hxxp:/// | Triage™

Analysis

user interaction
yes
max time kernel
835s
max time network
843s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http:///
Sample260808-k2f71sxvey

Score

8^/10

defense_evasion discovery installer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
200	3364	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
5200	tsetup-x64.7.0.9.exe
6028	tsetup-x64.7.0.9.tmp
6604	Telegram.exe

Loads dropped DLL 1 IoCs

pid	Process
6604	Telegram.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.7.0.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.7.0.9.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3364	msedge.exe
2876	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5200-1089-0x0000000000530000-0x0000000000608000-memory.dmp	innosetup
behavioral1/memory/5200-1142-0x0000000000530000-0x0000000000608000-memory.dmp	innosetup
behavioral1/memory/5200-1186-0x0000000000530000-0x0000000000608000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	Telegram.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306535501662542"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tonsite\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5600310000000000085dd4481000526f616d696e6700400009000400efbeea5cfa58085dd9482e0000006000000000000200000000000000000000000000000047e0d20052006f0061006d0069006e006700000016000000	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 6a00310000000000085ddb48100054454c4547527e310000520009000400efbe085dd448085ddb482e000000e60200000000080000000000000000000000000000003d6a9700540065006c0065006700720061006d0020004400650073006b0074006f007000000018000000	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2"	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Telegram.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{2309BCB7-04BB-4351-9B8F-D3992C3E0F05}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tg	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite\shell\open	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Telegram.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6604	Telegram.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6028	tsetup-x64.7.0.9.tmp
6028	tsetup-x64.7.0.9.tmp
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6604	Telegram.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe
6604	Telegram.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1828	2484	msedge.exe	89
PID 2484 wrote to memory of 3364	2484	msedge.exe	90
PID 2484 wrote to memory of 4720	2484	msedge.exe	91
PID 2484 wrote to memory of 4720	2484	msedge.exe	91
PID 2484 wrote to memory of 4720	2484	msedge.exe	91
PID 2484 wrote to memory of 6092	2484	msedge.exe	92
PID 2484 wrote to memory of 6092	2484	msedge.exe	92
PID 2484 wrote to memory of 5520	2484	msedge.exe	94
PID 2484 wrote to memory of 5520	2484	msedge.exe	94
PID 2484 wrote to memory of 5520	2484	msedge.exe	94
PID 2484 wrote to memory of 3708	2484	msedge.exe	95
PID 2484 wrote to memory of 3708	2484	msedge.exe	95
PID 2484 wrote to memory of 3708	2484	msedge.exe	95
PID 2484 wrote to memory of 4724	2484	msedge.exe	97
PID 2484 wrote to memory of 3476	2484	msedge.exe	96
PID 2484 wrote to memory of 4724	2484	msedge.exe	97
PID 2484 wrote to memory of 4724	2484	msedge.exe	97
PID 2484 wrote to memory of 3476	2484	msedge.exe	96
PID 2484 wrote to memory of 3476	2484	msedge.exe	96
PID 2484 wrote to memory of 5480	2484	msedge.exe	99
PID 2484 wrote to memory of 4684	2484	msedge.exe	100
PID 2484 wrote to memory of 5480	2484	msedge.exe	99
PID 2484 wrote to memory of 4684	2484	msedge.exe	100
PID 2484 wrote to memory of 3584	2484	msedge.exe	102
PID 2484 wrote to memory of 4656	2484	msedge.exe	105
PID 2484 wrote to memory of 4656	2484	msedge.exe	105
PID 2484 wrote to memory of 1868	2484	msedge.exe	106
PID 2484 wrote to memory of 1868	2484	msedge.exe	106
PID 2484 wrote to memory of 1868	2484	msedge.exe	106
PID 2484 wrote to memory of 1072	2484	msedge.exe	107
PID 2484 wrote to memory of 1072	2484	msedge.exe	107
PID 2484 wrote to memory of 1072	2484	msedge.exe	107
PID 2484 wrote to memory of 3448	2484	msedge.exe	108
PID 2484 wrote to memory of 3448	2484	msedge.exe	108
PID 2484 wrote to memory of 3448	2484	msedge.exe	108
PID 2484 wrote to memory of 2756	2484	msedge.exe	109
PID 2484 wrote to memory of 2756	2484	msedge.exe	109
PID 2484 wrote to memory of 2756	2484	msedge.exe	109
PID 2484 wrote to memory of 3340	2484	msedge.exe	110
PID 2484 wrote to memory of 3340	2484	msedge.exe	110
PID 2484 wrote to memory of 3556	2484	msedge.exe	111
PID 2484 wrote to memory of 3556	2484	msedge.exe	111
PID 2484 wrote to memory of 3556	2484	msedge.exe	111
PID 2484 wrote to memory of 6496	2484	msedge.exe	113
PID 2484 wrote to memory of 6504	2484	msedge.exe	114
PID 2484 wrote to memory of 6512	2484	msedge.exe	115
PID 2484 wrote to memory of 7164	2484	msedge.exe	116
PID 2484 wrote to memory of 5200	2484	msedge.exe	117
PID 5200 wrote to memory of 6028	5200	tsetup-x64.7.0.9.exe	118
PID 2484 wrote to memory of 4896	2484	msedge.exe	119
PID 2484 wrote to memory of 4896	2484	msedge.exe	119
PID 6028 wrote to memory of 6604	6028	tsetup-x64.7.0.9.tmp	122
PID 2484 wrote to memory of 2744	2484	msedge.exe	123
PID 2484 wrote to memory of 1272	2484	msedge.exe	124
PID 2484 wrote to memory of 1272	2484	msedge.exe	124
PID 2484 wrote to memory of 5492	2484	msedge.exe	125
PID 2484 wrote to memory of 5492	2484	msedge.exe	125
PID 2484 wrote to memory of 1960	2484	msedge.exe	126
PID 2484 wrote to memory of 1960	2484	msedge.exe	126
PID 2484 wrote to memory of 3792	2484	msedge.exe	136
PID 2484 wrote to memory of 3792	2484	msedge.exe	136
PID 2484 wrote to memory of 4380	2484	msedge.exe	137
PID 2484 wrote to memory of 4380	2484	msedge.exe	137
PID 2484 wrote to memory of 1836	2484	msedge.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http:///
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ffae139c188,0x7ffae139c194,0x7ffae139c1a0
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,1687025380061085524,16934411033554859283,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,9123729579290922875,18174144689808108978,262144 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,10657347642754702757,12068499278973270295,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,3439153062918884278,7977766777122693154,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,799757132903290973,10676514226865165346,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,6725085077600526224,11670001658620885264,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,17911567101503323621,14513095061775858119,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,10094136113197343533,11489530212630493234,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,17920124770586180551,11207596895965897970,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,7925812821388980777,3425632177834498495,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,7925812821388980777,3425632177834498495,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,2248042516657308352,7321475947206125952,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6676,i,6896613674353528954,5648974828929412807,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6736,i,9637118926449885217,9124061092863109559,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6620,i,7329370919361014335,16090259552546919801,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6748,i,637336357052679948,4921749399598888205,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,8984897237767852870,10095171562246071434,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7640,i,11805951781037244946,6479360502809152366,2097152 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,13581021014490148621,576181095066908837,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:14
  2⤵
  PID:6496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,15833475147327571758,2633790957984754603,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:14
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8176,i,5999006232398931837,6166119506302143328,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:14
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,8934110414311562604,13374286803316251524,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:14
  2⤵
  PID:7164
- C:\Users\Admin\Downloads\tsetup-x64.7.0.9.exe
  "C:\Users\Admin\Downloads\tsetup-x64.7.0.9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Users\Admin\AppData\Local\Temp\is-LVBIA.tmp\tsetup-x64.7.0.9.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LVBIA.tmp\tsetup-x64.7.0.9.tmp" /SL5="$C00CE,53457430,826880,C:\Users\Admin\Downloads\tsetup-x64.7.0.9.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:6604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,4617263999973795000,1752282896768670877,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3808,i,5988334643595104119,10389830375223024486,262144 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9344494014941995269,3285167024603702338,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3204,i,16981868620319906072,12120910506305101832,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8176,i,17050246081688308285,3636794714243764103,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,8886122911728610435,11595094224476930877,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,15119302824865967256,5076859704394541258,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5904858814150444568,13951312646858920764,524288 --field-trial-handle=2544,i,2637807825840441626,7512255029895553799,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffae139c188,0x7ffae139c194,0x7ffae139c1a0
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,4527277522386863431,9954008780211444268,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16009297059189165829,14728101687857975299,262144 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,5476666774471624770,5932892420205172943,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
    3⤵
    PID:1516
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,6818022382069356793,2578772871117915561,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,6818022382069356793,2578772871117915561,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10410815002488726968,2227476942462770891,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,329555166864154244,7176366523294168013,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,949206041890644689,11610259010085641044,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12623738730058198383,12031094178746018088,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:7080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,6558499163534951144,14432549269115566798,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9265089575028379324,12942193659953018483,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,9883923082915885767,1229422263357740930,524288 --field-trial-handle=2224,i,8812273602890719202,15735665349354351299,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4308

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6644

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3985055 /state1:0x41c64e6d
1⤵
PID:4472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe2d1a3fe4e125a20450a80b65338ae68752f44903f85c5d2d5e731ae3d70183
MD5 ecfbcc3efd6c00edce689f1146aeaa68
SHA1 a6a0173a3f8b7dd0a0d89d6dcaee185d8b60cb80
SHA512 08461dcccefc71f7839c3071c69f8790daf8e792e69a9831c24ccd3f8cd8589f942f098920666496b0fe78f07a5032ba3d3fea47ac1a59dfb3a3079f1f8fd197
TLSH
T13ED09734A826A3E0C92A017188203200222000B138E2078210622C0CCF70042A2DFEDA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92122a55c7f168c968cd8251cbe4fa8ba08379f6572a7c530626c74401bb4cfc
MD5 5fdbb49fdfdfad346f61ce2a6e23e4c6
SHA1 03e24c31c666609b432c33dd7945b36af67a34b8
SHA512 b7c8042bbb32fac02ff7ef013a7de3febd98e2119844df63711ba4f807563f375f58227b098de8f60186554dc2c7b3cb86f1db00d09cdd1042982b62f63c7980
TLSH
T167D09778A016A388C81701718838331232310C3034A20B9540A2241CCB7002373EF6DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

73cff744-c28e-4500-b2f6-f9f302a97e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73cff744-c28e-4500-b2f6-f9f302a97e4a.tmp
Size 414B
SHA256 5743d63355f4d88eed14c7d481d12f4a47236ff62355dbcfebd21cb320b40174
MD5 8a007bbcce1c324130eedf5952882435
SHA1 ba733a34b59981a8bb875e6e3cdc55730275154d
SHA512 c967f0c35f3cb2f4ad48a40405c70a8fbb282fbcbfd31bf88494e2cc5e09128575640a0050d29b3a4fd40ec835c630487273123657c53cd01a8f621f175166de
TLSH
T19AE02BB5C820AC3B0CFC0B5D50450E4AE71113676B40890F7F3C511C9F7063A059685C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6a137cda544444a1204ae121aaee01182a027902c7f42b2a838389a46aca0cfe
MD5 536e9eca27a69c3bad02e4f3912e0115
SHA1 8a6a1a91de4f7d0c532c79a268c53aaa663f181d
SHA512 1dc1db6d9f1b08ebc61d896e6c1fe5eb108813fa281fa9d7225cb2ceac9b80675d22fc5cfa05ccee0e78e709b9d3c9adf623c8f784e659c06b30b1a80150f404
TLSH
T131E0208429EDC72E6B04644B525C531EC2C0360E96C5A90737048DC57441840E7C3DE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dae80ed3a70c9162548ca7c4eea0adc56fcba4198de424646cbc1be89d9b4248
MD5 d1c744d1509db9ae9b77db3e8b8d62fd
SHA1 8c2b2ac1b2d43b393df4b0cdc3847570ebbfc4b5
SHA512 88e9a27c8b80b5baa14a844b6d59d10f50198d3ee39b8649716fa5bb1fa9aef9eb947f0f79504233d7e1b1d2bcffece1b651c44783a2a57c06b51cd61373607c
TLSH
T116E026882ECCC26FFB01644F596CA74C92C0361A9FCCBE0B270889947501848FBC3EA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5a99a6af0deb870b74d9b840f656788851737c05ff0eb9f20facf89389dfb62c
MD5 1bd85c91d32c14703d190e265ddea7b5
SHA1 a431fdbe9aae6101055d9cb226818dabe224a5bf
SHA512 caa67075e06576db72f7248f561e2b490c307dddec7590c6eb19436ef93ddb3f68cea453bd7a6015a81acb1f95ec89a7b2330d5b8dc08bb486929e02613ca698
TLSH
T16EE020C634CCC29D5940644B559C934CE6C0364E9AC5ED0F1B00888D714354077C3AA1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 30KB
SHA256 32339f355b5b9b8693f9f6370dca7b05fe6042e3b2d94546afa05d569dd6b66b
MD5 348c832a4560adebb39e32b91f392e20
SHA1 5f8743e97e3d0c418d90998072416705f17eb720
SHA512 c225d7794c5c01872bb1af8a0c6af443f54e07f40cb8c03ed79c77a092ab35e03cbf29e2672cd070e93c998f54fe7776f4ff4e948dfd67af8d77039af6638cb9
SSDEEP 768:5q2yiiih0/n1a/WAfZXxZbFtjd3iXn24He5UKnCljV4fx:k2yOh0da+qZW24Ha3n4x45
TLSH
T10EE2F12E4C58BDF8AF09B230D8C62E76CAF216D7C6D2EED0543DAAFD2529590D18C5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 151KB
SHA256 a8e7368f03b24867920b42fe31331acf8bde1626336affcee9bd6a9d7daf0692
MD5 c798737fd303ec814cf40d8076bd5d5f
SHA1 0d18fd05f16c17652468175fcc41423a3d99170c
SHA512 31ad0a4e439b706ce0da3a541bad7ed5e5340d086bac526b7872ecfeb722edd9767d99baf72307ae6f79649e3be90542e9034b618dd75db7fc46c19eca72da35
SSDEEP 3072:0EqzX0mMLYGYjNWkUBgpF8djK+nrXXfmlCPaPGOZOaO9TMunLe6EatD:0EoX0mMLYR978dW+njXelCPa3bAYualw
TLSH
T1C8E312AA520A418C573142C80BEF712E499FD0C619DF829B35B4DBFA9974D17270CAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 8d3a535cc81e73760e29951ac75f5250a9e51303a76f97d924733369a015859d
MD5 4a98d094c64848a42bbb7d7f208c0983
SHA1 c464a59427bd5521eeaedbe2e8d551b56e66fbd6
SHA512 477d5a035aaad6cec8a5e9e387262242fc6efca7081969adeaf8f290568c89aad7837e6f2a6cb07fccbdb271443c314e73e9e2b7c96b7ebea96f36452a3df767
SSDEEP 96:TKG19pBNl0Xu3luCvLLcaE3tlbnwfPBRGlVoB4mjm7LBrezUAIwg2q8j5DgE25z6:1LqyOOB4vBziEkGJBsg0F
TLSH
T1FFD1CA80869ED6C5FF196D782AD00CC93B304A230A036F7607752D3A2A97BDD34F4E54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a28c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a28c7.TMP
Size 2KB
SHA256 c972eab7376c1056a49d303ef7e6e38eae281f0b89fba01142290acf5a2b06af
MD5 7214fc813d0f5e540d7eca69e3fdb36a
SHA1 d63962296f028220f1c2a091b2b7b8590ca4e824
SHA512 1608af4616c5baff36df64f2bb05884ea8deb59c257f7990059d5071b63548e21f9b077003649a2ceefe7e1e475c9d041e6129de2c0ff667b21e32255101c150
TLSH
T1B55163D4872FDBD2E72456BE25E148CA76709E572907AF3113BA52B65CC2F0E34F0214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 96B
SHA256 f1a6e6f6802dcf006f84df571eda6896ac925633037584922ae2d7e0b8696473
MD5 4628b1ffc9e0ec5f21423b321bc812d5
SHA1 2029683989c67e24475e348d565282d54638acba
SHA512 dc47c928c0361d1237e2fb199b228f0308af3e3134ba4be6ce8302548176d49783e5f7ddb5fe753c025fb6c0006d095e7abb81908b9ab6f683661110fa2dd73f
TLSH
T18CB0016846D58422FF8583F435EE4DB9B1B1DC2956465B0B81A5187986207449A02406
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 382f554faa837400eec307553954bf41090217a6227d05c456f4428f66a0cb7f
MD5 599e6ecb895a66e7adb3e6266c7c93de
SHA1 2bb3190b063001e53a523d65b8403ab2513c13c9
SHA512 ecd660902799f89052c80e65f90e5b0778f252d277a022f15266b1a5cb7739dae6705b22a2595386d20d10fed5e014186a7120bfde9cd33bde369f38fdd95e55
SSDEEP 3:MsEllllkEthXllkl2zE54/l/:/M/xT02zG41
TLSH
T12E4402946BB00806EB066038506187900360D45005515BC3285508125CC5B400C00451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 463cac9fd99acaf19744d2ad7f29daab09260e452a06eb6b5e10ec91dfc58932
MD5 8319712bb65f65915840436d23572824
SHA1 d3917b45b24eaa64a6b99cb45be98371e5c8f75a
SHA512 13fd54d2e6dcdbccfd084287da592900df93e570fddd3be278dbd41c94d5ffe6adf0109e003be21f06b5505093ecb59e289f4f55a15f33423a360082829c537f
SSDEEP 96:xBCmJPdZ+BzPJPuZ+BzlmswtHE7UA6+GGHzwea/ik8vwiZROVVe98BNUoSTHK:HrJLUJA4mhtv5FFea/yZRlOORH
TLSH
T156D24CA3AF347851CB501EB6557A36B6CA33E1488FDFB99C383550A24C3843B24744BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 7a50707a26ac8bb3930dce05e1fd297fee787f9f6d87cea023d060b0a5d53062
MD5 f53ab37687e11c8bfba4ba8ab7c1e21f
SHA1 d4d9c806af089b0e7d1b9e877f3c5208ac03effe
SHA512 6a17b7bedf901971afacd9cb9b35af4e2eb1388cae58e7a0afb0250300411cc97380bd2beb1b6f5243a94a61c4f22ca637cc716eee3d1ef9d74a2b3d606a3cfd
SSDEEP 384:XJyDJOJkIkUI3ijVoWN3qL/iyJz9JPJZaJimJvA:XcDM/4i93qDiyt9pfasmt
TLSH
T16224A95F5F312712CD7C40B668E726E69C2DF42ECB96B5DA6C700061CEE2A53602C8BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2df89e81-bb11-4fe9-9b22-c5f62f07c0ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2df89e81-bb11-4fe9-9b22-c5f62f07c0ee.tmp
Size 211B
SHA256 250f1de5d498f2501742ff7aa4690242acacf4a9cf23da96bde1525801e357b8
MD5 08e348da0eb22d2ee1be28f996a8cc15
SHA1 52d160dc043ba33339f10f192d6f359f6d7fd4cb
SHA512 2f9ce807b6abca1c151af8432e36edac1a815ecd508de16d08bec994407db97d97f93d0341c0b6103cbab1c9a8dc311f84e59e065bec8ed71874aa0535ead0f1
TLSH
T185D02223621030B9B76CBECD406AAC8FCB3721260802DDFB12D0989C0F7A5AD858B181
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 bf6dc33871071a64af0ef6621eac68c2ba7ac80cb9a44478f6f740a27e57b481
MD5 7482d7a680546b4bf9dad9d0b7d11acb
SHA1 f6743c8aca1213bdc97c3fbc83329a4f11545652
SHA512 592735dcb226f8ece5b07a6ff866a90468cb41fd47ab7d98f895309e898da0220a09bb187d8b01726360eddc353c45d046d91d23228bd323934a7ea6f6808c56
SSDEEP 96:D/OLMFbwZfS3pamWizBGO5qGWYVHzCXLiEBDzD9Ij4/QwMA:DWLMFbwZ63pamWi175qGWYTCXLigfxIo
TLSH
T161A1BCF783F5862DDA1195F0EA08AE1BCF1C0456436C3D6A85D0AF1BA3F2471E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9a8a2b9a153998694a86ff1c2a3295d5eecd54925190084c9363962945ed044f
MD5 440174bfdb0c67fdf7c48162b444148d
SHA1 b5de332026fd6cb3657dfbb919eb1e7ab6e0cc3d
SHA512 8aae79091255cbe88ecbe17e4ce1d26924df0bdb59f79241bcdf28503de185eb9125e2d0e82ffd4d6e89d653557b90093a593ef94bd935fe39e6719705db7d15
SSDEEP 96:D/OLMFbwZfS3VZzBGO5qGWYVHzCXLiEBDzD9Ij4/ixaw2d+l:DWLMFbwZ63VZ175qGWYTCXLigfxIj4K9
TLSH
T1BAA1ACF783F5866DD91195F0EA08AF1BCF1C0446436C3D6A89D0AE1B93F2471E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c488dc22db23316ceb59743c344518bafaa85aa2e3ee06dba7e5cc84654ea1c
MD5 adff22ea350b7fae6f92b57f703d20cd
SHA1 27f93007cdd10c2d346dcb49f37e976d5b9137f0
SHA512 5bc951389040b9e3084b62837749c66324a81759561718726eec4a89684e0ebdf7dba3d5d6012860663a924682aad60ef8795330a34fdbb2eae54ed0957d15c4
TLSH
T1F521B1F7C3F8597E8A4182F867142E1BCE2D0815431C7E5BC4D46F5BA3E2871D28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 043c2b276d099707696eb10222f2ffe95659f96cd9c9327f8982bf7110d1f36f
MD5 e581e1bcf38c1c0a3947d54ccc92a865
SHA1 b6e8b333900f2cf8b7b816947ab5e93e732261f0
SHA512 b557c7b845c9e584faf07a28cd7f827ec25ca3e04ae4ca4268022891c7a9922a01e0e9bbc5fb0ef7eb63f486429bdffcbce8dc8a6037225f97bf556583676a31
SSDEEP 192:DWGke6iBspamWR175I1GWYBgUFvXLig6CxyxT:DWGke6iBspamWR175IGWYBgUFvXLig61
TLSH
T1F2D1BAF3C3E5862DC91152F0AA186E2BCE1D0856436C3D5AC9D4AF1B93F28B1E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 913cf14756068a59bd98b35074f7a3a387e6f45db8bd5469c0eaf69328fdc97c
MD5 2eca90b7dd7abb55fe4cc78de2c44fd2
SHA1 41c6b20a3e7aed3a4017cd664def3b33074b578a
SHA512 cb660cb84207a4947f7274cf2e319929a90501704824997db6c8ad933ab442d9801142a00abf2ed9724416067b564e6be3c1a1fca3de21d73a4ac71923339dd7
SSDEEP 192:DWGke6iBwOpamWR175I1GWYBgUFvXLig6CxOT4uA:DWGke6iBwOpamWR175IGWYBgUFvXLig5
TLSH
T172D1BCF3C3E5862DC91152F0AA187E2BCE1D0856436C3D1AC9D4AF1B93F28B1E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7d6b97bf080c532a7796de793595ec403de0687d1a878dca58eba89d58384c9d
MD5 5e6ea0a41402fc7615ad48fa54641b93
SHA1 92084b454fc641b1e244fb2389141d789b8dfa21
SHA512 4a2ecad083307dd4b1d80f34d907d3bde623979e025797df74e0a09546cdcb4e9db8376df88e570922ba9105f6a6447355439574152f7006cd303e4510e133a5
SSDEEP 96:D/OLMFbjwZfKpamWizBGO5qGWYVHzCXLiEBDzD9IwBj4/3:DWLMFbjwZipamWi175qGWYTCXLigfxIx
TLSH
T157A1CDF783B5866DDA1195F0EA08AF1BCF1C0452436C3D6A85D0AF1BA3F2471E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 35KB
SHA256 9109d71e02ff1529486011c75eb42456ba3e71da693afc157c2f83dc50654c73
MD5 5fc6c074de63358679851502f3298944
SHA1 f83d6f83343da515cddceadab577fcf3b5947bcd
SHA512 41f6e98f87152515dbe0c5d6877e6211051064428b3ca9a4df49bcf0e7b2a6586a962206b54746e7d57f19ab265827e388a5a341e753e044f40275128c447a3e
SSDEEP 768:sYAm4B/f9Y8Q4Mnc7WeT+OO/5bCwb2qvA2r:/Am4vY8RMmWgIbCIpYC
TLSH
T1F4F2E6429820C86BDAC39D1DAD3D7F32DAAC54535986CEDD2AE8C91C009E1FD6F17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 4f853565261ae857a8f60589542f549d211f20fde69abca8f57977c2da1eb27e
MD5 550645325a90677277d26714787f9602
SHA1 30f80af34605fb6d434accf5f9fe19ee6ae5cce7
SHA512 be67503d060b20a008c87c388273a71adb57de89d5ca848a9d572e7ec335eae929e0331c0ebacba43c4e30602e651615f2bbb1c3a5bdc1d16950bd611bf594fa
SSDEEP 384:sxRUNm4B/fUsDxdrp5/5Kd/pw12qvJC2r:sYNm4B/f7xh/5+pu2qvA2r
TLSH
T1A992C4526924D87BCCC7891DAE327F52D7F814239D920A9CABFCC91C04EB5FD261681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f4e96b2ce3a068eb69ffd7b4391c78659761a30e6c47582be48b49ccbc010c99
MD5 ea85c6d50864019cebde42e317f9b856
SHA1 db6e32ad6f28bfd44732a59762f14bfa438d6052
SHA512 2a4a15a4568bcaf04b786e345e41a723c6d526825887adf56a44ebdee3c8b82cb69706a831cdd94e3e48dabe2fc03880df1970f45d5519223710bb64ec51b246
SSDEEP 192:sxRIRDGOB/fUsK2/Ljb7coA8pJn/g6+WNPRd/YZ7gKs9GJIgIJ:sxRIQOB/fUsK2jrvV/5z//ws
TLSH
T1C242B6166D68693B9CCBD25DFA257F53E2F81132A1D41F58A6FC9A1C04E7ADD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 34KB
SHA256 2bf104c14143458de158c058ca9ee27a4b891b375f75b8ef4086940e0fd00980
MD5 b405cae48fa2fab4801c479cb85ba105
SHA1 2ac8a178846d640abffd1838b7cbaa5e6422c6af
SHA512 5cdba6e72da9021489ec83751ed403cb90bc734bb71dec8b726a069541b0c51e0ab471f163ef4a199f3cb04dce05b4b4a633dce246eb9d660167e1812c539e08
SSDEEP 384:sxRUNm4B/fUsDQ66s8qMpRiYnazAW8pZS15posJWeT+OdrpL/5Cid/qw32qvJC2r:sYNm4B/f7Q4Mnc7WeT+Oj/57qs2qvA2r
TLSH
T111F2F7429920C867DAC35D1DAD3D7F32DAAC54539986CEDE2AE8C91C009E0FD6F17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0ca40d6fbb1101b22c34b7f54cd35f78bc85d3167031807df8db84705c23af03
MD5 770fe06f073a38b07743e8ae7ec3c9bd
SHA1 5e963fa3351e23971b657132d50356fcc6aa1797
SHA512 ac2017cefefb027f8d03e15d710220cda0791610301eb8c34d4d59fb0bab04287508580ac341fd44582b1c3f58b8864a0dbce63285204bc21e49757bfd94e411
SSDEEP 384:sxRUNm1B/fUsD2Mrp5/5Kd/aw12qvJC2r:sYNm1B/f72q/5+au2qvA2r
TLSH
T14492C5526924D87BCCC78A1DAE327F51D7F814239D920A9CAAFCC91C04DF5FD261681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7be270b2b078a004dcedc0aba027004d081089d48041ca9dbd6c874308f67acb
MD5 4935ddb8855de300e562bc9e28cf40ce
SHA1 feaa1daa1d31e6c45e30d9d9fa476ed63973956e
SHA512 6bef56ca08a73f4860592f96b4bb7ce1c5cf340ca130d4194dbbea4eb34b07d20660967f6fbb9b432b1df66475f211d942ef39cc0ce14b6d265f692cb0019312
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR65roOp8:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0VC
TLSH
T1D3B2DA2B604DCB7F9F801A9DAC196FDA7D9802C797588D4047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index
Size 120B
SHA256 e83060c025330972e89d83259835c86d57f2c14eb88810d7106f15a9025c1f06
MD5 5ca5bd259a8e46206c06fef459d208cb
SHA1 8009abd0950a011cbbf1574fa690cea3c864c072
SHA512 7fc2d5cfa43a0ea69e9b9537c7a0fb42effe25f600885ce450606b360f55b1ff9ecb47d84f5301e4fe4abfd26c7d3ba7fb59808a14118e2c3132af37f809a8fb
TLSH
T1BBB012104D690D91CD0A963107B73154673717ED0C61270310DC101B94910ADA10D554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index
Size 3KB
SHA256 1e87b5fd42f1ed9aaf4027e728d4fa0b96518ccae0f52de6f0e78dac05cbe13e
MD5 6206b1b9afc0a74b4e382924352c7aa3
SHA1 0b76b338d7604753b886501b6a2b9e83198d8b88
SHA512 d747fd0a20c4ad9ba7e69475c2c6edf5ecadfb461b72603870685875b668eb7e78f7a8810c7b4ab89af9b430379b1214924b1e49db47454d1f36cea755a948d0
TLSH
T1DD51C74E4C42696ADE6E09B228FE1804333A11ED52C56F1B71BCB2307DC332A7D5A654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5978df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1120b6ae-fb42-48e8-8eda-6b083ada1cfd\index-dir\the-real-index~RFe5978df.TMP
Size 120B
SHA256 8e8a893f5a5ff79b47ebf36f3f3ff42321dc9e81a80da6487cb4928a0200c8a0
MD5 9f20d5ba6bd0d40bb72cb93c22cec435
SHA1 50f17107a223c7958a9394e2d0bd8e219e508e34
SHA512 ed36ba109e388d0d1305ddc552993cc47a8959641b26517b884729d194e9b1bb9a53b693a19679ddc0ead660ed86797387331ebdfca1457c32614338bfda2d83
TLSH
T1C3B0121201A40CA0CC0A96701053D25433271C140820630320E9048B4C610C45145544
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index
Size 72B
SHA256 34db10d068aed2d3aa534b098a66fba4478c3f9d8152b599462741c9b04664a0
MD5 1f3261ae32815b3e2b9e4e63d210ae2f
SHA1 8c2a79ef7e59d5f678d2f996fd5f8c6b7f0b9814
SHA512 68f134ab7c8bd7d24cf73bb5fd3f9710d1cf84660210c05dcee0779dddcfd5b029c7727cb4673e17ec69b2e66b4fccc145d61a9b8111903b1c843a72c2af4f6c
TLSH
T1BDA0027C52C05911C00617FC2E9B9B4132204910964B130591901654D955D46464999F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d69f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index~RFe59d69f.TMP
Size 72B
SHA256 2ced0cd824073e8a755f5294e6eb7e602fd062f3d55c86347ff3e12b6935016f
MD5 54fd8222829d2bb26244c12ff3d907fd
SHA1 c52c7c3ccc2379c67a758d58d24f9e028e892b38
SHA512 367ba57d5530eaa8ab6dc5dae694e336d58c3b9dbb16f06ac97758d220ff92fcf6047d94b01b7bc8d51e6898f858016cff1980a322f1aa5a30783de993d6ef7c
TLSH
T1CDA0026013C58686C81331B515A2C7D536D089115280970FA0F11044CC504C4458204C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cd8372c754c51f80e0907f7e5406be4e1c6465b8cb2e2e02f9143676e21540cd
MD5 36865ff4486bce26199bf193cabb4e92
SHA1 b632d966434f9ee88709777fc97dcb498e11b01a
SHA512 836563a2b080743a54ab0ef0e2f5eaa084fa7e45f49e9a0ee503efe9615e387bdd48b5a925706193fbc946c62b98c6f42344e978608488158eec3604406131b0
TLSH
T15EE0C0FB2DEB082CFC5FC3E6683688B140027E504A44DC4E5015418310B1B10202BCA1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 201e7276642f125233ab5a909fb1d7e5ba27013c5289b1a1ac717f5fd36e508b
MD5 827a44e0be9fc2d1ee8a2715c65d41cf
SHA1 f66c26630d4a91a583737f78c9f2cecf8f0f1f64
SHA512 26cbed999760b0504502aeb656f0425f8257e0431a3d006a8870f12bd139885e74bfae5c1ce602d154e76adff45e5d93597e090c34ea4bc7365eadb3b1c119eb
SSDEEP 48:F2em5HdYlvSEcJp69f54OHoXpC/8wp6A54OdpG54OV:F1m5HeaJp69GXpCvp64pA
TLSH
T18691FDE3CA105043C9C966FB2039F5D8296DCA066FFF87A610BD8F6E52442D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 df17dd78702cd413501578a978a9c2b0060769866778fc6f30848ac754b50af6
MD5 32fb76388499ba8d52cd22fe8762c270
SHA1 de9f312c1b4728cd314f313ccc81c6e9ab1e3a76
SHA512 1f2e229af0e296daa7417e67a7af9de112a8f94deb59b5e6dc2a2387f402701561875bd11f527dfad2a0ca30da047a1bd3f4c76cec2ab7a8401bf394bf9ba7a2
TLSH
T12AE0DF301ACAD2FA695660CB2A28A30EA2E8B44BDAC839023F01CC406542904F693DA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cac75a471c79fe804a36828665080f49cea461c200b2eab0580f92c362950901
MD5 b919ecdc30024699ef76c1ea6d2fc982
SHA1 fdaa447eb46f03cf0d773cd57b38c8fb40e8ccaa
SHA512 5c42d3237dedf8fa0159322309fca1f0a4ada4c5141b7dc6542c0d585fc71e4a01ff1f4a5dcf9ba0d2ab314e1560cbf5d40628464a5e8ccba88dced5792b23b9
TLSH
T13BA0021D8F5C8451C0501770D065498D6E1189D81E05673959AC515488725855296D24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d826.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d826.TMP
Size 48B
SHA256 e905ad2f1fdd0abeec99278bd5a2a5ec6a147d21518b9b570bfb035690ac0321
MD5 0488c7f0c17ba21fc11d04660e326a1b
SHA1 7374dc88febd64cedbe04c928b8a40b7f02b244a
SHA512 92197b4c862b684d84fb42cbf2473ca2982c47e79623811810c178d0fb04730afd56bff38a0e227641964f18db8b912abf09b87dd7c60e8baf131855dd46fdd1
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 247B
SHA256 13920105bfe78fc0b5782409402b3f5ef39efcf50ca06a4eb66a5fb60c7a79ac
MD5 182e246dd5f2010071118a5d001c9eb5
SHA1 0b282e111788c5cbb4cdded18e12e435802a61b8
SHA512 f3db479e9cd71a0e5a491cea556a5b8703576a46caa402b03664c27969cefc8445afbfac39da2d383d798109f4bb7b48dcec327e22942c8295715cc453f630bb
TLSH
T1AED02240B3A56A4ED98F3A35017CB30BDBC9EC002D268637CB4C9E350D066F82E839E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 fd5218a2e1c9c8c391f7fadcda9223330c715b041dfa1279a077f97e4ada35d0
MD5 8ce0f68cd5e1ca9cb289badda01264f5
SHA1 e770b4989cedde679b18dc5c1ac81ff1d825599e
SHA512 bcfa7da6530bad8f9cbed64715a2b2dd064ac379625ad767e6fdd8d8628a95f39d38afe8f67124344039b07fb1dbb0bc1d135dcc7206d0ab95cf3559acc56a63
TLSH
T1FEE0D8306ACDC67B658730CF5618E30DE2E27443DECA6A173B099C846206580F383A51
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 66234fac570564eca710d8d12e6b5dd8fba42f1c7aec31c7d915643276e2eb47
MD5 f0b2db6105502c84d335cb024433d026
SHA1 497084c993bf33e5eaddc72d5972f7820a714f27
SHA512 2fa0da2573395cd4fd2de655420318e42f9f8e7485f5d0780f248092826106eeff97ef8b1fb328d0d765821a6d4a954f6166815e031d3d144f83347f5725514e
TLSH
T190E026705ACCC6BE590060875B7CE75EA2F079069BC93A137B0C4444A501A00F3E7D92
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a139abaf54fdbf8ee249414e72e9d2f6b8202ae3f4e89e3f13ab41f7869cfdf4
MD5 e85626dca9dbcfc83b1c57934fc2f081
SHA1 21f40b44c82e4c57c9d9f2e7a9d0ca43887acb01
SHA512 b346da9bc8e4f1a997ed2f4d94960e06585b69a7dca5da88bce2dfa1bbce9181f17dd82636ceba8144a473c416d74a4291ed7b7ca4ecc340cd0d5ecfee6bf821
SSDEEP 48:K0rc/7dptgJxuzI6jgK71j1gvzwoeVLtyxdIxKu0cbyPt0ZdX7Pkf7mPImVkKBBt:KUEIKZmSidaKu0iKKgKP68OnSLcS
TLSH
T1B591356177BE46813C7F251DAC708617D68174B23069A82BF7A911B64F6BE001EFCCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 e88ca2ed25a7fe3cb8d0b524ae16e5d552957be3c2141873034d9ca0e8fd78b6
MD5 e5d3074d7ae81fb3677c2336d125d07f
SHA1 a3366b51279aca7fe0b396af98c9b7b8189aa1f5
SHA512 dd292ec8fa1ff8d947350ab41742f59d6d6e5075ae6a9e203b2ec00ce996b64e7088bafe63305c19f1b4ffd0ee0a7b3bb2ba04f4220be2ba6b68abf623d8d619
TLSH
T10E21D295F330D109E14E867EA47A9B291739E802CFB8EC0F857924746EB6F041E4B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 4e1620daeaff25e9c2f1956f999b9d528c46be77b0e2b90f4dcd7caaf55bb2a3
MD5 e6e05f2b9274bb94cedfef708caac844
SHA1 ce9c8427176bd5cc83baf0fbe9a0e9a6de03ff13
SHA512 add15a11a26d933477ff9536c5e211a902b89d1cbda632b149b5dd5ea58423bdf5df4bea12d5fd44dd1c253c23770d2b889bccfe8efbc986c744a0d72a0f804b
TLSH
T112E0D814BEC9C65F541030870178A78E82D53822EE942E423F0288445502D41FF87D52
MD5 SHA1 SHA512 TLSH

Submit Download

a5717b04-49b0-49d4-8f07-157c2c585f46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a5717b04-49b0-49d4-8f07-157c2c585f46.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 63610ccd4e7bf2688a47b5a3ccb0a56e12f6544ca8696b07642f96f18abcfbc8
MD5 dfb800a1f91cc91007463698a6ac9b93
SHA1 6c952c6068c65915b54dd72b0089c60c09ef4b14
SHA512 6d1bbbab29023263bc7e91a46a4f6347facc84dac76fa3d54610a72717c439671722c7cb5017dd262ce54b540fe8d9ba5528690fc3dca3b0b7a5f823fb4a22fa
SSDEEP 768:krv+4UNbdq3SJUq/YAam6aQMGdjWca4Ghf9ZnP:kbsbc3S3ymaME6pZP
TLSH
T1C103BF31A87899779CB79695F21B3643BEB412A784C80E90C9DD6B0D07DB4DE230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 e89e38b3fa4471a753da573fde452c3912329bb9dc6d2cd99480da710bcc6edc
MD5 04be9178d26b6fe03e0e50c1680e56a5
SHA1 97f441555383470814acc0db8d15c5f42d3ca509
SHA512 c87df417134330e6cf32e6fbf1a46634af9b4ab4c2c48610ef7687dce2ff5fb0b69ff03cf3258da18e89a288422e270e02559ff399fb5756aad53e560045a073
SSDEEP 768:LFaN35wg48ROquAam6aQMGdjWca4Ghf94nc9S2+0X:UN3wjmaME6p4T2+2
TLSH
T12513B1E94CD6943EC86EAB47A33E2D1699BCC277F4A44954F7945B0CCE6207FE302815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d6ab6608c35b7384d2a88b899ed2ee4df1a387a3153314d6225d5cddf1965f87
MD5 6dce680a346b23b19c37026643125c4b
SHA1 7c18045671d6cb95be151efc4a5101484345e89e
SHA512 f7960ea927fc9c8f7e33b6af0c7fa68585b2968fa790b9d83d10569cc6ae9b39484edecf1aeb37f7f102378926b3afa4c4c453c82931aa776fd7ad647021faf7
SSDEEP 768:LF4N35wg4xROqOAam6aQMGdjWca4Ghf9Z0X:+N3wAmaME6pZ2
TLSH
T1EE0317F148D79837DCAE9783A73E2D42ADBCC163B4845950B7D8690DCE960BFD20781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 02bbda915d058ec0a109794864be8c9f6e020d30bcf44cba2bd7f86f21f8abca
MD5 bf13c616629f42221565a88338318fdc
SHA1 5dd6d875f5d276b53dd3c678a23cbabaadd34bbe
SHA512 fb79e96c6a1779caf3a814479900a6e7faacbffdbdbba8a1f04635baa08289e21ef57c10e2938aeab332bcd34b8aa97a02cb77665f0e1c8f9701b70be5f522be
SSDEEP 768:/rv+4UNbdq3w3q8AAam6aQMGdjWca4GhfBCPeU/:/bsbc3SKmaME6pqH
TLSH
T136F2AE31A87C9973DDB79A99F21B6687BEF021A384D40E80D9D95B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2ca9ed1a66cdaf92af7eee830ef2f50d6abd43729553ab9458709650dea239d7
MD5 880b013b3385d63c0a36b33729175e74
SHA1 03d15810bae0749b079c5a19823b2cdc9278dfd6
SHA512 f405c4dab7a40fa0ac631f2caa828f2adb2b9b0d443feebd6ad4c4ef881390b20635bbfc358599406095a81f696f2d112516c0142c8e22ba9c6b162add205c98
SSDEEP 384:yZcIV38NgWTRc6cmivfPg6d+dfYb9UUM6VWmkA1QiZh6vPqQMQYeJfjWca4G2KCb:AV3aQUq/YAam6aQMGdjWca4Ghf9Z0X
TLSH
T12BE2AE319CB49C779CA7D696F62B3643BEB0526385C84E80C9DDAB0D07A759E2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 72ec17e6246281dd9d2e0f833119d75175703b551370ad6fb1ec6f702d864135
MD5 b6df5d68a0ec597f3d01bffa79b03d07
SHA1 bc9f6ebd7ef7f9d99f4a083bf0f1606f6fe41436
SHA512 019087e660d2e4018f0c3b151dd2a1029a3b0d673c4d84eb2e780a8ecccdff4ec68cb884e4cde18985f1cb8d3702dd12c015ea64c0febbe8c0ee3c46296672c2
SSDEEP 384:EZcIV38NgnTRc6cmivf/R26d+dfYb9UUM6VWmkA1QiZh6vPqQMQYeJfjWca4G2K+:iV3lQROq/YAam6aQMGdjWca4Ghf9Z0X
TLSH
T11AE2AE319CA49C779CA7D696F62B3643BEB0526385C84E80C5DDAB0E07A759E2307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a60e7e5a827e8784eedc42a4cdca8ce7fb8eb2f83a0d8642af0127ee4570f3a0
MD5 4f09a1beb355a4988b02e720433b7a3c
SHA1 22a2b81ac243def39d8ce084b7eef0f7e9074659
SHA512 a7a29ad70bbe10c79e477f21deb96ec495ce979d296c0b24b37d9ef03038b29f2f830c5c09e80a75a680d4c362d8791bbe3fd215e54cbd50c086d2624d95b0da
SSDEEP 384:yZcIZ38NgjTRc6cmivC/R26d+dfYb9UUM6VWmkA1QiZh6vPqQMQYeJfjWca4G2K+:AZ3V9ROq/YAam6aQMGdjWca4Ghf9Z0X
TLSH
T126E29E319CA49C779CA7D696F62B3643BEB0526385C84E80C5EC6B0E07A759E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 98e77a374599c5e7582cbee9baa023c3b8f7b77fdffc63194cda720d5c1c5ae2
MD5 2707fd31da59051c9c9a17201ced17e1
SHA1 de2910f5a290946215d3900d1c101d23d421dcc8
SHA512 ff64e364ce8eb46883b31ef6b57ff0c4efeae9c32deeb352f02f45a1ff1062d6018eadd74acf26b293cfa7fbc8875a1dc488324bfea070f65af19e7bf52b5faa
SSDEEP 768:LFH43LwgBvROq+Aam6aQMGdjWca4Ghf9Z0X:l43/ymaME6pZ2
TLSH
T1DB0317F148D79836DCAE9783A73E2D42ADBCC163B4885A40B7D8690DCE560BFD307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4f2044f3e5683765e15273d617c669e88912f868f068bf297f0c4fcb457765a5
MD5 fd06cd9373d165850f9fcbcc047daec3
SHA1 4d2dacd843addfb2419ad855d51e7c22751a9169
SHA512 f5e07af77b1b086124b10c71793ee0f4488c8ce5f396b761e451c4d40456b1690c224d6b56c81a3f63bb47c1a99fe765761b21d9279ecfcaccec1c8c9bfc26ff
SSDEEP 768:LFG+3LwgBvROqbAam6aQMGdjWca4Ghf9Z0X:A+3/HmaME6pZ2
TLSH
T1D60317F148D79837DCAE9783A73E2E42ADBCC163B4845940B7D86A0DCE560BFD207816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 6a4b1841cf79424ba17c320df1f4412a8ba39673826eab817f580d4c9437a7ca
MD5 bfccf0cd5fa98df6177c1e3eb56b8be6
SHA1 8d7b7c769ca5ed0cdfc7f1a691d8a04b82b4c7d2
SHA512 acfa69741c2d23aabdece0d07eafdf7696c35c1c7ac8cff8e2bd6cc81fe15438c705218ea6d8d26de47bf3e67fb5f25149727fd808bf247226e94dcce703806a
SSDEEP 24:TLE/j0afDdWec9sJVUOiyHXI5FNhnVTGVjy:T0Dbg34UyHXqT1V61y
TLSH
T10A92E171B9302067E4AE1BB5F8534C600DFC02EF8D6B755499E00D910562BC27B551FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 9cd92669308bb0da444075cf849f4ef9d6afbe95c9de8667db5a45bdfdf1c216
MD5 7cc5238e2c4ce92f2ab1cc4d0c5afd39
SHA1 2b0d4d077cdb9a61293719d85ff0d88ef9ef426a
SHA512 0022b292bc4f0db7301e0d8d509098aaf41cd56e06d355a97832842f7e34b9f8f68820a6e4e180e669f09abdeb70b17ddc75fe2de49bf03f8355f03e30ffb660
SSDEEP 3:MsEllllkEthXllkl2zEAlrA+ll/:/M/xT02z7rAe
TLSH
T1C14402046BC00405DA0010B04821839603A0D49405115B43349598526CC96401C05011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 e764760c5489cf2cf56d0c7f1d4d1c0c8ef4075781e4d0454fd0e0aba04f2b80
MD5 583ea8b8d20fb8613c2df1421d17e6f5
SHA1 4e156ad986a88931c09ce2714ebe171449f41819
SHA512 5b72531cc6b4b3d221cbf701c79233590da951b87212fa854cf5fccefa9355cc2b23f79f4b12930eba60a7a802cf2d4ac56bebac68e5b1aa3fba9afe3d5263d4
TLSH
T149F054677CF4C3D8C80159784206D01C6CE6110E08F53D4903142D777048EE94547C5D
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 fd2dbebff0cf6dd0ba9a8fef876bbed39d704645de4c3fe09de58de36f4a757e
MD5 1a9d9693b0e99f5de18f719f0a542afb
SHA1 66f15039763e0dc9904e49808cf3961dbfa1f087
SHA512 f0ea914b12a6fa7670e10e8df9c10f31655ea2efc871966bbf745df63b00a4047beb68f561811b1aeb0c0297bf3b6774166fead7e92befabe4046a16c7a0a972
TLSH
T134512C1EFC28D3CB5CD372752207829ABE0F901D22ACD1A5C995DE6951160AE19A71F4
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a71167cb-e3cf-45eb-b7f3-b470fba177be.tmp

Path C:\Users\Admin\AppData\Local\Temp\a71167cb-e3cf-45eb-b7f3-b470fba177be.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

tsetup-x64.7.0.9.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LVBIA.tmp\tsetup-x64.7.0.9.tmp
Size 3.3MB
SHA256 f46be56a0a8484fbffead0c67d608ca93fffcdd0e1e441d14a4be7515380a15b
MD5 7b438140cbee5f088f0d16cd75ba3eda
SHA1 6aeb3cc6b3cdd897c1c95ae8b6b755f3343f5578
SHA512 6146b86598801c0b36b8dae836b11b7bb1b2362b702b4c2e374858c7a5008d76776b577be221f0090eff6ef73bb511e9ff9b65f31b570cbb4959a210ae5750d2
SSDEEP 49152:6uAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLz333jx:6uAK6XMXhKAWwLsXa23331
TLSH
T196F55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A4C8F361802E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5528_627257627\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Telegram.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
Size 1KB
SHA256 4b0361776a63dc9c8015ec5212ffafbbdbd8a5d4e2716afd2dfd7569624cdb9d
MD5 6fcd68ab9b80dcb66eafab4f3a89540b
SHA1 f6674b6b00cc6cbf7048d504084aeeb426677f73
SHA512 acbfbd0123f2a61b3541cc5595cbade75a06a993adae96aa61dc8c307122ecd0a1c46612232ecf35219d1f15b6423c14d9937301396c46b210e194ec25ce7051
TLSH
T11711EF5237CA2B1BF1B266B007F752208A37F8507B98C75F44E4410A0C21620DBACFA7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8C44DA7397C2

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\1A\8C44DA7397C2
Size 2KB
SHA256 e34ab6858d8324af5bad7b65aeac1cfb2a289f4153ec4834a26f520ba83a851c
MD5 fe27f3b8cbfadc6c64464dd81edc0850
SHA1 17deb74dfff61342c53b623b02cdd98424d0da74
SHA512 f633edf81406bdcbc677c5284027b616664ae4c7a99f8270eabc2430b4e4341a285ebd212a257239a838f3cbb344101640dad57311d7585700820299f5c05880
TLSH
T11F411BAE6B0514D8E05E1E2C6FC20A5207AFF35F87C8F43832D5AE070893D849D56A89
MD5 SHA1 SHA512 TLSH

Submit Download

553E550F0092

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\1F\553E550F0092
Size 4KB
SHA256 3b3e11cfad01ece761871b616c4de70b08c6b0b99848688eea36d1bb0014c62e
MD5 2e1d78e1dba83ec607afbe3ab6793d14
SHA1 9d386a699a70003876c71a76d844adc1824ff838
SHA512 83c71216369668f0037a8044cd7eda69e53a54e4b3258172acf20e1d682461499c480d2fd98746b8065227104980b86540d0d5a0bbb33f94d2c905607df8ea6b
SSDEEP 96:XV0vFa5mVAtwThK7dFLJcuOsswVbVMhVuMqWVmdohl646jTTgxM:X2rVAt17dF1FlVbVMh4Mnf6njQG
TLSH
T147A19E82E873D1A9D74C6AA8189BF1E3713CE1751293845A7EC824EDDC4B31F662162F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6A1789674ED0

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\41\6A1789674ED0
Size 5KB
SHA256 52753755bb938086989db75f4f255ab492b0255a6548a92fcc4fb5a05648b419
MD5 e4a85ad7df474c9b0e3f20ec10458f70
SHA1 2dd52817a7a379b79337cb9447b11ca1dfa9c868
SHA512 eb3baf27cd5ab7affd3d570352165e7ba689797e295ae5845b4ea996fbfd681bd566b94970a50a926434a82cbe92301db39c7c5138c758e9af45a6fd55142368
SSDEEP 96:Pad3A5DBbvOhQcidXdno/XxzDJGqSarH1EvF9GrwLWDOCUS1LInm4VVCVM6SVmhn:PaAZhOhQbdno5zDMTarH1CGrwLWArVcF
TLSH
T1F4C19F5844B6C45C143B24FDBF8678D37503B6977D7142052AC5C5B0896A13DBBF82DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCBF186403C7

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\71\BCBF186403C7
Size 5KB
SHA256 a976cfc02b174d1e6eea4aded1ed7fc8d7cd0730f9d3eff5315b9d0cf53214d9
MD5 1bee0bd136dbd4881d9fae37117a9b66
SHA1 1d445b59ed7452bdc3c5d6f9140ab782ac22c6bf
SHA512 2981dd955265d0981ee8d9d2f2ccc68be2dfc856233a37210d173f6a351994497a16bf768812a864a253b0b2ddf877817451fccaf80b4e5da509e2154b9eb226
SSDEEP 96:Guz/+n2WrK2ElZQCA3vGYb2BSS0dgz0jzu9a4AaDbYbXXU6tlWM5HBmfWlw61964:Guz+n2WrK2Eleh3vRVS0dgz86yaDUTpZ
TLSH
T1AFC1AFFD2B973567B9217BD2B55369A879C4B1E332B75384716CFCC022D451072768C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97AACE95C4A0

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\84\97AACE95C4A0
Size 4KB
SHA256 53d4d1093783b4ff1c90ed19f274c7a3c00dbdd928a731a339cc5992b217f5e3
MD5 efc5d5dd3363ae3959472a7cb1361417
SHA1 6c4dd2a6fabf83b198d7c2333cf773482254797c
SHA512 a187dadedae65c06208bec9d40cb0220f2e98e58eac4e1a2ea1d5ac6efef2635039f417e332db3ade0a891b817143e509ee5b41e9f6caf0cce9608ae90d6ef19
SSDEEP 96:o1qI+QhVc7qi0YP8fXPRbgvs3epsRvAnU1PDz:rmSqCP8fZcOxAnePn
TLSH
T12B917D1712CC209BF85DD1EB5C33EBFFD90421574ABAC606D74810075EA7D3146846DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3A61BD025261

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\96\3A61BD025261
Size 4KB
SHA256 f0d2b957c3a26945fe4268ae6e550013e31c3ab7378a820d68d810c362069515
MD5 1515e514b0a29190edac92fc08ac38b9
SHA1 c6b7b2dde84543c58a805331aab9e020ad06873e
SHA512 a7bd8d76d6815519859d85d7574207c7a5e55ce5f310fa93b9804e71f1f4145dffc543953accc6ac61870c0b02543e599ac39a3c0ff377c5aa49a08bdb3ef522
SSDEEP 96:8N7ygUfM9ST6rT9/W20smL/XK53DVDevwpGcrzT:uyg4M4T6P9esmL/XI3DVDeeb
TLSH
T142917E5367AEC391900828DF9173E499D8B8BF63C797F97A0C500F1984721DD55CBBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8C9B105C167B

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\A7\8C9B105C167B
Size 3KB
SHA256 2f152ec0822ab8ec186cc769883b542151b3dd146f41eb3b29dad7925268cb25
MD5 4a65b66d918615f593c7463e12dec326
SHA1 233c0760a56f049cb104d5b3f85d48b5c01697bf
SHA512 d3a293f128138fd351a83b54005b5ebda465d86d258fd20ba63ef16e49e802ddb435b13a5b145eb98cda1dfa5742ca3855940055840e97db247d77388e616b19
TLSH
T15A819FD7AA3D153309898E7108F07094D4B3DDCF9C5A55290937C99E93AB8B121E5CE3
MD5 SHA1 SHA512 TLSH

Submit Download

D1217365953A

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\B1\D1217365953A
Size 1KB
SHA256 df3fafbbf1deb6f8d79a686bd3d8752b629e057126d247b73ef658a33c9f6cca
MD5 3cae01f20a327c9aad6f329eaa5e825d
SHA1 ae2ea2755d3786e172964d93409c4d143b07acbf
SHA512 0e4348c0ab41a5917124cffa399aa2683e8a055088f54681176c9cc15a3a9a5ff754788c674458959e24664b2f517be444bc0518915185ba399fca28bcbd3ae9
TLSH
T10511D834A4D109F2422482BB1D57EBEF5C60B47D7581309F1FEA10E1C8D57D044D4F44
MD5 SHA1 SHA512 TLSH

Submit Download

4A746E34D823

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\B5\4A746E34D823
Size 2KB
SHA256 18a9e6d0a0a38d2c269ebeb798f54f16d5fadf1907984508257e61cad6117195
MD5 df75e6eb901cc5d7083fdc3c9872f2bb
SHA1 28f689b820d76cf636d87b2e6e0f2086f0ea0302
SHA512 5005dc35e39cb8e32cbf018422dda01756340073aea70e3c3a6dc04145e233b23f4ad50876bf068fd3be4be7489cfb758ed35ba1f5ccf67e280a23b78cedc872
TLSH
T1A8512C76084E42C8DA5D839A48674C3F851CE08D42C2D6F8D52DC9647E0C2A752CEF7C
MD5 SHA1 SHA512 TLSH

Submit Download

C3C8CF62A1D9

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\B9\C3C8CF62A1D9
Size 7KB
SHA256 37b9b52787b0c9aa9681f22217815734c33d80ec39d47ceb2ffd152e7bf8b27f
MD5 41186c57f493bff3da2abaa58eb74c32
SHA1 3293c4a102f4ad69d9d8de8db6b4ea030b3c9f0b
SHA512 2a9aadaaebf8aeca1d2f942dd80b125562ba13c3bc0df65ce4a2fd666721826727d88f9db7206869c0a2dbeb6161688eea3c1edbd4c838f1b3447ce2ca0d17ef
SSDEEP 192:hEPe6C1H9pUtGog/sIjzGVE63LVhAtdxTwqWSADTA0CpD5RijZUj:hZ1H9pi7InQE63LSiZDTA0UD5RijCj
TLSH
T1DEF19E5A9CF913A5A231A67A8E5154BEC369D5DB365FA0C527A0A4909CCC29C0802DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DB780800C457

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\C8\DB780800C457
Size 7KB
SHA256 c2b65127f352c5d2e6d36282b04eda3cdf65f93842ec0774e02ce3b9bf062beb
MD5 5bca34e75754a5a1f8bfa83f62a3972c
SHA1 2b0760d9fe34ad0e7a5ee4b1e0d208aba9f16e3b
SHA512 04d2b7ffe0665aaba05876b6b8a4902fcf912631fd469c4cb65845e1289b107211f59290d401d52dcf734ad48e907eb09ef480b81895d9700450d89aacd368b2
SSDEEP 192:JoZPfmp99AIB8U7sVUmUK7ftA9HSz2DEP/ZFY65g270R:Gt+p9Sx+sVUIQHSBPBhkR
TLSH
T14CF18E7D725CCD648F6154C822A856412A9FA3F2F3918D1F17648F83A1E257919F3F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53EADEE8FA5F

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\user_data\cache\0\E0\53EADEE8FA5F
Size 4KB
SHA256 875bc69443e9fedbab7aa62a658a1f7dd9b46c16ef074d7c623e9c7caaf2686f
MD5 279218d6b97c74a4d5d75d614213dbdf
SHA1 5bb5f6976c5f480effebb448697e8fe1d960b3cb
SHA512 11cbbc4cbe6b7d9ccdf7cbd53aff532e86dcf63d68dffa20b60a1720a22c70eaef5db8eba152108d4dd831163cbcb08d29a82f11c3369d9528ff3b2f801a5b0c
SSDEEP 96:99jzgbjkEGEpfjp9Xau32zc7KhGiYHT4zmWIk:PjzgbbGufjp9Xaumzc2hsMzgk
TLSH
T193815C11E7252EFDAAFF27C362A09203E439691D82829FF1AC1AD40764679371C2F00F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5200-1186-0x0000000000530000-0x0000000000608000-memory.dmp

Download

memory/5200-1142-0x0000000000530000-0x0000000000608000-memory.dmp

Download

memory/5200-1089-0x0000000000530000-0x0000000000608000-memory.dmp

Download

memory/6028-1185-0x00000000002C0000-0x000000000061F000-memory.dmp

Download

memory/6028-1184-0x00000000002C0000-0x000000000061F000-memory.dmp

Download

memory/6028-1143-0x00000000002C0000-0x000000000061F000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads