0f2051005cf9120f471f4d8f3c92e366eb330200c539c5019cfda5be6cd8435e

Analysis

user interaction
yes
max time kernel
74s
max time network
77s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
02/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ransom.exe
Size 22.6MB
Sample261002-pxekvaab49
SHA256 0f2051005cf9120f471f4d8f3c92e366eb330200c539c5019cfda5be6cd8435e
MD5 4b1c93963ad6437d493d9707d898d94d
SHA1 6eaedc8e8a48ebb746593555695052f476844a1d
SHA512 1090af2ed9bf3a70632433bc0f0483501f306874bccdba0cc8a1f9a32d7aecdea6ea4ece67414890467dd942636e3f75652d2983ae7c4e01226bb54ba3703d8c
SSDEEP 393216:jtDs7TSTyOyxE1XstMHsuKdD657mLzV0ty0bTr47d6aGbsDoXq/TUE6t+ajxOOEz:ji/STy3uXshJWcoZ0causDoXqYE6oaj2
TLSH
T1A837DF15E263E704C1ED9536D942C9E48311BD464F1299EF2078FE8B7A72383BD3269E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3904	msedge.exe
3748	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{D3E77C9A-1E57-4D2C-9DF1-7759C34E063C}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{4A588045-0926-4FDB-A593-1F471F0EC4A3}	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
680	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1816	4644	ransom.exe	82
PID 1816 wrote to memory of 4756	1816	msedge.exe	83
PID 1816 wrote to memory of 3904	1816	msedge.exe	84
PID 1816 wrote to memory of 5812	1816	msedge.exe	85
PID 1816 wrote to memory of 5812	1816	msedge.exe	85
PID 1816 wrote to memory of 5812	1816	msedge.exe	85
PID 1816 wrote to memory of 3640	1816	msedge.exe	86
PID 1816 wrote to memory of 3640	1816	msedge.exe	86
PID 1816 wrote to memory of 2588	1816	msedge.exe	87
PID 1816 wrote to memory of 2588	1816	msedge.exe	87
PID 1816 wrote to memory of 2588	1816	msedge.exe	87
PID 1816 wrote to memory of 2520	1816	msedge.exe	88
PID 1816 wrote to memory of 2520	1816	msedge.exe	88
PID 1816 wrote to memory of 2520	1816	msedge.exe	88
PID 1816 wrote to memory of 4964	1816	msedge.exe	92
PID 1816 wrote to memory of 4964	1816	msedge.exe	92
PID 1816 wrote to memory of 3336	1816	msedge.exe	93
PID 1816 wrote to memory of 3336	1816	msedge.exe	93
PID 1816 wrote to memory of 5068	1816	msedge.exe	95
PID 1816 wrote to memory of 1692	1816	msedge.exe	98
PID 1816 wrote to memory of 1692	1816	msedge.exe	98
PID 1816 wrote to memory of 1692	1816	msedge.exe	98
PID 1816 wrote to memory of 4056	1816	msedge.exe	99
PID 1816 wrote to memory of 4056	1816	msedge.exe	99
PID 1816 wrote to memory of 4056	1816	msedge.exe	99
PID 1816 wrote to memory of 5272	1816	msedge.exe	105
PID 1816 wrote to memory of 5820	1816	msedge.exe	106
PID 1816 wrote to memory of 5436	1816	msedge.exe	107
PID 1816 wrote to memory of 6056	1816	msedge.exe	122
PID 1816 wrote to memory of 6056	1816	msedge.exe	122
PID 1816 wrote to memory of 6056	1816	msedge.exe	122
PID 1816 wrote to memory of 212	1816	msedge.exe	125
PID 212 wrote to memory of 4368	212	msedge.exe	126
PID 212 wrote to memory of 3748	212	msedge.exe	127
PID 212 wrote to memory of 4808	212	msedge.exe	128
PID 212 wrote to memory of 4808	212	msedge.exe	128
PID 212 wrote to memory of 4808	212	msedge.exe	128
PID 212 wrote to memory of 2392	212	msedge.exe	129
PID 212 wrote to memory of 2392	212	msedge.exe	129
PID 212 wrote to memory of 2512	212	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\ransom.exe
"C:\Users\Admin\AppData\Local\Temp\ransom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fff4f4dc188,0x7fff4f4dc194,0x7fff4f4dc1a0
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,891116498006213960,18049114724101896383,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,13275784393744448163,763321618819661739,262144 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,7441275339204469236,16532700757711730473,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,14611344703911387989,12399754806923659776,2097152 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,14972766287070767460,15485469263142040720,2097152 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=uk --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,16952810334489635171,2085501478080319473,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
    3⤵
    PID:4964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=uk --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,15287534872860878632,3068677450594663901,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,4576306476711263677,5590995296936740926,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,4576306476711263677,5590995296936740926,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5644,i,13508728873916724000,6227293750070117912,2097152 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6124,i,6633128896418434865,15209507305366807070,2097152 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,773625751451458455,14950090748041257745,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11682248061405411560,2647481705046245092,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=uk --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3485206567830178746,18143845308156972270,524288 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=uk --js-flags=--ms-user-locale=uk_UA --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4996,i,17411062771345820052,8821239725197724440,2097152 --field-trial-handle=2292,i,3359449767279832606,11099362021175634983,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff4f4dc188,0x7fff4f4dc194,0x7fff4f4dc1a0
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,11346132643243395719,10072617087827801367,524288 --field-trial-handle=2100,i,553756556727387419,18414598437025923203,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:3
      4⤵
      System Time Discovery
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,8719589837714585582,6656403319902339821,262144 --field-trial-handle=2100,i,553756556727387419,18414598437025923203,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=uk --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,17622318189212782696,649393785599063547,524288 --field-trial-handle=2100,i,553756556727387419,18414598437025923203,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6502749925292106975,6117716870618771181,524288 --field-trial-handle=2100,i,553756556727387419,18414598437025923203,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=uk --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6502749925292106975,6117716870618771181,524288 --field-trial-handle=2100,i,553756556727387419,18414598437025923203,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2692

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2020

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1286dfb3-d561-49b3-86a6-dd5b17b048d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1286dfb3-d561-49b3-86a6-dd5b17b048d8.tmp
Size 24KB
SHA256 59732793a89e685d72bd8ec973b67a9a06536e4fab538d7cea8cdff5ed77bb7a
MD5 2cf990ed0aba0af9bb62ebec0cd50907
SHA1 5b6c8457d7ce34864c4e676c909be753135333ea
SHA512 e49fa4d3836645244fd3172666981b1bb9710c6001119462b7bf3be86015d7fbe680e0b8ec7dde20b34916ca2f3951b0fe8bae3a10131137e3c44d46a1ecd274
SSDEEP 384:n6iFiZcI63sNF8TUNTUlImkrjh+mSAbyfa1DlPxYsa+VYN2gL/7Iz4ol:xFQ63uwg5iKPZYhgOu
TLSH
T107B24935DC98D9ABE9FA4FD6AB4A7A03EEF0016385EC99C4DAD85E1D009319D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

339564e7-e786-41ca-9328-efdb3214b08c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\339564e7-e786-41ca-9328-efdb3214b08c.tmp
Size 26KB
SHA256 27eb998ef2301e0c32d3ae9e88eca64adde56f53e4b52e693c15b532bb54432a
MD5 3fe7cbdb91eac9e0ac79b26fc02982ca
SHA1 af8818e6f9edaefd6da02ed55c8814d6d844ebcf
SHA512 e5b19a447a19d819cc9a967d09b2827614263b6030e1dcc5be874b977fa98acdce54c0e49b825dcb23841f89aadf494ec20fc1bbf1253e2374596d5a10842550
SSDEEP 384:nViFiZcIZ3sNp8TUNTUlI4kljh+kRdubyfa1DlPXO+eBsa+VYN2gL/7Izbol:cFQZ3GwgNniPfOLBhglu
TLSH
T1C8C23935DC58D9ABE8EA4FC6AB4A7643EEF4416385DC59C8DAD85E1D00832DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4699f53d-6795-4ffe-a842-4a2a5ed12143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4699f53d-6795-4ffe-a842-4a2a5ed12143.tmp
Size 30KB
SHA256 fa3ec8e37bb91e5f5ee5f960cc76f1a3f03862fe7ee5c64f70560ff7e1afb9b3
MD5 e37233639e6601965b58a40522e20931
SHA1 0d578775db643daaba53db69986ab8a5f9410bcb
SHA512 b690927d6860a086e81d97dc114d5a23bc7326c843fbdb1a9e412f78bb6e3ec4c8ba796a859af1db110383775e8494e0cfb0be79385ef89c233b0fbe71653792
SSDEEP 384:nniFNZcI6sNp8TUNTUlI4Aljh+hSdubyfa1DlPXO+pSA8LloJdziUtUsa+VYN2gx:iFV6GwghHiPfOAl8qrziUtUhgXu
TLSH
T14FE22975D894DCE798E6DAC5AA4AF602ADE44133868C598CD6F8BD3D208F4FC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8130862c-cffd-45f3-8e53-7c7be85a7471.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8130862c-cffd-45f3-8e53-7c7be85a7471.tmp
Size 26KB
SHA256 57e9e2f799c1eae56fbbcece70da531581374d2a1a2953264a8cc31b9596bfdf
MD5 0199895f03f19e053febb3e1edc52a73
SHA1 6acd0667c7b610d2f3ae89e8e62d008b0d19b8e5
SHA512 1355e038c4a350a08a2e9d2ff189ca6cbe3b36cbee35bba4daa9b2dd6e6b9ebe9ddf6f47d84bfccfc168556814d8a8cd0bb696e664868a7112ce3837824c4791
SSDEEP 384:nniFUZcI73sNp8TUNTUlI4Aljh+vRdubyfa1DlPXO+eBsa+VYN2gL/7Izhol:iFS73GwghYiPfOLBhgXu
TLSH
T1E6C24936DC58D9A7ECEA4FC6AB4A7647EEF4416381DC59C8DAD85E1D00832DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0710244f6c2eaaf4acfb05d61070b45f2aea33a761c2d107e9155296c7dee05a
MD5 49dedd8e82d5adf35b0a617365b032e7
SHA1 12b165c0a22dd4fe75315e395ea7130bdc67800d
SHA512 8e04f3794e65e56ef587814dd94a133c9501a112fcdbb73c38f837b9b10776cec3b2b64532b921e8298beafcf7b3d9527d8264753519db6b3a5f9b59ae71f28b
TLSH
T1FED02BA496C8C9C0C84120361358420830C8D23448A3404644E00244DE9027212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

0652cb48-b42b-4624-ade5-54bb1ac8e84d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0652cb48-b42b-4624-ade5-54bb1ac8e84d.tmp
Size 12KB
SHA256 e5b31ba937ca421f01d103399f63a354cf9775cc54deab7d437ebd3f627aef31
MD5 98535b33c52af2e57131138fbbb21a8c
SHA1 1d172de6517e27157435697f13fec6246c289be8
SHA512 5e7790ecca91bace4d6788b0593cb96442c5454a2f3aea8034bd6cb364e8bdf4abc152474393774c9f6f6b37d27f6d2cdb5408b245cba67c8f201a119799df21
SSDEEP 192:sxZcuRnjE/fcsdXQbwzmmthzoJpLHW6+WNGYC3RaxEIgjoJ:sxZcuxE/fcsdXdqjLHbGAOjM
TLSH
T1A042D7156E28A97F8CC7E219AB55BF53D7F91132A0C01E58EAFC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22286bb4-6bdc-4d7a-a500-caabc7951b4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22286bb4-6bdc-4d7a-a500-caabc7951b4f.tmp
Size 12KB
SHA256 ca9c4baa16871bc38bab452e3ba7348c87d59e6fe8638a260448afc90da8975b
MD5 cdd69fbe846c9b39efbda7adedc3d4af
SHA1 de7d87fd2a3fb231ad13513e33bfaf211f315532
SHA512 3c0dd5155d37ffae3cf5c4b78429448fdc883932f02325295fe7fc3159e7aaab9e5dda30c3b6fbe115bc54ccdf11b8251fc527a8d4938e84a882bbe5ce8dfa3c
SSDEEP 192:sxZcuRnjE/fcstXQbwzmmtgzoJpOcHW6+WNGYC3XaxEIg5RoJ:sxZcuxE/fcstXdqy3HbGWO3M
TLSH
T1AC42E815AE28A97F8CC7E219AB55BF53D7F91132A0C01E58E6FC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26a22919-2fe6-4d85-a481-ae59254b8d18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26a22919-2fe6-4d85-a481-ae59254b8d18.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

696815a4-83e2-42db-a3cb-d0912fb36a03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\696815a4-83e2-42db-a3cb-d0912fb36a03.tmp
Size 13KB
SHA256 1ae5106cca475953a4c5fa0fcb66e1dd5b94096d4b53bdf1c79c9656f6221080
MD5 76a4a8d5792e934f9982a0bbad6e65ee
SHA1 442f16aad089a0a25f4fa107d51460dc27697ccd
SHA512 20c6621ef220d6995af436a093d5ed2c513f11deee3c1111370601d7dd2df68752c917b8804da0c7d2f6c5daf406c63b307195ed54b73334521f2e64c054b0a5
SSDEEP 192:sxZcuR6jE/fcsUWpVuXQbwzmmtgzoJpOd4HW6+WNvz5/YG3jahaIgbjwTaIJ:sxZcuoE/fcsUWvuXdqyI4HbF/y8wp
TLSH
T19E52E815AD28A97F8CC6E219EB557F53E7F91032A0C11E48EAFC8A1C15E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5280ada64bebe7d0eccb53dce5b516e55652809c0062f8c018da5813e9cacc30
MD5 d2ee611569768ced127c84bc89751674
SHA1 38ffd71d8e848b0ecaa5d560ecfaf7cce3ecfb0a
SHA512 b3a11ad063ebd2187fffd4bc8d84d43555d42553350d668b62fe4629dd9f58bcb4be54b6113ebac8b4e45e7f17882eaaf8ae15f66b68ede22b8d52922aefcdc1
SSDEEP 192:G/VJM4CId59ljEpyDArxnUfjHcL6bTD315JrbLB4IIIG9MxoVODnczPx:WHM4CId53jEpXUbbTD31fnLo9MBDcj
TLSH
T15E130B3EB2292E56E2F620BD0B770B3B6B36D443E0E524431632F50665213960D2EFDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 84e43dabcbf1aebc9cafc440440a21cbbc74c2f48eea8a52dba22cc3799e23e7
MD5 64361e3df0d7ebe186f4732b5784fd8c
SHA1 2dd6ba4ef309d841a6ddd5645ba991ffad73753f
SHA512 d3cac3d983a5c7a7256367d1b1aee9133c3d2af9454c463be7e4411887edbcffa9321c79cddf6657174cd1fe2518d1249480806bcfff6f3609b07eee29cc69e5
SSDEEP 1536:danQL/IpL/v+yvo3pVcqZ0vGZL/dL/jL/84:0QL/sL/UGeZL/dL/jL/
TLSH
T130444FF71911601BCBA852F6D3033A3ED17B415E6CD2F8A9E5788C812825B71B6BCF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 99ada220de65b4b246470d42dc685715f376c87e188721d5f0699934f7529bb6
MD5 b179e6fd7ba3f5e528e5ec11f1786aa7
SHA1 6adc48bb109be60feca7250fb805c3f47f29e46f
SHA512 521f24be086d267acef3e28f4ffb066756b9aa749680877232daeedc09604aade58da3c39bff1db029717797b9ef0672be6eee7288d4ce8ec7128c3a61b74cfa
SSDEEP 12288:ZiqonCMoTy7KGOW10zw6AfWqryZQBdgNkSx3bVYwDTTqXKCXHAxliHwfVuk+Fn1R:IEWWVUC66U7EGn5WUFO4G3K2
TLSH
T1A3167DEDCA6858C3CD639930B4F0E9877C7413C3F995D1D68C98C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0cfdc89248b0e14b5eba7721e5d599a154c8748810c969df681d49b69c0b93a5
MD5 c63b9ae3f900894300eb2e2589929d34
SHA1 bcade474a3f05b57f0447dc6c2fd57c94436be92
SHA512 050123cb741f6ea85b1127c2cbdcdb967339ffc62493ceaae96881b2542f32461d612b1812b70edd938a5520bc23ee1d1162f078adbddf64a9164d93da76d1d1
TLSH
T1DD51B1A80EE246A1FB781C7383D17E8B3AB089833C431EE11557C5B84A2935F01543FC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 739dc75bd8cda90ff2584da849cae6dfaef39e451ff32fa545f160fd748f88e1
MD5 321dbb81b7a10471d38aadd3093d2265
SHA1 2cdc53977f8d37b7d41b18a9221d93259675c344
SHA512 4f208e4abe188593b963927aa523d200e084d13fabccdf1e0e8a570f6a6d2455758214a73339d552887e74da4e3914237050da46ec76069f0789ec75714e11cd
SSDEEP 3:MsEllllkEthXllkl2zEkl/Ml:/M/xT02zn/Ml
TLSH
T16F44044CFFC40D0DC500D0304011C37053F0D4110D515743745305137CC55410C44001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e303d82-1e75-4ce4-b1b8-0486c5b6a7dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1e303d82-1e75-4ce4-b1b8-0486c5b6a7dc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 7fc9efb9e8a5ccdf89451233854005fdf76b717db0edb4df00757f71ad4e2806
MD5 f83be56d7056aa00585f6538f9545d5a
SHA1 98cc834a8b269034a80f61543d35751ee8a8e1d0
SHA512 5dce561e69f07c163deb6cdf3bd7b2391410a1a8c0c0f82917e1fe0a2a57ffa23ccd135b5836caefc5584a330cb2e3677979693d2cd5f90aececf15a4e9ca56d
TLSH
T11CE0D8E6A4C6DA1D5718348202646718C7C03457D6C2BD0727C0C9C87A1B541B74265A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 8337efdde94edfe0ddb317fb0bcd498aa182811393de9a4ed22c155a34a81053
MD5 0ff332fbef4d735deb30f0416d979b14
SHA1 2253f571e22f2b8d7eebf6103b09ce064da74d3b
SHA512 7d2b70ecc3da097776c2285e9b27d0fd86ee1ae2779ce847380e4db0cc59ecf467321ba3ecf11ed97800559a764bc82500fe63b321f398ac7bead263e2d76637
TLSH
T125E026AC54CCE92F9518789302686308CBE0342BB3C0390E67C8CC847123249A387394
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9891e9e416fc4f6d901624bb91f7d581bee888524385657025764b763f688439
MD5 842c2fc3c26c388bf4dee46ae3893c5c
SHA1 9cb364eec8f34f210cc78a381ef97296040bb44b
SHA512 eff2888e1e2c6787bf6b3636f2c3153d9c9395be8ba503548faaf022f7ca6730a097165579372827c503d52a5d103e0027ce39f43837784647fd0f87e75cd5d5
TLSH
T105E0D8B485CDD91E5209305B02197708DFA07437E6C43B092B84E980B85A004A7852D5
MD5 SHA1 SHA512 TLSH

Submit Download

6c7c648c-19b8-46d8-a2a2-934fb9f57700.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c7c648c-19b8-46d8-a2a2-934fb9f57700.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7bba2d78-1e51-4a48-9480-8ba3619e7e90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7bba2d78-1e51-4a48-9480-8ba3619e7e90.tmp
Size 1KB
SHA256 19c98391f0dd9548b7dcd8c8ddbe4a03a6d200179fd342378813beb4292c7c5a
MD5 411ffb6b7eefff9eda02694c06b56619
SHA1 2bf84b6586dcf325418a81b73d92882bc0c53295
SHA512 e33b5338d3e6f8b41bb38c39c4147918366e9512a3ccab633ab4a8129e229bfd467cf3fe9638539ae71f46e2c6bec8042ee8f60b6396d8479602cd4d371aaa57
TLSH
T1AD419DF383E4866EC90056F0A718AE2BDE2D0914832C3D59C9D4AF6BD3E3471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

84b48b43-3c11-48b2-97d8-474bc31a3f51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84b48b43-3c11-48b2-97d8-474bc31a3f51.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 cdc2fbedb2341e340700afc78403047066a8065ed82b643c429c0ab465a020e5
MD5 c4f4ad992396817a8ae9f616229a95ae
SHA1 97f4ffb35d071afda51684c99b4e67b15b71c287
SHA512 9970f9d5d34dcd8ae9ad861a85205b29bfa80b480bf606c00fc5b45aa1c99752946f83ff8edfc8c1276ace407dd5cee42aa9ff6e25ee7c425bd3358ce1fdf536
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T1A8928C4E5F346220C0F04B76EDD185672F7C211CD3A72A99DE5410F3DE925ABF1055AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 3706f65b14c375692b630aa2ab19dd860ad6954722bfa7a177a10765e751878e
MD5 08b88cf54ab3d221f811077e3c584934
SHA1 368d881b9a4ae772eb308269e6f52e925694c32a
SHA512 3dd57a19313cb5892611c1f1c0ea7ef798726514544a78e6e013e32405d56e4576377dd24772fd3b6057b3cc52cb7ae379ab8bbc5c111eb6aa35e6d3f9d19132
TLSH
T1BAE026B455CCE93D611920530234934CCFE4F827E2C43D063FC0DA8565AB504F9926D8
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8f8c2b1702120f420249e9554a54e0765a6fe182ebe0971fd3c0ba2e6b3f35a2
MD5 f8d45c1b03acc37893b5c75d4a79ccc2
SHA1 779ed3dd5aef657ec7fbf599c84904bf4657d2e8
SHA512 b8f0a5638d0e82684364e3e16c4e7251e21d10de2d6d1b3f0f451bb95fbb92324e2bdfa54d4e2e28c76e599a568e0854381a282dae83e392aca7d89e82f60ecd
TLSH
T1E6B01241BF209332CCCD4D3003855BC4B351F17121E80513C80C5F300D057EC2E81AD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6ced8fa59176a667f3ca049a560900998e5669ff23ffceb5c0153543358a3237
MD5 d8b11bbebc94d75a0839ca4ae824bda7
SHA1 56ddf9d056e923aef4dfd640efcbb5fb3e5e3827
SHA512 6258282153393ad75a9cbb56a414e57e84e5bea73ba179eda9492eea0db3b04ca652ee8d31143b37c72b27208a2d208410f62f10b29e43025ee948741bd40164
TLSH
T1D8E0687441C9DB3F220860971220E31CCBB2B803D6C828013B88D5C0621B144B743288
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 6fa812e85807f4180bdeca7cbaa31452b07ca169f33ad85f80a948a43062caf7
MD5 30b41f7efdb2837e4edac5f715366820
SHA1 ba3484a373e2a64d03fe11152ed3be764f553a98
SHA512 5ef4fc184c944bb040f3dcac5bcbaedeb4c8b786dc29743fa6087eafc179f1e68d44c0d7739154e93ac0c95ff22eac1f1435b6a60d0f3065e40ac46c1c6872cc
TLSH
T1CEE080BC86DDDA3E5504A09302A4A71CC7F0BC1B97C53F45A78884447957144F76769C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 29KB
SHA256 284939b25caf4fd81e2ac22da466b3517211085bcb1e6a29dbb92590ac84ed36
MD5 ed3ba396dda2c0e16deaf41a70789dc8
SHA1 608265dead2e76e795b79acabb45761b562c7f83
SHA512 3726ca26548bb6ea7e3ab3aa4bd44acb93452e7d8961148880b76b63dc009663214007f1c5400f031538bf8d8adde46ec607de344fb98bcb84d8032a45fad61e
SSDEEP 192:yjNB/XORbkJNlzjk517HN1dbQZnyRFZZBdpg:yZBvOFk3lPk/7t1ZQhynZjda
TLSH
T1E7D24111707B5250383E2D1C81B4972E964272A33079EA6B7FBD44A29E6BE085DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 47548a3802e8b637f1aa8ca8993d3395545b2812e74cb1ddd94a98b3bde3739c
MD5 8bcb070c798b62b3c7a02c5690bcc06e
SHA1 a344f38b86f669103708ff07d3af5d8ea93a7057
SHA512 16278d46a45d3dfe4e7e6220b6b471aa54a0ad8d2d9b78a5c957e9af2ae9cb3563ead073ed78e01f21fdb8e6d0a70febd02880450fab7b3449754a2df4922be2
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQP:yjNB/XORbkJNlzjk517HN1dbQZnyRFv
TLSH
T1AAC20115717B0210383E2D1881B49B6E964272A37078E67B7FBD44A6CE6BE085DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 1999835f46178c85e30eb29e77aff3a995d7929fea15bf776de8de842ca14f40
MD5 127d7195c6837b627600f13785e01972
SHA1 aa550b56f1d141fac325a8a4880c9358ef748893
SHA512 616c992fe2d517b7bbbda3c55a1c61d5537501ed5f7a5a6336b79265866a298c758fcc20c873e2792c95a6be741d5f5d778734b5c065bbb970ae0e4cbf2ded10
SSDEEP 192:P+xFtfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T11324730A7B747001EDE6D9725CB080771A3C716ECF22A6916DB254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5b308b8-342c-445f-bfb8-29cbb676bdf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5b308b8-342c-445f-bfb8-29cbb676bdf2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

af2acc5f-ebb9-4f41-8bda-0e60edb1cda6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af2acc5f-ebb9-4f41-8bda-0e60edb1cda6.tmp
Size 12KB
SHA256 e6a88766c97cd5e88fd4dcaf2919b9dd29034e599268fff5b7cba48b9e8da8f4
MD5 0345a76486e995a3480bb6074b6b7aa7
SHA1 017a172911a672dae93d4153b16491d0af275683
SHA512 5d99d7a1c43bd2b3401fc41cdc7357f5ac846de8cfca507e01ce489963f62117bfa99eac65249222abbfc5c67b9a1a88b7bab16acd8e8203b947bc633405b1ac
SSDEEP 192:sxZcuRnjE/fcsEXQbwzmmtgzoJpOd4HW6+WNvz5/YC3AaxEIg5jwoJ:sxZcuxE/fcsEXdqyI4HbF/xOSM
TLSH
T16142E915AD28A97F4CC7E219B655BF53E7F91132A0C01E58E6FC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbac0068-a06b-46aa-a6bb-12cb20a22093.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbac0068-a06b-46aa-a6bb-12cb20a22093.tmp
Size 13KB
SHA256 dc5a7d672009e9c5b50b6ca549691f303d068562746ede431f6459288826312c
MD5 828c612034fe750a1caa394aa802a4d2
SHA1 dc49f0806486181b64c2617331de73a8785b66e7
SHA512 287d1f390317f3998034b0880abce32783db4a9f44b9102b22c5d5359cd80f1ba15d4331d667ef02f89a51fede6973f1a2fa060bcddfe56525aba679a868f8f1
SSDEEP 192:sxZcuR6jE/fcsOWpVuXQbwzmmtgzoJpOd4HW6+WNvz5/YG3jaREIgbjwTaIJ:sxZcuoE/fcsOWvuXdqyI4HbF/yuwp
TLSH
T1A952E815A928A97F8CC6E219EA55BF53D7F91132A0C11E48A6FC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea324872-63b1-4fa1-8aa8-9b006c897b4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea324872-63b1-4fa1-8aa8-9b006c897b4f.tmp
Size 649B
SHA256 e6fb712a3c08ab40bb25d688161b1f605440d719ce72571ec71d51a9cf8f1bef
MD5 2922739aee674310a186bbc68d18cf2c
SHA1 66e617c51857ead3b8693e13edef95b0edb825c8
SHA512 1798f6877fdece83e3516493a3a5b158d52311ef5ab33b58968d1212ece81fc8444f59c808c519ad98579eda665d510cd7f1162cf5f376bf3dae2e0386746020
TLSH
T1C9F02DB5CD21BC3B18FC072960A54B46F75113573B40488F3B3D410C8FB563B859686C
MD5 SHA1 SHA512 TLSH

Submit Download

f29706ad-4c90-4f6b-abb7-219243b2b03c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f29706ad-4c90-4f6b-abb7-219243b2b03c.tmp
Size 32KB
SHA256 c6b08f704d1d55720c76546ed6818c112ff5cac6b712a23ebee39f1a4e5c592e
MD5 f2f92f527ced5ca491b4db5aa4f6dd57
SHA1 3f9192cefda138702b9d8f8bd6272920fe13dc1c
SHA512 a29b5a7013921ca8e0ad9e02f9a32f370c512ed12c76a21e35c2dc48a12bf71ebf0fcd13e902cf44febae48acffc024764c3b6aa59881d2904bd1af0fb3b95e0
SSDEEP 768:d8+S3Ni7pLxL4V9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8HpwLle4ZvWroS:d8+S3N6N4V9WvhLvbu1jaVHpwLQ8vtKV
TLSH
T125E2EA7B7C0CCA7E4FC00EDDDC1A7E8A6DA802DBA698894047F9945C03D67EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 a5b0705e936b1abe24811c6d9370043e81f3e273ff83c1e73d640269ae6a4962
MD5 f3a6fe6dce22c000a954a7cfed8a65ea
SHA1 94ff1d4d29b76ef82cb9e25e5547e42e1772dd77
SHA512 eee34d39975c2b2367bca360a6a6b1ba24e14e8452e4552fcfa522d88b239b0cef5cb1ae3f4f55a8d05e01cdf57fd011a7ebccbca391b15fb4e7373f207fbce2
TLSH
T1945167C1A399B4947F89BD41C11D5503E8E13F6B261E98B1376E84F48F8DC188E2FE65
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 7474e208d25da30423b43d40cb2d6b00addcc42a99608eeddd91177272b1e603
MD5 31d345fac1e841e43bacb10c602ff0b2
SHA1 e027f06fae797d9046489fcc58134adfca830c63
SHA512 e85ce43b9cc23b41eda8245368a686ce2a78e9a07df98d70e7b792a953721bdf67a52eca296d7da724dd7f372804692cb71db5503d4bcf39fbe889bc5290b18c
SSDEEP 192:NkOa6Asul8TECsfm3uVD7IQEGIII+beMIM45YcYyR:taTssGsuCIQEGIII+beMIMSBb
TLSH
T13F52602F27055B33C18F1FB7136A4BA81BD988814273666D3172285F8DF3A5786D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 a295e00e96dc15aa46b92551dd7b555363fbd4a4ac079b817361debe28b44503
MD5 b0383a350a2b4455119e56aa600e7638
SHA1 ab100227846f31ec6ce22cc7cbe0cc92f137aa54
SHA512 1724d3465e36004311a0afd0794d91dbc0a9af18d26b74a3fef79960c9d35e47bb167bc0e46c84c8dcc39fcdb38b635f747663d6620edfb127d25aebe6079830
TLSH
T1C8E026B4E8CDE96FA11C608B02245348CB81381BFBC1290E6F84CC8CB817204B68B291
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f04835cdd7239f9ffbc779d08dad0adc81b3ff33548576ba1a1bf25449286360
MD5 b28fbfb8f5df98ae8ec2a1063bc37d14
SHA1 e409ab0107fee1e75410f4b3ad0ff43d526ba66d
SHA512 72f1c2d02c2927b915cb989ff724ef2901a11cd18b503e014b61d422aede97413db58c9488e893b1dc5bde3eeb7a8e6da57b48c43410987baed98b5717b46c31
TLSH
T1A4218E51F324C158D18A867D902BD7361738E8169FFCEC0F41B960262EB1F050E8BAF5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 08623ff2b2d129b5ba8659f37b6c575359e62c69854eaa30009789fef0452e6e
MD5 46822abf9d0104989736d0f0a700288b
SHA1 df55581efa749edea9d271bbe09f7e81ee025ddf
SHA512 417e64093f1c3882e83a6e4d5f558a5826668a59620402dd8f7d8709615ad6aa298ef566b9955b36df24d290efbcd625df27a32c89011b797d7d1f9cca0f3ec9
TLSH
T16AE0D8B4A8C8D95F6118209302649348CB953817FBC02E096F80CD887D57145B647255
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 9e5e5fb49a771d7e172465535a69515dc64f01b1bfc7782d40ed56ed4e9d73a3
MD5 dda7d584508183c0af3a9754283c028c
SHA1 113e4fb792b24454b91d8f8f74f4b64ea55e0a32
SHA512 cefb5ec931668181a501581c5e48e66e0c62e861b5f8508ab654d6224dff16b4c2dc5b79714440762fe0cd507e0b36fec5096e740c1ee2ce824d2d61c3d5be1c
SSDEEP 3:MsEllllkEthXllkl2zEelV:/M/xT02zNV
TLSH
T1B444044C7FCC1D55C51430314111C35003F0DC1105117753345544137CC7D414C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 22742ac65b1ef0e109b62fa182827a96150e0a3d773cac1ec3e1fb3d100a189f
MD5 9358e2336dc98fceaf10b71ed9138585
SHA1 2ebaf135819ed48fcd8ca347c875daf0caf80452
SHA512 2acb262601cee29f57023002e742d97cbd75b538baa059f15e3ed2fac7340cdb9ec53174d2047056d91b927dc7cfcd97b7fe95b1eb792c179268f4830d9c2062
SSDEEP 384:nniFNZcI6sNp8TUNTUlI4Aljh+hTdubyfa1DlPXO+pSA8LloJdziUtUsa+VYN2gx:iFV6GwghWiPfOAl8qrziUtUhgXu
TLSH
T10FE22875D894DCE798E6DAC5AA4AF602ADE44233868C598CD6F8BD3D208F4FC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 c55efb0ca9908137cdf0a35dbe6ee802db26adbdc158584241f35ad0d6f4d698
MD5 8ec57e80a66b60173ff3d65f885d034d
SHA1 0e54ade31dc8f854782e4e20697b5dda126d3f53
SHA512 89ef5750e0b3025db41a36462ce10f58b6a493a612ede685e5a090c11c9cdca833e83ea18b03b92ec1f68a55d6f3ba11f5d435d354f237bf00c606d6d90ca43c
SSDEEP 3:MsEllllkEthXllkl2zEelxb:/M/xT02zNN
TLSH
T1B444040C7FCC5D05CD3450304051C35003F0FC51055157C337510417FCC75410C14444
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 b20ca4589c8f379b43c13ae0409461361bb90cecb1dee885333c0ee1d066e862
MD5 a34ec9c59051b8fbf03b12c026f7100d
SHA1 2a5424f849994f5d1035666e8773c60ceeeb2e66
SHA512 cb1fbbd5dc88f914a199591b71613a1df81b9150b5fa6933dc3e23b2adefec833b904a986e03508c567bb9781fbd054f68777cda3aaa893802755cd55a8d4521
TLSH
T11BB02447C473C00FF45540D1C45C034114F4C047011DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

cc17aee7-2d0e-4aed-b5ee-7d0039dc617f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cc17aee7-2d0e-4aed-b5ee-7d0039dc617f.tmp
Size 26KB
SHA256 cfba734c1f1a26554a8a9e8c277af190fb626d37c970595e2eb1932ea4769710
MD5 f1324de6912050b240a816f1660226c2
SHA1 fab8fb1c32336084de9a712bd6e90299df07f797
SHA512 f5e104463b7e3f4496e16fe76edbceec09ebb17573c7a32898c01cceabbb41c83e3784eb0b84cb419159f1177d57046a0c2a4988728832008658b8d44590e23c
SSDEEP 384:nniFiZcI73sNp8TUNTUlI4kljh+vRdubyfa1DlPXO+eBsa+VYN2gL/7Izhol:iFQ73GwgNYiPfOLBhgXu
TLSH
T10CC24935DC58D9A7ECEA4FC6AB4A7643EEF4416381DC59C8DAD85E1D00832DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 7017570471a78ad48e769e847d3ecc53b29ab635f3813881c7dbc889aac6b8d6
MD5 0519629174acc947c2c07561e82a36ff
SHA1 86d2b025330d88ffa0296c800e75685ad1ea562d
SHA512 b689f780891fd3fa4c0ca883d7ada210791a744d5d04db2a898eca6b4b1fc0d921acd89aad71f740718255550a378f3bc20c2611d7be825a1f0a63d1f5d517b2
SSDEEP 768:lQIOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:qxhaqLI1WcxKgdfHJHH
TLSH
T1C163D9FB495B02D0FB9D40F4924B76CCC35B299C8CF8E792F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 8959b8cc46f1b9beedbdf5029b6aed498edbf2b91ddb5441197d397c15a2482d
MD5 314815313242bbcc6711a2fb65f349fe
SHA1 7c1079b87bcc3cf2464ada837df83c5b3acac837
SHA512 9a1d59260247efc364dd4ff0c359c26a453fa517cfd12a8e235a483c0b5d1084bd71e96e481678157d835d7fbc8e32f787b140bd23f33db5bc788b517575582a
SSDEEP 48:sct3ef0WqZ/IHRH34kWqB1kQnjhHmr6ITmUN:sApW6IHRHIbKkQndHmLn
TLSH
T11842A86EDA2CB9A2FEE00B3ED7D1D0123B35A60EC2E4C9F1095B505747C440401DB23E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4d47e6373574f415322e1fcc3cf4bdc8b49245a52a739f4a78621ba9ab8b9d8
MD5 e47764f03993ff7bb0d0af450b9a47d5
SHA1 d3178bd10f89daaafefd721a79e8abdc1fcc0160
SHA512 0ebacc0ddf384fba87c9960810b55142f0dfc7ff3c052b25ed4e7afdae0654ae91c6c7f445e6b28b593f763b29c2ef84298eb8f2680855a091f7249db68fb8dc
TLSH
T16E412A4CBAF9015873B7AE0AABF7A86D487EB8776F06D49D10010E4E4622A40DD61737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ff247d8fd6b2af56a69e7c15daec3d471ecd5fcc74710999be7b5d98977b2abb
MD5 e7ab71427920f4e07b41852634dfa6e4
SHA1 69b13ef6faa3a520e23525bfed3872a3875b088d
SHA512 6ec1e99e7fb285a7a8354d43d48e3653380e1d52cb2bac3524820131ce9cd932548b56ebcbf3b8415c356be82f34e2ee99e04aa5d739e4a9ef92c6aa00b52956
TLSH
T125513B5CA6FD1109B3B37E569BF6B86E487FB9332B07D49D10110E4E0A23A40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2512-448-0x000001F7B89B0000-0x000001F7B99B0000-memory.dmp

Download

memory/5068-163-0x000001C351CE0000-0x000001C352CE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads