hxxps://github[.]com/Matelpro777/MEMZ-4[.]0-pannel

Analysis

user interaction
yes
max time kernel
83s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Matelpro777/MEMZ-4.0-pannel
Sample260910-ar1tkacj9x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3332	msedge.exe
5432	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334736752918225"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "7"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{36FAD616-BF0C-4851-B930-BDB5F3CD61E7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{ED2EA946-B913-44AD-A0F9-43C7884D1A9B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1112	LogonUI.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4772	4764	msedge.exe	85
PID 4764 wrote to memory of 3332	4764	msedge.exe	86
PID 4764 wrote to memory of 836	4764	msedge.exe	87
PID 4764 wrote to memory of 836	4764	msedge.exe	87
PID 4764 wrote to memory of 836	4764	msedge.exe	87
PID 4764 wrote to memory of 2404	4764	msedge.exe	89
PID 4764 wrote to memory of 2404	4764	msedge.exe	89
PID 4764 wrote to memory of 4088	4764	msedge.exe	91
PID 4764 wrote to memory of 4088	4764	msedge.exe	91
PID 4764 wrote to memory of 4088	4764	msedge.exe	91
PID 4764 wrote to memory of 5584	4764	msedge.exe	90
PID 4764 wrote to memory of 5584	4764	msedge.exe	90
PID 4764 wrote to memory of 5584	4764	msedge.exe	90
PID 4764 wrote to memory of 1968	4764	msedge.exe	99
PID 4764 wrote to memory of 1968	4764	msedge.exe	99
PID 4764 wrote to memory of 1720	4764	msedge.exe	100
PID 4764 wrote to memory of 1720	4764	msedge.exe	100
PID 4764 wrote to memory of 5344	4764	msedge.exe	102
PID 4764 wrote to memory of 5604	4764	msedge.exe	120
PID 4764 wrote to memory of 5696	4764	msedge.exe	121
PID 4764 wrote to memory of 3820	4764	msedge.exe	122
PID 4764 wrote to memory of 3020	4764	msedge.exe	123
PID 4764 wrote to memory of 3020	4764	msedge.exe	123
PID 4764 wrote to memory of 5180	4764	msedge.exe	124
PID 4764 wrote to memory of 5180	4764	msedge.exe	124
PID 4764 wrote to memory of 5180	4764	msedge.exe	124
PID 4764 wrote to memory of 220	4764	msedge.exe	125
PID 4764 wrote to memory of 4864	4764	msedge.exe	126
PID 4864 wrote to memory of 4704	4864	msedge.exe	127
PID 4864 wrote to memory of 3744	4864	msedge.exe	129
PID 4864 wrote to memory of 5432	4864	msedge.exe	130
PID 4864 wrote to memory of 3744	4864	msedge.exe	129
PID 4864 wrote to memory of 3744	4864	msedge.exe	129
PID 4864 wrote to memory of 3016	4864	msedge.exe	131
PID 4864 wrote to memory of 3016	4864	msedge.exe	131
PID 4864 wrote to memory of 1096	4864	msedge.exe	134
PID 4864 wrote to memory of 3884	4864	msedge.exe	135
PID 4864 wrote to memory of 3884	4864	msedge.exe	135
PID 4864 wrote to memory of 6132	4864	msedge.exe	136
PID 4864 wrote to memory of 6132	4864	msedge.exe	136
PID 4864 wrote to memory of 2260	4864	msedge.exe	137
PID 4864 wrote to memory of 2260	4864	msedge.exe	137
PID 4864 wrote to memory of 1968	4864	msedge.exe	138
PID 4864 wrote to memory of 1968	4864	msedge.exe	138
PID 4864 wrote to memory of 6044	4864	msedge.exe	139
PID 4864 wrote to memory of 6044	4864	msedge.exe	139
PID 4864 wrote to memory of 3288	4864	msedge.exe	140
PID 4864 wrote to memory of 3288	4864	msedge.exe	140
PID 4864 wrote to memory of 4760	4864	msedge.exe	141
PID 4864 wrote to memory of 4760	4864	msedge.exe	141
PID 4864 wrote to memory of 1164	4864	msedge.exe	145
PID 4864 wrote to memory of 5272	4864	msedge.exe	146
PID 4864 wrote to memory of 4780	4864	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Matelpro777/MEMZ-4.0-pannel
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,11810417702091423429,3439299388672985534,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7633081619723640122,12263771297270784233,262144 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,12670784366103230642,15028531196555644792,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,17177204601533058649,5964228257316952732,2097152 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3300,i,4820635536790839634,4673398312699342698,2097152 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17657976142056761524,3406456713474645860,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13799895975480373519,16335826005698524085,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11113670676810268305,17521370602480791623,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11113670676810268305,17521370602480791623,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,956433349497593875,4953335866881564437,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,888052758046261463,16275014603532410024,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,5731779364331039388,211876712595743944,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17589656043633202813,1287143009020242040,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6324,i,2346635222871302819,280692222762428127,2097152 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15557051460578279610,10346139140391447321,524288 --field-trial-handle=2308,i,18006715453319958740,7007554597427762192,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffdd6dfc188,0x7ffdd6dfc194,0x7ffdd6dfc1a0
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,8392765055071050052,3045955992334609595,262144 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,10350709468088977411,3454963994704242846,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,12578936872857271892,3714115634319720417,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,11534660998910309686,1872154590761077448,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,11534660998910309686,1872154590761077448,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,6682438627024963498,8809410774565842206,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,7128828140875936348,9552864992266520612,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,4531656165922692671,68740871001328404,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,3517780994391511957,3702575096350006414,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,9249807551825230301,9516604074054712246,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,3395049241939735082,11053038173422281668,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,9580450976855346571,7040331339592319830,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2098016543121778653,13203102341209821624,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,2178203375418116956,9266237804121921926,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,11305821165460073526,15497258916447736115,524288 --field-trial-handle=2280,i,4469742224669751662,9833748121089305014,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1040

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3849855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22b27797-9148-4a74-863d-0ef8f16cf3e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22b27797-9148-4a74-863d-0ef8f16cf3e1.tmp
Size 27KB
SHA256 f2c8b44a60a4d929947e13c38a36d49f15f4e37a16011e0b8e0dc77c9416ee13
MD5 17d2c43da684c4763a80780bb8887c51
SHA1 f7916d86da23bed5658acae55faee3474519430f
SHA512 f2375b1100315cd23c1a95b3e72c3e4b269059135063eb984e38cf831d9b080b7af5853e9288850f1829e8e1009ea8ce68ea0b8458b710da6728db4d1ac1b4b9
SSDEEP 384:np1iFiZcIk3sNI8TUNTUlI4PQckCr6bXXphiftGP/sxXLo/MxuvzxV+MhdpWty/m:p8FQk3xwg+kTZoGP/sxc/M4184p2l
TLSH
T182C24A32EC68DDBBACE78BC9A74A7603DEF0416399CC5AD4D5D85E1D00971AE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dd7796929e25b7481ac9bfb39d0ff633f397d26802b1bbce3ed377f96986e8ba
MD5 bdb8bdbd572dfe712d2385875aaaa438
SHA1 0816733137bca4f5625a5c3a81998c6d4da2849b
SHA512 1c865cc89d10b2713358f4d3229e03e8ba233a4258df3b01ab531111e475c7f8541e1c407894555474cac356b9ae57aed4083c61e4d1af12dd955b9fc8d33046
TLSH
T176D0A7E8599DF5E0F03A1D3A61244600B29C1AD26D53A30AE16805099D6E05222D55DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 51b89eea9f115a56d1fc7761dbc5429c3ab4a1dcd69096791d5b5178b3ab10ff
MD5 12adac44798c0b644146a39778dbc5fa
SHA1 8396529ab10f81ca04c17d80adb12d84e9dd0588
SHA512 c0825055915f5ba6e410a7ca2555b692f410a52a93008be94bdc4c400e55ba991df41fb489237e5eab4081b0995e0eb9971a068cae82852fafd3faa71abb9baf
TLSH
T140D0A7E8B78DB560F1670C3575184615B2AD5B816C23E319F46921495C4E42223D8189
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e082665ae546ff0afa056bebc42add36c40be8b1b26aad5743f2d79381a0ab4c
MD5 d8dac59773b5d91328c039904818a8c0
SHA1 004fc8ba5115b7476ee102c5cc47c8997f59166d
SHA512 8b7d2865b37786498f25e6f76afd408aab9a713ae57d8e38c28e1d9a854f6a94248f0b7dfe164d6877e35b7f1952cd9da1a75516deab75bdae48ae32b3af3dc9
TLSH
T10EE02B6ACC61FC2708FD1759A05D9B46E74113172B80995F3A3D81098FB063A45C585C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 19600186b185e7eb0ec49cc6411d8faaddfd6d5f87647c436be8f870dcd248a4
MD5 c4ccde2c48a67f7515c3e42de077bffb
SHA1 00dc5488f5e83a4ba934896e9247585520b20f27
SHA512 c8928c97d924fd86e0d86ea2c1bef0c0c2c97dc486d7097ff7928b2831e50e0b409fb9116cfc89bf0ab0bac53b883c43f414c3d69b886638c21b185a6cb19005
SSDEEP 768:szzTBiEAq9vL1dVxrJxe0EtUboBNSUvF7WHsDNycbNzFM+E2:sPTwrqp1dVxtxdIAUv15AcbzM+
TLSH
T13413EC7DBD9A0E86EAD743FC187F4AB3A728D430FBD5260F7225F116421631E895DA08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 92654c6b043ae2101b1738009ec76b383d69f67a80979cbf951ca1c97daf3afa
MD5 d441ff6e2292f9673628622fff181274
SHA1 f1f10b43bc07a6e99368bcba9a5ffc34201bfb6f
SHA512 b540505d1103d4412b73a37260b2ff5bf1207eb99788074db40801cfd424f9eee93fd5de3bd09e8930d2ed4f8bda39915e4d7fcb7f179f4640ae27e9d91cf26d
SSDEEP 3072:nL/uL/NxeSeML/PL/XL/yXRAKkdfrT0Qvp5kOSR:nL/uL/jrfL/PL/XL/sRmZPvp5kn
TLSH
T169B42DF71810605ECF6826F6DA063A7DE177011DFCD1ECEDE6390C91A825F22A2ADE54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 f6656035d5621a806cb4e520dab6d83bd881886ae721c4cdab60296af0435236
MD5 67883a7f7efc95ccd1241798fa5e1855
SHA1 493f840fdcf83b46af7ae49d447e13044332518b
SHA512 29b2cb04d3895869bab0a83c1917144445ee0e4e2e19c54d2b4c3abb0555994fc08fc56201cc5755839844d0ffc4300e1013f04d459d10bcc418e265c557868e
SSDEEP 6144:7f0v52gKhN3IcG545+xdVZIJRFnaXfIAoS1wncndEOlpDxoOQaq:IgRj3D245kdVZIJLavDdXe2
TLSH
T1CD255CEECB681C82CE6B8774B0E0D9177E312183B68DC0D3A948C5D897D5B8575E92BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 12.0MB
SHA256 6626d2d14fc571190441b4d011603158b98997beedf8c6759301f9a6acfc57a1
MD5 d15faf89070bd90a7651e059d76037b1
SHA1 4e4e00515e3f47abe3921261354e6223543b0d14
SHA512 bda7146035c6f8c75458ec16f23402084bdad6dbdda97fdbe9e4e49977c6f28af481fbef11437468e5482364d9226a2e29eae4d00f20f28a4f21fb391d5d7665
SSDEEP 98304:jW5DBPTKPIYvblRSV33tdCvVFp3siN+oi:j2J+lBMcFp8iT
TLSH
T105C6AEED9A3458C2CE638930F0E0ED977D7013E3F9A4C4C68864C599459B3C6BB9A25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 66a09d15911c695fa257e0a84b4ae706a453d3cf7ee89d5f1f60f9fbeba1ac0a
MD5 7da385d173d2f22f9e2dcbaa9bc2c737
SHA1 8d0a382972cb6c6ea5194c05dcc221ec17a77f23
SHA512 a00ea358bd98733c0b853d62fee07df0c6bb6cf1f4eec63b9fdcbdea04f0424e3191c86a3fd396067e470644696076cb6c4d6716ba00047228d6f355865c65d4
SSDEEP 96:/4tX31HQ5XDmK84YWIqLvlKiK+ShocaLStIg3kx8xFFbQgHtoS+ZHMfTnZ/0rBs7:/+1HQJDmZQvl3K+Shoro+xOSnZ8+1s7
TLSH
T1ED128531BA5919A4E36083F798F809E3F8BAC8D5F7033EF76088F83261297136942715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f04f27554ff7771df0411ea76c63f7263b798ce9b46558764621a87cde49f1c8
MD5 904585a344bbd185bfe8bac65d6dacb5
SHA1 3cd2652c91c435da53d01b496a09a401bf5b47a1
SHA512 9069ea1b0ed9833e2b7df110665d011e3e2205223872b79df2e255303202586ec6cc652068cb17639249d5628f65c80c04a94a46b3c34a9d43696e134c5306cd
TLSH
T12A81B53625524DF9D7A1037A95D01A26F432C6E9FB275FCF2140A0372931723B25B719
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 086c3f143d7a1610a98e53c60261577a2ed056c187741b6d6572289d266816f0
MD5 644f035859ddc4c3d72113b1c06cc64a
SHA1 ee68f9b34f62cf431fbe6e208e13e44ab7161197
SHA512 d6263e29b0894912c1ec84370a9477cf32bb3e32bf7fc1a926dc99eca1eb9e961b6b75b2864d4a43bd0c41ec4398fe88a5e998d2fdab90e4026329ce46be679f
SSDEEP 3:MsEllllkEthXllkl2zEklOlt:/M/xT02znOX
TLSH
T1D7440444FFC04407C50030704035D3510374D410151377433D5154137CC57500D01000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 ff2179486a769a3a15ed1faf97f0809e010cfda0b28db9cc034b3d85cdea2662
MD5 43593dfc811d287e55364f3e0b38859a
SHA1 9c7ffd3c9d368adbfa56549d106f2282adb64b21
SHA512 16c57ffabf8dd76642520e1b812d17c6766ac6b21209560efc4fc4ad17ec332b8e1c3921144c91e61e84ad85755860ba34aa3f9d85472517b3764e7419567cb3
TLSH
T1F9E0D8A867CBC16D9550398252386B4891803A86DA996E435B44ACC4BE02411FA8A957
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 709374df1e9e8c49d3b6588e1b3073c9c0f0a8f048131588c127e0879a8cf4ea
MD5 1b54fb75727b7bcc6700c8896207058c
SHA1 d276600c49f2cffb7d936f64096a6455089d3dc1
SHA512 d97fbd94c22757e6a1919079c2bb8fc3149cc451f036e84f1f2938c1f08cea7657d50e9c98622200fe6992f9bb5208e2c9fc54e1fdb20a7ba4e8cf4388a2fc5e
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j9pW5LvR7K5fKFtIWqYpo:Tyi+7f+UZD4jJ/BbWxpCKFOWTpo
TLSH
T17EE2E08C3B11F512C8ED733DA0C2C9E15EBC682C465D71B1563C58768D63AA2F59E11F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 53ae90717b296b75473023b3ffd9e695b66757faa2e73003ecd8e8627582e260
MD5 e62bde809781ae59208479a94f124298
SHA1 50d86512d7ea76ebcf899edae63cf8e15494be16
SHA512 647b63882e686eae82b7535b3c5951ecf6db51f978d6c5ab4d86040f1b7a133f885e302dd4c8475ddaaf2e85d74f94784e0f50853a6d4951af7948adb45d0d99
TLSH
T113E0201416CFC119D06964E34275670E97D23B42A28C3A811B888C487D09551EB79550
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 d86b7b7f10bbecfa155b2aa53e2a61a8b726d075be1073b16322b4446e5f564a
MD5 959fd7a9dd064b5f7fead31a31b71b10
SHA1 fd0d829d81034864d3c8c3f212815cdadc8bed62
SHA512 84099eb90e068a3100530d376ebd68db1a68880d543e8c94c0cd92c292ec0655afe96d491ebb837604bb491b987bfbf18cdf13e6be24aac9ba0c205bd8744d00
SSDEEP 24:TL8JhK3iOvwxwwweePKmJIOAdQBVA/BNj2VTJZwJ9vpV3WOT/uReQQ:Tgm+BE9ZW9v/3WOT/
TLSH
T1A3E23A2A5E7C7521CD667136BC21A4665CB910DA977336F23EE0007D6F8228BC475CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 d0469a349a0e51447dce550f67523215fa5b07742350032482b5600c2643b0bb
MD5 ca682ebd6a5709a9461581e858e0a131
SHA1 6d2a911ad5313bf5a3b419b16ae0a9d24a57b29f
SHA512 65a9747708c942d96886299980df86190ec7330587f17a35928af8d66c6a04269c7c80514131e2116ae3c20fe84a1070c2d054b65c16f57f1e3794b4049b8774
SSDEEP 96:UBCxZ8s4yyheOJsUYlTCGad2bybsq1pW4EM0j:Ga+PyyhetUoTCtIIhEM0j
TLSH
T131B2C6E7AA303005DF142EFA43A96DA19E77E15DDFD0EC8CB4714023D8B486192798AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 d3e7ac891070dca8d50f49c67d1a2f10efe79488dc471cc4e37e97b03f33caf8
MD5 d459dd34f56031f313a0b7d5d1398e52
SHA1 e1a9f20e5e47d86010c03c8738d26df971b64ba3
SHA512 63fe96569dc4b83424ab33af386beab6fd3dce30b702b5b46d2ba177a0c60e04011eb1bb64bf93221218e1f03e6a2e7a215e48a7c40dd656fd8ab88c1b7b61c4
SSDEEP 192:ncnksbeSOfef+G83uy3Ct7XBBKfIca/H7DXspU3id:nuksbeSye/83uICtTBBBf7DXspU3id
TLSH
T1BC14569F9F303320CD7C51F59AEB1892ADAEF02FCF0269DDB8760465CEE2511622D469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 534B
SHA256 7ccf450071513333cf2ed235b53818567fd105d6d91168dd558cbb1db4df895e
MD5 4ae2c9e98b9f78120d2e8d54a386c90b
SHA1 45159b6b6473964c280a618c019ad5d98bb0b989
SHA512 a08a1c44aa7dd511f91045ff6356c2f75b76fad0d36d0e48de5bfdceb8eabf92eb7e9cad1a0ac4804ee615b9e48bd61e6bfb2b43cebae5783589e979d875b973
TLSH
T1EDF089F25154A096EF663CF44D982DA4F362B4AADBC1D7D8C563A90A5D409B013CF053
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 b21e40149117d34d50153c08d6ee8f927d66887d7fed11af6d6cf9b5e53fc06a
MD5 9dc0c53e6db55ded57aa558904817059
SHA1 d3342fa1ee02e359b4a723fcb0865f5abec058bf
SHA512 40a77fae9d0db865e1c0318137795e144c94f6c8751e69511323eb53ec351821b9a24b41f98e9e7b531a89ae095c9e232a71a88b74c1da8fb4b7b68e8de6f1ba
TLSH
T17FE0D8705ADFC12D916430574225BB08CBA03A4AD68F2B821F44D845B441104EB95DE2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5c2b4cd45d14c496fb52aebe1ba1da067498b809659ed10568d092b96f95a008
MD5 d2c44963be42cb75392f5bc6cf821029
SHA1 730d348aac4c7dfaa30c144c645eac818631ad91
SHA512 88b2650d2519e9104cb8878f174f462b3d8f4b2175c1cd4ed5e335cb5d35a8a7c4831847960fef0ceb8326d0a2ab47e0eac5b0320756e58e8008ede5180944b3
TLSH
T1A531C0F383E8856E8A1195F0BA18AE2FDE1D0510432C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3a0a4b0a0c47ad7d0f9eb2838ce1455e7c62eb632df70b45b85e688f0ffe3607
MD5 f28ceff1bdef9fdcd57bbf47b2c09b77
SHA1 3414bb0ac4dc8e3350958b7d9d68ff81bd2ef3f8
SHA512 a59d2c8dc3641d4899ab3ee265e59c8a1de8f94199b09fa00e2f7c3061a7096903140c2fb3ac359fe0f8ddeda847a1a817c466d51dcb8bd83db7770719d317bb
TLSH
T1115199F783F5866D9A0295F0AA18EE1BCE2D0510831C7DA985E0BE67D3E3871E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c428b1e54576a05a87702d6c10d16b96c7b138531cb0246df07acbe9d670d224
MD5 0edebebebebc8da3fd2be55e1d0975f3
SHA1 f7af54558b2da819c0be4ad6387e2c8556918c72
SHA512 da41376f6262156412fa3d530269f43f0ae794bf3ac6d32d632760293667a09763aa3c4cc00d1b54333ddf4f052f237b8c24b77d9f71b2c3ae97d274445bff66
TLSH
T10B113BABC8BA651B506D097B1E0CBC092F7DBC360152A9F0DB96937CA0C14F74B29065
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 458bbe8101c5e462dd336483f7619626e02979f0791aea2d275c7e3eedb25615
MD5 ca5469e17780cc25b96d3bb4e6ffaa83
SHA1 8a07bf299cb08cb9d8e95631a049d2073e64bbe3
SHA512 f98b728e7f128a74eeb14018f85c19cff4e80902b5b16a729c94cae0b1cd4aca9d44c54e4515c57696084851af4471b76d1f161bf791dfd74428b0218d1922ca
SSDEEP 192:sxZiRoyMqZjK1Ml8y9B/fQsTAWpVHZZdOzodpvymHW6+WNTZfYdYPI3S8qIgb6cJ:sxZiFlB/fQskWvHZzV9HbadGdOA
TLSH
T12972E616693859BBCDE7D219FA857F53D7F91123A2905E449AFC8A1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 937b2398b92cf53f778d85245bfe7e5fc6462820ed8e034bd7e37c058be36c15
MD5 00ddbfe2c5aeddc726de52610b495734
SHA1 a88f3fdea4f4a5091b1691435151aa4ffce53e1d
SHA512 deab569bf1ac46d6ad7f20345a8e0c00a26b4c27012e536be57bd1c328f937ba2148052e072ad6885ebb05c58271b8465b80659f69decd073a98150ac3a3359b
SSDEEP 192:sxZiRoyMqZjK1Ml8MkB/fQsst9DaZdxzodpvymHW6+WNYjv4/Yvvu8Sx0IgjcJ:sxZiFMB/fQss/Daz69Hb44/BWjA
TLSH
T1F372F8166A38597B8DD7D319FA457B53D7F90123E2905E449AFC8A1C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 3b0e596585d822d757e4d47f81e915b40c243f159c6ecd9c9668489e8779d04d
MD5 1932724a546ee74a5274117bf6cdd3c9
SHA1 0840ce8fd31320e7724d88b5a3103e1c6c7c4ff8
SHA512 72c8bc4d973920ba5d77650e8adae15b7b88d2ff20865746f8106fed096c328069a4ef4304035715a0d794ab18fdc6bce502a4bef11a55ea0c61182119c9f2b5
TLSH
T1BDE0DF2016CBC27AA1AA60834234A70D93A57E47D3EC3A826F809A486543604BA96990
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 a95b1de63fff601f8ea25310a4211337c45e852b35fd4722e89d62d3cc433d08
MD5 876d02ecad5fb7d4643efe319e3cfd99
SHA1 469c4373bf7b67dc38d7ed052e1eadb9be4f1e5a
SHA512 f55b824f1453129021d7bfde8ac02375a433f81082c82bdbbb1ef7609c954084df1b88537dfbcfa2d07db37f02df3eb5c966f95b3168ea578ad069887c1f4536
TLSH
T13FB012903B00416FDCCA083206958F819F28E803D0519A578A4A8F68CD06EB92F40ED4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 9bdd3827db0eadb89c0eb6db9f2ef51478ff0309aebee9d2d68ed1cb035f9770
MD5 72b65d9d8423a9236ddeff8d85289854
SHA1 8a73e5ecf4c3f081461a72dbecb3cfee3b8181fb
SHA512 ca19c86c1429f8e157e6ee3350250a978aeb2c5cf5d7864cb91cc027e1078d63b96c138049b92e78ddeb2c2aa203878d6420f363f04e609707580ea705e711c7
TLSH
T1E3E0927027CFC73FA19620866224E708C2A27A82D6FD6A917F48EC887206148BA5A560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 347556237f25a050e1bd061a04029c1e69d177008314c8e96d1f5ea4f956dc1f
MD5 79c8dbafc1847fece7193bbd2019709f
SHA1 d49b2e653beab579fc23e7ae28562cb0d215ce3b
SHA512 3d440eb44178a1e2f570fd06ac2b6a9333b61c14b6b70fd662a4bfeeeaa0ad344634aa1cf266e8c386b075187b7f0bc0bf95341bc85a9e55eaa06350fde920ec
TLSH
T192E0D8B066CBC73A925860828274AB0D83A17E46D3AA3B81AB489D447902120FBB9990
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e14965215cc80cfd445cb545ebccc2a7154b93e8f22869bdb0ef5c1a6ce429be
MD5 04b1bdce6570d9f9444b60b038582a36
SHA1 447c892b06ff7558f10b163479a3611af33775ef
SHA512 38f28be9dffae4f1a1d26a3e772b30b66ed70fb3ec38f9ff90a71c26cd1a11339ea1b7a62611ed127686ba3f8d9059c8e7684a9ce320f2dc2192793e0875c9a3
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9JyzGi0wMBwtO6uBmsRCiN0C5WeTI0eY4HU9IM64c:0LppY93PBZJPtN53t7c
TLSH
T17EB27C5A703F0212397E2948B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 5b9e1f992ded2e00ae68e0e8deffdbc0e03eea3022cc4cf119d2358dcd4a11ec
MD5 0f3c094b704b7a1b70dff26df518081d
SHA1 52463f0267a141d9445a11357f9979929bb15978
SHA512 e12ca894ea86bb0bcab9be46970c8f650da0046508a3047fd25c75d8a900539e48a75d8964c3a942a4cdccb6f53ed36aadb52b8f483738673bb752b559c69ab6
SSDEEP 384:0LppY93PBZJPtN53t7h99cZgsyOKDevIUo5YKj8svicy:0LppY93PBZJPtN53t7h9vK
TLSH
T152C29816703B0211397E2958B3A696365F4235A37058F5AF7FB800A18F67E264CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 043e390f110d5009f6e0fc9d369ab4982585789335b2b982e4d9c88a172146f1
MD5 1e084dc241b1bf4f6c36d64a9470e7a5
SHA1 269c26e8c7b3dbe04d839ccefae13787d9bf97e7
SHA512 2dbaaed63b3109234a1e2ee07d1c70962dc96c5d500dec631845768b514e62527f955902dd4a10498f591a1f81caf715671325bbb4c336e79d3f12e22a89361e
SSDEEP 96:DEtSyGhp22iSaNqaEyNqDE/DNqSEsNq1EDNq0LO6:DLTaDlDdVm6
TLSH
T12052F5E7E7242219DF745AF0CAE50EC0B967F417EF409D6AB4EE842382F4560E35E849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 14890cbc87ab8c4fc5a02c78c16913a82bbe3451be0f46fd05ff74c544fd4bf8
MD5 89788d99aa064da158d84028d2cc7583
SHA1 b242b07080d71757c52fc673b9eba9c7ea50f1ac
SHA512 c44e77aaa0df10e7ec9273fd56ad7f1b3342c5fb1b4ac73bf04985ae13c77dade6827cc93306d5d951214b0eb8f6b3358e618370fdfff3850813dd862a6f3dde
TLSH
T1145154C1A3A964D57F89A981E21A5613ADE13F57260E98F2332E44F48F44C298F3FD35
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 b804f93b29e82e2ed7707b65861b45f9fb1f8fbadfa8d7bd07252ec518c9b9bc
MD5 5d7082a7244531fc1bea737e56caf0f4
SHA1 82aac8686028d8bdc5b2dcd4a98d5302b7808189
SHA512 7f108e0dcbed7a5661556fe8c349f924d90fec02f63e80049a35fb2f3d5f7802f3fe354bd2f92439850e0d9941438d6b1a3a13d771c50e34d0135bf34ecc2638
SSDEEP 384:GAhsBJGsc7QlW7sIIIyVb3sMIMyCi6ypBwVAefATy:3qvnc7Qp3
TLSH
T11E62841AB7047B37C12E2FF613B5475957D1E8438A66124C74A2281FDEF2A2786C52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 c0e7435a88cdf6f334ef2615188b0634b8bbc3d2a176607ce2fa36d1f2a81fd9
MD5 f1d3581a59efc85c9d984621394228f7
SHA1 380b8ceb5eb3aac87147338a6d404f242e61939f
SHA512 9572b60109f76cc82ecb08c99328106e0f6286b1e60c37a3f0752c5c32d5f0951e2757e06bf91efd0135b0c619c8db3a9f8d085a1efd75392b436d18ece014b5
TLSH
T19BE0D82065CBC19EB16820971136970D87853A43EAD82A851F408C487805110FF6A551
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 90a6f23acaff2816f2c0974e641b8f85ce96547cd49db6a064ddac6b47ea2e31
MD5 e45bd2e0fb9f5eb969aef98d24c8b49e
SHA1 704c24f74768001966f51ec15ce8a608bb4ded27
SHA512 1d31c083293ea921628fec5629851779ce51bd31dde712c41632779fe303a635306f3c893d678fa77f1d1d88f9a754e71f85eb6a4595ed3b2a38acb3978ccbe0
TLSH
T147E0D82075CBC1DFA16420930175A74D839A3E43FAA82F812F408C486905152FF6B551
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 4230fb37fde628bed6f6ffa7bb69b7662c6f6aaa3779a7e4ef4b30207e22b6e7
MD5 3696f93e87d1098335585d7cdd007592
SHA1 0146a2b6c2e261d607f82740ba44423bd2f1655a
SHA512 77e60959fdee20ba3f463c896b1d7287c62e62ce751c9186c3b5bdc7a67fd7ae360ebb208940049bd0dc6b15d0ddb3bdeb6ddd52f0e4883be59e4b7d5125e584
SSDEEP 3:MsEllllkEthXllkl2zEelh7lt:/M/xT02zNh7lt
TLSH
T1DC44040C7FC41405C53454734035C3730370DC101D115743347157135CD77404C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6d5df0101558404571de293c328507738a0cec691613bab59335718daf820e31
MD5 6611d402dfed76698c6557a5168d1ad0
SHA1 370b560322cefcf7658a3173b81ec868e89a209e
SHA512 191881d959d6c4574dbedafdf2a76e1d49d41a809d848582b26d0af928fd9ad832bc24d27c941b507d940c96063534c71b0e694d8a424002fe68c2825433f133
SSDEEP 384:npgiF9CcmyWCs3sNF8TUNTUlIm2QckCr9leKphiftGP/scnpse4KV8p0+Hrty/7j:p7Fccps3owgbkUYkoGP/sc+I8p0oK
TLSH
T173B25B36EC68DDBBEDE34F99B74E3A03DEE05167859C59E4CAD81E0D00931AC170B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6d7133c87317cfe8bf8da058b90c3eda65cbbb094f687ee7ff6078de6204c395
MD5 66c7daef0bdc28936b6b2ab486f89727
SHA1 0b0cc1a81ec72b8247ada3c82765d1c81a45ab3a
SHA512 bdd217b95485b3eb270924b3fb2ec49aa59757fe852e1c841feee33fcda21d9b81fd894972a853b7ed475d20ea92d9cc0e196db0171763ca5f48d465b8972705
SSDEEP 384:n1iFiZcIk3sNI8TUNTUlI4PQckCrDXXphiftGP/sxXLo/MxuvzxV+MhdpWty/7IN:8FQk3xwg+k6ZoGP/sxc/M4184p2l
TLSH
T1BAC23A32EC68DDBBACE78BC9A74A7603DEF0416399CC5AD4D5D85E1D00971AE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9093060ae141b073571953176eefc71294767317c8eb5f2b5e7ca715770d5045
MD5 454c82cb4b716f9d18d3494f7ad955a2
SHA1 4a80029a792ef3e8f439911fbb8658acfc58a0ec
SHA512 a633b486ff1088a4301f150e25f36bbe1dc3dd7a75deb6cc648f138cbad24679c7d69076795979f42967bd91368969af24c828142a5f87b0ede0ea04dda6afdb
SSDEEP 384:npXiF9CcmyWCs3sNU8TUNTUlIm2QckCr9DJkphiftGP/sxXLJ/Me4KV8p0+Hrtyf:pSFccps3BwgbkU9CoGP/sx1/MI8p0oK
TLSH
T1DDC25B32EC68DDBBECE34B99A74A3903DEE0526785CC5AE4CADC1E4D00971AD530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d356c8f4924384eef9c2bcede1451ba37e8a7587d2d7bdf11f772ef9f69e76bf
MD5 144a33698fbd5e1cc72f0c14b5f07962
SHA1 954720317f566886cbf183a7697d346d5eae0460
SHA512 2c572cd4957dd3f850dbd5d299e739c44dbd9717aa298326e6d941e02096cfeebc6cbb466cea5fc840acee844c3a36213ea8b3c95826ca41b8f8c6c08edac9df
SSDEEP 768:8FQYxwg+kiZoGP/sxcyxSp1DCxFT4184p2l:zYuP51exRb5l
TLSH
T159E22872D8949DEBA8E6CAC9A749F503AEF04133858C499CE6F87D3D309F1B94306C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0cdd6507e66c5d770ec20068ffea4e2ab6dcab05cefb199f8a1cccda9b3e2997
MD5 1251d789f61d17467ad5a42015edddd1
SHA1 3c7a9fb4cc5e920a5b85c6184523c216ccf8c440
SHA512 2cfaf9677afbf43e963c578c47eddd5b9c5ee5a56da249a6edfec2006321e8c4648820197798e6562989107cf7f7b716b855c2bdc9ae3e3e85f5427fd8d9aaa5
SSDEEP 768:8FQYxwg+kFZoGP/sxcyxSp1DCxFT4184p2l:zYuG51exRb5l
TLSH
T195E22872D8949DEBA8E6CAC9A749F502AEF04133858C499CE6F87D3D309F1F94306C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 841a46ce497b2b1217e432cf87ce206b05d421ba19a0d7c36cac13b7e7c6531c
MD5 71b0026915e7918b602fccee5a771afa
SHA1 4d10fc46e542617c4f503f5108182209e5bfc4b2
SHA512 8d332611f89b619a43ad2c72f00e3403d28efb96b0b5a75fa83a8fd5ae6f5794533529d53fcebba61077d5d463dfa95f01932e66a596ac3c35600a51744f5130
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58b541.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b541.TMP
Size 392B
SHA256 a488e1fbfcedf10f54ff59b32a5f357d3c1b6ef233a262fc6d372d1e3110b48d
MD5 9806b80051e40817de52e90f68041bcc
SHA1 f75e9e8b37f23bbadbb204aa901d6d1553724d48
SHA512 938a51271482697e3fa94ec3911c0fb3ee0610127c7e9708a11bf76124c5c61ee63c1152f68c75c63eb0a21be0b3f00a8d7cfef9b3a4792038aa33948fcb1926
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7ee255fccd89d4085673714c4603edab9d80d97a4804ae2c9e7f1c4e12cbff8d
MD5 aadba74d0c269ee5ff0bc1de235d9172
SHA1 946a4267852b16533005ff90e46d2fdf0e965747
SHA512 bc7242c20cb953b285a2467a0dd948c6cfa59bf545df19ddf0779aa36d158a98774b9351f4858b654449f178261a066646ef534169f87ee62ae851006916a3d5
SSDEEP 3:MsEllllkEthXllkl2zEelW//:/M/xT02zNWX
TLSH
T10C44040C7FC43415D51410F04035C3D103F0DC111511D743745DDC175CC75400FC0000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e6878cf41575b8821f51531205303784647f2a06fa892608dd12bcf11769ed05
MD5 25f35e6922ae070842fc9ed031f814bd
SHA1 aa9945522f3329d848a34456158b21597d575529
SHA512 a417be0611c968577754d152275e1162e57b4132ea7d715355f5bef08dee20ab73471ff7b9641c3108a20193a23590f0bf32a869f21606e86739aca451cacf56
TLSH
T150412A98AAEA1148B3B37F169BF6A86D487B7C372F0AD45D10110E4F0667A40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

2b8c7bfd-1f67-43bb-b151-7b385bb81a35.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b8c7bfd-1f67-43bb-b151-7b385bb81a35.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9f3243c9-ae24-403a-881b-9f9d52a8cece.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f3243c9-ae24-403a-881b-9f9d52a8cece.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 2KB
SHA256 033cab69581b26771e01dda5a31f9f8e4d78a2a14e987028d6adaad6f4e91cf6
MD5 ce8c4c8b6b6685f4cff18b5daa1ec0c8
SHA1 9fe7960f169770867fe2ca06568ab43118a327e1
SHA512 ca3803f3f32e047c19c1918f7eaeec33753ee102bb4da4239163f31656c3d1c0b1d23eedc8e265d5ab49f16039fbae7c1573024d773686cc690b371a28432b55
TLSH
T1205148A53935A22F6BC387C560754C84A570F180032E5A5CEE5AC034BE6CEF2A71F7C9
MD5 SHA1 SHA512 TLSH

Submit Download

c821678c-fdd3-43d6-8049-42b1e280563b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_1602012071\c821678c-fdd3-43d6-8049-42b1e280563b.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_1958687449\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads