7B24972DC58C977ACEB9B85B79A3647CEF41163899C9EC4E9C85E1C00832DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 a1c7a16fa9e2731a60c7eac05a70fd9c5f675dd9cbdc23109d5a3b7a9c8e0c4e
MD5 6720789680abb59ba31ca5982ff87522
SHA1 1bff1d867844238dd05d3582f94c6033a73477e8
SHA512 d999d7a5c62611cc277d85c39ad15279a826e98003b482e3618b6a8eabe4a097448aa88da4ba9e4eba909ecbaec70bd2124a2125e3428d2dd9158ea68b448cc8
SSDEEP 3:MsEllllkEthXllkl2zEflyf//l:/M/xT02zRf/t
TLSH
T18C440414FFD14C45C50010304051C35033F0D4507D13574375D50D335CD75500C00410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 216a276d2a3ca714fb39915833cce9e3c1c1f907bac62072cbb7ded47102e4af
MD5 4c424622eea03b3f3e806a84b60b3923
SHA1 322b7ed69935eb5359815262609fa6bd64fd0a7c
SHA512 300c4fd5eef24dbfa68baa1861e9cdabef0b6c4a4b38706aef0fefd84cc6cc95c1a143e0fd63786f9fe20e4fc4547cb4ecc5c6522416832f553613ef305dcddd
TLSH
T1A541295DBAFA1058B3B77F1A5BF7A8AE447BBD272E0BD15E00110D4E0A22A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 b94ef28349cec73c747b19bae92fadd8a9f4d7c7fb9ad04b410c90e5a06bee83
MD5 764f6eee7295e7583ac546400d61ddf2
SHA1 2ff1cc13e2bc2e3a6bf5aa703a280d28ea246c01
SHA512 6be064ddf42ae4ea1c6b50033d5c5402e070a295f42f7094d4886839d9503f86c1895edbdbb3e1f5be0837fea27395b2c8c10187a2b4659b923e87b0eed804cd
TLSH
T1B9514258A6E9115477B76F5AABF6A86E847F79732F07945E00110E4F0A23740C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

c206018a-38ca-4aec-ae6b-073d94c697ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\c206018a-38ca-4aec-ae6b-073d94c697ee.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

memory/5856-0-0x00007FF6D5A80000-0x00007FF6D5A8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads