4104dac4bad8d3d547d56240c9362ac06f25f7ae9fb96d2b3673260e7c0a0da3

Analysis

user interaction
yes
max time kernel
21s
max time network
36s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revosetup.exe
Size 11.3MB
Sample260810-pjzzmayclf
SHA256 4104dac4bad8d3d547d56240c9362ac06f25f7ae9fb96d2b3673260e7c0a0da3
MD5 d980e12c027180b2f4bdf96405e7544e
SHA1 efd92a3eaa7268138f0d6145d6139ef0cd2a83ab
SHA512 1041340f88654437f119edb47297a88747d5d629399e8e46b97edc3bc502e29ed4d7414f7faed2078f24367d02eafb9c71ab161b30a992afe24c0692f643dca5
SSDEEP 196608:pX5jUtEUW1IotP/D8wUi0R8Ap7xcZCvD7FBnqPnD5oQm+485:pJjLJIot4wUi0R866e3n2l4W
TLSH
T107C63313A7C68072D8B25A74ED928D46EEB37DB13EE345063EB5F52E413C6252E3B118
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1872	revosetup.tmp
5036	RevoUnin.exe

Loads dropped DLL 1 IoCs

pid	Process
5036	RevoUnin.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4572	tasklist.exe

Drops file in Program Files directory 59 IoCs

description	ioc	Process
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-PRU2T.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-EA6HO.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-QKK1L.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-DG468.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-556BB.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-I5UM8.tmp	revosetup.tmp
File opened for modification	C:\Program Files\VS Revo Group\Revo Uninstaller\unins000.dat	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-V5ELE.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-D83GO.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-KNTFF.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-9THVD.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-4O2EL.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-NS632.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-9RITA.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-I2JMQ.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-R2O6E.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-TDM9U.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-GTO9Q.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-FMH65.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-4T9E3.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-H962O.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-FO2G2.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-O0LQ7.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-E3NR9.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-FRS0L.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-SQVJQ.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-IU9QJ.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-22ETK.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\unins000.msg	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-1UFDD.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-43GBV.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-5SNPU.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-OQOE4.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-JE60H.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-KFBNE.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-9D29I.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-20TJP.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-F7TJI.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-J70IN.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\is-M9A5O.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\unins000.dat	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-GAJBT.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-EO6JI.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-G53EV.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-5BL49.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-G6CF5.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-BA31G.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-BDMDO.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-0TIQ9.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-GHTKH.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-FK9VL.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-8DF3S.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-5ANU9.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-60OTH.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-5QBO1.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-L89AC.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-4KL3U.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-86RG6.tmp	revosetup.tmp
File created	C:\Program Files\VS Revo Group\Revo Uninstaller\lang\is-UAO1C.tmp	revosetup.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	RevoUnin.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3636	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	revosetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	revosetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
900	msedge.exe
5416	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1240-0-0x0000000000400000-0x000000000044B000-memory.dmp	innosetup
behavioral2/memory/1240-8-0x0000000000400000-0x000000000044B000-memory.dmp	innosetup
behavioral2/memory/1240-146-0x0000000000400000-0x000000000044B000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4940	taskkill.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	4572	tasklist.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1872	revosetup.tmp
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
2164	msedge.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe
5036	RevoUnin.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1872	1240	revosetup.exe	89
PID 1872 wrote to memory of 3636	1872	revosetup.tmp	90
PID 1872 wrote to memory of 4940	1872	revosetup.tmp	92
PID 1872 wrote to memory of 4572	1872	revosetup.tmp	95
PID 1872 wrote to memory of 3588	1872	revosetup.tmp	97
PID 1872 wrote to memory of 5036	1872	revosetup.tmp	100
PID 1872 wrote to memory of 2164	1872	revosetup.tmp	101
PID 2164 wrote to memory of 5708	2164	msedge.exe	102
PID 2164 wrote to memory of 900	2164	msedge.exe	103
PID 2164 wrote to memory of 2696	2164	msedge.exe	104
PID 2164 wrote to memory of 2696	2164	msedge.exe	104
PID 2164 wrote to memory of 2696	2164	msedge.exe	104
PID 2164 wrote to memory of 1172	2164	msedge.exe	105
PID 2164 wrote to memory of 1172	2164	msedge.exe	105
PID 2164 wrote to memory of 5908	2164	msedge.exe	107
PID 2164 wrote to memory of 5908	2164	msedge.exe	107
PID 2164 wrote to memory of 5908	2164	msedge.exe	107
PID 2164 wrote to memory of 3832	2164	msedge.exe	108
PID 2164 wrote to memory of 3832	2164	msedge.exe	108
PID 2164 wrote to memory of 3832	2164	msedge.exe	108
PID 2164 wrote to memory of 5912	2164	msedge.exe	109
PID 2164 wrote to memory of 4056	2164	msedge.exe	110
PID 2164 wrote to memory of 5912	2164	msedge.exe	109
PID 2164 wrote to memory of 5912	2164	msedge.exe	109
PID 2164 wrote to memory of 4056	2164	msedge.exe	110
PID 2164 wrote to memory of 4056	2164	msedge.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\revosetup.exe
"C:\Users\Admin\AppData\Local\Temp\revosetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\is-L7915.tmp\revosetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L7915.tmp\revosetup.tmp" /SL5="$400B0,11191091,266240,C:\Users\Admin\AppData\Local\Temp\revosetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop revoprocessdetector
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im RevoUninHelper.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\SYSTEM32\tasklist.exe
    "tasklist.exe" /FI "IMAGENAME eq RevoUninHelper.exe" | find /I "RevoUninHelper.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "VS Revo Group\RevoHelperFreeStartup" /F
    3⤵
    PID:3588
- - C:\Program Files\VS Revo Group\Revo Uninstaller\RevoUnin.exe
    "C:\Program Files\VS Revo Group\Revo Uninstaller\RevoUnin.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.revouninstaller.com/free-install-thankyou/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff902d5c188,0x7ff902d5c194,0x7ff902d5c1a0
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,2333182333407964114,12994465981131327674,524288 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
      4⤵
      System Time Discovery
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11493528263609807515,15753617452373776763,262144 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,5814108471578864675,3975311426396834716,524288 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,11257516980379027883,4707036236850294242,2097152 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6218843644169192756,4657376295298666667,2097152 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,11787003889089281003,2395094689260101026,2097152 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,14903553139984435422,16871020205432774699,2097152 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,1209953032066336183,622962281676529413,524288 --field-trial-handle=2600,i,5414709040562445440,5586838023015443913,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:4200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x288,0x7ff902d5c188,0x7ff902d5c194,0x7ff902d5c1a0
        5⤵
        
        PID:3588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,918460882693168488,1713178102307338745,262144 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
        5⤵
        
        PID:1764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,6252648880746074193,3792336068243465631,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,15145959614027907872,5518407407066765386,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
        5⤵
        
        PID:4348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,9570580072155018067,11096120135034319180,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10183274759513760430,2806518605097168409,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        5⤵
        
        PID:3932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10183274759513760430,2806518605097168409,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,4869818618414616404,3996068217130333569,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,9978732027281944260,4101503242786050965,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17423384252013877724,9925737618294589555,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
        5⤵
        
        PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14072979922670792228,17374294085587566900,524288 --field-trial-handle=2444,i,6889856916955480690,4192537595229923667,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
        5⤵
        
        PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RevoUnin.exe

Path C:\Program Files\VS Revo Group\Revo Uninstaller\RevoUnin.exe
Size 21.1MB
SHA256 8cc641fa0139badb95bdbb05cdaa38132cfb86b7659cf8e2a552a822bf612c11
MD5 6a9453cc240deaa7c2144bf596a9b162
SHA1 cc0c59684a2d0c7747d9879535e7ce96ad504d2b
SHA512 237d8ea77aba21855b85e2c13400a96775f2a8d792b8d5c33fd0553fc0e96f337c47bb86a2d22a468bc64d2cd3d0d76bfddbc24e8ea307f3503b940282b6401d
SSDEEP 196608:iJzAYYqCPo/ECZfiNLVhbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIV:iJzA3qCA8CRyVhlqPWpyR1px
TLSH
T1B52729B2D91184CCDE2CA6B5CE1E89FDCEA26C59AF9089AF41043D11ED736C0AD3D25D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinAppsDll.dll

Path C:\Program Files\VS Revo Group\Revo Uninstaller\WinAppsDll.dll
Size 37KB
SHA256 bc151c40ee4c5ba14c09e1f767c6d9bffc13fd73219912fe13e3c2f131b43b49
MD5 c0805cbe172aa129fe619538af7f2fcb
SHA1 cf76bbf255bdf2a2aa834bbe61aca25cc9b870b0
SHA512 ffd859187f2a02774c6abfd0dd3673b0783576391fa0df8abe3690edffade07236f1f538ac1c317cbd92e8355babd75b6b93f7c421c74cec0bc49c1f62afc07a
SSDEEP 384:SLgmHXXwfuhf4bNHOXysRKQ1TDsnB9GBdjzRBUOuB/GNyFIYi2mL4/y8R5UCMIY7:OUfuKghDLzMB/QYiDLk5DdYiH5AL
TLSH
T1A3038E53D9841C45D8779930F8D29936EEB2B2951B90D3CB7238825D4FA23C23BBE365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

english.ini

Path C:\Program Files\VS Revo Group\Revo Uninstaller\lang\english.ini
Size 103KB
SHA256 449862327c9ee59546c5b7aac6073431546870d11f3f1c6e7128feb53e7dfeb7
MD5 415be98de9be1469c6840d73415379f5
SHA1 b62e2a08afcea23e700a8aa3b28ca98c49e225c4
SHA512 22a72e1b722b0e2bf332dd72eb6669b43c0f0630e2a224e8cb3cc31db263b3b71e824f3f9fcbb4fc9eca2aed1667e03515e69092089c16cdc1a02ac074753414
SSDEEP 768:Qo3ogb2/ETiuWD6V5yBdzqp+iImPXhF9Jie9MzJsmIzS/GYeop6wklB69YK3zgik:57O6ryBdzqp+iImzcCop+lB69YK3zq
TLSH
T139A39C5267F80119F6F77F54AEB502714E77BC9AAD38D64C0281058E2AF1E40D8B27BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 75b70bfe773b6848c615c985e24a94bbb6fb1891c7c38f3a7b806bde93df88a3
MD5 49156155eb7717768f6f8b0445615022
SHA1 12f7158f649a31b169d57f53ae427b9a0a074ddc
SHA512 4ffeeef4a9913b487ff25e2584caf57a84f6b43baacb8e2192dd763a0626de24d773e6c519d9cec75b951fbaa7a3a5ba38b2fc55ef48144664893045f01cc94a
TLSH
T197D023707D55FAC9D6451072A5F14740A2154A52B952D3495100F51DDC780C177FFDDF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 563a46a8a347e748cf4d4c1a48a700789ccfdeec27a04899b5e577d0b266bc52
MD5 da6372d05fd8adcfcde5513913efab5a
SHA1 1ead17f8827ef9e0481c87e21469dc5169d4c95f
SHA512 55d1350b8dbcdeec8197fa60a21ff9e0dad8b0aeada796145d3712c2d97552ff849394e590e1b009f88aa54fc34e64399bbfda9005a70914f0a80d228fcbd152
SSDEEP 768:nwnEvEJcOyEVQdDE2EYE1EFEpEg1VVpA:nccOXQdM19A
TLSH
T19713067DBB158C26C2E28A7D1CABAB7117B0D4ABE4C102433F71706E6725F6A48CE053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 401576b8b81b750758e98c5e255fd6566979562afbd1df33b77b30b0faef8ec1
MD5 ceb82815876610dbee52f10950019177
SHA1 5afc692392756c83fcefa9d69bb5a0c3346c3208
SHA512 093897c155010b11d3c9bfa6944ab218059e6f364fad5a2cf7d5b51a2c4847461e82147bbd79c8a6e4ddb8a5af772c62605a6c829f5ea96d7845f18434c491b5
SSDEEP 1536:tSg9L/TVL/rbne9R3Vv+enINtAjmmOWxWNRrolb+7k2:tP9L/RL/nnQ17MRrc
TLSH
T1DE446FF70A51A01BCBA842F5E6037E3DD17B450E7CD1E8A9E53C4C852829F31B6BDA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 da4a90499aca42e0306218602421f77fe0f05ef29966ddb6e9d173b4b0a447a2
MD5 c1135969906ee8cf93ce68ace6c6bc6b
SHA1 7c2de307317f5754f0fa7d06baa425570bee6a95
SHA512 bd3fa281bffd6d966510b792b9e5337b58cb084c3560dede0f00d1b2e644c8d3c07d8d9f3103ae877f28ea3ea82ddf2d494df344b0ceec604321d4025fa356ff
SSDEEP 3072:Sv9G+HNF7JiHv6K42VB70vU5oDk98ulkQ:SQ8/7Jc6KtaUcxulB
TLSH
T1522528EECB682C82CE6B867074E0E9077E712183F64DD0D39944C5D897D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 bdeed259bb69ac3efcae135472597e98ff9d54ff4562a362fd298bbd4af43c80
MD5 44ec75a0ee10d588686408a6125fd6d3
SHA1 b666a4684a6f12b836e5bf900a7f574f7f410495
SHA512 4e5fab9575d98d9cffe425fca90d55abf70c56676950860b669531b6959eb6e6ba715bb3c38c073b821f2773856c949855a387a0c0e3db53e48fcd91f443b2b5
SSDEEP 24576:KvH9yij4MP0StZl84JIhZZ4dKdmfmtXSyKJg54L1:KvdynMP0huI/MfmtXSyKG54L
TLSH
T181167DEDCA6858C3CE639A30B4F0E9577C7413C3F594C1D6889CC584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2212a38724115616e2bdcacff03ad38a515a59fd94d7a14e0e89a6cfae54f098
MD5 96661b268203246f2d24746ecc501bd5
SHA1 3484db81799634a1575f37c2e3067f0f82a9f852
SHA512 4211c94cdb1b28e0295dcdd76db44baa3472a6bc8ac4558e7366b3bfd0d4c26cb4f84895e72bff1f25027bb960ff94fedf3f80887822859b3aba1286525f2f4e
TLSH
T1B0513BF123E21AC2D32C69B697D28CD836F5A86F04836E107C94BFF09986F1790E1857
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5980a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5980a0.TMP
Size 3KB
SHA256 1992f11ab0f584b6c09afdc8242b7e0718d2fb69b8dc3df9505cbb6605dd6989
MD5 8ab9a113756c63195bc36152d47f0b40
SHA1 7f589dca2f03566680304189179e8b1a9d3cd111
SHA512 36e6b9eb0aa251a1d6dfdfcf9beede9add8b67be7a8f8efbf6fe9c30ca92000ad75156ce27e0542e24bf389089c326b13b6589325e75c9f1919882f35bfadcc6
TLSH
T1D1512AF123E21AC2D36C69B697D28CD836F5A86F44831E107C94BFF05986F0794E1857
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 5a74e619f882def9f8b62aaacbf95511b0887cbb936d6d0fa37c4bd3f7f2bec6
MD5 6fb74331019cba10e8e56eace9a9a9f3
SHA1 02f2446a81fe9dd77c1ca1427a8c96c9d2572662
SHA512 4ed6f1a33e736dc120e1e3cc4d16d7a995ab197411007bc728ac4953a80dfa4ea58806c4f663e0d912ce45e80430df1dc5475952bba352f3c332f9b8857a6903
TLSH
T192E0D8D694EAC1AE9DA038C392346B1C89903842DA8DFE47378198C07602101BF8394A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 1947032111992e7ce9d88a523c38b2a1e299e10ff6d3af9b14a9a5f3490e1704
MD5 e9e384fa844d7f7b40d08f55efe8f98a
SHA1 718c2d3c12798fc1ff1fb792193c900442d5621c
SHA512 acdc1405bfc7ff030de4b09c0b81ce93bd4034478b41cd1cd074aa8a503b3b552df04aebce9a1930f9577db9962681c20e8c94f5f40112ec063ddbf4d96529b8
TLSH
T150E0268694CDC12EA8A474C3C2F4B709CA90B44AEBDCFD462B4D8881B002204BB87284
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 09e09b9aafc4f0e51a796f0cbbf26b89b78ad2fd70755a56a9fb49d8a246e269
MD5 386d526c730f0f5e95e4c59f4831eb98
SHA1 ac7fe706547ef32cbff296fcc7835819819c273b
SHA512 e478c4edacc9a8320030478a91803aeac1f2abb767a5cbf62a69f0a47e7a6d29ab755e0d1bd9c0e449a4dee8a3464abd9c3b535537039cf6d80d85e362eb2c30
TLSH
T103E086A848DDC52E989468D3C276B30D8AD1B446AADCFD46274DCC81A502344AF97684
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 5dc06792ac3d6ee4afb1129afc57078eca220644f12c9cf35674d0ccd9f3dbda
MD5 2349f7a56dab1a1ba741824163d0a546
SHA1 a3fdeec73dd00b63faec2fc2444740a40bdc7687
SHA512 8b2c8f3af0460e5b9e049dae75b6c6e506f4410962c37167342f9a7754232f0588f3346c6c2503581d65d58e35f222ecaf4a77a2f6ca3c965c08d1393e431382
TLSH
T16AE086D648DDC52ED894A8D382697748CBD5344BAB8CFD4A274A8C807501B4AFB9B284
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 f22635c246b36fa437b83e53dac51fa8703ae567a64b670722b315b9e5bd4647
MD5 f0e0f67ac53822a8a02abfce15f2fa40
SHA1 6074d4d676e00ae8c02d02941f66ac9102027d40
SHA512 517bcbd4b653c5bafb5254d5cb65035d12da32d5dac4cfcdc94423412114c2e95c36f8bfd1e0509fc9710b0e9c937f809698aeccab9d9cbe070c09e57041ca49
SSDEEP 96:rBmtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/UZbbEOVpZf24JkMfXSFR+CFqrn:rB5H+bF+UI3iWGVoWN3qL/mVVV63
TLSH
T10C240F1E5F342722CDBD913669E744A35C7DF03F8B5326DA6C6114B5CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 7b73298a9a65f038dd73887d32c3e1df21c91fee09758097c870dcd72ddd5959
MD5 0b3d031bbae019912bde7c80d80c10ee
SHA1 e67aa4a466948d228ff4ecd9caa9f77e3c81e3f4
SHA512 e6a2fa45711170922df8a51e249e949ab73e691002feda9dacc10ff683a5f43a0182ba5834418ccd44bb65524f08aabdfbcd1163693501fc57bb847663fc9371
TLSH
T10BE020E194DDC15FDEC4605B5229770CCBB03547EA8CBECA2B069840F201144FB972C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 77460caf626624e0e33a48dc5f3587f22947730faa6923e97ba85865d16029da
MD5 a3a38cf0d3fef356be38d8f4cd29b183
SHA1 060bd989559d30b1bc9530f86b0ef63ecfaed9d8
SHA512 fbc1c2a7077e96f15ed68465c5181881cca0ab99eccf41424be081b397ca4c6c03e6c8d6a23f20289afcfa9d5a24fbae7027d6942ddea1685aad3c4fc688716b
SSDEEP 48:Txk/LopFMaty423w/a9NUuTjAw7opw6NdXWYUIr:qDeMatha9RA1DN1
TLSH
T1CCB2004D1F306222C1F45B77EDD084772E7C111C9773364A9E1860F2CDA266BFA0607A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4c94489368f74dd745b603aa241d6d9dd2a9fed1c07525a8dd68ce1b39b67496
MD5 8365ad345e186b80fce0a2e64eb5e951
SHA1 64b97aae73c5b9fe944a4b83e048e4f07b02c51e
SHA512 052db0924b116307744ce12a1137ec065d636232e78baa190d39cebe4bce81ff6f4ba6426f1f087adbf0e6e2c074ed6c67253a17ab88be7859912b98ed0f5e2a
TLSH
T15551D3F383B4857E9A1185F4AA046F1BCE6D0511536C3CAAC5E4AD2B93F34B1D150A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 da1c80821f93aaa93bc1580555ff6955700fd5bf53d6c0c984fdd9c527a8de10
MD5 807dc800c35ae3185f015d22f0d69978
SHA1 ff5fd727c21058ef28b6af4c89e3404f3cda9806
SHA512 e3162d2b3c9a8ddaee5ca687b6f768625b9aaaf975ea1b2d44915ca51ae5475c02f33c4d3aebcab50e898309a8e69ed170e848f91d40e6a429859da8262555fa
SSDEEP 96:OIEumQv8m1ccnvS6YQNLkNcsKIOtfzcRKIvnFSf8jQ4mbif4g:OIEumQv8m1ccnvS6YEAcsmcR2fPi5
TLSH
T127F213FB17375105D99048B0A4009B8EBF1A010B47B9B6EC76D85BE3F7A24E1F27875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 689B
SHA256 fc735224bdbba3aaf77b7d61bf19b2aac337ce2b8548bc070cf1ec1518d2b704
MD5 09576daaddfc35e152eb7ffc252708f8
SHA1 872827f0b99eb5cb4470fd3803757642980082b5
SHA512 2c92b3376423da3f9c4313c9a44cefeb77653f6a7c5669d4c9d58e5cc1ad5faa062ef2c97a6d95d98544df19e6c4dce1493ba60427b0ed199e7067f7e6143841
TLSH
T10D019E53C2BFF47B006C487F1F04B8022AB9903201416CFACBA5C22DE1E95F76E53066
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 68620d43eb78a3154cc1fb2e8b33377c047c3c0ac37425c6bb1d6e77e1555cf3
MD5 be35aca0f44b89f513a75d0b23576bb4
SHA1 12fb3d76b150b806b76f37ff48f70053dbe3ca3f
SHA512 1e5c497c98f303f6d0841d1e6ade98b83283aa551914d5f2b614cf7cd1197356f101e5b60189b39fa4fd3f17cf6dc67f021bc32dbff5e7aaa7dfcd34119bc0f8
SSDEEP 192:sxRpRLyM/jK1Ml8MLCo/fDs0WpVmFprQ5ZzoA8pqh/g6+WNxYsLw/YHtWh7PgsIQ:sxRpDco/fDs0WvmFJ+/5E/CcZb
TLSH
T1F862D915AA34697BCCDBD21DFA557FA3D6F81423A1905E44AAFC9E0C00E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e32fcfa29dc036c9bbf0e38bff8eddbf9674426eb653d3c89e89e9c37b7ecfdc
MD5 a3e7e0b99896ab3e57d8f81ee13e2ac6
SHA1 c42defae4f452548c28a25cd852ee66b3dd5da2d
SHA512 596e947b9d67d3efa7d6658081d7ae9c760fb5868722d92dc82deab11da88c704801a2d5d0d7006a0a92f8611d6f8a85939132089ac1b3c5205a19fc1b0dbb55
SSDEEP 768:wGedUg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVu4YcroSj8A5H:wGedUsE7X6WgoufDMu1jaaVYH4B
TLSH
T101E2EB3B680CCB7E4F444EDCE829BE9BADE801CB5AD88D5447EA840C03C67EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 c92aa6594348974cfe5b0d235c62bb551386117731b2cbddf5807a16dd8226e8
MD5 12c4b73889f27dff093dfbee76e13be6
SHA1 c437645a765b4446b836ac28f54aae8024dcfe18
SHA512 1464218d7c4e3266f708676d8a4eaddccc55457a1eb97250e4af0b1059d0336d328f21a51106a79f0ba68409b9c6be971fd16d8ca550522de3975a24dcd01dc4
TLSH
T148E0269046CCC97FA8D626474737A768CEE4746BDFCCBD463FCDD840A142604BA97180
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 895cd84c8f4eecc73e1ed322a3ec8db93204e64e6796675274af7037d7cadcfa
MD5 f4ec39413bbf7180f2c451d889f04807
SHA1 0166a28a9f329858b454d8039f9eb38b2cd0d213
SHA512 a5914a68b2717f8324e7322ab13f7ee2921abe861bebe12cb7602e025b651d188eb614e996ce1dc214e7b5fc5be42deef058f952d3933781d64edb4d9bc7eba5
TLSH
T13EE0D8B056CDCA6FA5C6358B9635F708C9A27466DFCCBD553B4DE840B2062407743140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 88a805c76da20fafb7edff5009976ae062fbcec644eeb6b99db804eb355cbc77
MD5 1833d8f27607c54d4a2b4393a42f85a8
SHA1 abb60139905385ff8e944d34f8fb49839c623e2e
SHA512 c87d5bb9d65929caf195c60607204f0c1fa71dc3073c8e0cb767817dd76f81103ee5aa3da90bf4df75b6f9b7ff925d37802cb5d59d3d43b896857b6c77614422
TLSH
T132E0D8F095C9C73E9880A0878275BB0986E0FA4A9F887D85770C4480A542601B766582
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29b82a5e09b8b082aaa4d6081a0bb8ea407ad628cf4c17ff09607c8534b7e368
MD5 92cec03dd18213170fd7a9b7f16fe1f4
SHA1 25090646a9545110c3d24453c24f73f2bba40dce
SHA512 00c1eb4af63e2e89c94d70c5c578b56b44cb4b0e58a4e0d721c0a4f6ae41aa57b1b5bcdcc0b48a8a0899fd0ce6c11d12da3458b0c93d35131178dfc3570f2cbb
SSDEEP 96:KR4i4n4O4i4U404k4iW4s454Rg4S4iK44Hg4I4ic4y464h4A4i4LH4/4o4N4J4/x:Cr0xFzJZQNi5tPUgD6LTqN5eHyX+SkEy
TLSH
T184916841B47A02543D7EB90C85E9DD2AB68174A73009B46B3BA951B50F66F028FFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2aba5cde26f385e9fd32e6e73723748fba7969691a2701167c0a743a929966b5
MD5 a51a7a1a775131e3acee3eca9cd74f5a
SHA1 3df7efcbd1e222c5be97dda74fddc398e8955c65
SHA512 aad96e9ece8c80c1d7a17643f50e063324fab832affe97e3d5da3df3b801df808d5631870ad077247d5cd41ebcab3ee38513ac06edc14bc907796a20e9763d93
SSDEEP 384:DNrRZyCSDnxTICVMEhIKyll7svbFKfk7:xFZJSDninyI1l7svbF9
TLSH
T10444740A7B747001EDE6D9721CB080771E3CB16DCF22A6916DA254694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 ed947047eb92e83aa5570f5ff5af8471cac6bc52648cfc7a6d5b287328b190a5
MD5 54eea156d2a563e6828e5f03d4cf1456
SHA1 2df39b76709000b36740300b10a0016340415712
SHA512 e56fcc8a2f2ade67c9c1c1012359889eba33e961ac07db305c3cb421af66d403a43f27c929857fa3e0b8f70b4918d7f1a509c68c3018731ce3e32b3f9e130d66
TLSH
T1B6F0AECB6E030577CC02507150336783FF2189CB0024646703CD202B2A1D2F1C5CC0E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 683858293c6e64486880eec644b2431323c65d44c17ff30ebc099f5c75c4e5bb
MD5 b33dd05e062ba1407c908f035ba70c52
SHA1 84fab065ab76b0e36d9e7308d73afc913ac3f638
SHA512 4320417e85569b42aaef3c02afff5db60f88d922e67be509f7d79119e1cc1218deef0c68ce6af7962c269ea3261ac938802b04a212394c2b421b4fb5c86df9ce
TLSH
T17CE0DF96A8CCC16FA898A08721255308CA84380BEE8AFD8E2B098485B403708FF8A181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c5e544d586ff2d72be03a442e0087a70dcab901bb7c45239f1121076e2f0b2c6
MD5 caaddcb91ed3685ee80efe23182c970f
SHA1 1841c9d4c2467c7be78913821752fe6f5bd91169
SHA512 dae0ce2be1bbc0ace2d2198b3df6c700b0f5680fff66276b8f59b5340f4392733a97375be71957fc6cc30bd97ac85e5e3e91417cf00bd7707ebd258126440869
TLSH
T13D219E55F330D118E54E923A60AE9B261338D8438FB8ED0F44B570652E72B542E8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 3102f63785b372ab558a07f014151dddcae21909d5d4b0e2e832d7c6d02ac6c8
MD5 991bc7988ddfcdc3e08b77ae6fdd2410
SHA1 9abc43d2f75e6480d00991dee01083ebf9adcb56
SHA512 58d48e3034ee8565bb09e9ebe4a524be82bc548df3a73a84c7938fb5fa673e103ae2597315d6d23ceb1c1ca487f685f66e01e140e6e72832d324b5b06697a429
TLSH
T146E0D852A8D8C15FD490618301A5D748C7953807EE88FE452F018C44750174AFB4B181
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce4b70714a14d6edd3984aff6ffbf91500bc469237550e8fd2812a4b6ad0e23
MD5 c2cc02209692a818860bc7cca262985b
SHA1 eace9a5e211534271e6c46edbfb65dcd62031ffd
SHA512 ba7e89b94315fd7c09b67a6a9ad133e4c1b566da570f2096d931cc8263bac30d4f9ec28d491e3f20ed22b7bb5b71ab7037692a40d790e4a0d5292d02fde33f58
SSDEEP 3:MsEllllkEthXllkl2zEflxI/:/M/xT02z
TLSH
T1B2440404FFC0040DD50010304051C77033F0D4104535574334D30473DCC75400D74440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9319a453c459bfe130c27749277bb17b6e06ca48999e91ed97badba972a4c84c
MD5 e0e3fa179d9a9e2d1c1aa98b7a29606c
SHA1 099ce220046b005d8a30592c9389ddc390a15145
SHA512 ee3c0d1e3e88e8ad601cca2a03cc27ab3b013e9892c2e153444ce9876a9fadcb7f4aa1ee7ac916c9f131d5840c06b5d14e85689b8c93f79fc12db5066c77dbdf
SSDEEP 3:MsEllllkEthXllkl2zEflWhEt:/M/xT02zb
TLSH
T1C0440204AF808549C9001430406183602370E45505115743289508229CC69C00C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 60b6b323a62c51f5058590fdc61032dfd782d8560297f1bd43fada536da8c393
MD5 c97bab89e6c309e829ac1d9692d0a0d4
SHA1 7242961ec0f0efdba23de2de5d67d36cfb53cfc6
SHA512 46036f6365bf28864f00cd99e18f69b42ce9fe04b93e8d6fbd12b762bb8947a7a584cb98255cdd1a7857badf3b2e1281b46f88216e1da7a089919643eb1eb594
SSDEEP 768:6rv+4UNbds3aGDZIO0ENzc4ReyIsXoeVH1S5D:6bsbS35tc44bsYEH1Y
TLSH
T1AF03CF32A8388A77ACF66686B50776537EF8512BC2981ED4C5DE2F0C064B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b8b8e56cd724f836a421067ee85b0b5f9a9f2ac90eab40d8f28fcec595d80fac
MD5 26ba7ddb4716d29fec2a264869feaeb0
SHA1 518c294ca103640e7f649956c24a525143cdb339
SHA512 a4c3b828c83b0fb0553a59c315ec5e7238150acdc8c41764e99e6744d19ce523355c83ad6a3ce4a5de3a0621e95dfd05a338a5630efe9b0f0b75aa9b96fa76e6
SSDEEP 768:Xrv+4UNbds36hDZIO09Nzc4ReyIs2veVH1S5D:XbsbS3/tc44bs8EH1Y
TLSH
T14703DF32A828CD73ACFA6686B44776937EF8212B80881ED4C8E95F4C0A471DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1a7dcbdc38e9a987774fb7d3ae02837f8219c07c434785cd1039748872bf5d02
MD5 c796b87bb709cf467ce64d515a3e7d6b
SHA1 ffa8dba9303d35431b5686b8f16af1792a26692b
SHA512 04d62d75c867e5102139e224b2239d6b97f579b76495037e152ba04cda5758348c49a606cd11107641a690be15ed4dfe81813eff49df6f180ed306675780f248
SSDEEP 768:8rv+4UNbdg3LfrDZIO0INzc4ReyIsPv+cb2Yss:8bsbG3Jtc44bsH+u2Yss
TLSH
T1E9139D3DAC24997F8CAE7749720E35636DB8023BC1B919A8E7C81B0CC13649CF747962
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4675f54766420df72f4c1b7a6e98b2b1f9a516c2ef5ef2a5e93d7c69b4ee33b8
MD5 6700f89c16eda50dee65b7416fc1a102
SHA1 04b51349622cd3edf2c38632fe3564bf393920a1
SHA512 3ff759dc5b319bff4423a09e3298f385c605b64478e742976844c78143186fa847fcbd9baa353cf80e4c887f6595f5bc350cae0b8c56ef96c31e5c1e2be552a8
SSDEEP 768:8rv+4UNbdg3a2rDZIO0QNzc4ReyIsMmsT:8bsbG3Ptc44bsvsT
TLSH
T1A303CE31A829CD73ACFA6245B5473293BEF8216B40C91EA8DAD96F4C06471DD271F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

617d15c0-6372-4b61-a7a6-058ba27f33c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\617d15c0-6372-4b61-a7a6-058ba27f33c5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b7b72927-2a3b-485e-94a4-41bbf0f621c2.tmp

Path C:\Users\Admin\AppData\Local\Temp\b7b72927-2a3b-485e-94a4-41bbf0f621c2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

revosetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-L7915.tmp\revosetup.tmp
Size 1.3MB
SHA256 22eebdcca1831262156a70b67cb1e9dbab2dd894fbfc27e6b884fd6f01a7eb86
MD5 6dee7d7e4f833dc462c57e5ca0787b74
SHA1 ae195bcad995e9e396b787ecd96bf321f0fe5086
SHA512 c33d751d889e4109d60018bc970c67712764d6338e3ed3c0f4c10c79926195d7b6ab846ce079ff9882931ddd2d917dbea6286166e2c63902148c98e3d7d0be7f
SSDEEP 24576:FnbbPImgK4brDi4IxgRqzwqNb+Yz73P2EMZbG0JEtoPqx9nn:NHeKh4nqzF3PYdStoax
TLSH
T1CE554B22A3E18437D4732E359D6BD6946C357E202EB4D44A7EF9AE0C0E35B41BD39392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4200_697950309\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-0-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1240-8-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1240-146-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1872-10-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/1872-9-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/1872-144-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/1872-6-0x0000000002330000-0x0000000002331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads