7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/09/2026, 08:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rans0m.exe
Size 52.3MB
Sample260916-jxeb7agr21
SHA256 7abedb7bd160a5b1ef7467dd58dd70b6aa50b2983f54c7dab0cd100adb645dcc
MD5 f63b3544d5007af53976c71516612f3a
SHA1 cb9bbf84ba519aa4d8cdbf5da9d56e00eaf966f4
SHA512 367fe627db7a17e05dbefd8106c7a1b3a4128987d7d5ceff8acb17983f1f6da4547a5bf40b287a8507819cc5e2ec1a52fa0f6a5d9246a808f4763337568267d0
SSDEEP 786432:3i3/CStoACa66Z7lZrZzFY1NdjgJ/LxOjHyqsaWCuyYjV0XshJWcoZ0causDoXq1:it3ZBZjqxaJCusshkbZnmYNeRRd+UH
TLSH
T180C71215E263E700C1ED9536DD42C99447217D469F029AEB2078FB8B7A723C3BD3269E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
66	5716	msedge.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_1149947226\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_1149947226\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_616490558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_616490558\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_1149947226\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_1149947226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4736_478721277\female_names.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340195334689130"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{86CDAA4B-9D32-4D8B-B0CD-18B754F4FC01}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4736	4764	rans0m.exe	81
PID 4736 wrote to memory of 2776	4736	msedge.exe	82
PID 4736 wrote to memory of 5716	4736	msedge.exe	83
PID 4736 wrote to memory of 6012	4736	msedge.exe	84
PID 4736 wrote to memory of 6012	4736	msedge.exe	84
PID 4736 wrote to memory of 4368	4736	msedge.exe	85
PID 4736 wrote to memory of 4368	4736	msedge.exe	85
PID 4736 wrote to memory of 4368	4736	msedge.exe	85
PID 4736 wrote to memory of 2228	4736	msedge.exe	86
PID 4736 wrote to memory of 2228	4736	msedge.exe	86
PID 4736 wrote to memory of 2484	4736	msedge.exe	87
PID 4736 wrote to memory of 2228	4736	msedge.exe	86
PID 4736 wrote to memory of 2484	4736	msedge.exe	87
PID 4736 wrote to memory of 2484	4736	msedge.exe	87
PID 4736 wrote to memory of 2020	4736	msedge.exe	91
PID 4736 wrote to memory of 2020	4736	msedge.exe	91
PID 4736 wrote to memory of 2020	4736	msedge.exe	91
PID 4736 wrote to memory of 2932	4736	msedge.exe	92
PID 4736 wrote to memory of 2932	4736	msedge.exe	92
PID 4736 wrote to memory of 3800	4736	msedge.exe	93
PID 4736 wrote to memory of 3800	4736	msedge.exe	93
PID 4736 wrote to memory of 3800	4736	msedge.exe	93
PID 4736 wrote to memory of 3700	4736	msedge.exe	94
PID 4736 wrote to memory of 2136	4736	msedge.exe	95
PID 4736 wrote to memory of 3932	4736	msedge.exe	96
PID 4736 wrote to memory of 2136	4736	msedge.exe	95
PID 4736 wrote to memory of 3932	4736	msedge.exe	96
PID 4736 wrote to memory of 4016	4736	msedge.exe	99
PID 4736 wrote to memory of 5096	4736	msedge.exe	102
PID 4736 wrote to memory of 5252	4736	msedge.exe	103
PID 4736 wrote to memory of 5700	4736	msedge.exe	104
PID 4736 wrote to memory of 5736	4736	msedge.exe	107
PID 4736 wrote to memory of 5736	4736	msedge.exe	107
PID 4736 wrote to memory of 3880	4736	msedge.exe	108
PID 4736 wrote to memory of 3880	4736	msedge.exe	108
PID 4736 wrote to memory of 4788	4736	msedge.exe	110
PID 4736 wrote to memory of 4788	4736	msedge.exe	110
PID 4736 wrote to memory of 3452	4736	msedge.exe	111
PID 4736 wrote to memory of 3452	4736	msedge.exe	111
PID 4736 wrote to memory of 528	4736	msedge.exe	112
PID 4736 wrote to memory of 528	4736	msedge.exe	112
PID 4736 wrote to memory of 2384	4736	msedge.exe	113
PID 4736 wrote to memory of 4344	4736	msedge.exe	114
PID 4736 wrote to memory of 4344	4736	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\rans0m.exe
"C:\Users\Admin\AppData\Local\Temp\rans0m.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffb4b93c188,0x7ffb4b93c194,0x7ffb4b93c1a0
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,6523363200686146321,7243219303688465130,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,17357724452792727438,6231913751112151957,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,9068324074281240793,9519718922740150765,262144 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5648367611867305329,10286812741580931488,2097152 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,941568843704141365,5238676513150467312,2097152 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5048,i,1307281795190132482,18055184357975774086,2097152 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,5290436110660673715,10129713778074548767,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5264,i,3321532660791420931,2563593419616640763,2097152 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,15746191219713996170,10476178913977363816,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,9844622787970939470,3194981870278154500,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,16811511397619456010,5539319506767542742,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,1013668917964387437,8502122593800835192,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,1013668917964387437,8502122593800835192,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,15816369789960634659,13338534685251764690,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,7835442426810552132,5913600686910099595,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16947306453228665339,17513710657433283073,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,286655721690760921,14881723715194842638,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:8
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6091733181337019319,4184980449103295468,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,1420207073515421068,16417757237540724445,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=740,i,15609540371981484435,16288769527230624350,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,13924921299617492647,11241886591676947706,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2752,i,6561059633187095800,5778082121536920851,262144 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,10711603876217099831,9320264467450225368,524288 --field-trial-handle=2380,i,3042197821540266066,8907777429389559902,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27341f426aa0efd6c484bc21b43d92cf90ca72c2333c8e492f256c83fd880a23
MD5 5e7e3b8030681bdf6022439fe49f75f8
SHA1 0ff916bc55fa603e71947fca76af181bf6a176af
SHA512 f028e8f02a0deeb001818c82b1b058d78b877b08dfffccd53e7636c6b399cea4a3f75d2e7d48b81a7bd267b29da417e86f7b980e8764b264d26bc3942cb86bac
TLSH
T192D02BA49AC8C8C0C84120361358420831C8D23448A3404244E00254CED126216A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5f5d645707a8eec7acbcb7cbed3124ab1152c9a454ecd806e5cce64c5a6c0710
MD5 2035ba6835265bd23782b6148b009001
SHA1 16a21d479808282b9173df62b6a21a03a8cffe52
SHA512 4d48dd06a03d01204e62719e6ca50702d03d821f05ac379826c8a6cce180a8ad48e6826c4877a9b87ee0b99053e6e0a65ddc6988d123bb9f8dff8da2b95f37ca
TLSH
T172E0789819D9C65E63547487C174474DC2807B4BE3CC6F853784C8997043444F7E5990
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8250eedb8eacaccbb20d0cb74e97ea955f22f077d0a909c8f25884e394ac71e5
MD5 e99f1eb5a58bcf534ef94f3711d101a6
SHA1 984c90de027336fa8387081e465aab796038b5d1
SHA512 39f4bfef2579f2ec086c27c50efaa031fc594c3d02c3d20e146a1599297995fbde668ba066486a863317d2374cf4881fe4ba5f0b2a676208ff72a35fef5fad1b
TLSH
T103E02BE9CD61BC3B18FD072850954785E751139B7B40894F373C41098FB5637818687C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 774d34d474df914496f75229e40fdf3ad1a9258f7f3c908805396b1cbe30231d
MD5 81dded6a58ce81b7d904e582b41123a6
SHA1 247500c03e5e83bfc494886d563ef04a19d14e36
SHA512 a2d15ff243248b33f342da044e27cef843be4526e8efed32c59b69c67ff93c381f5e8dcb3537305c0152a212d14167f59ab3f5f333518533e909848f9ca68cf6
TLSH
T17771708CC1A05F0CC7A82870B2F630823132758862830E9F169BDF786B9632DF574BB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b59a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b59a.TMP
Size 3KB
SHA256 e930f27e7695e0800cdff8f5f57791ee0b86df9305db79848f8764800e12fd0d
MD5 39cab50f8da1b804ca5ea649289a816a
SHA1 57594a499729cc8796a9b611e09c84d7832c9f43
SHA512 5cbe5b923726a1c19a5a28a524378cdb418da1edf1869bb29003ac776616733125f5079e649d579fd0aca68ad5e15ada5a0d252d9b8903188b456b2a94581cf8
TLSH
T104614D8DC1909F4CD7A81870B2F670863235B68062830E9F15ABDF786B9672DF574BB4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e730a5eda0db09628fe02c01f05e92d7b79dfc0ef176d17b335dbba74199139b
MD5 f4bce134320cea5b1c99f0bdea6a79ad
SHA1 0ee2f9d26ecb3f5fbf67d8b296b9fb66f63a0240
SHA512 94dd506dc88036e662d93fe6727779df0fd60fbd8c72db20da515093cfee373139d9997216cf95d1a7ad2afcbd66f3cc4b7a8da674b2ef9eea82b09e94a3cff0
TLSH
T155819BF787B4856ECA0096F0AA18EE2FDF2C0615431C3C6989D4EE27D7E3472E10265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7df27dbb7fae44969e09821ecebd1431df4bb1113ef2acbcbe60756c227ee5d0
MD5 0ac9b7858d4808021ddc6cc33558426f
SHA1 2b51999d405b85b770039de33499cb51f6553187
SHA512 378370de7427b050fa4982fb9856370bbcdba3173c5bc420fac14fc9c5cd18edefa73f1798e112f6b09a5dd56419625ee1a54c072b0dbe1bbbea3ba35ddef126
TLSH
T17A419DF3C3E4866EC90056F0A718AE2BDE2D0914832C3D59C9D4AF6BD3E3471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 309e327e21e42ad69cab388de2b251033c886071ef91d6cd8297e75690bb4c1c
MD5 f62b2b238f8c0a85a9b909ce83f18873
SHA1 dc208b0eb275f17d3133bdb7f432801e0d9f5079
SHA512 39a883014796a57f2b65f34e918318fbeb5a35fbacd5fa9d6964db6a6673b85933529b4187f57b25a75fcdbe63537a1d1437c50af63575cd6eff612327ef2246
TLSH
T184419DF383E4866EC90056F0A718AE2BDE2D0914832C3D59C9D4AF6BD3E3471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 56d0d46e755fbba8af534a5f246dcf6a45ec1482db7fa0b4bf74ad4b4ce307ea
MD5 fae8504dd5731b4fcb11ec020f0c038a
SHA1 2bd6e87b92f92f8b5e71276de87db719b11e7e6a
SHA512 b0fb5214438f49accda6212a5e167bdd8884b39383e4dee23f82a75908fcb4a5499e6d7389bc8d916984c0d96f01fe56e74c600a59a1f59d5133f6751d793a65
SSDEEP 192:sxZ5RNm7/fHsLqXv8w8mt7Fodp6HHW6+WNrdaXa9cLWnC3sd5YIg53+VJ:sxZ5G7/fHsLqX58jIHb4XwOxA
TLSH
T1A852C659A938997F4CC7E219BA55BF63D7F91033A0C00E54AAFC9B1C14E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 68604ebe018c061dfa1a377bfa3462d73757a9f9e47890861e85c38933c55640
MD5 08c6ac075e51cc5107fdacc66ab941a5
SHA1 1cb214652cf7de2af67b408c6290958cf5cc8eda
SHA512 7d9024df134de717bce12537623237079ae03428e67b50c3f901acf74c715ebee8f5a2bd50c17de50990e62b3dc4429901a51bc1d2bb7bbfb4058f0bac54a229
SSDEEP 192:sxZ5RNm7/fHsLMXv8w8mt7Fodp6HHW6+WNrr/Za9cLWnfo3Sd5YIg53sJ:sxZ5G7/fHsLMX58jIHbnZ6OxQ
TLSH
T16152D75AA938997F4CC7E219BA55BF63D7F51033A0C00E44A6FC9B1C14EBADD220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8f41c24b75f96efad07acb7d7f3bebb433c8de4d926438006d7f86c9cd91fe9a
MD5 a4a641dd1b7961c2ab62561faa903075
SHA1 2ed44afbe5e083d5d3431dcc92d455f6dad654d4
SHA512 7c71c44dcc2f3411c23678c9907bfe0c56ee1e77cd5ad8c91ef411ac10d84c1d3ed73c833e3e3ac96af36109cea65b232240e6b3a0e295942284f83d66c8da3a
SSDEEP 192:sxZ5RNj7/fHsLMXv8w8mt7Fodp6HHW6+WNrBOda9cLWnfo31d5YIg53sJ:sxZ5D7/fHsLMX58jIHbwdXOxQ
TLSH
T14952D85AA934997F4CC7E619BA55BF63D7F91033A0C00E44A6FC9B1C14E7ADD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4bbf675f2e3149fcbbdbdcde791d02a119c651ef36f9a15083c20d21505948e9
MD5 b16de6442c40d585d5f82ed5b5e896c3
SHA1 97d8549fa0cb9143d383065d775982c72d1c7459
SHA512 066d762f0492512a1a3a71c171f5c2b4a41ebe08c469684d8a626f0a37885a594736ce8c0231ebc1681a6bf54f45bca39f30da1dade41a91bc9d0fc0e89b8d00
SSDEEP 192:sxZ5RNm7/fHsfqXv8w8mtLzodp6HHW6+WNrZ2/YC3Qd5YIgj+VJ:sxZ5G7/fHsfqX58dIHbc/oOjA
TLSH
T1DA42D7196E28A87F4CC7E209AB55BF53D7F91032A0D00E58A6FC8B1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8fb5c4bfc4a5db2dec5e3d4e8c9c3840ab02e0c531ea1824c6eed3aad2009d27
MD5 76e0455343b504c0ff29807c853a9ab7
SHA1 a2bee1a1a62ef9d1a5f945e526db7d94273ee594
SHA512 7c838331aa619a1b694ab0b3b2463087739629d1367558e6cf2e7b4350b4d9db9eba9a05f8cfaa57ff8847456b721b8c554ecce63329561ab37734bec8edab0b
SSDEEP 768:d8+S3Ni7pLuLbV9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2HpwLle4ZvWroT:d8+S3N6EbV9WvhLvbu1jabHpwLQ8vtKs
TLSH
T1B5E2E97B7C0CCA7E4FC00EDDDC1A6E9A6DA802CBA698C94047F9945C03D67EB51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cc6436f7981e887b8dac2394a6d515a4f066726d8ac50739809a0c1ebf2f06bf
MD5 3af0c4c39475f443ed7197961cfc8bbe
SHA1 7d0d39324c472f5564b7d8d7e0c8aa234c9bc4bf
SHA512 1b56f6920943df614feaf46ede1c139aae7566a24ff9bcd5a6b7683864d988b9513bf0eb3fc67ec27f10a5e2dd5b7eb0fdc363d75619fdeaa81a9b1058c186d3
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQJ:yjNB/XORbkJNlzjk517HNRZhdxlv
TLSH
T1E1B2FF1571BF0350387E2D0881B4976E9A4271A33068EA7B7FBD04A6CA67E095DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3c022d36abd7fc818a1903f978e0b533fe4cf8f61f22aa806dd51a069f38bd61
MD5 e8bc7ae49e2ee3d1ff2144b3be98a9bb
SHA1 2bd66d5ca5f229030d3e18405b8561b4cc7283a9
SHA512 a4fec51274677b58221717a8fbdb44f8ca05088b2405cb75b405c4fe0c971713346d2b3ad987d7043378a79bc86db26190ef2697e14ae5d81500334add9bde00
SSDEEP 384:nxiFiZcIE3sNm8TUNTUlI4kj2jh+vz2byfauEyUKzXHPUBom7O6R2FeovlBgL/7v:YFQE3ZwgIm8+fvUBH7TRWS
TLSH
T175C24A35EC68D9ABADEB8FDAA70A7A13EEF0016385DC59C4D9D86E1D008359D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2c0104a1f6c6671d3e8149c899876e8bb9a81bd1dc43740db225cd58728374f8
MD5 587a4e1113e62dd414321bc2ad21ae18
SHA1 14ea1c8000481ad70d11c3ddf97da2c4e4c856a7
SHA512 6c2bf765a1ce834febf45205e9a6476b15a2f01ef139a2671efb158891f177f90a8bd66a46c30be6abb5a7cd38af239714f3262d587144afe4a2abbee413b17e
SSDEEP 384:nyiFiZcIdS3sNm8TUNTUlI4kj2jh+vz2byfauEyUKzXHPUWom7O6R2FeovlBgL/D:5FQo3ZwgIm8+fvUWH7TRWS
TLSH
T156C25B35EC68D9BBADEB9F9AA70A7A13EEF0016385CC59C4D9D86E1D00835DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 19fedea8aa1f50111edf82c08c79836e44f73ba5aca4b3bbcd1a6c33d010f566
MD5 74b9db116b44563b057a5a2bfbbdfa3f
SHA1 fa106c53c9647c3c7c01c84117ed55535368166c
SHA512 920729ea007bb8feb9233638822cc9e6f15be02b5d184eb33ff83c455bfddb5a12b3495fc7a575160078a15d730b15f15c00d20c39e72b4321ed92c1b703cc4c
SSDEEP 384:nqiFiZcI63sNm8TUNTUlI4kv2jh+bz2byfauEyUKzXHPUBom32gL/7Izpo+:hFQ63Zwg8k8+fvUBH3CR
TLSH
T12BB24A35EC64D9BBBDEA9FD9A74A7A13DEE00163C59C5AC4DAD85E0D008359E030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cd79d9a89dc35468fad45b3b86a9915c57532c8a561835733f5e06a75df07c07
MD5 b26833b5ec253f413784ba559d1f9c85
SHA1 093abcf85f8210bb7a3a31acb0196875ea61cf72
SHA512 caf02d05a5f9441184c408ef1e65beb85d6ad38bc2ab3b5eaab30aaa71aaf6525ba86942b88acd98cedd1a22b541c7db65b6a7981b9d92af53324166769c2fdc
SSDEEP 384:nKiFiZcI63sNZW8TUNTUlImkwjh+m+AbyfauEyUKx1sa+VYdlUgL/7Izeoj:BFQ637wgsOK+l1hgcw
TLSH
T126B23931EC98D9ABEDFB8FD9AB4A6A53DEF0016381DC6AD4DAD85D0D008359D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 1518cbdebc013bf936a4198672c0e21435659d70879adaae4fd581ec89d319ba
MD5 ce15ad8c39c6acaafb75d3bb651ed50f
SHA1 b2087601b6df5a06b65eb9176090243f17c89ced
SHA512 5abc55bd71648c4aeedc542553678bc8a9a815f5d13df97a2934570e4c79b3ca904a3e1aa7b9e6577265648b29409a1acbf53a3b18d01367126251a7d7cfb028
SSDEEP 384:nyiFqZcId73sNLF8TUNTUlI4Aj2jh+vb2byfuuEyUKzXHPUWom7O6R2FeovlBgL7:5FIp3gFwgUq4+fvUWH7TRWS
TLSH
T174E290F598E78976E9AE4B97673D2E029EFCC053B1885980B7985E0DCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d5a6ac5a39351165463c27810196f4eed7252e3848dc1fab4e82a685dada0b22
MD5 83df648e545829c93a8ec2f980e85361
SHA1 b4e841a7fcccfe64d1d89abf4f61ec5957b258c9
SHA512 599588dcb7287b45f89c8c0beb149891f537431e1dd2d2549b214af7eda079b6733bffd25c7047c03f06c285b3e458c269805fcbbeb7b5bc2cfa5b02ff05497a
TLSH
T1FF3146D0483C5EC1D1BD0D7EB09B35EC90ECD761B5A4343D289CD8988A7AA0D710083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a9f98159fc4df667b0c37bfc6dff949991bdbb54a7c075428d36d536afcbec15
MD5 2e330e1141d1b78cde7942648b41b6d2
SHA1 292793fbf776fc4ccdf5d23d579b4f91a6c19693
SHA512 e3d6fc36fa74804f2b2f3fe454ecc6b4f98102980def8ccaccec7bc65ce5a9d20e632cc6fca038a87a34def6f647abf15127fe12b8e17181ac9f2a197010bc47
TLSH
T1EB3145D0493C5EC1D1FD0D6EB49B35FC90ECD762B5A4343D3898D8984A7AA0E614083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 015fdddfbb9b72143660aa374a85ce6b536d0f19fc1c1e0354e8d13f97e6cb6c
MD5 2f1f276d570dfd43f616e5c311d3a772
SHA1 8ddc303b2b606b37d8cae7e87dc0b336b1eed12b
SHA512 ee21ceb0af9874c27b05f5b34cabe34df47c9c7a144384f532c306dbcbae6dcc4ef80eed1d4654ecd7266268bdd3fbba47dbe52b4bf7e2fb731558e5e87239cb
TLSH
T1E9411A5CA6FA1148B3B76E56AFF7A86D487FB9732F0AD55D10110D4F0622A40CCA2737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4016-246-0x000001AB557B0000-0x000001AB567B0000-memory.dmp

Download