hxxp://download roblox free

Analysis

user interaction
yes
max time kernel
77s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://download roblox free
Sample260620-dd4vvaes2x

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4928	Setup (1).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Setup (1).exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4836	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263976831188050"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{A3E2BB4E-C34B-460E-B318-95DA6AD00397}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{19D6DC0E-5549-445E-A929-19820313485E}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Setup (1).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4928	Setup (1).exe
4928	Setup (1).exe
4928	Setup (1).exe
4928	Setup (1).exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	Setup (1).exe
4928	Setup (1).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 5060	1320	msedge.exe	81
PID 1320 wrote to memory of 4836	1320	msedge.exe	82
PID 1320 wrote to memory of 4364	1320	msedge.exe	83
PID 1320 wrote to memory of 4364	1320	msedge.exe	83
PID 1320 wrote to memory of 4364	1320	msedge.exe	83
PID 1320 wrote to memory of 928	1320	msedge.exe	84
PID 1320 wrote to memory of 928	1320	msedge.exe	84
PID 1320 wrote to memory of 4752	1320	msedge.exe	86
PID 1320 wrote to memory of 4752	1320	msedge.exe	86
PID 1320 wrote to memory of 4752	1320	msedge.exe	86
PID 1320 wrote to memory of 2016	1320	msedge.exe	87
PID 1320 wrote to memory of 2016	1320	msedge.exe	87
PID 1320 wrote to memory of 2016	1320	msedge.exe	87
PID 1320 wrote to memory of 4724	1320	msedge.exe	89
PID 1320 wrote to memory of 1032	1320	msedge.exe	90
PID 1320 wrote to memory of 4724	1320	msedge.exe	89
PID 1320 wrote to memory of 4724	1320	msedge.exe	89
PID 1320 wrote to memory of 1680	1320	msedge.exe	91
PID 1320 wrote to memory of 4404	1320	msedge.exe	92
PID 1320 wrote to memory of 1032	1320	msedge.exe	90
PID 1320 wrote to memory of 1032	1320	msedge.exe	90
PID 1320 wrote to memory of 1680	1320	msedge.exe	91
PID 1320 wrote to memory of 1680	1320	msedge.exe	91
PID 1320 wrote to memory of 4404	1320	msedge.exe	92
PID 1320 wrote to memory of 4404	1320	msedge.exe	92
PID 1320 wrote to memory of 3136	1320	msedge.exe	93
PID 1320 wrote to memory of 3136	1320	msedge.exe	93
PID 1320 wrote to memory of 3136	1320	msedge.exe	93
PID 1320 wrote to memory of 4628	1320	msedge.exe	96
PID 1320 wrote to memory of 4628	1320	msedge.exe	96
PID 1320 wrote to memory of 4628	1320	msedge.exe	96
PID 1320 wrote to memory of 3436	1320	msedge.exe	98
PID 1320 wrote to memory of 3740	1320	msedge.exe	99
PID 1320 wrote to memory of 1120	1320	msedge.exe	100
PID 1320 wrote to memory of 3740	1320	msedge.exe	99
PID 1320 wrote to memory of 4008	1320	msedge.exe	101
PID 1320 wrote to memory of 4008	1320	msedge.exe	101
PID 1120 wrote to memory of 1052	1120	msedge.exe	102
PID 1320 wrote to memory of 840	1320	msedge.exe	103
PID 1320 wrote to memory of 840	1320	msedge.exe	103
PID 1320 wrote to memory of 840	1320	msedge.exe	103
PID 1320 wrote to memory of 5012	1320	msedge.exe	104
PID 1320 wrote to memory of 5012	1320	msedge.exe	104
PID 1320 wrote to memory of 3292	1320	msedge.exe	105
PID 1320 wrote to memory of 3292	1320	msedge.exe	105
PID 1320 wrote to memory of 3292	1320	msedge.exe	105
PID 1320 wrote to memory of 752	1320	msedge.exe	106
PID 1320 wrote to memory of 752	1320	msedge.exe	106
PID 1320 wrote to memory of 752	1320	msedge.exe	106
PID 1320 wrote to memory of 1724	1320	msedge.exe	107
PID 1320 wrote to memory of 1724	1320	msedge.exe	107
PID 1320 wrote to memory of 1724	1320	msedge.exe	107
PID 1320 wrote to memory of 3164	1320	msedge.exe	108
PID 1320 wrote to memory of 3164	1320	msedge.exe	108
PID 1320 wrote to memory of 3164	1320	msedge.exe	108
PID 1320 wrote to memory of 704	1320	msedge.exe	109
PID 1320 wrote to memory of 2100	1320	msedge.exe	110
PID 1320 wrote to memory of 2860	1320	msedge.exe	111
PID 1320 wrote to memory of 1800	1320	msedge.exe	112
PID 1320 wrote to memory of 1800	1320	msedge.exe	112
PID 1320 wrote to memory of 1800	1320	msedge.exe	112
PID 1320 wrote to memory of 2020	1320	msedge.exe	113
PID 1320 wrote to memory of 2020	1320	msedge.exe	113
PID 1320 wrote to memory of 2020	1320	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://download roblox free
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffdbeaec188,0x7ffdbeaec194,0x7ffdbeaec1a0
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,6377724446170440154,10913489613053255475,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,5881675516176263164,9870450450720037804,262144 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,11845992316870699782,14434901520069079454,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,18227548364860885732,8715635893072320447,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10304834152867161411,1612072513976667141,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,894955486539715067,1666582506735802243,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,433479928158058565,11673728084592945000,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,12131183684090437424,9189015834849764163,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4316,i,14573224308268666007,9434575457494845753,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5376,i,3339434877794980683,8707194360486760864,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3584,i,10450861586857808669,14795452918193310443,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3012761592292620437,11341400127220052106,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3012761592292620437,11341400127220052106,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12754893688992125226,15592413500469186536,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3471719995532981108,7087520730621502136,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,1814267975959156661,15016201101747153294,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6676,i,10478754426933949738,2050930332274585580,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,98068203695905937,13672296549177556787,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4772,i,165493748709070303,14962913728435974896,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5008,i,2571192667161891624,3415932161881491574,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6788,i,6980156569684965389,18334974776496310228,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3508,i,16141593082448045565,1279001521732943611,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4026173060407277405,17234254108721497334,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6364976193289134132,13217883394201558523,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,12463219991742650351,12912674976942154189,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4408,i,2827736822392956294,11281294749516691684,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4244,i,6376605441220763301,8818506788026873798,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5088,i,4697689356593838666,14013859853019951043,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7292,i,5426039022849092082,6085547100444050315,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10520513907413728591,9834236540693208438,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10520513907413728591,9834236540693208438,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5944,i,1122704769764963681,15053350015303265326,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7300,i,12119392722257219469,6179818519885347082,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5504,i,17857602412888942477,9701119825862977507,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,10742032430022084236,14333267542103860990,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,10742032430022084236,14333267542103860990,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,7407250745585450253,17411573186713073193,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,13033672141400966507,14241225915738682005,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:12
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7692,i,15116022818444910795,16647260923553377294,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,4541692614758784999,15933198568611441554,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7744,i,15736499642875785652,10879012920112126764,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8256,i,3381173613020222850,9137880718797807255,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5052,i,14514330487316995140,16720565307451675728,2097152 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,5642466554000638651,12775896054563107704,524288 --field-trial-handle=2064,i,13654059980079303598,13678696341761863949,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4652
- C:\Users\Admin\Downloads\Setup (1).exe
  "C:\Users\Admin\Downloads\Setup (1).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 22KB
SHA256 9a69e55ff4ec1f8b27de86cf04e55b627f161ee872eb14d9bc536ff0be510201
MD5 7c54aa7ef909fedf027f8da7605bb8b1
SHA1 86b5e8089fe4d24cfdd8cf326094119e9c922e3b
SHA512 78eb0060c63d26d874b412839835f13b66d5065bea5232294b6e4ae01d4e82847c1c87c9abfd3404f66a014d3ddfd0a36709affd12e9d1558c74faeca2a0467e
SSDEEP 384:C3Y9eSfj06/0Xm4hvaxXlgEU/OiCjx5q+dpmecYDWOREtzR/zYDcEYdNJ:2lSfb/0jhaXCCdPq+dzdNE/LYDcFh
TLSH
T13DB2E162679B82E6D5C3E568CB1B889C083ADF844E276382295F6CE219BE135C1D2593
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f08a21db4a78bef4d8a6c50c612e632572ed500f2dcb6d3bb017db3ac8127234
MD5 c3ad755467d7a13d8b8a099cf39636e7
SHA1 529f0908a58e715b6e126de1aa443e095e89f693
SHA512 9dc99fde55320531f4b5415c89d9c8cbae64966e4a7daadea4cd424d83a9c6c17f82fe15b1451d2ccd0bd88fa11d61cc9caf02461ee2f433893156a2a0fba0cd
SSDEEP 192:M+VkQLp1uP45oIxAs76no5tdplxBrfMcczDMJadX0NyQI9ijOpOggLhiUNw5hZfR:M+VkQLp1uP45oI+s76no5tvlxBrfMccJ
TLSH
T139D18F7E21954223E7542974C3EA1BAC373D28B9424B3E410B68993FB07E7FB5913899
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593c34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593c34.TMP
Size 3KB
SHA256 68a75378cb5f966c63c4ea6ed0dd8f90ba786f20256f242d33af9ca7f646b447
MD5 490a3fa82e751f8cd451c0f190c797a4
SHA1 29a8c168a28a8096d0bc893de6104a255a0df9fd
SHA512 796ddb7c180c478d7440217a77299e997c2a646276351cbf0eab56a4a1204140aaaa0b78153988459cd466e5788a8f6f87c8f368888d927876bca3d1e90cc780
TLSH
T12071D53F02428802F3A047B0E4D22118377E50D58B632E591668DA7F7A2FBE79D23C4D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 0b5defab4051eb3f4a38e5ce32cd11473e17c925814bdd11f53f9fcbb7c361c3
MD5 2a9fe3ee8869f2b0c17546e92e497b93
SHA1 2992771026be8a77272b997d30e9ff17f84b9d76
SHA512 573c4cbc57d3bc9fedcafcee6f6681752b9a7c1215ba9348b8bc46d742a5f8f5b0132c4e79ae35b3e9bdce636d6d2e7cefaf680e882c8a7dd3a492bb6390a021
SSDEEP 384:DUGD5l1kpOtNe8ozv8/JDo3+JIeeNideAUi1G8ek7qi/381xVU2HjcZXKdQ6idae:HNYL1KeOf9
TLSH
T114625BB787E48A2DDC2152F1A72D3D1ACD5A0D18533C3D2BCAE5AF5B63D1071E242A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 524a7214ee26e8efd7932014b009ab8eda297773a0191d04aad4256e7f1be4c2
MD5 e22879d1b69601aa89f09fe1d32b03a8
SHA1 08e99f98c3cd9ed584fce24ba89e2494ab4e0c6c
SHA512 abc4c9bf40dfec8a530adee0526906a09a2b5b67e717ff5d7ebc7b628c4c6baf14f9632b320e43cac18fc4699da32495fcdd653b616a127e4bf8c71c7cd36505
TLSH
T1A3D02333154570B9E55C3ED58075BDCFC32710584453FFD911E15579153185D0607540
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58996c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58996c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c46ed8126c864806d45de4db2c975599660af090f8af4b808fe3b84c4bf4fba8
MD5 50501232b5b6db9b52ecf22473735e5a
SHA1 ccd35babe022dff8cd56977c4ed4068251fb8d47
SHA512 9c81a8183fde4a0837a2d7415082c2bbf5245b1f42e7ff687dcffec59fbad3f05c90ba44826542e223d7ace394398825bb537a1878d9644d2e9f56cc1cbb91b6
SSDEEP 192:sxZcRPyM/jK1Ml8MF6/f1sER5Idpjy/W6+WNGY0YcLSbIgrJ:sxZc7d6/f1sERS2/bG5G9
TLSH
T10142E7166A346977CCDBD209FA55BF53D6F81473A2900E44A9FCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 324f20fd71f62e7cc68209721ac9851e47818d54a50bc87f71cf60c997d74489
MD5 be6769429c07af747c241f933799dc97
SHA1 b018b442cb44ab986cd483e9493e38c06790e341
SHA512 7752994c0b431c9e5aad0f23c1b8cdee6aac20b366a1afb008250d8a7645fbccdc7d2adce8b0a48cbae37d488b737cf3b9983eb24dbfb5ababb866f53114a20f
SSDEEP 192:sxZcRPyM/jK1Ml8M5cB46/f1s7HkdpiSihSmS/W6+WNkVHdTHslXYH6sY0sMbIg6:sxZcVBm46/f1s7HEV/bcwXArb94
TLSH
T17172F95266345977CCDBD609B950BF53D7F51463A6904E88AAFCCA0C04EABED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f01a140a705852939b9b9280ff81fb1190484572b1770919d8f603c2325fd4ff
MD5 6e920f709fedfaad3e1c0bf0029534d6
SHA1 13cab047d5c22a0d768de342b0699e9ef7a6e1f0
SHA512 9ac5a7ac96e647bf6e1cfad5964b3e4af4f6f060a56929dcff3e225297acd8b7bf48d9c8dcb2e2b2585d17690debae1037b524e784230d44965cc9be0d75fde1
SSDEEP 192:sxZcRPyM/jK1Ml8M5cB16/f1s7RMdp8ghE/W6+WNiul/Y0Y0LSbIg5frMBk4:sxZcVBm16/f1s7R8M/b9/5Ud94
TLSH
T14A62E95266349977CCDBD609B965BF53D7F8246296500E8CA9FCCA0C04EAAED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 6a0a3aa02a576a7aa027a207c5a48f4a46584d7919231bbef6503faa5acbd377
MD5 f0ae4282e0f5fd1e5ffbb7fbbe3f1bbf
SHA1 7cb0c277346e250b15457a85011084c485dcf0a9
SHA512 4b14060ae940432e8121f6be3de2ed8d0eb3d9b6448831c637a15636da883d579a0fce07fcb195104af4e32a1d45571227f14a812a761e4f96c3db23a803ebe7
SSDEEP 768:Yxl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/djrocc:Yxl1j83r2pmWRmeKQBCu1jaK3ALpCN/A
TLSH
T1C7E22C3B680CC77E4F844E5CEC26AF966ED801CBAB684D5447FA494C03C73EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 5f37f5620fa3e4eff54d4e4a449bbd2912556c2a1f0995b6a3f0d017aef11301
MD5 753074ddbf69be5f53ef3c50d4a0730f
SHA1 4d94f48bb99f9373a1dae850a224a4eed0064857
SHA512 ca3b912514cc0d7104f432f32584974ca14df49a3a1bd378139c18551c63a8565cb7050c4729bdd62ace736f8f5cb143b51a19ca140d743e44f822639e4c5a95
TLSH
T13AB02222A88E008EC0000FF083A228C03BB00C3B0B02220208B8A0FFEC20BC020E2388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fbd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fbd0.TMP
Size 72B
SHA256 a28446cb7f0268542ca068fc26991e18ae85f3cff081fbc10c2da06629b4e983
MD5 37e6daab7d2de44c1e5ce16e741afac5
SHA1 33b72c500bca9ccfeb553bb4a19e13340338515c
SHA512 2276a28e65eacfec04407b9e1d8db7a281c05aaf833809a0ca327d6470570a52ad0d64c096c7bd7f64d25b85b7590b837f6eefc86a585af5f6dfe59b9546508e
TLSH
T10EA0021A824A5A08C44445B5225722721340896D0201130B499494ADFCE21D19661109
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 92c3fc7522a817abc9f4ae3798966f83e0a4fb61d429967ced71dc8471513dcf
MD5 e6dc7c06998b9cf451f2a7223c062cb8
SHA1 be41c3c2115a56b08243b0bb8c6599dc40a56870
SHA512 cbd8afccca04ce4117eb6951116a2904267417c58894f76eae1c9ed5451a8745fc869ce38fee831d04c6ec37fd20b403891a5b0848078d715384a318f5ff0515
SSDEEP 48:KkUIHKtecXypIILKBak3yFdIVKeIoHypMIzK1ycG:KkUgKtemqIAKBaGudSKeIqKMwK1yB
TLSH
T1FDC1E30671BF62463C3D7508B2618B6B4A4272A33069A5EB7F9840B20E67F244DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f54413b9-78f2-4e6b-bb4f-9a1fa7a12b2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f54413b9-78f2-4e6b-bb4f-9a1fa7a12b2a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fc4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fc4d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 135a799a0dee911064a7409ec701dfd9aa9be3e9c7e7b9ebc4e94644854f46ff
MD5 dbb71fef71646af9a897ed24ceceed1a
SHA1 93f095a51c95051aa354358669b48d97475d31a2
SHA512 1c63f1fc31acd85d0f84ebc4f0106da5036a0ce2777c901d4b0f4a81b758a497cdf2a6b51c075d8ee72d4a4e2cac89c052141cd2295ab5ba35a7f26f94aed509
SSDEEP 384:TtNn/s3n9Sf8NKqCRuyU5KgX532V8m/fX58S+2oM/Pb9oRDRAx9C:Tj+9UBEyqN+5floM/ADRAvC
TLSH
T170925C3259349C365ED3AA89F1463A135FB4506BA5C53FD896ED6B1C00CBADC430AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a947ee9ea072f300af61c34e0bc627c09c493111d34b2db2a77168aab86732c7
MD5 4ee8a76f80dac53e30688d36baf9d3b5
SHA1 8c4abe5e5f0d261e592efc4851634750f98977c7
SHA512 6dc13db19530c7b5a62f86584ccd354fc8402743fef42908d82942cd0b66237e2ea748ab2309cf8146932b1fa37914acb16186b5416f710ddc45bdcfbf51acfc
SSDEEP 384:uiF1tNn/s3n9SI8NS8TUNTUlIlZCRuyLVL2gX532V8m/fX58S+2JM/Pb9oRDRAxw:FF1j+9R7wgiEyxLh+5flJM/ADRAvC
TLSH
T1ECC22AF245E78C36D99E5B47A37D2E024FBCC067B4846A94B7985A0CCC8A5BFC306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 560977a9d14a8141369d0eb52f7b15aff3993b4f58d5642e3a97e61c44b70562
MD5 fe46c4a23a736361ebbe20678e820449
SHA1 fafb15bf16fa8225e49df233cfb83f951b22f24c
SHA512 1b29fd0dc503e9a9f93672ca4f112bfcdc161c83f60b0a3993da9e6335ef7d73da8236ac535e549d3e93fd381b6e5bc5df6915898727d8828e198bba46ed1989
SSDEEP 192:6GNL6i5fQmiUyrdpO7X5zPr25jzorm/QajxtBU6:6GNL62h8HO7X532V8m/1bBU6
TLSH
T14602C935A9646C778FE3AD45B58637275FE4102BEA996F80DAEC1B1C00C7A9C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8035ad5425e4c8a6afbe2d69fa153d978f1ea63e6ec4b0c72c92b2af418e03d4
MD5 59be03c427f28f58bdd9d83b241dc386
SHA1 7c4a6a851a62db8492b0eefa3b2157415c222afa
SHA512 b095d696112f7ff5e481e2533e3d59aae5685e39e7a1bdfd8acb8791cd0fb34f58df841835bea22e705b3ac352cb49813874304c368a12b585c7206d16033ba0
SSDEEP 384:AtNn/s3n9Sf8NKZCRuy17L2gX532V8m/fX58S+2oM/Pb9oRDRAx9C:Aj+9U2EyZLh+5floM/ADRAvC
TLSH
T12C925C3259349C365ED3AA89F1463A135FB4506BA5C53FD896ED6B1C00CBADC430AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fedab2d09301572bfc03ef20a89058b34620199b7001959e6c897fab5737e995
MD5 62662f288230a6fede9825b9a164b53f
SHA1 453bfc72e49037d53e644091ab4f8fbfd709a1c1
SHA512 321030d2f2d5cac02dec790ce177cf4079cadbfa69fecf8fce59edea984bc593c171d35c41791a9a7e5708f713a69e788f8c6d775ff23dec025a87c896466ed6
SSDEEP 192:FGNz6i5nQmiUyZOpW7X5zPr25jzorm/fX55+S+2FcGQhrqxU6:FGNz62JDW7X532V8m/fX58S+2oMU6
TLSH
T18A12F935A864AC275ED2A995B18731135FB5512BEB8C6FD0D6EC2B1C00DFA9C530EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8b65dd79b2c647492a3da21ae8bce30e3d45b77c2efff11b41e655a05c96af47
MD5 1a71cd98b3bffd84879cf1a2f3d728cd
SHA1 7385cd5caaedf0fbaaefbf5d8058b777b8a18f39
SHA512 44835dc1ee6ffbc9cf7949c4dab0a585f4fed3880d04442f1702a4b3593128c83c2b64e52c18ba951f8f160e4409f3411725d7d8d71189682c3aa1b6a852c698
TLSH
T16EE00205A200412DC2280130008B1F313E608014058342050771016D9C307107B208E0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 41d1aa86568832df5abd79cf869279135a5b94c93e3d6ff7944540be5dfe67f5
MD5 201472f4351341f4bfc8a751d9ca69f5
SHA1 634cfb9c85e2ae12c5892805807e46feba2ee9bf
SHA512 7afbc17e4e3befacdd2ee780263b69a150f779075748ef16682ebb1b5b8bfc168dd24a07aa717c94efb6c15f18c2e3acf0b331c4401a3201295fa07d86696234
TLSH
T17DE00105E3004129C2281130088B1F202A60C0105582030707710169FC607106E218E0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bec7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bec7.TMP
Size 392B
SHA256 12f259d61a1a2698cdc903f7c6ea07d998bc688645b1ac070b4213574d1dcb38
MD5 a563260a1e528ad94032c6e6b25a098a
SHA1 b83471483cd687d898d61d3473a9b22cc73b1e57
SHA512 707c69b6fb232f34d3713b57b82f400c25a14b8b04ca2bb3f45b384995a3cbbb58da26735718a6bfba1c2c2d58ae8481b9379a5b0cf3fc11c4cb8c298413e421
MD5 SHA1 SHA512

Submit Download

332e7b0e-a6e3-4e41-8304-a16eaab2bf28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\332e7b0e-a6e3-4e41-8304-a16eaab2bf28.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Setup (1).exe

Path C:\Users\Admin\Downloads\Setup (1).exe
Size 4.5MB
SHA256 6609b0808697fc00471b2c3396285f064f0995d5d0705ef51b6b9e6a5d73f581
MD5 0b66b987572c8de513c1d0d26f1f6ca6
SHA1 029b1cfd1d4f1d97029f062eb7ea6cb15464a800
SHA512 5af54b9381e6936370ff743be8be7bd24bce4b9c0ed632ca23a512562ef79bb056efa6fa58d9759ff910c9f1f3aa14b1f24b19880914d848d1d72fc3deae4bc8
SSDEEP 98304:uVzCTWj5bvoX1bE0LIhyotUVXeg79NziJeK6BKbda63PF8pV:uoTIvsNE0LcUNH2eKtbEp
TLSH
T1B2261209DAD702F8DDA7C6BD8A965403D772B8860374CAEF02D197160FAB5E09E3B711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier
Size 63B
SHA256 bb24c3f51558435cf94c88aa6a73e821afcd6908eb72b84b7a4b3bc1d749f046
MD5 f685f47ee4c098fa13f53dd75ce19480
SHA1 853c3fc26579fec667d4f0b6d5a7dfd9413f97cf
SHA512 6cb2b02ecaec1642281f8e034536efb804cdb164833957e44b80ef8c749aa2cd0e4eb3c805b5037fe2fb364498ae3b85160af145dd31ac31b577698b720d72f3
TLSH
T16FA002574D0844550F6535CC36DED45CB50E76984E854384FC5040DBD9850DD43A845A
MD5 SHA1 SHA512 TLSH

Submit Download