hxxps://github[.]com/notdeathlyatall/Coco-bar-V2[.]git

Analysis

user interaction
yes
max time kernel
900s
max time network
839s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/notdeathlyatall/Coco-bar-V2.git
Sample260804-s7vxcs1yft

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
35	camo.githubusercontent.com
36	camo.githubusercontent.com
38	camo.githubusercontent.com
40	camo.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303320077466274"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{35883D95-9D76-48F7-8D75-194C7D8B9E80}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 6104	5848	msedge.exe	89
PID 5848 wrote to memory of 1104	5848	msedge.exe	90
PID 5848 wrote to memory of 5452	5848	msedge.exe	91
PID 5848 wrote to memory of 1104	5848	msedge.exe	90
PID 5848 wrote to memory of 1104	5848	msedge.exe	90
PID 5848 wrote to memory of 2892	5848	msedge.exe	92
PID 5848 wrote to memory of 2892	5848	msedge.exe	92
PID 5848 wrote to memory of 4960	5848	msedge.exe	94
PID 5848 wrote to memory of 4960	5848	msedge.exe	94
PID 5848 wrote to memory of 3664	5848	msedge.exe	95
PID 5848 wrote to memory of 4960	5848	msedge.exe	94
PID 5848 wrote to memory of 3664	5848	msedge.exe	95
PID 5848 wrote to memory of 3664	5848	msedge.exe	95
PID 5848 wrote to memory of 1424	5848	msedge.exe	96
PID 5848 wrote to memory of 1424	5848	msedge.exe	96
PID 5848 wrote to memory of 1424	5848	msedge.exe	96
PID 5848 wrote to memory of 2592	5848	msedge.exe	97
PID 5848 wrote to memory of 2592	5848	msedge.exe	97
PID 5848 wrote to memory of 2592	5848	msedge.exe	97
PID 5848 wrote to memory of 1880	5848	msedge.exe	99
PID 5848 wrote to memory of 1880	5848	msedge.exe	99
PID 5848 wrote to memory of 3272	5848	msedge.exe	100
PID 5848 wrote to memory of 3272	5848	msedge.exe	100
PID 5848 wrote to memory of 2980	5848	msedge.exe	102
PID 5848 wrote to memory of 5016	5848	msedge.exe	105
PID 5848 wrote to memory of 5016	5848	msedge.exe	105
PID 5848 wrote to memory of 3076	5848	msedge.exe	106
PID 5848 wrote to memory of 3076	5848	msedge.exe	106
PID 5848 wrote to memory of 3076	5848	msedge.exe	106
PID 5848 wrote to memory of 2108	5848	msedge.exe	107
PID 5848 wrote to memory of 1348	5848	msedge.exe	112
PID 5848 wrote to memory of 5812	5848	msedge.exe	113
PID 5848 wrote to memory of 5364	5848	msedge.exe	114
PID 5848 wrote to memory of 4316	5848	msedge.exe	115
PID 5848 wrote to memory of 4316	5848	msedge.exe	115
PID 5848 wrote to memory of 1868	5848	msedge.exe	117
PID 5848 wrote to memory of 4224	5848	msedge.exe	118
PID 5848 wrote to memory of 4224	5848	msedge.exe	118
PID 5848 wrote to memory of 756	5848	msedge.exe	119
PID 5848 wrote to memory of 756	5848	msedge.exe	119
PID 5848 wrote to memory of 3352	5848	msedge.exe	120
PID 5848 wrote to memory of 3352	5848	msedge.exe	120
PID 5848 wrote to memory of 3308	5848	msedge.exe	121
PID 5848 wrote to memory of 3308	5848	msedge.exe	121
PID 5848 wrote to memory of 248	5848	msedge.exe	122
PID 5848 wrote to memory of 248	5848	msedge.exe	122
PID 5848 wrote to memory of 3644	5848	msedge.exe	130
PID 5848 wrote to memory of 3644	5848	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/notdeathlyatall/Coco-bar-V2.git
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x2c4,0x7ffd3968c188,0x7ffd3968c194,0x7ffd3968c1a0
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,13740354530280376223,2954285369115316631,262144 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,4606014536224107421,3165002099137603485,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,5288487758585020475,13374986511901644775,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14433644134287491699,17576026406655999025,2097152 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,14549330857971952411,3655772592485861433,2097152 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,1564206713800603068,7679956269290148875,2097152 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,846080501739820221,3174510397208483804,2097152 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,12548229653042954842,13857044000289098698,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14878830778978263426,723843390574539058,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,806163091521219304,5332860818793377506,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,806163091521219304,5332860818793377506,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7844797863055853822,4609927894208661826,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6280,i,1278258878168579782,18321931187282216348,2097152 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,4247150121715142943,16207793295031356533,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,8204649461063541133,5890062029623853126,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5098880375627666840,16420548005936148703,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,15708138085719975931,17461382837465529789,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,1154975150150577030,4491081119582837235,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=832,i,10489511091606816787,8016902735177111626,262144 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16573924926340973782,16293420301722038178,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,9594671881797819480,8436497350614073573,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,12768322416032005662,2808991238532757506,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,9918268474923782521,13475943181764873068,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1112,i,14836252665935904819,14769517314353200551,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=1116 /prefetch:14
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3152,i,4039297209262919794,9374499368442448599,524288 --field-trial-handle=2840,i,5550117312918173165,15744485106450571993,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2200

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5bfe405c42793d62dc1701dbf9939c882f055b163f8a1e801b7f729f8e373abd
MD5 0ca56a48e4859a97e209a086f14a73cb
SHA1 54095c91c44a4837cb4ed946001d3a99f60e10f1
SHA512 646e5c3791acf45376cbd3c793002b0165a3e238f8633c863ee3fa2a859e75906475956875c984357929a5d19b3ec5c1f6c9c7cdb7a984add92b6fbbf4ed1502
TLSH
T1ABE0209854C6D27F56006587926C5B4C92D0370E9EC8A94517048C45B083084A385D64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 085546d5dba114b612c395e036439c33e83f10bd5a3c3183c3153fd8f907f7be
MD5 1c73a34293b5c577fe2caeef1e61ab3c
SHA1 5e531b9d98d0c910e2e33fcb9096419a1e7b2c4d
SHA512 a4fc6a03d5d612a03a53cac442c466a2cc06a92cbc397aa8011aeb93ed4b12439dec1a8b4549d50750d8a22009d105c0797e55b09795b387444c5ee1ee9cc250
TLSH
T134E0269404CECB3FAB45A48F91685F0C82C5360E9FD8BDCE1B048988B041988F3DABE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 938be6de2d6512d5cc3b11a4645c4f4e95da1872b62244b2b60a4b4c2af0c0bc
MD5 e63c704b770efce36020765007e6e9aa
SHA1 9533cce29be54fde97fe1cff1dc35762da32b7bd
SHA512 b1df19d2eb0c30772b684ec502e4dafe753fb26dc3eec57d7d2cdf5b802fcdba8aae0376596c4ce131ce4e38c67994ae61f4822ef12743d0d0632a2f7a7752e7
TLSH
T15BE020E814C5C63F7704A4CF51755B1C92D1760E9EC8BDC93B048C44714244077D5965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 77b5f55da033ce83e75488ad1d9a3d6a4970c20da1f1ccc72a41565974d355c6
MD5 023882285983e67f84ae5b6ad1fef5a7
SHA1 ed8e868eee2e93ead69be432eb313af99ee3021a
SHA512 c16c384f9b07cc4ce36448544d2e6954d04518f011bcee456e45434cfee49e001b73a567ebf70efc132ad8199f63ed527a8b2b35e14eed89666da9b105de34f1
SSDEEP 48:zs+i6dx5WfsyHtsyYG9IIsVIkVfmjaQYgJ1lCRpgHNO5NyCsXop//Xycu21Ya6ig:I+iI8fPN7EV9Ve9loEOrxnp//iq9zfQ
TLSH
T17BB1E5AE67E763F3C35415BB20C117A93E79AB5870E7DED1488112F3798AB867031740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ae57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ae57.TMP
Size 2KB
SHA256 fca689c81fe2b8b764e9d7c7336393de855132a0300b8067c282330e480676ff
MD5 5f7f0f1ba6187b6b5e50449cf9188823
SHA1 8eae9f72b69f78da70bcf9844ec0097f73b6bf29
SHA512 c039725c1800ed5e47ea260499b715f3f0956aa81fc8230d1b834c58004b39c52138f2069b876d325e43f0b95d6f7db1c8943b3fac4b5e10a5b778f21d83e141
TLSH
T19951DAE62BFB34E0C36056BE50D215E93F7DAF0A0137AF11988621737A4BF1A6012191
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d4e88ab97f97b2559015348aabef7aef7ab93919bf5eb1f9f7fc4d669312223e
MD5 3fdc1a461b94e2797ebaab265955dc99
SHA1 8f89892d1c6ee0f4d771d264c3865903262c8268
SHA512 834cdde71d39e2e45c416a35201080ae2b66cce2d3c0375f6be9670cb7207d36ece8514c6f2c1e0d35a031fbecde2efa09e38a9639249402b60cd9f94861291f
TLSH
T1C951ABF787F5966D8A0255F0BA08AE1BCE2C0914831C386AC5E07E5BE3F3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c0e839a69ea0f9d2e49ba76fa4670b395ecd38ac5646f85e81837a3082941b64
MD5 9dcb89103f460fd1c1c0305f514f9fbf
SHA1 63d886a091486d682db992feaa0c89e03b1d9351
SHA512 1be6adc8a02e92caaca40d8a9d7ff3930bb67102f440a633bee77f3fc16fb7120515b556c9fad7bce673a26633fddbd22ac486160b61c60d56417f11ed2813ad
TLSH
T1D561ABF787F5966D9A0255F0FA08AE1BCE6C0514831C38BA85E07E57E3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b5646fa3b8ac542a3cfa27515fd1ce31bab924eda9c5b129873a8abba29a447
MD5 1bada2e25051103e3fe68b7e73ae8300
SHA1 02754bbc6c647b1c534c1a42d859ec2dacc875d5
SHA512 19dbc266078aaea336605a579f3f3bf189330a22233a8694e13b7e6930dbdd856a366bac09112821b9989452b0c378497c14f3482d43efa33c8b518f0a889ee8
SSDEEP 192:sxRTrOQ/ffsjJKrjDKzoA8pyWB/g6+WNS52XYEaiKnG4IgDsJ:sxRTyQ/ffsjJC1/5lXv+c
TLSH
T1EC42E7166968A93B9CCBD21DBBA5BF53E2F95022A0D01F58E6FC961C00E77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 98f1f371697c008a95f311f8c1254d04ecf953cf0e2775465ecd97d09be45774
MD5 b24e57d6b39b30c6a357a74c6ab31dad
SHA1 6d6e8de650a5ddbf46ebaa855e95bfc93df4901e
SHA512 a7b2bc242377794a503855a6b496872e947550c1619f873e4628727a19590cb5c6f4bdf62efcf527f7213e321d3f532b7eb6c0d510d51d892f427f56c0422179
SSDEEP 192:sxRQrbQ/ffsCJKrjDKzoA8pyWB/g6+WNSG2/YEriKnG4IgyJ:sxRQPQ/ffsCJC1/5i/a+O
TLSH
T16C42E7166D68A93B9CCBD21DBB65BF53D2F95022A0D01F58EBFC961C00E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 493d69d2e4e07ff29bbdd463284067083d4dc92f438eec625ef998bbd025aeb3
MD5 4414cce2ac5cc60dfeb0c40d78908d1b
SHA1 94b2726a5291dda90ebafaa97fe153a4c9d0f04c
SHA512 afde1b404defb8adb56fbbf925f4a5f4c018ac58670038cd6c7c3c8c5190a9f742c42ac61d6d380cd8d10c457e39d26af983e7f43cef8be9a1250782947e61db
SSDEEP 384:sxRTNQ/ffsjH66s8qMpRiYnazAW8pZS15posJWeT+HCL/5lX31+e:sfNQ/fuH4Mnc7WeT+HI/5x313
TLSH
T106C2F6059824C83B9FC3AD18A57D7E33EAEC505221C5DEDE5AECCA1C019E1F9AB47417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3376fc6d63f9ee4847adec4213f99b83381fc17a7f382838e7eb4e827676daab
MD5 272ebc547166c60821eaac3d924e1ab6
SHA1 ec078c8a57617ab1d868bbb28db19e31d9cc071a
SHA512 4125b86c3ae478b38c746a94024e3ad655508ec8820d30d792bf0aef422ef8aad61b3648b0d2ca5f21dd3f09ecf65b29ab47d8c2d3ac107b768cf939dc019e54
SSDEEP 192:sxRTrOQ/ffsj0KrjDKzoA8pyWB/g6+WNS52XYEj8iKnG4IgD2J:sxRTyQ/ffsj0C1/5lX31+e
TLSH
T1A942E9166968A97B9CCBD21DBB95BF53E2F95022A0D01F58E7FC961C00E7BDD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 96f04e58945b35025bd617f93d83f37e9448b620b9071a54db7c2a6168c91b44
MD5 0c2fa95c9830d4284b2e3dc1aa15bb18
SHA1 ce1f09b396adb78877bfeb08a5d6e7523b33b6cb
SHA512 a0b5446ab65e6b74a1ce2f7961b0d31de7a6f31949d4eba125f58c67727160b0c3cf650024d850a667d84517f66003a9d7d58470712c42a79f26e114e4dd6727
SSDEEP 192:sxRTrBQ/ffsj0KrjDKzoA8pyWB/g6+WNS52XYEj8iKnG4IgD2J:sxRTNQ/ffsj0C1/5lX31+e
TLSH
T1B742E8166968A97B9CCBD21DBB95BF53E2F95022A0D01F58E7FC961C00E7BDD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 597b34b0937915a0a355b7adacef9c8825729f48f8820d000c9782edaab2b33f
MD5 8e65ac5bf34a8f711a5c4360880c363d
SHA1 e6bd98af017dde82456175ab7cb4b52fe7d6a139
SHA512 ef8f91dd68747cf784dd7ac8cf6bd145a1cd3d89bd45aea25de02b6fb1ec520ab51bf2aa80b41227469acb5b4190f0211e4ab4b5f9612d754fd643a59a9ccd1d
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRAmroZCc:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0Vj
TLSH
T1E8B2FB2B600DCB7E5F804AADEC196FD76D9802C79A588D8047FE994C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c613385a-e0b4-4605-b082-21c3ca6c787e\index-dir\the-real-index
Size 96B
SHA256 8f55d347f1c30d1d75b3d94a8cef6a8f221b127f4755540168c578f220efdac9
MD5 2b99fd4018e05ad84bd0e364be990f8d
SHA1 0b1caad50e2b8890dc9fb7d58caf58d8b610057c
SHA512 55797c04cf1b3d6a758e0a0793bd57f83aa627705142fb3f5d74b8f59615d7d7e6022dc52c39318191a8cd4472de11dfde31ec49b46f329d83d1a03d666abb38
TLSH
T1A8B01102880208AFCA02033200E320A833320EA80A220A0220EC282AB8A00AC8088800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5de0be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c613385a-e0b4-4605-b082-21c3ca6c787e\index-dir\the-real-index~RFe5de0be.TMP
Size 96B
SHA256 156cd6503b78e430174e717be4604dc414c4a8f44bbb7e25e80177681b01f5be
MD5 c1abdb8a8f267955dcfa4a59d23fcce5
SHA1 83319c9f451e57c555cccf1fc62e3ea49eef0c92
SHA512 236af98cc0a3ace56bfd9340c114010ae63e7079ced8b5536bc5cc09e889a17ce3ead8ec3ae289119719553438dc756d2ee5fce5a6d26a050d1ce2d85cfef36a
TLSH
T1F7B001A6428619B1C9015AB220838358327B4C650621965775EA587FB96159C9586904
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 878aec8d98318cb39c02137f5bab4c944002a692d815ec7e5a8a65c998a30a3a
MD5 454b4754aa4fed5020fc7f22ff09a09e
SHA1 3ddc4a41f676c30fab1829eb4ff7167b1b77251f
SHA512 5593efbb3936a462786dc398afde3226a5a35492c10bc8c058156af2f71e351a8cab48b1fd2abb605e7b3dc2a488ce5d58552b5cb94b8eb63817efba13f2f79e
TLSH
T1DCE068BB3EE31440F86BC7D610B484500409B8A48605AC8F8929E1C7A173301340AC32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 90954f9ed0cbb375153a245ed6cd854595c9febf3c7dc2ec64a4d45c610b3ace
MD5 99fbd4748224f0fa2fceb4012ad1652a
SHA1 f17c6b2a408e14c6da1b0973e2079355d95a8491
SHA512 29dde467e559566d439b81bbb3a5059118bae9a2e8697854699570179e5db861717a26c49c038d3b76804862ee96efde24390cadf3d970b716719346a2c20198
SSDEEP 768:+rv+4UNbdK37MqGK0DctpK48dHeByERRFzjK3YfeVH1SCX:+bsb43pGNT48dHSyw/ZEH11
TLSH
T11113CF71A8A86E734CE7D28975837A57BFF4421381C81BA4C5DE6E4E858B0DD130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 613e6d8e61829a563ba5d6a56fd6c4afd0a2b5f90cb2c57f0cd8c760b7d10477
MD5 0b2b4aaf4d5862966a147b83da3186ef
SHA1 323015a62cc14191465379db1dcf8bef6d408e5c
SHA512 565abdad4404305a9c04846fd996a0fcf4e0b2e96c198d297ae6e188371215220743a3ff42fa392e4ad497dd6c2b4339deda55732116cf012dabeeb5c11f0c17
SSDEEP 768:3336MqG4L0DctThK48dHeByERRFzjK3YfojKgqmUa0:333WG4AOo48dHSyw/ZfgRUa0
TLSH
T17BF2BFB068646E774CEBD68975937757AEF04103C2C86B6491DDAE0E44875CD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 295182ab78705a4bc49fd8c81f2b91f10c1b1646f507bfbc0e30c1b6f832745b
MD5 c41ee57a014b1b0f8df22394f3affcb9
SHA1 45810b2f91153944a8272c3395c7f64357f1f1aa
SHA512 37523316d3610ef64159b495075e5035c32c75060fff451657f5476780df025df31164a8159cb892b183dacea06bccbe984299b95d6ec9cb1e22162ab7a41236
SSDEEP 768:CI36MqG4/0DctjNK48dHeByERRFzjK3YfojKgqmUa0:CI3WG4sWk48dHSyw/ZfgRUa0
TLSH
T1F3136BF058D75972C89E938767BE2E56AEFCC103B1C46A54B3D9690DCC460BFD30A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2add25dc18f2c0cef3cc168ea8ec7e634c609cc3d0e5e9554038e68cd0ad9300
MD5 6a424f9fb1009133afc3bdd6fc73ae86
SHA1 38dc9e1e254330755d02449d0c7306eb73eddc0b
SHA512 8aebe4b8e622cc427b762507dade239423c0da49501f8b4bdde2956ccf58e4913484d421ff4711b415c36522e922bf7a8e7cb95d542047e8f3303e370dd07f7c
SSDEEP 768:Qrv+4UNbdf3SqGiWDDK48dHeByERRFzjK3YqeVH1SCj:QbsbJ3DGHm48dHSyw/8EH1Z
TLSH
T10A03BF71A8A85E734CE792897683B617BFF4411386C81BA4C5DD6F4E868B0DD130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e88052502b946d88f076d44789c7b5c4fa6dca85c42674203c83464c1572a1a
MD5 bda97fa2962d04639ecc8508b6f9a7ba
SHA1 7b01f18daccf4544335e8b83b5f29c6495e96c28
SHA512 8f089729cce7c140ba77b49ff0289072faaf177836763b29de1f32c3ad8ab985dcbd63fd81809aeb2e2d437bd070c61286376c8993ee313e6d0361d1b5584c18
SSDEEP 768:Gn3bMqGK0Dct0K48dHeByERRFzjK3YfojKgqmUa0:Gn3JGNk48dHSyw/ZfgRUa0
TLSH
T1DDF2BFB068A46E774CEBD6897A937B57AEF04103C2C86B6491DDAE0E44875CD170BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 07f3aa20e4da7eb915376562917023b81d4b149daec96f838481afd1787c889c
MD5 da4bfb1dca896b2bfb4e0a2c580d543a
SHA1 fabf22e165fa4cabebc9efd2c813065e4cfb7dbb
SHA512 b14302277c365e35017f432a581a5b1c90bf338dac4e61fd08cec0694478aa0adfdb7be05549eb6a1247f52d45ecd5b4546c95423511e280c9c2b47228f0e5b6
SSDEEP 768:d336MqG4L0DctThK48dHeByERRFzjK3YfojKgqmUa0:d33WG4AOo48dHSyw/ZfgRUa0
TLSH
T154F2BFB068646E774CEBD68975937757AEF04103C2C86B6491DDAE0E44875CD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577da0b1-b51a-4ad6-b62a-8679d30a558d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\577da0b1-b51a-4ad6-b62a-8679d30a558d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Coco-bar-V2-Cat_Mascot.zip

Path C:\Users\Admin\Downloads\Coco-bar-V2-Cat_Mascot.zip
Size 1.5MB
SHA256 3fbd6435f43726802e3521feda10c8b942676876170e0780c93c62c625b450b1
MD5 8ecd2c20e2deb237d0b06da4172b9561
SHA1 2e2d3440fcec1b04966f0d0c7edeadfc024962ba
SHA512 467485587a410e88c9a43220780763d654f8c8109f78567e6414155cc3485e000332c5eb91e5ed6d602109caf2d040c9c5533cc6fefd48429a472dcb533c1364
SSDEEP 24576:3wMIfS4Td5rzG+TV6PvuN/o/pMFVqoy8RqZIz8NOX+3HdBIcPOFjkPOC4KyHlCzc:kS4frzG+0uevoGGgb3HdBIcsjkACA15
TLSH
T10E65335DC554DE83C5E0E5B851445EB7A4321583EC0B0CE8EC20BAF837BF866A66D78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download