a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37

Analysis

user interaction
yes
max time kernel
52s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced.exe
Size 294KB
Sample261024-czrxqsfs71
SHA256 a28b5df1dd5a0dc7e17421cd41bc198d0b0fa6d1d347c7924d3edee09ff88b37
MD5 7e7a8d677ba2465e703a9367fe5847ec
SHA1 e5bec7567061dfb25e2888b84fca9376128a6cf3
SHA512 4b4fe1ffb0680b0fefdb01bd6fc167ea29c6ed11fbc6b8bfb2a6ee2bc642fff32ba1f9f3a8a3d5e6da70a5c7c2f96d77210b9b2b0e351e50b808fa9c7160ed13
SSDEEP 3072:vIQaVQ4eHr1mBs0IoyUlyiYBK4mAbJB3fSN1/3A2+qGl1g7NzUWVMk9PaxrtUEVk:vUesq0IXU3G4O2jGl1gZthDCuHtFdAc
TLSH
T1D654A41FEAA650E1D4BAC0389193713FFCB170A68331A7D79B815A471B61BE4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2396_1423189144\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2396_971065938\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
940	msedge.exe
416	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{3A6EF53D-2CC8-4A03-ADC4-F4044F6C220E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{AD70B359-64B5-4A81-B642-91DA58302424}	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4632	fastflag_injector_gui_enhanced.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4020	4632	fastflag_injector_gui_enhanced.exe	85
PID 4020 wrote to memory of 1344	4020	msedge.exe	86
PID 4020 wrote to memory of 940	4020	msedge.exe	87
PID 4020 wrote to memory of 3500	4020	msedge.exe	88
PID 4020 wrote to memory of 3500	4020	msedge.exe	88
PID 4020 wrote to memory of 3500	4020	msedge.exe	88
PID 4020 wrote to memory of 2560	4020	msedge.exe	89
PID 4020 wrote to memory of 2560	4020	msedge.exe	89
PID 4020 wrote to memory of 5348	4020	msedge.exe	91
PID 4020 wrote to memory of 1448	4020	msedge.exe	92
PID 4020 wrote to memory of 5348	4020	msedge.exe	91
PID 4020 wrote to memory of 5348	4020	msedge.exe	91
PID 4020 wrote to memory of 1448	4020	msedge.exe	92
PID 4020 wrote to memory of 1448	4020	msedge.exe	92
PID 4020 wrote to memory of 4128	4020	msedge.exe	95
PID 4020 wrote to memory of 4128	4020	msedge.exe	95
PID 4020 wrote to memory of 4128	4020	msedge.exe	95
PID 4020 wrote to memory of 2620	4020	msedge.exe	96
PID 4020 wrote to memory of 2620	4020	msedge.exe	96
PID 4020 wrote to memory of 2620	4020	msedge.exe	96
PID 4020 wrote to memory of 3808	4020	msedge.exe	97
PID 4020 wrote to memory of 3976	4020	msedge.exe	98
PID 4020 wrote to memory of 3808	4020	msedge.exe	97
PID 4020 wrote to memory of 3976	4020	msedge.exe	98
PID 4020 wrote to memory of 4844	4020	msedge.exe	102
PID 4020 wrote to memory of 2396	4020	msedge.exe	108
PID 2396 wrote to memory of 4168	2396	msedge.exe	109
PID 2396 wrote to memory of 416	2396	msedge.exe	110
PID 2396 wrote to memory of 4216	2396	msedge.exe	111
PID 2396 wrote to memory of 1188	2396	msedge.exe	112
PID 2396 wrote to memory of 4216	2396	msedge.exe	111
PID 2396 wrote to memory of 1188	2396	msedge.exe	112
PID 2396 wrote to memory of 1188	2396	msedge.exe	112
PID 2396 wrote to memory of 4228	2396	msedge.exe	115
PID 2396 wrote to memory of 5056	2396	msedge.exe	122
PID 2396 wrote to memory of 5924	2396	msedge.exe	123
PID 2396 wrote to memory of 960	2396	msedge.exe	124
PID 2396 wrote to memory of 4200	2396	msedge.exe	125
PID 2396 wrote to memory of 4200	2396	msedge.exe	125
PID 2396 wrote to memory of 4556	2396	msedge.exe	126
PID 2396 wrote to memory of 4556	2396	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guns.lol/davedown
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffedaa3c188,0x7ffedaa3c194,0x7ffedaa3c1a0
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,11022337266103322815,1768404480988780069,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - System Time Discovery
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,12732852913644975019,14131584768919541258,262144 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,12937379893367231727,6503300635630272776,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10999627881893369691,8717418086497802619,2097152 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,8607300885884263880,17601955072536826193,2097152 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5220,i,12929275668478396862,9015745735283090783,2097152 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5484,i,6482652274450789668,3279676265837079842,2097152 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,10314954946911586948,12530671130357553429,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5847112660326132837,16542391616934971693,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:3976
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11521736045199049999,11744849769647635367,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,11521736045199049999,11744849769647635367,524288 --field-trial-handle=2360,i,4073265014995407302,1774608384141107483,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffedaa3c188,0x7ffedaa3c194,0x7ffedaa3c1a0
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,12361914015103733787,511458896514018238,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:3
      4⤵
      System Time Discovery
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,11819681186293067340,11317952934429403445,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3811796038848522838,9579870166028563364,262144 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,1158530833795922237,16834854826469844757,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,1158530833795922237,16834854826469844757,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,5567997943043728273,15627133233864257883,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,16061341584164159137,17948858346425986343,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,2324118949367651791,14118474048676259488,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,11918538821904428488,11490547893862903638,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,17931783322635779344,3361660285576463486,524288 --field-trial-handle=2340,i,10777518972883417487,9494710018933889414,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
      4⤵
      PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2f1fdffa-45a2-418b-97a1-0a074f8a7a41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f1fdffa-45a2-418b-97a1-0a074f8a7a41.tmp
Size 26KB
SHA256 75090b9a667528e6b46f50d4a135f9b8cfc770377b8b8ba982447de4cdff23f7
MD5 7f8e5ebfbcae3093a10d30ad97aa4bdd
SHA1 af39897bb7f5cfacb5703abfbf98d2aae0e16eee
SHA512 3fd8c43f9e1d7da8a983be2fb869a6e60ad62437c46baccee2cad01cc7c3aa3c81a26e94e2f7909dfe3292b1d90c8199fe9cd9d476dd4d25b7e240794df48529
SSDEEP 384:nEiFiZcI63sNy8TUNTUlIm2aKMHBpw2f0BCUvPAVG9gtuLLioF7O6R2FeoSqgL/x:fFQ63jwgcvIBCUwVAgtoLioF7TRXyQ
TLSH
T18CC25C32EC99D9BBEDF64FDAA74A7A03DEF00167859C89C4D9D81D1D00879AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4322b9b9-c4a8-4354-841d-58f9847f3f71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4322b9b9-c4a8-4354-841d-58f9847f3f71.tmp
Size 31KB
SHA256 75a6fca5ce8f7af78e83771d42ac355e34a0383f5b063fba997c6e3e5706eb72
MD5 3d296326d7aa1e3916b1ec0af97e9179
SHA1 f07373297f54f11b7127a5122d6eea38ac4d1efa
SHA512 ea32d6aed75512715bac49c33183cc339fafeca4ce22416a77bee35aa7a1031af4739a272f8181ede7711cbe346252836c50525b7f51b8ed0a60af11e5a78e04
SSDEEP 768:PF55Twg+plBCUwVAgtoritvlkKWuFB54Le:f5UnwxAykKHFBOq
TLSH
T19BE218F1DA56D9A7FFEA0EE5A22B6502DFE00127C4885994FED71CAC0C8A19D13C6816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 29ea26ec51204c89d6c29812c96d75759d549bc69cdf153106a032078e0b6e3c
MD5 626031ecf805ea806111be0322259885
SHA1 a1474dd7fa4cfda2969e58008d55cf3fdee2a739
SHA512 2137e955ef9bcbcdf411ae1b71a2afda3fd388d77cc010bd8b168f6e7770c2a5e7fd21248af86e3f4bf99a3a0e2c7fbb6af78af5e04d21172014cf43f0548515
TLSH
T1F7D08C28763A3EECE12E723909589ACC35899FB356186950170B1F288FE055228D4EEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 898be87634bf02e67a632d41fe06b488b089507c256dc8de8f3e3c356ff4acc8
MD5 b5a087f9560fe126ecd2c68ee08a8b3d
SHA1 b2616c7ebba030c06c2804b3b0b4fe5551475ad2
SHA512 204398a2a9f755afe7c8ce970dfa71ee3022237eeded4dafc61b2081a8b787cecbfa9f6ce3b69e2ba3219a891ec800db004b123ea1718300e03e03c5ac405243
TLSH
T10BD08039736F3D1CDA0F7135194496DC75419F725509AD2015171B144FC052D19C40ED
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 325b72649f982b10ee0459314714ec70e331775dda076e21d549bef773c92553
MD5 2d51c2b918e5b3f25dcde88e3a0751e7
SHA1 84bdbd027c7e514686dffedc5fb56d7797324479
SHA512 ecba9e7719fc34f4fdee6ab09d151d3bb6bbe040de8085491f1d06e544bf80a33d3a3bd5dc872d5cf5e1e6a3a175a64f83bc4e7fda89eac9d9ef30fef7b1aa6e
TLSH
T1F6D08035736B3E1CDA0F7135194496DC75419F735509AD2015171B145FC053D19C40ED
MD5 SHA1 SHA512 TLSH

Submit Download

0677e2e2-d95c-4670-904f-a151fd9838ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0677e2e2-d95c-4670-904f-a151fd9838ce.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2bf51ac3-2f63-4ea0-a606-022898d040df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bf51ac3-2f63-4ea0-a606-022898d040df.tmp
Size 32KB
SHA256 c197dae08a35d8acfa7269b4b54140e7e1466709aa3c942b48a26cc478da81f4
MD5 ac7205aa1ece3caf10a0322425f18a08
SHA1 8f88c4060fdd721740ce2aad99a9c28cd2c53368
SHA512 c8887b0d5d1a1843e5d5813155c142f53b26a266eb36f89a6cbdbcf7b423f646a3b18008b8a882e61df31acf0a13957a9efc7897781bb3e06d7a1624eae200df
SSDEEP 768:Px6r8sW7pLuLbG+Wviy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OV01qpLlvVajYro3:Px6r8s2EbG+Wviy8Ku1ja11qpLd4jjoK
TLSH
T106E2E97B780CCF7E4FC05A9DDD1A7F8A6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30caaeaf-c80c-4962-b95a-a5ffa553b7bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30caaeaf-c80c-4962-b95a-a5ffa553b7bb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

3f8404b4-2ca3-4fe4-baad-e27ea95c90c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f8404b4-2ca3-4fe4-baad-e27ea95c90c9.tmp
Size 13KB
SHA256 277beae78d7297f9b51f581c37b1033cf6a755562d895fadd791ba3daac51ec1
MD5 e676d0eee920bbb266db9e72e0726c1c
SHA1 edcbce9dbfe5d679264ca311dc5894367e73bd8b
SHA512 7895ce0b4dcb0b34a5f05e9894fec4fdd49246ec56ffdb70a0459e95bea6ac35fd3793c04e35542bdf10d286c732265de41070e0cca6a74fa5a42bb576810628
SSDEEP 384:sxZHDX/fDseWvSOPCelyHbEe/7rSjW7ZtI:sfDX/f5YSt5HbT/SjWI
TLSH
T1B552D815AD24A93F8CD7D21AFB55BF62D7F9103394911E44AAFC8A2C14E76ED220350F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eedf12c-13db-4c87-8e49-7fd61022ead3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4eedf12c-13db-4c87-8e49-7fd61022ead3.tmp
Size 13KB
SHA256 97ace7bb5a40d07ff6e0968abeab0d3e25dcb07c91dfec4e501c073d6a26987a
MD5 3a42bfa18ead19e25d2a134ca1a9cf1d
SHA1 cf26ac6f6bc5cb71c4f0069d1de47f77524c3a24
SHA512 a79bfd86a5cf770cfd42940d4f7a6bec512fb15803140a4fe967c611c4a919b085576ca191078411813f66662ceea4707a16c6d111109536afadddd503320dde
SSDEEP 384:sxZHDX/fDsKWvSOPCelyHbEe/7nSj17ZtI:sfDX/f9YSt5HbTTSjhI
TLSH
T1D852D815AD24A93B8CC7D21EFB55BF63D7F9103394A51E44AAFC8A2C14E76ED220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e41a09-622c-4f60-95e5-9a6e78131e54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71e41a09-622c-4f60-95e5-9a6e78131e54.tmp
Size 12KB
SHA256 b94c1ab211eda5aa82c6d13009aefe3127178ce79fd5e93c6f02374e580898fc
MD5 c3a340698b717dd148b91edaab4db645
SHA1 6ee04a7558f85da906f9f5ca5c8d0d73a7527ccf
SHA512 7835e284c527445379fe320c83c052db04c7233b2f9d067a5d0a871a7577b8f239a064fd68394c1c550859fde5bc36c8dd1f0e5bcd661fc729a7177de125f4bd
SSDEEP 192:sxZHRmiX/fDs5aQZLjj81zodpnlyHW6+WNWafIm8/zXao/h2Sj+/DIgjtEJ:sxZHFX/fDssOPIelyHbje/74Sjk7jtI
TLSH
T16642D855AD28A93B8CC7D219FB15BF52D7F9503394950E48AAFC8A2C14EBADD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d11031332741b000e6ad2817e72b16d5c2a4ef279297c263c110b0db0ece1c5e
MD5 68321d8938a3b4f904701fea3359d08b
SHA1 fe53ff0220098b54e4a644625eebb9a9c28f2fc3
SHA512 ab8b4b8ef0d32a0d0c3810b94afabd528d4c022b17a0d92b71000dc48fb67a7fd9333cf12b310128b4741ed443b18e218e8527f0dbac8c3a261d824c6d5ef5f2
SSDEEP 192:jtUK3ppQNEge2EiuCN6pMy2b3ToCmf9gESkIBi6gyCwNScqtvckG3aHYg1sKu4:OK5pQNqix48KyCwNgtvnGK5L
TLSH
T10413193CB6616FD6F6E7487D61DB1BB26BB2D6A4D5C6552B3E35F0300226B1329EE000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d448b647a57ff556e4f9b9a73be7b348ff2ef67638c724be0ae8e5d61552035b
MD5 a472027e658179be83b5f48e1755ed45
SHA1 3b8d58f10dc215ed6c0f4fc0f9845d089afee47c
SHA512 c1c58068802de92d2c54675769cb50dc9ee88da185f08624d645ec194a98958771cd6487ec869a459239e3d5ce285e5d68bee286e61831a71ff0363dee278744
SSDEEP 1536:8a0kSL/QOL/A7zfmBvKWI/JqpL/+L/8L/3AJYbSnTVoOPEPa0+:8rkSL/XL/yqpL/+L/8L/wM
TLSH
T1D34472F71911A00BDFA842F9D6033A3EC177415D6DE1E8A9EA788C812835F7276FDA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 ac0cb7d550238acfea58a64079d14de31a4b51487b9a7f7a7ee65a775f4e1adf
MD5 e9d8b86e88e791955e21a556a8c89970
SHA1 a4e1cc82e21df997acc908d6229445e574704180
SHA512 75918e8c6a4ca086c123d290f8b28383ed03302fbbc97c6ab287c09feeafc34340160e347475b2ee043f433080d643ce71e694540adefa923007b58bc738339d
SSDEEP 3072:4W3n49WGlsHaD7rWyifouwMHdygZhEB+mIhyrZagVx7rpZI1:q9We37ZgmMHdyKKB+mIAZj/I1
TLSH
T15C255DDECF282C83CFB78BB1B4D0D8163E742182B599E0D39441C6E956C2BC57AE526D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6f8526f95dcf93d83388858110ca20537245e0d0e431b06729f41b66efb098a6
MD5 071b4246f593b297a1d1cb7b9d652e18
SHA1 2170c9e1c95e48000e35c4d74298da39f54968b7
SHA512 19e0584d887af1e132aa860ee4a99250b138662c8284fc8ab97eaaa572b3ad57ef6b1a736feace1b81f940e022a0cdb9af2735b6fcce58fb975bba40667defcf
SSDEEP 12288:Hs9FlYv37vlOLbsf/jS7QH21Jq4GRdSDQT4Z97wDbvgMay3J8GP9hbLGUX3j3iUF:arr1fmu4WjDB98xDtnKkg+Lk3gv
TLSH
T108167CEDCA6858C3CD639A30B4F0E9477C7413C3F995D1D68C98C184026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0ec50f4ccd896c45cb70645cbc493c6d4354869c51e4209d8b5db750b8a13fc0
MD5 1053e5bddc5a14c09c8b7e937010a650
SHA1 ccb472764e80a2848bbda56f296d1b260b9ee2cf
SHA512 49466ae0d9c333dc1cddaf2bcd1b81f75350869b8a02464dc96eb62e75775e2bc3d65be26580b317c2556a3c3ca51eb930cc179b8c5100775bb3dfccb13def83
TLSH
T1EE61C86141A16FD6F797C2B181DE0787BA349584DCA71F473DE4C6B85B0A34B63ED014
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

00a85674-fd58-4a93-a88a-acd41f53d4e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\00a85674-fd58-4a93-a88a-acd41f53d4e5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 abb0bbbae49c5728b20ee1ba6c2dd031cce643f988d08ad0398812e16429cdbe
MD5 2fc5af9029478ad196f1cbab6ccd25e3
SHA1 00dc0e80a6d85b6ece60d772d434de12a702c1d2
SHA512 d421a9c4fdc179045812c0034b56c78ecaee028070527d94ba534c3149c0f209272663b4d39111f40ee06f929a8d84fc3529de6292343df8a4e67babaa8323e9
TLSH
T147E0DF96A9CEC12E652938CB15245B08C38436ABD6A5EE472B10C8C8768E905B6866C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 1adc07fe6283c456100643b0af6638e718d4a03ac59dc6a26bf3682450668921
MD5 69165c867181452ccae70c7d413319fc
SHA1 f325a75524a925becd7dcf905d4d8a073e4fc1dd
SHA512 e83f0d031be66faac6562426d6bae3d51153a40e5e0e364526594ee02ff813bc5320ed5817b18d329b3ad337f59f1c5ab1b632c0972b4133a8805ccf5040bec4
TLSH
T1EEE026040CCAC12D9118BDD30F6D430C87D835EBA2B0BA0A574AF844794DB41B3CA2C0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 a3d0f2feb3d9bdc6294fa9f6990e6903cd839bff3a3fd05c1e825b4c93259ed3
MD5 4c1675f9cb9f4728c0f62d57e4d1b0f6
SHA1 a4f345f58d83a229b5d23583e53a95a9cf17ba0a
SHA512 1124ac96f53358a8c5b85d0d4c6d18b83eefa963b7f3aa71952e5dae45ca6e8dc66fce9ec26445289eea2a691fe28817a9e5a2b81cefab81de680054d57704bc
SSDEEP 48:IzBmw6QU1PzI2oVMFolFXv/lsz4UCL81ezhNqMVMcEGFkGlRPjcsO:UBCxI2oV1lHXnqMECRhO
TLSH
T1E0B218472F343403EF412E3F7A1A4479D93BA32C5FA9AE09346028518CF940694791FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 74e48c5d561f36ee890843314fddfba249588a141fe5acee4293e329571fa83b
MD5 24be84ac2fec25251bf11cd38d096a97
SHA1 5534764f0e8a01310d7607702dc9310f7ff7689f
SHA512 609133c772fdb8b30d494dbcf29a9c811921f9dc46e48ae53e133f08fd00f7e24bd776d18b2ce06b0e58a8fbda7fba768ffc34eef7a3ec049dbb8c025b8fd1cc
SSDEEP 96:n6vPIU+bGz83uy3+u4tgp4DLjGQLBze9z3eDjBHMsDEuspU0wbtqrOQpPfR4J+Mk:nef+G83uy3Ct7XBBK6H7DXspU3iD
TLSH
T15B14111E5F243721CDBD917669E744B35D7CF03F8B1266CA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 596B
SHA256 eb77b139cfba14a1819c50866d62e593826972b37d05a8fbf6489d602eff3208
MD5 d9f9d5319df9e88abb2907b0c2e9c214
SHA1 82d3c9c15b5b1c077a2c9731da6960ad7191e55d
SHA512 03b30936c522343deef226cb0c0d23682ee0c6aea445b9e0a5a14e0829bedfb563609d8dcca942f8cb6ffb6ff398c5fe45f56bed0df0dd6343d36fb5c41c6e53
TLSH
T1D3F0C2B72C2A4953E7420EB03D9277FCE756920C8DD8A3D5CB02901A0DA04F441E1814
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 3ba6eed79e14d67ca22a3c54048088d9e52e4a6df7d84ad7d07df931dc09996c
MD5 f3d461b2045596c7998203cf53c018e8
SHA1 e9d2b0dc29b6a20462b253996e72d717c1b3cebf
SHA512 13b37f4a7b7f35e70d1c98de28eb74f2850d4a74ace20883d59fa28b361beda9dfaebff1b1da4316a44a63af25a2c102974aae3662f9f04f8665857cfdddcdf3
TLSH
T1B5E0D8A044EDC22957487D97163C6708C7B4366FD6A4BB052B14D948B48D504B7C91C2
MD5 SHA1 SHA512 TLSH

Submit Download

795c00d8-4e01-4afb-9617-030dd1c4587b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\795c00d8-4e01-4afb-9617-030dd1c4587b.tmp
Size 4KB
SHA256 d1c0f32537f8d836f55f4a8053ca79297ea00ed8b9e84f5078f72bfc01027041
MD5 9264776d56d5608a5144fd5ab1f2b5a4
SHA1 f9d76afe737767b855338a729bf95e5e0ae090fe
SHA512 b7f25d5457b504096ea1655fb94b484495f4a937550f19ea0118c93b1e05c227eea023486650f191ffa29c1a2dc2c3762d1ee9d609b0cc04e6b1f285f5df4695
SSDEEP 96:D1YO/+N84qaaGxzBLDExL0jDLuYq+AwB7cw:D1D/+N84qaaGx1LDExL0jDLuYq+Ak7cw
TLSH
T12791C0F387E9869ED91163F1EA147E2BCE1D0918432C3C1AC5D49F1B97F24B1E181A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 cc3c2e6977967ff20d8d3d6baeda7239906c341e2afeb933e082a29b5fed9713
MD5 e4087253bc300e50039c907b333d87cf
SHA1 184404c287b4538604145b138984d40cfb22abc1
SHA512 5786a70d3e9583195063172ef0abde4a3b60dec618e12340762777605235992f0f2230ec9faf4c22718a31d8abdafd7b89852a2f00fc9b3938cb383a9c7dd640
SSDEEP 96:iSeMatUaAKfBQ7EQeBvaob3+nitF2BrArFimRZ0aXyRiB:iSLaSaHfEEQeZDL+niX2eFimRZRXyRu
TLSH
T17C92D94E5F206302D1EA2F36EAE285027D2C2068C76374969D8154B1CC21BEBBF5747D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c60cdae977444173f2ce93f25c077667899d0164de171ffc99b9cf2d26d11cab
MD5 9d587f2ab1864cd0eb0a837b16c31a6c
SHA1 3dbd40f8bd9ea2ef144bbcaaf40a8805ed3019ee
SHA512 9176251f610bba293d8e74f72fcbac00a123a0491dde49615130403017bf1a3f1ed3d417040f0e5523f6a170b8c86f1a3d25880006513bb88a06648fb6354eb0
SSDEEP 192:eIEumQv8m1ccnvS6pKGEpfLnf4FWpf8m2uE:XpXpKGGfMFAfSh
TLSH
T1B3F237FB162B654AE98415B0E0007E9F9F06000B42F5B6ECA6C457E3F7A34F2B079B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 d6fd19ba701aadf2f57985d5fe54bae13f6daeca34477dba562f3a3a30403a2f
MD5 134d9622896eadc2c1a51d48a6c51152
SHA1 d87961a885c02bbfc269d44d04475b9d960bb5a0
SHA512 f8c7c9f349bb7741ca5eb8c6775f156af3e375caeb5c6c8625b0e54e0f1d9267be4481cd9a45cbd5add2c2078b796bfc785c1d149ea9bda9db610991f3107ce5
TLSH
T156F0C9979CBAE4FB012D483B8C48BC405B7AD83D026048F8EAB7427CB0C19F36B12036
MD5 SHA1 SHA512 TLSH

Submit Download

c18ca17d-62d3-4191-ae23-9855e979d872.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c18ca17d-62d3-4191-ae23-9855e979d872.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ddd80c78-86cb-4d91-8849-208ea4efd0fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ddd80c78-86cb-4d91-8849-208ea4efd0fc.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ae70a35a90054ea496162593ebdc493e227bb92515f7c5428a8d04dae3792c76
MD5 c9df57e9f739f068656bab90aab08e4a
SHA1 55fd38fc32d964a2e0e742dfae76b72f76a9b75b
SHA512 f6a13f2030bd6c6aaedd40a1df02b2bb34d0316f8b90df1e64081b4a0e85e8177aca9b8eddd78b8ca1ab36d12f67e73f2c284b08821e38aa85bedc71b0a4a6b9
TLSH
T1C6E0261005C9D1BD601AB4C30B34E30C83E875BBE2F4FE0A2F20EA48718EE84B2D61D0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3896bfee36a8d156e2afa91dc667fab2ad932c46fbb4662f2a19c126270f9780
MD5 ce34e406c3c1359e9d8702e959e6f25e
SHA1 881fdd6d76bd6ee97c775645920f85aa5144524a
SHA512 8b8f9a79205cc11ebe45b39375a698b815d766a60480128a8b03d16b2f847c76e4f127608e1d52dc8d68c49654b28e8f079513e2aca1e548c8e6371822ffa0e5
TLSH
T1F2B012647B107301C6DC463036605B70A704E005308AB5176CA87F250DC416D3F05CD9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 558cf8a817fdb46e74186df43035f6a5138d7406f3914595da205ea79caf930a
MD5 b9154d4a1815ccaf1908db92d725fccc
SHA1 ada90192a99e3d5c82df567e472d4dbf0ab48b10
SHA512 90a19925d599b5e6762acb3f7bbbf03a1736eeef7e44b4d89146f47572ab38e7f4f1dfec50355d2e5c92136a1e25e91aceb81b65baa774b3de145fd68f19bd9f
TLSH
T153E0D83426CAC22A614A74C72B24E388D3A27567D6F8AA152B08D584724E684B38B190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0cfbca81dd15b57a06ff2473d569a6d2c1244779ff499a38d6aa0c8d49f9bfc6
MD5 e24f6f5c6accc0898c1cbdbb1f8d51cf
SHA1 365186001468d24790af0f3add12cd0f81ebb879
SHA512 d5400acf60f8435497af9837b09deb07e7e83c55993aef309b8cbd4552a9a0d1aa4929485e4500c9e5194903cd2204175bfa699d607afae1b924af49a40a7ba5
TLSH
T183E0267446DCC239550A74C70375E74CC3F0796B93F8BB8A57088484B24D680B3EA1D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 30198df532094d060eb91dc7929e5a71c2f928ace0c93a1140bc1959359392ef
MD5 8c6c6f12db00b3875343ed09951375dc
SHA1 8d43074685f4401df319080a94aa49f3797522b0
SHA512 66775e5e9bfccbb074266f03bd695ad47500a0f05ad54e158f3c972c20bfaa34ecd0bdfd9235d4611a49fffc66bc59a624efb3744c2c306e017f6653d43ab137
SSDEEP 384:SL29ObJffppdNlrtEYFdFyFJFtF3FrFPFYFrFsFRFFFxFBpFvFIFNFtFMF3Fm:SL29ObJffppdNlrtEoHWL31R9oRkj/Dm
TLSH
T175B2111571BB421039FE295891B6972E068231B33119E66F7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 28KB
SHA256 e64144757ed05d4c0c862b33624d23f62505214e1a324339007a6712284f4df9
MD5 d6bf36c6862ac65608d0598040b6af2e
SHA1 48fc39521b43a8ec9bebd83fba23b7267fb6d3bf
SHA512 214db84d971bfcb49dc36f5481613186f6b87a51c712e16ae9f006970e42da0691f0db285a9b20a231cc3ea06961ac2c25ce59bac425e5996cf1fcbe4d54abde
SSDEEP 768:SL29ObJffppdNlrtEoHWL31R9oRkj/DBrd4X3E1kbEdf:SL29ObJffppdNlrtEoHWL31R9oRkj/Df
TLSH
T143D23E1471BB425038BE390891B69B6A468271B37118E66F7FBD40F68E2BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 57be2e8a38b1567f6a001573d19de835010947ffd358cefa33ff6e76f16eb33b
MD5 bfd752a9183d44673436a64ee587d34c
SHA1 ce417c09cb63b2687b654c8e66e75647599509b0
SHA512 fc097fb26118b880a177b0ba2b72ba310d70a7a05d3ce739a81cd1a508026a0f961626913d70ae2bb0c2e49f7f5bc849c12b9fe98da0bed70b9b865658ce7207
SSDEEP 192:P+xWFSzfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxJfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DB24630A6B747001EDE6D9721CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 515a66ac5ee4bc3cc4f4990d8f0b3424f12da2b0507663c4cee801fd46ecc180
MD5 7c8830c5b9827dfbd69dd07f6bd7daa8
SHA1 bb9c81a72128897988eda4d69e42e97bde17f0f6
SHA512 94df24579cee7b2c3ad881e18e317d4fe5e71cc77f9f5208a32c259ef6641ea696614aaab78243f163d6efb3e5f07b928b795a5eec50f9109537e026ba398550
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgTM68T3MMGt:DEK3tjkSI5IUltGhp22iSBgo684MW
TLSH
T13952AC9FFE343212CDE983319EC002E1BE7B913E8FC1DB0258DA20115EB45A1632E59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2975b76-74a1-4153-87d0-aa885c557dde.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2975b76-74a1-4153-87d0-aa885c557dde.tmp
Size 414B
SHA256 e8b6ddaa094102d10e68ee561a5da2ec10399081245ed1afa8db5b613f0b891f
MD5 6fe72e06f5698c2b9a05921df626848d
SHA1 8c7905188b369923a1816dff7f51cf945fbb9f01
SHA512 7e984f9d8fd94040a42e4e2cf055ff7a26ac82e79be605480f054e50d5fd3028011833892229265de5d3eb4844e5f02b87fb298991c549c3de7a95da7cfa3eea
TLSH
T195E02B6AC811FC3B08FD5B7D90940346EB1113272A50984F3B3E95088FB09374585D6C
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 3KB
SHA256 8141262c119a4f1f90f190a1833c2e19af676fd3baaaf81a1364bbdb8cea1b4f
MD5 028465eb7f043934eadb8e31fdc35d27
SHA1 f07855aa0843e31beda05a401b95416a6a405600
SHA512 fe44c66b4c3378fb05af89b48f200e6f4047def2bbedd1d8a7a14ec28e4b4670ad799000fc20ecf8613ea571d9c74863752996ea8b6793d770bc910d801e71a3
TLSH
T18B7163C0A2D95098BECAB981C21D5613A5E53E7B230E99B1633E84F54F4CC185F6FE71
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 e385adcf6d065f23160dd96625f5ee4184032ad0d50bdb29cf13b9c6d3f79a5b
MD5 2a981ffb8c0dd340398e2444b976378e
SHA1 8425404a2f335b1d4b7e8cfdaa1ae28ae2144bb3
SHA512 dfc1dcc4b9f8fd17075d82728909a9ce769044f60570ca4c62c0c8c127bdf5b7d8f8768c3e58a7e3d70fa21d0d697f5e4bdffc1b1ea2c67dea3b8a703c741ef3
SSDEEP 192:8gR4OE8Aslli0wQ2sCxJnBJvaJa2D+95QkIIIbbLMIMNsYcYZ9:8eEls/72sAX95QkIIIbbLMIM2B
TLSH
T18752632D260A1B33D05E5F77136E47A59BDD888142B3226C3062584F9DF7A67C6C92F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 952c76d76cedc12cf00d0a5580f9f2575183c5e9875faaab9555eedfe92e737c
MD5 df5c276583bc33df0dc424bba39490de
SHA1 c3d1e9ffdb14f8193e64755c9f493f2b0ba67984
SHA512 e5249a6db69fcc3a71964383fd3013296906a3150f48e52430eb856533cfef0e8af3a8feb7b90cbff99d832da1b13c8bfa8be513902dfa40c7533265e235d428
TLSH
T1CEE02610ACECC12EE01974CB1136C30CC3843A6BEAF0AA8A1F00C488B48D601F7CB1C1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 12ef40cf1292c21bcd821c237b65d07dd3e2b8ff1a4a39f559b8666905a8662b
MD5 74d1e9e378f242ecacca598aa60d44a8
SHA1 fb66f3a18988d0a211262a85cf03ffb6bf844c52
SHA512 4af0e6569d4af92f3c228ffd58ed38f10ad42c4b9ddd7b436c7fd83cd5117e26df7ba87a0c2c9e0093f97e62f1670ef93163bd562a10a7256242c7cff24aac98
TLSH
T1FD21B245F320C249E14E967EA46A9B391338E9168FFCED0F847924352D72F141E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 5e77133f633d8a602ec210a41b750a6b8a4c76d7dcc5888e13b9c8cf3e0953a2
MD5 ef8d7eb33b2e9ab56c9bbbd99d7d9a25
SHA1 af8dceaa0f6dadb257e8efac02adf3831242bc50
SHA512 bd3a1dc26294fea82f853b7c1c0e001c97a32a5bfed2c367327aa3f88973556502ef7b06bfb5ccc7ec24caf3b486752797ebd2d3eb4dc6f9e1e5f50258d6fc8f
TLSH
T181E0DF10ACD8C16F901934C70A75E34CC39539ABEAB0AF4A1F00C988A18D642B7CA181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 2e80630eb51a234e08e955a42f2bc1868b4b349ce0766aeb96f53f9dbc36230c
MD5 7f4b2f7197d2c7d2079cd8469cf2281a
SHA1 43ca92f44ee12010e02d6704f1ea61e85d46c099
SHA512 4d31646aff0eaf9eb465ade1b088153e514f2325eb9795a394af6cc690f6cee852140cf1344beb6508c99b9fa35e45643e734f354b45e70f3d967609f0f8fbd4
SSDEEP 3:MsEllllkEthXllkl2zEflWJ0/:/M/xT02z5
TLSH
T1174404047FC00515D70054304071C3501370F5350511574374FF4433DCC7DC00D50000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b522c66143ae102772d0b6702d5d9a40faff12fa68d5174e9a6664ba5bbc1940
MD5 8cbd6b2ca3d9e6e8e538c8bd5d189a6c
SHA1 11ba39bf9afd59ba36a998630081a1f9040b15a4
SHA512 658bb46bb7dcc678ca15490c15f16ff944bd46147cc20f391f54e7ed18b5934ff934c32e57ef747566e5bfa94e7a2fb3d965589527568bf9a25cd2763a33626a
SSDEEP 3:MsEllllkEthXllkl2zEflncl:/M/xT02z6c
TLSH
T1584404047FC00435F51010314051C7503370D4310511574334F34433DCD75C50D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 8fff1674decde08ec422538d02f4ac02ddf0803922f451c9b15916343a310c64
MD5 b6d7c0b53f8aed5ba7a8ce130c874d5f
SHA1 5ed11d5e382d45a89bbfea02a73b5676602e3d88
SHA512 fc1448eb35a4908524b43c04a0cd5f54194e7b404f9a42730f21e0907ee30a83f0ca776fc9fb42b6949f046ad6d45e3e181c9548f8cd25d7c415cdb177e3a362
SSDEEP 768:PF55Twg+GlBCUwVAgtoritvlkKWuFB54Le:f5UUwxAykKHFBOq
TLSH
T15AE218F1DA56D9A7FFEA0EE5A22B6503DFE00127C4885994FED71CAC0C8B19D13C6816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 65d98d3ad7b3b59ed74ce5ddb5812a81d14b431cb000ef735825fe1cd4671406
MD5 f32e6c8253fc08a7cffd4f8d9dba3511
SHA1 86d3d7e0846e05cd50ccd1c8a15072c51c05be38
SHA512 25edc5bfcf164ff02ad2ac39ab902cfaf26fa6cbe869780e0578202fe4d13bac0944d24a25872d812b55d8af8ffb42542cd0cab4a694e7c954c91c98b9985c42
SSDEEP 3:MsEllllkEthXllkl2zEfldal:/M/xT02zT
TLSH
T1C04404147FC0041DD50070305051C3501370D51D0511574334D34C735CC75C11D04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

cbcb5c9d-0315-4f68-88c1-c4bfd114eaca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbcb5c9d-0315-4f68-88c1-c4bfd114eaca.tmp
Size 25KB
SHA256 4a17286c4e0e7cf22aaf200da2520a928bbb62e4b5b5906466323ecafe49fbf7
MD5 bf56540ea57665f22a75fcfa195c81a5
SHA1 e2f07da394f112d202cbf080ef77e81d76ecfe08
SHA512 c4467975593fd229e790ed4bbc5ebd0bb71236f415d49b80881f372a1f6802400c017e0b2c9ff28317b3114bb341b8176b4facbabe0189fed65506615f147aa3
SSDEEP 384:n0iFiZcI2sNG8TUNTUlI4kaKMIXMw2f0BCUvPAVG9gtuLxioFX4MgL/7IzwoY:PFQ2TwgqclBCUwVAgtoxioFX49b
TLSH
T16BB24B32EC95D9BBEDFA4FC6A74A7A03DEE00167849C99C4D9D91D1D00935EE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea863c29-e428-4f44-b406-fd9ba6027e59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea863c29-e428-4f44-b406-fd9ba6027e59.tmp
Size 25KB
SHA256 fe9f35d7780f5238b65b76139bc7548a9d5fb7d503b69f4d35641bebabc67e63
MD5 76a58f07b1bccb50b672d2fd00082c75
SHA1 766fe6bb08c7c9b278fca0bdcd2e21d78d46247c
SHA512 831977cbf681a81c34e889ec73cf09fb5109f368052eed315244e42211c8157d714add491d5a73d7bd152e0b71ecb604d6c91c554709d6b3fe29e4ac064bda3f
SSDEEP 384:nCiFiZcI63sNK8TUNTUlIm2aKMi94w2f0BCUvPAVG9g7F67O6R2FeoSqgL/7Iz7Q:JFQ63DwgceZBCUwVAg7F67TRXyQ
TLSH
T1B0C25B32EC99DABBEDFA4FDAA74A7A03DEF00163959C89C4D9D81D1D00835AD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 68KB
SHA256 9061cef2dae36773bac05af99d1133ae3692f735df7565ff5f17f40a9deed9ec
MD5 88bf35a77b25e16c2037a71dfa6c2ddb
SHA1 2d6c7cfeea66e7cee4cc057e175d750b3f25d8c2
SHA512 9ae87b7b18aa23df20082c9f55ebc9d731675eeea7cdfe9270bda1f6c72d9c44280986bb3b6415da0ad26735e6949728b8e46327ba31cf424615aeded58b7e55
SSDEEP 768:OQaOTpdNuwT4shrJWRIdaqrLI1WcxKT0dTTTjTVHAM:xLhaqLI1WcxKgdfHJHH
TLSH
T1AD63D9FB495B02D0FB9941F4924B76CCC35B299C8CF8E7D2F96188176AB04B4E255A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 768c3b9fcd039d9faa1a92eafd4d92a21d0b9e85735fcc1b4ecd0ebacb86e83c
MD5 484319a3bde1556f9b82d30ae41d492e
SHA1 cf64711637fba7fd47dfa30493c41821975585c9
SHA512 37db3d58f3b824cae12b3dcec90a826c2f04358bc38740dd179fe18d56411de0f70fa446a4bbe9f5afeec112e882704982d84ac03df3a5b18dfcfebe034792f4
SSDEEP 24:4zA4pC5fbqLo4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwE:5pbqp/IHRH34kWqB1kQnjhHmr6ITmU3
TLSH
T15842896EDA2CA9A2FEE00B3ED7D1E0127B36A60EC2E4D5F1095B505747C544405DB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 559abbf69a622dc0efd78aa49fa6ab765ae3b4d149493ebcc0cb2f0b86f03a7b
MD5 781bcf7bf064035de546551fd69ac2fb
SHA1 b3eb6ee530d8cb2fab3273656ebcbdc342babf3c
SHA512 947464bdff0a47124fac7a5254c099397b4c64c425e38f677c8b07102627db2b1749fc5827b9355116d076d009722f584f27a555393039042d3d5dd72616c4e9
TLSH
T1F4412B4CAAEA1148B7B77F1A9FF6A86E087F78772E0AD45D10110E4F0623A44D971B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 7b7c1a3a057362fa0e9a573b67c5c438165f27c9b21ca29415a6587aceb279ed
MD5 22dd9c1d3521cdbe378908fc290c4816
SHA1 c94a08042ec949a7c83f0756189ee817ad584ba2
SHA512 12932a7e188f4efea1fe2db33cd7e685ffdb4517a5d88ec7a795965ca0cc073f7fec39a6a9f111d644eaa4b23e777e2395bd611d2cd381abe3b7c9e00af4928c
TLSH
T154514E6896F91158B3B37F5A9BF6786D587FB9332F0694AE10120E4F0A22B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2396_2058650552\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4228-580-0x000001B6348E0000-0x000001B6358E0000-memory.dmp

Download

memory/4844-406-0x0000023480000000-0x0000023481000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads