asyncrat | 944d93753f2a5cd355f440220343a5c6dccdf661069b4272c58701d74a31ed19

Analysis

user interaction
yes
max time kernel
112s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 63KB
Sample260930-vavansyy5r
SHA256 944d93753f2a5cd355f440220343a5c6dccdf661069b4272c58701d74a31ed19
MD5 f981ff4fe484ce1be57f1a5e8fa3c9e1
SHA1 970ffb702d737f3d15f0b7f361a89ae5b5e0d2b7
SHA512 7ec1072be44b7bc66ccc53fa0c5959bff8f43c456c49e532b356b4293a552a1e3226f0aabc0845eeece59e9501ba97c484677d1b15035c94b6b6c8a138d37f0f
SSDEEP 1536:3hjExLDRwQuNMXbmaeWs1l1ceimnjEuGbbXwsU0p3V9GftpqKmY7:3hjExLDRwQuNMXbreFlyeBGbbXD/pl+s
TLSH
T151536C002798C965E2AD4AF8ACF2550106B1D6772106DB5E7CC804DFAB9FFC64A127EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

193.161.193.99:63868

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	Client.exe
File opened for modification	C:\Program Files\SetUndo.mp4	Client.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Client.exe
File opened for modification	C:\Program Files\ConnectSync.htm	Client.exe
File opened for modification	C:\Program Files\RequestSave.mp3	Client.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	Client.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	Client.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	Client.exe
File opened for modification	C:\Program Files\PublishImport.gif	Client.exe
File opened for modification	C:\Program Files\ReceiveGrant.mov	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	Client.exe
File opened for modification	C:\Program Files\RevokeDisable.png	Client.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	Client.exe
File opened for modification	C:\Program Files\SelectFormat.png	Client.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	Client.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	Client.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1184	msedge.exe
2028	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{33BB3DBC-F590-4B34-B815-88F8D9B2860A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{DE2AA2B3-0A37-40C3-9D3B-6AA3AF4AEAD7}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe
3784	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	Client.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3784	4472	Client.exe	91
PID 3784 wrote to memory of 3952	3784	msedge.exe	92
PID 3784 wrote to memory of 3808	3784	msedge.exe	93
PID 3784 wrote to memory of 2028	3784	msedge.exe	94
PID 3784 wrote to memory of 3808	3784	msedge.exe	93
PID 3784 wrote to memory of 3808	3784	msedge.exe	93
PID 3784 wrote to memory of 5464	3784	msedge.exe	95
PID 3784 wrote to memory of 5464	3784	msedge.exe	95
PID 3784 wrote to memory of 984	3784	msedge.exe	98
PID 3784 wrote to memory of 984	3784	msedge.exe	98
PID 3784 wrote to memory of 4128	3784	msedge.exe	97
PID 3784 wrote to memory of 984	3784	msedge.exe	98
PID 3784 wrote to memory of 4128	3784	msedge.exe	97
PID 3784 wrote to memory of 4128	3784	msedge.exe	97
PID 3784 wrote to memory of 4624	3784	msedge.exe	100
PID 3784 wrote to memory of 4788	3784	msedge.exe	99
PID 3784 wrote to memory of 4624	3784	msedge.exe	100
PID 3784 wrote to memory of 4624	3784	msedge.exe	100
PID 3784 wrote to memory of 4788	3784	msedge.exe	99
PID 3784 wrote to memory of 4788	3784	msedge.exe	99
PID 3784 wrote to memory of 5944	3784	msedge.exe	101
PID 3784 wrote to memory of 5944	3784	msedge.exe	101
PID 3784 wrote to memory of 5944	3784	msedge.exe	101
PID 3784 wrote to memory of 5268	3784	msedge.exe	102
PID 3784 wrote to memory of 5268	3784	msedge.exe	102
PID 3784 wrote to memory of 688	3784	msedge.exe	104
PID 3784 wrote to memory of 5976	3784	msedge.exe	105
PID 3784 wrote to memory of 688	3784	msedge.exe	104
PID 3784 wrote to memory of 5976	3784	msedge.exe	105
PID 3784 wrote to memory of 2400	3784	msedge.exe	107
PID 3784 wrote to memory of 1376	3784	msedge.exe	108
PID 3784 wrote to memory of 1376	3784	msedge.exe	108
PID 3784 wrote to memory of 6476	3784	msedge.exe	111
PID 3784 wrote to memory of 6476	3784	msedge.exe	111
PID 3784 wrote to memory of 5792	3784	msedge.exe	112
PID 5792 wrote to memory of 1144	5792	msedge.exe	113
PID 5792 wrote to memory of 1252	5792	msedge.exe	114
PID 5792 wrote to memory of 1184	5792	msedge.exe	116
PID 5792 wrote to memory of 1252	5792	msedge.exe	114
PID 5792 wrote to memory of 1252	5792	msedge.exe	114
PID 5792 wrote to memory of 1312	5792	msedge.exe	117
PID 5792 wrote to memory of 1312	5792	msedge.exe	117
PID 5792 wrote to memory of 6228	5792	msedge.exe	119

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8e1c6c188,0x7ff8e1c6c194,0x7ff8e1c6c1a0
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,5924864500449427303,18404371103437598710,262144 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15494595203833013800,3327899391444634407,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,16905121410954840628,7820408760219037088,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,13788794486518068031,5627968942242833577,2097152 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,8668254154554526059,671913401764816336,2097152 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,435607843459298022,2675269146190471627,2097152 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,640640525952933176,8185090732529098366,2097152 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
    3⤵
    PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3744,i,6149135123826271593,4881552414598743045,2097152 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,18368974169725552625,15836900308491128814,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12424113104920364774,17445818101699263533,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,9142973823137966276,10038250537106312659,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5456552710251138969,12493699171907607769,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5456552710251138969,12493699171907607769,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,10932491889952565289,15794090122366895535,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,5308840217026385436,2059732033866386632,524288 --field-trial-handle=2608,i,12278996683223854692,16162721085579746504,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8e1c6c188,0x7ff8e1c6c194,0x7ff8e1c6c1a0
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,18078944605382818955,4396856117209066552,262144 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,16503344877836105254,2051137568997729724,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:11
      4⤵
      System Time Discovery
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,14161743491220346458,2261599628983850704,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16872562540317148078,5510030506059114975,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,16872562540317148078,5510030506059114975,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:14
      4⤵
      PID:6228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,16435625047519443404,1867566280162416641,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15841489457804378022,12261925943764983530,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,9220552653030648760,1349631589526977788,524288 --field-trial-handle=2320,i,774480003791884997,17821899006651799866,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9da7eb4878a6027aba4b99a96529081310463f7258d2bd96a8f30d8970da7a75
MD5 a42ff7872fc07a0650237993c7e95026
SHA1 98112e42e8b72d035e5a5c2c6ca5030660baaac9
SHA512 3e34a04c7cdecefb5d52748ec84b5727ed1e0e6853c72b0c477d36c455b33ca7640f89f0acbc0718e8e561575f84854c2bfaee664dee6d5e1c42345d1a974b63
TLSH
T1BCD0C050C4EC56F0E030303C03204201724CCA93BB8331065B6081BC0D31186029BCB8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c8c3aced0e5579810b7773ebbdcd5084df989b4ab2c9b9ebd48eb8ff676abd7e
MD5 f1a8ea3f5b452b549d71ffe67b88fead
SHA1 797fba65685044e2ede0e2625c44fad7a9fa91e0
SHA512 bfea5fed9065b002c292b461e30b8bfcef8aec6c9658a0678796168a4efb5990d3ca5804949e3ad43797f7c79f8252b3fb3a3e9ef67fc4205448861dc7129814
TLSH
T194D080D4E0E84574D021347C21159241B28CDB91BD537445EA61E17C3627655135A0B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

4f5bfa44-b72a-4acb-a7c1-66f425e7d030.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f5bfa44-b72a-4acb-a7c1-66f425e7d030.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c1c7934eaf9977b60ff05dd48db46d65aa31784a3e671986d95b435e5e5db73
MD5 6673f135924bb8bb3ae3811646dfdd64
SHA1 c3ed0f9d87f40a086e5530720cfd34a4598d48fe
SHA512 50d5ba903dbafb1fd46e09e99611298f01c0feccc668d549dbb112be4a7dbd0fdbe230f270ba88bcbd8f983f015abf57805039004c8a6d2599e1f05c5902781c
TLSH
T178E02B6AC862AC7719FF1B2C94440746E750135B2680594F7B3C82494FF1A77429185C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d415f90de24f2b1fc49006760240fd749033af8bab95a0589cc9e2a765ceb432
MD5 5d5ee6d30df948852ee9de5c7c826d1b
SHA1 f6fbe5b6fe4f4853c8b993e934ea1620c174e2b1
SHA512 337dd7d2a7aab14e517f5b21e2d41bcccaa2d76e96be68d35e3285d84e64a10ec5fe5dfd51b7bb174cf7f500f0bcc1c9f15634e093604efc027c03e8ab36d8cc
SSDEEP 384:yo0MuuMa/+e2v71C2iwTQ7eYnxIVY++ak4AR:yoMuf/++7mT
TLSH
T146133C3E3682DC25FAD6427CC6BB6B3AAF319AB4D4D548035672F8142314392EDCF129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 16d0c55e9f5f25bebcec7d54875ab3b6b3da5c15edd18528d85ca7614d2d84d2
MD5 8e688458cdc94b8c27c011c628ff4755
SHA1 e59bf780d2694a1f36990856d50278763920c3c0
SHA512 f13645e8d79d4d9f7827a5dde4b4f18fb3fe5f7d67e349b276a846ed00e00692a0f22223dd1434749d8623fef9671c70233f6451772834099f12f0a2f0343e67
SSDEEP 768:9I6IlNXovQAL/n4QL/4qOntJFdgbFOAUYz8nWpzSsGwAUS7dq+JoY2qlRu0Hj6:i6DQAL/n5L/4LJ9AQWBYLpI
TLSH
T1E34470FB1951A00BCBA842F5D2033A3DCD77415F7CD5E8E9E6788C912825F21B6B8E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 2284db77f49743a43582503ab5b3304d5208f0135eaa7d4e4d1ea113e3306512
MD5 6f00018a810a3cebd1b5d6c34d48d6f3
SHA1 f225c898eb0c59f09483afa9f7d0dc03229317fe
SHA512 30f72dd45f0c2f63652d813f1d740dbc5f48984428787747b5d096674988837519c09b87961589100797d4a2972a58a0bdc2ab12939819a732a4c6e191edc329
SSDEEP 3072:4v9G+bWA7uHvn9M3QstJLYJ0efouoD8rwAZqIR0bitibgyJq:4QUQM3vtJkJ08Y87PR0OSN
TLSH
T1A62539FEC7682C82DB6B8A7074E0D9077E712183B69DC0D39944C5E897D2B8575E82BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d7811f13c281647c83b581be4e459a4375f17add162e4c553e4910b1e8382ad9
MD5 d9bb739c266a8794318623250a1364b0
SHA1 3339ac1504b5cd7a7018067d1c59da7d459952dc
SHA512 90fa15afb189201eb1a66e7d2b17ca9b070df9a57cbb14a1f968f42e5888388fd2997d0e96ef30c50746a8bcf66b70c94464859d17894c2bbc377a02e94b02eb
SSDEEP 12288:ki9TuZ5BEMZxiCr2MIp+FXx1gCvcgLj4KgRFU2TViwD1pOGz5XwWcQ2Q55S+AAIe:GwIID+8XLCRmMS/Ln5dRKXK8gOq
TLSH
T1E9167DEDCA7858C3DD639A30B5F0ED477C7413C3F955C1D28898C18402ABBC5BBAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f0109275cb45db5d75ed9298054d0ff1c34d04585930f70f8abca717727461a5
MD5 6bc2933deee8521fc5b8bcc25e651092
SHA1 71dd4b798051b976794f29272a9d46f58d995cb6
SHA512 d85ab9fffafe9be6e527aef9883f2c50270d7c18aed5606275a6719a51b20d7b22ff3152a8966bf5d312fec72b27c1fb1948fe1cc63d824b826d337565f3b043
TLSH
T1B1613E95DAE1C428DBAF2033C6C2C6473A7077F3598B1E4907E8C87A6B4FB69D947044
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 04123ef8e674fa2cfa7ce9e66c24e7b9625ad401aa7e8a606b671da3f2a4e069
MD5 a1c08f1033a87deebae568d75d68f2eb
SHA1 835859d647a73d9b0c833ed26848ed7adac6bc19
SHA512 31cac808c123a0af9fe473b79c5926826f06ff22c2944489cbaeecea704b3de657d214c56f11871ead9660c92a6afe9bc0a96b69c5d82da7c5a8bebbcbf6dcbc
TLSH
T1E6E0D894B7C6C22DA968389741396F688280394AD6C96E172708A8C47706042F241587
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 26e613ea805d5780b5fce01cb4c488d26f5af140714db097c0124052f54e1d97
MD5 726023a4d33c71b6b980901923f9b8ac
SHA1 f6bab7821c37dfd8d63e5fac2d49e58d43e3a4d2
SHA512 f336086dc67f328a2dc3c6d6674ddecf28756b6da3133e9f2771cc130717d6f976d4051ef74876f183a11d21d76e0316ad933d7330959a8a1d3af698b1fa11f7
TLSH
T158E0260847C8C229E01C68F382BA6B6A83D0B942A2CC3E022708A8407142641A2C66C0
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 15caaf6950abb6035bef289bdc053c8b95f41dc2738c825828bb2e7c7549199f
MD5 9e509366b6adc99bafbff16b1c62c4f8
SHA1 cc05ef33f8ffd8fba964a1f50566854171855da4
SHA512 92e1ac4390f153b1d746477410b6b8b3ef650a0d86a26607bf96a94085baa0e1726e38bc96e313717f63a86f06f64642fe500737381d3a7acb244370b4d48f94
SSDEEP 48:IzBmw6QU1PzGD54Ho0QepPoR8/ZadHetgokpfpkAAXsqY2jEUEXhmGv12mT8p:UBCxGl5FepQRIadHettkUAEYOPA1Q
TLSH
T135B2E78F6F343963DF590C7E212A5974DE7BD22C6F6A9CA5382448210CF89455039AAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 54bc3d0db4c5254be7950a65df200a715be2c4e876e0a13e4a9ef43f210ca67a
MD5 a4a17f4404113f2155880d6bb43a6470
SHA1 8104d046d2e4f124f4fbe49896a4db24cc925aac
SHA512 0fe5eeb1826d122196fde561e7e2801537e029ac6cd9d99c460ed517a726c2a2d02e22e28520585ffe5c610acf1fa76a9b4b6274f59c32f2ec5588dbaae6024f
SSDEEP 96:rUQWtstejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/e1bbEOVpZf24JkMfXSFR+Cw:rUQWtzH+bF+UI3iWGVoWN3qL/wVVV63
TLSH
T1E924FF4E5F342722CDBD913668E744A35C7DF03F8B1226DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 3KB
SHA256 26aad25b67d72a269127bdbe1ac57103432c9b02273ef489dd67c41809eaa9f7
MD5 525a57459fa60e388c20f5cc292c2bf3
SHA1 9a118fcfd566b23cc79cc9b724d4bdd7cf18b8da
SHA512 1c6ea45d1ac4a436b75227d5f46df6ebab264c567afd14bab733ac3bd4ecfe8a93fdacdb799165a75e6245e279c9ac94fe1bf17965766ec33a669610e6fb7146
TLSH
T17871D67DDF95D006AF98A8EA3047342A8DEC61B7334D62916CC00C5A9BCD88D7C5CBE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 7004aad68246fd4c4872b9287cd54b390be5e33960c5095f5cf1c43613653b5f
MD5 89dc7b4d3773d6990a5af571ce189de0
SHA1 2574ddf46e44321d3886abbf25b6b8b829074fc3
SHA512 a681e641391ff78713cf0ad83df0263bee9c1d5d2ad757f399c45f34c59ed0331f060d8dd980b62fc4ce2e200db37ebc6b567ed0069a27b3f3451d022d6e03d9
TLSH
T14CE020648BDDC21DB11C649B427A7B5DD3B03B46D7CC7F81BB04BC40B009104A7C11C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 39ccb54a648c32c03e02f5ccf3746a3e366a620554bd5cfe11d31aa3b12b4215
MD5 0bbd334b8538938c6b4a5110d306d506
SHA1 67af50b520a67c0d92ede2c992ba4e90d4759334
SHA512 819bde0575b354347c01cdccee0aaa292a8b5b71bee67a1a47cd20e5f768253442036dbd73a6db80f6aef0c86f96556f504fce2f0d107a1e2dc6265a76ace355
SSDEEP 48:Txk/LopFMaty423w/a9NUuTPwJUPodwublnHzkLvoFHN6mbNORhtwJkomQ1zbLuI:qDeMatha9BRuF1GvPC4KLuAwA
TLSH
T134B2C4CF2F212101D4F94BB9E9E188662E7E020D273379EEB51454724DB2A1EA8070F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 cbf99e5c20710dda3be26cedd0c4498e89228130e0f5ab0d1dac05735b79f436
MD5 3c64ba5f7b462242e793a695b4375fc3
SHA1 b677d528c03cac659e163842c26f06817934cc57
SHA512 3fb399fb917b050de9c019f492a4373fb081ba15ea24f4e1f04fb332573a8d0e9975b375f2fe7bdd13491bac701f2df22b983450862f77109cc3d736bd917ed7
SSDEEP 96:DEOXC9NaSPfvfaIWzB0O9GwKzQdGL5NmVE:DPXC9NaSPfvfaIW1X9G3zQdGL5NmVE
TLSH
T1D9B1EEF7C3E9C12DC91156F4AB156F2FCE2E0A18532C3C2AC8D8AE5B93E2471E10565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 5dda4e56959f1549da4e78a81d31c0811efca21d450870613565ff911e30cbdd
MD5 0c07cae39d4267e0a28df4729590f2ff
SHA1 74fdfc975782e930da5417873ce2cd4c9ed0a406
SHA512 775dfdc8ffd666cbba13b61fd94ef8275d2f863e58789e191e2b2f33caca62526d9ec136ba7a64a415f955c91a6dfb1a252612018b43edbd3e0d84af9cfeb0f9
TLSH
T1AC017BA7A6BEF47B117E45770E48B8896AFB9435214078F4DD97C22DF0D09F36B42012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1bb30e0d5fd27c838832014a6084e59d0ebcbedf64084e888fae5380cf076c5d
MD5 6cd03e63c3b49afc7695f4a3dbb4ee08
SHA1 9052cb024f11336217fda8f409f48243a6fa29d6
SHA512 440159dc1bb51b1cd22dca87170d0d1edd2ec359e77bde8affb14816d4b24242efd036f8186598b1a409b49f114bab6c94512711832ad97fe392100a4c5918fe
SSDEEP 192:sxR0RPCP/fUsWGWpVkfZFjZNDOzoA8pjzh/g6+WNwO8LXYJacC+rgNIgDVaJ:sxR0sP/fUsjWvkBJZ9zJ/5+XPQ
TLSH
T1A852E816AD68A97B9CC7D21DFB65BF53D6F91032A0D01E48A6FC891C10E76DD220384F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5febd0a8ffe38ad8eebb8f5e1a2aab6c0be414c71857d55db273d8e1e83e478b
MD5 a54dbf1de4a4ca44ebeb46e0d62a5dfd
SHA1 d543e6965b244a4c4d5900d3f7cc30edb4be52ae
SHA512 aa48fd62cbaf8852c180c5eb9e8c6a1073be6927b7579a80a6140cb1e4800843b253ac9347a7154c84e008e9c5759e7f7d41c30c698288a65a6fe336f9d0f166
SSDEEP 192:sxR0RPCP/fUsWquWpVofZFjZNjmrUlTXOzoA8pjzh/g6+WNwO8LXYJaceE0GNIgw:sxR0sP/fUsiWvoBJZxmrGzJ/5+XcYJ
TLSH
T1A752E855AD64A97B9CC7D21DFA65BF63D6F91033A0C01E48A6FC8A1C10E7ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 535f32bdef555ec2a4721b881aa43d67b968da64b0dd5f5dbe6e3c186ad31ea1
MD5 30b945f46247d3efabf8e10abe8585f7
SHA1 830483bd2dabb20bf2b2b63e0d1b85fd081a6241
SHA512 b7eb30ad06e2f4324dffbdbf8c8420acab02e0c9b93371db2554b1f537989902f2acb0a8d4ddedcf880ae8a08ce43f460b0848da7f5f862f038288709fa3a8ee
SSDEEP 192:sxR0RPCP/fUsWquWpVcfZFjZNjmrUlTXOzoA8pjzh/g6+WNwO8LXYJacC+0GNIgQ:sxR0sP/fUsiWvcBJZxmrGzJ/5+XSQ
TLSH
T17A52E915AD64A97B9CC7D21DFA69BF63D6F91033A0C41E48A6FC891C10E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9d32e16151ab970199f917374f49cb5a8e70893568f0d0f340f6c330aa2179ce
MD5 c15a67fdf58974a5303e251d21c0cea6
SHA1 b0cde4d81ebaca7f12c3d27be59c881800251c53
SHA512 eafb27568a7ec64dfde03288f6f2f21de4d671f239bb5796907cdb60a771c6fdae6470690a3e81daa10e675b5dae1726d83fd31494bb99cf9ddae33924657f44
SSDEEP 768:ksRdYIG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2Np2+gvroe2GV:ksRdYImEb0JWgSwffTu1ja9Nprg8e2GV
TLSH
T1B3D2D97B640CCB7F4F814ADDD8197A9F6DA802CB9698CD8047FE941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e6d41824c099b5be9519b2023de64e1ffbd7b71367eaad4209be826f175dbb29
MD5 878dc45d411d185d07b5734f9d243b5e
SHA1 ccf7244d65ae23221f931880e4ec80868d9773d6
SHA512 99548b262173210f182213675d066ece28ea20422e37213a2190cbea999f98e268297c4f05d98f18ef63dbe374238b14b65998966df830bb4eb0eac63f68b96d
TLSH
T16DE04F5857C9D2F9B05D605302679769D3A8BA2FD6DD3F122F44AD847143588B192181
MD5 SHA1 SHA512 TLSH

Submit Download

715e6f608ee73a09_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\715e6f608ee73a09_0
Size 193KB
SHA256 b87709376828f9b75fd7bc6b9734e5fbdc738790d2850817732dbc6f81d853c0
MD5 5fac458383af0dcae64761efb79ad708
SHA1 d6e15fe1e6d8e0e82c35a879dc5ef0f0550fc02f
SHA512 57f7a3919e68155eec84fd4c5934581eb37c54b81bfea5063e0d091ef91f3744d16acd8ada8eaba6c31ca54f69d631e5c136a1d767856e2bfbe2f806105be0ab
SSDEEP 1536:AoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:hrFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T1F1145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ca4a980090ecff7d3a3a0c4bc1df8d00257e2266e824d13110daa230b5c9e4ea
MD5 8d5357138c80fb1078bc9c5a05a2560c
SHA1 d8183c793fb39e8497964f2e744f0605afedfd2c
SHA512 d953f8c67f41f74e3fac94581e308850d0549b87482bae0d1445065a6e5f266f48e58e9e84d52ec6cb73e7b212ce66082a642387d37890f8a994a9ae26d9049d
TLSH
T124A0021951C80B15CD451A739052118C76744966A954D7036C94ADC5BC924524902029
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 bcfdd7ee212c6b72fd9195d9b9bedb10538bc60b6998a53e29d03a3487f814f9
MD5 5f4b37fdf38a72d42af366caaa6b4e4b
SHA1 6b07b9954d685c4e53545eaeb711490cab788fbb
SHA512 9d3897d99f7d8484561336a19d3529c91a8a90b74ae24aed957116bf422c5fb16cbf3614718458a8011eb91e27dc52d49ec95f9c28d3ce82041b2dd1f6b51c53
SSDEEP 24:TLRRY/9JhPaWMuz62ZeL1b3IeNSllviteteX4TDQeU6Uw9q8zPq8yzRfJhIv1MKf:TcZa31b3fEvTFULcqJzxXIOrMYrb6
TLSH
T1B213FB9F2A547442D2A98139E49A8F7F6D7F310C9F836CD165E056B30CE242C582F17A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 f1a654e07e9355f36932d5f953dcc7ed93c646511d334df2c82424af42da7705
MD5 2d1cda0b11291ce215e7c2d9ae843a91
SHA1 5f0eddc90af3216982b59b8dd5c4209c9f97bbf1
SHA512 313a555df94a7e8d8b6850424071e5353104b54ddd1426fd5fbec1d30fd7d19dc4b77e91957bc510a1fa55c0febaa85a12441985d12f2be25a2461bb41041e98
TLSH
T1AAB012443F20A309E4C84D3009D24B446700F4429091C4B3E85C5F104D1A6A8AFD1CD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6f306bb83d2877d76090971721c2709f96ccbd010ffe4b0d0be4ae3239203456
MD5 91460be2d018cbb669dbb3a1f4309e40
SHA1 729f6e04c39124851ea668b1c79bda4325f8a1bd
SHA512 765a0341739c1e61a2dccb64ef751b2c679d21908388295af98bb397ec4d8741c7b8173acfd9b58e25ffc3d5cbd6fb2fdea0513dcd9885031fa9e645d0b94149
TLSH
T1EBE0D82867CDC36AB24D20974217E759C3A2BA1AD6DD2E213B08BC8472072807343180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 c8c2c4df48f8134af1b00e87d35f13d68d3de5cf25494cd9d2754d95f798f525
MD5 9cf10a2cb0d324d1da48c00d6c422e44
SHA1 c17e00b1b03ca5f27ccced030509f6d9dc68373b
SHA512 4684af7c6e53f42b3d5ed239baf25880983fb52e56d6d3ab8ce5bce15cbe1d00167ea8423bf25067f08965c4020bedc3999db5776abf33a0abea0048c165abb2
TLSH
T18DE080B487C5D3B9A00C74934266AB6EC3F5BD0E97DD3F556708A88C720314476655C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c5255c4768e4d1d1168a7fc4ddb711125481ad71f55efe1aef8be520bd59630
MD5 8ff78c70e0c77cd620aef8f17cc6dcef
SHA1 f748698e6904e9284574c17adeb39f73e2238fb9
SHA512 d8c1558fc41f46d5944a196a0d823947f40045bedb593faf8d7f7936daef985f5fa9d6a2d96fbb96a19405e021fc529f1929dc4f48323413e30306418aae8a09
SSDEEP 96:KgZCKaQSWHmKg4xZmtp7njEzngvtREKFhtDEBJpA7JZ+:gJVgZmtp7nj0nglRFhtDkJpA7JZ+
TLSH
T16F911054317B124078BE789882B6875F124172777416EB2B7FBC10BA4E2EE094DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 c40034a7008322edb13b22642b250d628b1c218ea8c03897a826922c2d33432a
MD5 16683c6f18bf6b8cc9f17cddaf7cd860
SHA1 3bacf8322de1f0c5a73055507c0cf0d54743333b
SHA512 9662a6903ff5122ba030af07a24a5968013eaf614722a7a31985d39ed78ed52e5fbcf4a7978c1040aaa4e04a687e0a3d48b80be8127203b3cfb12a1cc775c3fd
SSDEEP 96:KgZCKaQSWHmKg4xZmtp7njEzngvtREKFhtDEBJpA7JZ2H+KAQNv:gJVgZmtp7nj0nglRFhtDkJpA7JZ9k
TLSH
T1BFC12F14317B1340787E78A881A6C75F52417277741AEB2B7FBC10BA4A6AE0D4DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 933f0cc48d6f400c78f8ba045d947033e3171e8edac009d9fe284a797342161a
MD5 49cb056d4d238f6ac971cf13855953a8
SHA1 922a4c54c7ecb231463b734f25dc7f15a1a161d2
SHA512 f824f6362b1abfb5f9e3300a2507ef29f0954ba39ac14d03da6a668c3f5b07c34ecafe47930f0dae399dbad25b45b0a6c9eceda4b7f1c270ac48bee5b8c4ee1c
SSDEEP 384:DNrRZyCSDnxTICvPMEhIKyll7svbFKfk7:xFZJSDni0EyI1l7svbF9
TLSH
T1EE44640A7B747001EDE6D9725CB080771E3CB16E8F22A6D16DA254694DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 7127c51c51a512774c726f92e3d99f6675fea9d5e4bb0ff580e87669b238e7de
MD5 6c0f877db5b17831726164c7782c4149
SHA1 6f6485b386979c877ff3a7b0ee47835cc2856c33
SHA512 b4264b0de6e9d8c9094ccfdcdd546ea349c2079210948daa02585c90639a9fab69e5a82e8ec1881248dd5a1c58cf983c2092f4044e8e79da917abff15e0f15dd
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBg1AlJGt:DEK3tjkSI5IUltGhp22iSBg1UW
TLSH
T1F252799BFE342212DCEA83319AD002E57E7A913D8FC1EB4254D610211EF4692A71E5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8afc2bb-fc94-434e-9d0e-f5e2723ec241.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8afc2bb-fc94-434e-9d0e-f5e2723ec241.tmp
Size 11KB
SHA256 a835cd292f3322ec66ba7a08ccbdc4af248103957c509652b0c745848e929381
MD5 a95b7e8dc25b23f0f80af63546e23db1
SHA1 3c9fd0af383b1338b6fec8f22d1f4004ffc67ecb
SHA512 b3cd6cf3787434f57cabd2c93fb789421be52098d61512e10b80d275c9087dedf7e8384c35ba871af084b9cda495e0ee772d51ae00230dab30518a220040f20d
SSDEEP 192:sxRfRvCP/fUsEfZFjZNMOzoA8pjzh/g6+WN9Yp/YlaceNGNIgVaJ:sxRfQP/fUsEBJZ+zJ/5G/I0
TLSH
T11842B756AD68A97B8CC7D21DBA65BF53D6F91032A0D01E48F6FC851C14E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 0f207e7032ab1fcfb412fedd37cf5ccbd44cb6739b8181d5e495716f9a7102a3
MD5 fe0ed1bc56f4a3b11577b0a9a4a9a0b5
SHA1 0506f74fd93f34e176dc88ea400c2af8de48f572
SHA512 11481f77b0ffadbda07689410903d859f0ae2db409011b908a090648fb6a9d7c06e478b59bd41d6ba67345bb5ee2260d4670f9d1d40ef4be5202953b189a34c5
SSDEEP 192:395QkIIIbbLMIMNsYcYNxOgUvAs9luqNssI34X:395QkIIIbbLMIM2BJgUos38sn
TLSH
T1F342832E26051B77C05F5BBB136B87595BE888828172252D72523C0F8DF3FA786D92F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 290bd6b6c3cc0fa4f3c49f1b5d57bc46b3e9b0490f02842be0a19284da5b64d4
MD5 60c2650a01ef166e2a136116d0bb99de
SHA1 6b31d2194326b84321d0c5b38d9653ebba6edb51
SHA512 5f125e73d3d4ae0e2ca8b0c0452cf1091eb410a9e1b4cd28e23e062cc100f5787474ba5c4e5393ba0dc264dcd80c69c6df09750f0f07714f87ab42fce9a7a37c
TLSH
T15FE02654EBC8C26EF02C24D701B76BAD83D0BE03EACC2F062F00E444A086A00BA9A5C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 eb6eda801a5871910daf445cddbef6d7b9756cbb7d0a512bd049614a3b0a1ad4
MD5 a1a0922e81a0fec1baa9b44bff60d64f
SHA1 7227294d402f3427b0195c3132e8c4d3390e7d80
SHA512 77f1f31aba18b2e33069b67e564fbcd7acb51ac5753d33a4a087f80ea119353a8686e676d9257a5086104af763e411e07708bc906fbfdc214dc356465b0c666e
TLSH
T182212B55F330C548E14E827A603E87251378E9538FBCED0F447931382E72B081E876E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 79f89d229a577bc075a7bb890b6a281de4736a4ac73170b958d25816cad52cea
MD5 f3a910ce97a76e48c08ee7b78a94825f
SHA1 cdac31009db1ba54aa5b14a6119f08b7ac2034f1
SHA512 683c6a220e83c1d599b0f3aa18857ea03b1ba46d95e3f3399bc87c3d748c734c6378268e6fc70d8216ae057024323fd5b85384bff7229b9f5a10292ed3fd7574
TLSH
T141E04858A7C9D2AFB11820930166A7A9D3917D47EAE83F152F04ADC85642145735A181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 c20909e3486282cfc71a749a9c1991392155e234e1135bb3aed125b65f07e93d
MD5 dce3351b4489d7cd3c1da2578444eb57
SHA1 84ea85e020e266bb6baabe72a4fe2ebb7ef75109
SHA512 c097098c93ca583ef3d0fed2b71f62c9d266e60f4aa2d7aceafe46949912fcac630e283d2cd2d589907e8d39f0b976f18e0ef925eaa3bbf6cd4878dafeb28f8c
SSDEEP 3:MsEllllkEthXllkl2zEfl6sc:/M/xT02z5s
TLSH
T1184404047FC00505F50030307051C7501374D4100511D74735F147375CC77400C50000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 038bd6398d1df89b7a16e1133a72b7e8480ab5b23be605cda2228cb95ec5812b
MD5 ca96b463941f630db988090f7a46087e
SHA1 bb045cdff00a40449d44e5fb76245868d8031911
SHA512 6992c8cfa382fe45e7f644236490af86cfe5ffe7ed4106c94854c359f018a5ba2412b574cc62abfa5d36dec9d2139f6696f4480c5ee616952c318c06d7282197
SSDEEP 3:MsEllllkEthXllkl2zEflIBKll:/M/xT02zz+
TLSH
T19C440404FFC00405D500103140D1C350D370DC11051D57533CD544335CC75400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1f08cb01753c8afd0be75ec75b91e5fecbf070bc5954d466e07bec8594d44d49
MD5 b67ce8f0c29ba1f06bc9819fbb3a0146
SHA1 a053748d3ab7e526546f0aab56d48af5aa0f546f
SHA512 d429deb507ff35f0e46c7cb01977308f85e6de408c0f550f36b0596fa3ee51853fcea7096caf9630e7423c1c3e74425afa9b2e0f539a7e46795177cbebe1d626
SSDEEP 768:Kz3l1sSFajTxcnqMwQi5BgK5/CwYcZ62sCU:Kz3lK3xcVmBg8/d82sCU
TLSH
T1C1F2AE30ECF58EF71CFA9204B2867786AFF46167D8D8094894E98A0D4187DEE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5b7699f7aa862d5cc21f77211cd743cbe3698c5ec6b692d02718ed5d38103db2
MD5 485ce64741470a9fe875374f10de1e1a
SHA1 975c29a7b3949977f9a4b71657b25a8ba5a7f5e0
SHA512 0679069675470e7194e93c706f7a4ae5de9e9cdf21d857ee41d686c752e54ff8a6cb8d29c9ef12e1a5032cf2ad08f7fb61f4c9641b8673a101d9945834864061
SSDEEP 768:ac3PpsSFajTxRnqMwQi5BgK5/CwYcyc2snW:ac3Pe3xRVmBg8/dz2snW
TLSH
T1D3F2AD30ECB58EF758FA9244B6877782AFF46167D8D90998D4E99A0D0183DEE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c9a25687a0e532ee6a84f4f7120491a85780870fe1189c64eee35bab90ae5413
MD5 5569141317a5305a6506ccca7fa0db44
SHA1 84fa35a6f9a272f4c9aba478f9dd0ad5a8aac64f
SHA512 82996385bf68d9f889720dfc404ae20cb2542be213c248e113f584bffb44c12c41a2c701b6f186d58ab6915ef5b7a6d1d0701ca4741909728828d487bd6be840
SSDEEP 768:O/UxvxjgC+Ft3VDUSFajTFnqMwQi5BgK5/CwYclbA8Dea:DZj3+Ft3V03FVmBg8/dJA8Sa
TLSH
T1D403CF36ECB49DB78CFA9640768A638BEFF45153C5C4099885ED1E0E02C79EC130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0ffda556d19b0c4c4ce19ea87a64ac470161ab10d92f148564982462b6da42f6
MD5 acf00be2f594bdb56dbff54ba084b055
SHA1 17fc44b95cf0a5788ffbbfe2866df04dbe97e4ea
SHA512 725884b1b27a02514d64b4f5517dcc5f701f7d3ce1c973f296bdc00aac2869e9d16387bfd762bf3b5418955fef9b481eb133c9bba3f0e234bbb8753d64adca18
SSDEEP 768:9c3lDsSFajTxcnqMwQi5BgK5/CwYcZkh9Ji2sCU:9c3l03xcVmBg8/dONi2sCU
TLSH
T1BA038D3DDCA08ABF48BEB304A24E3615AEA8423BD5B40598D7D94B0DC177DADF307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3c18e461f5af518de365b18d48e7e74bfa55b2ba6cd3399d10e633579e2eb068
MD5 bed619d534dd7d26a6e773341ae58b53
SHA1 b347e0f7bd6f8890b6d2767851a08350550987cb
SHA512 5d82083d6efe7f8b4455788239225261470c89c36e1f0a3ceccff15c28077d63d4a74920515a377d25aadcda992d0aac0253053d74758d89817c5f00c99b3a1d
SSDEEP 768:K/UxvxjgC+y3lFsSFajTxinqMwQi5BgK5/CwYcZ62s4T:PZj3+y3l63xiVmBg8/d82s4T
TLSH
T10903BF35E8F59DB758FBA204B28B6396EFF415A3D8C5096888E94E0D06879ED130BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 a50fe066a2396fce6f750b7ba9c0bd73ea668ccd7aa1c5d836afa0710e6c6ec5
MD5 3ec21a16cfc93f16c6bc49893e111aa0
SHA1 e4e24bc7c0222523aa260b1559bc52c0811a043b
SHA512 688ad9f314405c7e31e3ccf37181f87b2c8c575e78e959090fbd3a0a833adfeac3e617ab598ad23288bd92f3bde01bbd02a06d37f0c5a0811ac3d544c1de614c
SSDEEP 12:TLJYJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isZQQtydQaPj2qzQ/:TL+j0afDdWec9sJVUOOIsXjy
TLSH
T1F992FE366D352033E8EB4B3AB89349E00EBC12ADC9A778548DD44D610D61BC2A2892FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 eab0486d95acce9d8ab3d1cd8dfc913a8e9ff3e60f31b87067fb6cd00b928399
MD5 a1ffa3d6d339dff14032e0cefd2b2187
SHA1 19c4437b0eeeff62a4bccc789ef420106652a746
SHA512 468c7c868cb4742bc6e0ab47290e0d1d3f3ae1aa0d692414cc68f41b653b2e564543a5ce67a1da4487fc1b0da5c8a3b8882abba56648fe301f12faa3d17093d8
SSDEEP 3:MsEllllkEthXllkl2zEfl1:/M/xT02z
TLSH
T11D4404047FC00445D500103054D1C7D01370D410551157C374D144735CC75400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3784_1397568815\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4472-11-0x00000000062A0000-0x00000000062B0000-memory.dmp

Download

memory/4472-14-0x0000000006480000-0x000000000648E000-memory.dmp

Download

memory/4472-10-0x0000000007260000-0x00000000072D6000-memory.dmp

Download

memory/4472-9-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Download

memory/4472-13-0x0000000006490000-0x0000000006522000-memory.dmp

Download

memory/4472-4-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/4472-7-0x0000000006100000-0x000000000619C000-memory.dmp

Download

memory/4472-8-0x0000000006760000-0x0000000006D1A000-memory.dmp

Download

memory/4472-3-0x0000000075002000-0x0000000075003000-memory.dmp

Download

memory/4472-12-0x0000000007230000-0x000000000724E000-memory.dmp

Download

memory/4472-525-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

Download

memory/4472-2-0x0000000074FF0000-0x00000000757AC000-memory.dmp

Download

memory/4472-1-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Download

memory/4472-0-0x0000000075002000-0x0000000075003000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads