hxxps://github[.]com/scemmaz/Roblox-Cookie-Gen-and-Checker

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/scemmaz/Roblox-Cookie-Gen-and-Checker
Sample260824-yrc99sshkg

Score

6^/10

adware discovery execution spyware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
42	camo.githubusercontent.com
91	raw.githubusercontent.com
92	raw.githubusercontent.com
93	raw.githubusercontent.com
38	camo.githubusercontent.com
39	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe
832	cmd.exe
4664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2316	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320752589975070"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A428A442-6724-4DA9-A622-5C335C649C87}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1528	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
4144	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1528	OpenWith.exe
1092	AcroRd32.exe
1092	AcroRd32.exe
1092	AcroRd32.exe
1092	AcroRd32.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4232	3040	msedge.exe	88
PID 3040 wrote to memory of 3720	3040	msedge.exe	89
PID 3040 wrote to memory of 2316	3040	msedge.exe	90
PID 3040 wrote to memory of 3720	3040	msedge.exe	89
PID 3040 wrote to memory of 3720	3040	msedge.exe	89
PID 3040 wrote to memory of 4644	3040	msedge.exe	91
PID 3040 wrote to memory of 4644	3040	msedge.exe	91
PID 3040 wrote to memory of 1192	3040	msedge.exe	93
PID 3040 wrote to memory of 1192	3040	msedge.exe	93
PID 3040 wrote to memory of 1192	3040	msedge.exe	93
PID 3040 wrote to memory of 4376	3040	msedge.exe	94
PID 3040 wrote to memory of 4376	3040	msedge.exe	94
PID 3040 wrote to memory of 4376	3040	msedge.exe	94
PID 3040 wrote to memory of 2964	3040	msedge.exe	95
PID 3040 wrote to memory of 3056	3040	msedge.exe	96
PID 3040 wrote to memory of 2964	3040	msedge.exe	95
PID 3040 wrote to memory of 2964	3040	msedge.exe	95
PID 3040 wrote to memory of 3056	3040	msedge.exe	96
PID 3040 wrote to memory of 3056	3040	msedge.exe	96
PID 3040 wrote to memory of 4772	3040	msedge.exe	99
PID 3040 wrote to memory of 4772	3040	msedge.exe	99
PID 3040 wrote to memory of 3552	3040	msedge.exe	100
PID 3040 wrote to memory of 3552	3040	msedge.exe	100
PID 3040 wrote to memory of 4296	3040	msedge.exe	102
PID 3040 wrote to memory of 2628	3040	msedge.exe	105
PID 3040 wrote to memory of 2628	3040	msedge.exe	105
PID 3040 wrote to memory of 2628	3040	msedge.exe	105
PID 3040 wrote to memory of 4116	3040	msedge.exe	104
PID 3040 wrote to memory of 4116	3040	msedge.exe	104
PID 3040 wrote to memory of 3116	3040	msedge.exe	106
PID 3040 wrote to memory of 3788	3040	msedge.exe	112
PID 3040 wrote to memory of 3788	3040	msedge.exe	112
PID 3040 wrote to memory of 3788	3040	msedge.exe	112
PID 3040 wrote to memory of 3960	3040	msedge.exe	113
PID 3040 wrote to memory of 2256	3040	msedge.exe	116
PID 3040 wrote to memory of 2980	3040	msedge.exe	120
PID 3040 wrote to memory of 744	3040	msedge.exe	121
PID 3040 wrote to memory of 2824	3040	msedge.exe	122
PID 3040 wrote to memory of 832	3040	msedge.exe	123
PID 3040 wrote to memory of 4664	3040	msedge.exe	126
PID 1528 wrote to memory of 1092	1528	OpenWith.exe	130
PID 1092 wrote to memory of 3572	1092	AcroRd32.exe	131
PID 3572 wrote to memory of 780	3572	RdrCEF.exe	132
PID 3572 wrote to memory of 4372	3572	RdrCEF.exe	133
PID 3572 wrote to memory of 4372	3572	RdrCEF.exe	133
PID 3572 wrote to memory of 4876	3572	RdrCEF.exe	135
PID 3572 wrote to memory of 456	3572	RdrCEF.exe	136
PID 3572 wrote to memory of 4140	3572	RdrCEF.exe	137
PID 3040 wrote to memory of 5012	3040	msedge.exe	138
PID 3040 wrote to memory of 5012	3040	msedge.exe	138
PID 3040 wrote to memory of 5188	3040	msedge.exe	141
PID 3040 wrote to memory of 5188	3040	msedge.exe	141
PID 3040 wrote to memory of 5396	3040	msedge.exe	142
PID 3040 wrote to memory of 5396	3040	msedge.exe	142
PID 3040 wrote to memory of 5396	3040	msedge.exe	142
PID 3040 wrote to memory of 4732	3040	msedge.exe	143
PID 3040 wrote to memory of 4732	3040	msedge.exe	143
PID 3040 wrote to memory of 3836	3040	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/scemmaz/Roblox-Cookie-Gen-and-Checker
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffef3b2c188,0x7ffef3b2c194,0x7ffef3b2c1a0
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,1036190847371253913,12958590317647686835,262144 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,17605370736863974344,9367457180185118893,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,15569343871946567369,4091004925021760039,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3433339908794729573,534807765543605516,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15801369332954726409,753234264620499942,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17464858835988475085,7688120167808856460,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,12654902257862381075,1646353484724053612,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7633245726837664830,7071287191696165398,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,7835175592912021524,16039031687222146853,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,17763427648748804866,13450322701577928833,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,17763427648748804866,13450322701577928833,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,8170809797991579213,11634091273641863456,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6344,i,3078156905710984915,1283164504936201335,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,2206236998090806172,17630975480623538659,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4592,i,7956143787966428578,825955678088725488,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,10498423131539145124,18353248035549951659,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\install.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,17314867495078136371,7949864373317103232,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,10695984382279822837,14165087352014182879,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17175740058139138821,3400955141360844366,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\install.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\install.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6876618780824868560,14213814167477135128,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1093861304929955884,3172315258327114320,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6528,i,1448779065759506169,1624623274355380866,2097152 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,17453861713177968975,13021028951054198716,524288 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,6094635946979650985,9337398895756915138,262144 --field-trial-handle=2280,i,14230719527392808191,16596262104011033244,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\main.py"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A2DF4F9018120391E58B9F11D247C1A4 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:780
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FE3695071339980FB9A18421675DB6F8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FE3695071339980FB9A18421675DB6F8 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DC40938D189C2A231561510FC71426AB --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D177D7C2894EB6C2F5E95F73EDCE81F4 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:456
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7E092E5041AE11CB0740AF036CB2D50 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2bc7f3a4024d9673a2f7a098d546fe1f592a8aa0477eb259121fe80954c2f99d
MD5 403039b77d88ae3c8e79a108e60c95e6
SHA1 478b6a90cbd5967be9b36c911b5a2135e0b7199c
SHA512 fbec8c6863e6042041cea05b5efa69ca53b0340f3bee0900ef55602e442dca5b20c736b16589ad755fc44c45bb2c920ed0e29957fb7ab74fe05e101f104c82fb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7I:fwUQC5VwBIiElEd2K57P7I
TLSH
T1EEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 7bf32f9d3ba3cfa693ed965a795f121983b7ba9c7f72a3696ce34d09bd08ab2a
MD5 92fa065dea255d83d0968be1024ec46a
SHA1 9bcb81d5305ef114691fc8f39fc31edb681bd8ba
SHA512 37ede4802c9805f02f8cdde0424ef8812b9be9ad160303fa73dd187b6ee7f727aee33796b44e22fde6d0c341496b9e5b6e664c4f6447d450919aaac7f2b24ae0
TLSH
T174E0D81456B9C3E44912DAC7E06F529E8151E00BD78CCCE5A717F2A8A414004D2CD6FA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 a08b5b788f8958ca21e5afff76ed5a28e93cfb19ddf02af4a278ef432547b8a6
MD5 370d94c890127c6677caac6fd306ccf3
SHA1 bb324c888ee685b2cd07ee2b5ef7d296b147dab1
SHA512 c860fc82075d029644c8fb262f04d0f8bd87e32974eeb82c4a7ee727eeacfc9a8f291c8a61714b7302c587219481ec4a37c86bd037ff07abd55c927c7c6e293c
SSDEEP 192:LEOCjmSFyjBBqtir04N4eKUOfOzaikP5Uix:IvFyStiI4NEfOzaida
TLSH
T11912CE62D44D34DDFB831C7ADCD84A017D7BBC596587FE160B604AFF65C6782620E844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 94ae4c2c8050858d49b20cf325b95633e5a76642a45d256abe72fc77ce976f8f
MD5 ab6a05ae17a1eb799e3b5d2e70a6a41a
SHA1 16d23851bda30527f37cbc111d37bb5aedc44d48
SHA512 246dbe469b05876022658eb13af98f24c38b9fc07ad6e70de1a4d7994d2d4734cdd10213aea268534e6b3a565e74868d805e65ec22d940d0c9c6fc8cfc0ba4d4
SSDEEP 96:W1+8jMeBgVd+AiGz04tBfvB2xtjYsQZo8H5L:W1+neBKxiGz04HfviYZhH5L
TLSH
T1FFC13D26E14D38DDF7531CBCD8D80600BDBFBC594887FD251B9049FEA9D9746A20E888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c82d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c82d.TMP
Size 3KB
SHA256 e7662110d68b692f14c096220ca2959e8b0c9ebff704d6ecefa96ab6b536575c
MD5 d680e776b9dbbfe5eaa0f8321f2757a9
SHA1 f77c995df86e141bf14da6edd0b03fad8fca5a27
SHA512 1a5da905fd81014334a9fea3a8e97f25e839f059a3f0331be6ec6cac4893e945d6dd9c147c4b3225c797e0fbca9af2a305cb47d33b7708fcab7ef8830dd80be0
TLSH
T19671293726424952D34020B1E8A91740F6BDCCAD8DCB7E6A1D904DFEF919747B306CC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2a3981ec8736153dca3ac60cb1bc4a46621b37ab165acf5645039bc3c79b1e20
MD5 302bb98632b482deffba8b3a0333ac3f
SHA1 d5eb38845a69c511a3c383c64b1c15491cf5f337
SHA512 c7484a93d602b8c1943f3db2bbb4dfceec2c17efbc1edc6af5cce734ad203d5a20375fc760a02068dd00836d5e5eb33b90a67784d5adb9db05497115bcb10439
TLSH
T1C74127F747F2956D9A0255F0AA18EE2BCE2C0511831C786A85E4BE57D3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3ab594eca46b291cd423f55e03bf4fa495b08bf3c95ee248feb20111ec307259
MD5 52b18849098d62a3241f377af7aed22a
SHA1 27b35f65fec30d9566685ec13a6f0ee7ab60c563
SHA512 fef8500f4c48268b51c6ebd4caa40230db1501d4350a95e4e2cd6ebe5c4a316ce1060a9fd717b5b05d7492a5048b74d8a4769bc51be9a03279eeae80b02e96fc
SSDEEP 96:DWOmePEaEEjozBm9mQmDmO+mnBmtmDwBizc5GOmgRftt9Lbx:D1mePvEyo1m9mQmDmzmBmtmDkizc57my
TLSH
T187A19BF783E6856DDA0255F0AA18AF1BCE280552436C3C6985E47E47D3F2871E15178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e59f3eafce7e305e405b4fb5270050bccd1975b6abf06d8d9a2a52dbf23b4677
MD5 2b9c565a937b24fa18afd1d3cbda95dd
SHA1 676569462e6e8fc7468bacced1ab276c6fbcc3fe
SHA512 8d68a15f6911e2881ee02555fd6124e10aec29107ccdc06743c9de2852f266a8a84fa742f8a7799194244f998049567f55fe26714d7f35d9facf041519210536
TLSH
T16E4127F787F2956D9A0255F0AA18EE2BCE2C0511831C786A85E4BE57D3E3872E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 feb19b5a1fba6c9b6964ae7bead10bfbc170b18515822b48358a008c24ffa2c7
MD5 49fbce18ba1bb21e62445570c0127651
SHA1 a9ec5fa014162c59d4e63a7ab0b99b94d97d052d
SHA512 943c73197fb9810593c6d00b33b101405c940915b2677d4468a7f40db6c44afc01a6745f9b1b2777bcaa6652c5ec72b8344ccc4cfad0f0f21a0afee1a7f353de
SSDEEP 192:sxZhRHyM/jK1Ml8Mkcc/fZsRGYhaYZIdp9l5SHW6+WNYTh/Ywv/4iIgrJ:sxZhlMcc/fZsRGYhaYyfAHbS/D9
TLSH
T1FE52C7116A34697BCCCBD209FA557F53D6F90572A2900E48A9FCCA1C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 16bc89da6c8f9fbf5b7af1b15f91a43b20ac14c320d912d514254e963cc7b382
MD5 0aa41fc0a89e320bb1b751fdfc98f57b
SHA1 9908ce1edc0bd993e38011818b8778e578152fc5
SHA512 111f96cced2863884b6c1946582292bd1daa34fdaa91338d986e9b795ed9a2628aa04f8ca45f1a69782c9d394a3b139d1a8d1e3e97fdff2233d30e35367fb967
SSDEEP 384:sxZplqsPcc/fZs2GYaaYBFP9EHb4F/lC/K8:sh029/ftGXaosHbWQ/p
TLSH
T11D82C75265248977CCCBC659FA357F53D7F9046399900E8CAAFCCA1C04EAAFD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 092be1559939646a8f0a72140e291728d712e570ad25860cb3958d73e2d78486
MD5 c4a85bb9934c6e51d662ab43ca3ff8ca
SHA1 c7ffeae70b47a5b01aed295a2d42116d270a5ad9
SHA512 b6a7f7a7b187d321f495fd9c45f6b5d169c2b448b6a6e469f6b105aa7ad2c9b6e75c9100fe329e438f6f357e03d70beb65c9be687d87a98f792267cff75e10f6
SSDEEP 384:sxZpluPcc/fZs2GYaaYBFP9EHb4F/lC/K8:sh69/ftGXaosHbWQ/p
TLSH
T19082C64265248977CCCBD659FA357F53D6F9046399900E8C9AFCCA1C04EAAFD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 175418b85c9eeec85479438212406749c8f7ca294b243d3487e35a7b07e11a7e
MD5 8f071b01457be48f925931e6a7fee0ed
SHA1 c913e5c946f19f1b8ed74d42b729002e5d86cad6
SHA512 8637f5e1a4f717a2614d3cab61eceb338d79b189b8cdec76db7f2541bef6ff285778ceb7c3cef12b1b2e25dc4a6024e4ea00a078a14ec6eddf9aa2e4aadc0b91
SSDEEP 192:sxZhRHyM/jK1Ml8M9cc/fZs2GYhaYZIdp9l5SHW6+WNYE0XYwc/4iIg5lJ:sxZhl1cc/fZs2GYhaYyfAHb4XMV
TLSH
T1E652B711AA34697BCCCBD209FA557F53D6F9057292900E48AAFC8A1C04F6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 82f0ced99683f105495e0b5d16c9fd71e3e3aa063b0b8b64ab5536942f081d27
MD5 16a3964da7fcd9d27b8f5e88bdd47e0f
SHA1 4ec9eef8755c15201c00f622b22cd19b482903a6
SHA512 b68028d4fdbf2319d13d45447ab8296043f9ba61919d8a5a562a2bdeb9f5b2e7eb09e26a5ccb8c24ff5c7f96113535b9af44dece6156d37e486f8aa3bb86ede4
SSDEEP 192:sxZhRHyM/jK1Ml8MWPcc/fZs2GYaaYZJpDdpvl4xSHW6+WNYE0Scb/YwfmPiIg5t:sxZhluPcc/fZs2GYaaYF9nHb4F/HL
TLSH
T14962D702AA34597BCCDBD20DFA557F53E6F9047295900E48AAFC9A1C04E6BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0d9534d1841ccf7a7a7ba13e69852d45edc6cfcdcd60562ca175db1a6f65d73e
MD5 3d091fc0c6e4ad0911fbabe26b88f2f4
SHA1 bcf545188020cda4a7cce68d164f3dfd53bb3643
SHA512 c38be7f3886d605a178801392a537bcb68abfe6bed220c8314f90458773686aa5c7842f59cbffdb9233c7782ba243fa688a4273c8924d151aabe2f08e2fa6157
SSDEEP 768:8V4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dlrohdcTax:8V4jeXmWvmKLEu1jacPLZQdeUu
TLSH
T12DD20A3B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 68d674eacf761c051564747d8b51f7bfe96746cb74be32cf4582c2590d3b60b1
MD5 df34e23baf417fc71cf58756487dcf4b
SHA1 1c9517f39ea24e9ccfdc554d9ae158527430bce4
SHA512 1d0d7d2271efeebad091219b370ad3dca8cfeda001cd451fa5a64162ffe7096e9c469603108f23ba2fc414ee81c33ed06e1e99c98af108c2219d119e7f28fbb2
TLSH
T18551FA4F4D8A1D1DC5AD01B264FA158133B85CEE5B64CA8B39DCB271B8C733E1D0C65A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 52f6683d189a3267fccef8726be96d93e0aafaef10cf56433ac78b7447cbf205
MD5 b9ca75883d039cb22b61994f78359d21
SHA1 1142194e91a9bdc988486054e640e73cd93e80a6
SHA512 7f667200d0e79797db0ffb39fd08d38a1fc5a66d45ec0d19c6e14c6894562f15365217282eceabc5f24cf46df1fe95c240b445fa25643c6ae59e492b4a7b0010
TLSH
T18B3141498D90DD5FE85844B314B3B4B8727089CC4620E363586C21767E1639A1A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597d44.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe597d44.TMP
Size 1KB
SHA256 f55716d099d73e10515d8e907c72969076c7ed5427944b2065348d4de54cecb0
MD5 098ff546eafc42be7b86ce82a94d07d9
SHA1 2e20e38280289ea8dde41fb7a439c79841720bf5
SHA512 0b2b2fe0c4bdedf3a5220906449517f86b8fee312670a6a680a452d68a48cc56396786aef17340f46ee2e951a81c326b78772da7c8ba75d507c99ff6cf775183
TLSH
T1EF31235A4A91891AE894507709A7A4B873358C408311B793987C6279AD21B9E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 1f7579f1848a169a18bd2c5c96c13c91d3747cf2052fe190c3dc89013d2473af
MD5 248539789fac4936c8c8af61e6b4049c
SHA1 1b6743997ce441bf723e97b7db793c6562e0d4d2
SHA512 ade2ab9f6ec99442ed7039bc1aadd087db0db7713c90a6f420b455a55bc495399e65790929207b4a53164e82ef9ee73b4766c530723cf3690af3c61b7b1ee121
TLSH
T14BA0022746A4018DC102E7FC269601612317E9138615131B519154C6CC50D574F6510D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 7b867ad472ee593f4453443f9ac49219356edfefc0e7a2761c135e1120b5b020
MD5 5df4a493ac35e41aa3ad199ad4f79ee5
SHA1 fbdd48c82ceff777365480f8e60b003feee4d8e2
SHA512 56478cf7bbe077ee9dcfcde57e59b3fdc36470ac268b06cba3e67ebca94eea8a292d78e5a5cdb1b292dd3d2adf0b7c164917f8d2db8026e2671339520f4f5e9e
TLSH
T1EEA0021013800117C09B17B116DA0A823301CC345110230B4897218DDC909805E4150C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 97d7002786932461cde3555c5df18755059e5405d42b64bbdbb40b4098b0df8b
MD5 4c711f83df1675930a3befab4bf026d2
SHA1 a5aa4780640f87a495360619bfab6065e200e078
SHA512 91c241f0f44382c94fef88aed01b46140dcab8fa2cf3fd113b1091ee932e53e97c430e59a02b541761b1f054b7e8b1cbdcbb8ab2c37eeb487cf2997d9cc0cdcd
TLSH
T177E0D8F63DE72D20ACBF47E628B245A44146F4688555AD8E2416A2E761A02682016C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b1d6a9de3013925b6a78586bce38946ef3ef2c469c52435cffb6040c12329eeb
MD5 39edfa19992027b29b47efa51412248e
SHA1 f67a442012bc6f9fe70814e5098f46411d05656b
SHA512 4639b6329ffbfd1c792d100244b3c33d8f36e44138692f7b24bfa7655cec185df26b026867c0bc819d1ec3c0e080c1435f06e1bb097d9872972ea281c8e1f006
TLSH
T193A00222CA55C497D1305276E0A9618472118CB966E63331B1AC1065DA78F548592206
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d47d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d47d.TMP
Size 48B
SHA256 0b480731e2d9596694ac95907bc3f8ba5f76cbfa3d4af79f55ff4c1d50f38d2c
MD5 531ffe04094b58d513f79074c5fe99c5
SHA1 99eedefd1e05634786f39d9186251d2649d3e0bf
SHA512 c4d87cc564143ad07297298402e17df90d0a6af62c7a7d8a1023db17b3aa8cd95b8e503b6e78339b76383353d9baad48b966a2fac9adc23f253aed0eefb7ba6c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 71fbc7d467f8d5caf28e05c8a737febb11d374d9c8da4c44a91048d0474fd86f
MD5 f6c75681cc145927294251668dda5d9c
SHA1 962d2f924bd7945aa37e2abf8956d15a1393c8f2
SHA512 cf8d04425d1571c9945d3daf3e89e1b6b30cf29ef024a356dfb4bc2f46c5911158a14e5305d7792e4948e32b269ac39f7971fa61fc387a51d77d7254899039cb
SSDEEP 96:KPYDMoGi+cmypHUwcKsJUecI4oJ24Bp65OaQwgSmdcWUx/KsuUP/ILDUttORauQo:UlXQtQ
TLSH
T13991841136FA02022D3E7A4C81E597276B527063354DA93B3BAC11B18E67E208CFDDDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b59b1ba4-2b2a-4258-be1d-70ed8cebff96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b59b1ba4-2b2a-4258-be1d-70ed8cebff96.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8cd6795ed30d503f5e653a5ef066faaac418d38bca48aad6c942569a7eba6063
MD5 62321719c84b2bc9871c9656598daf81
SHA1 4be5a41db07e88b28ab27c95e41ceb57d5146d4c
SHA512 748dafc4067b3ee34459d70482b24a5eca3fe525b5f2cec8a49236956b4ca0a0012b66244bb55b5e54a7babf6ba165f1f72deb1673a4b2e38255a782d5838d8f
SSDEEP 384:YZcIYsNghuqBU3Nf+682IXeLFDivhuhof:mYAtGQDi5uhk
TLSH
T1F9828D325C78AC7759E6E285F08725179FF840279BCA6F8095FCAB2D00DD6AD131BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62a80828547c3bab573f22bab4728b184538b4f460f2fbc9c7bd31da3054d201
MD5 ef4fdff112cb4fcb4cbb6eb844ff25f8
SHA1 a6cbae12164711b6ea05ec103d58df6dba289e61
SHA512 b3b19171fb76843fbde7c78a23efa14a2ae69cf895f90c74789bfb922a44b408a69f8a2bf282bec6b6baa8dd40f02125c1d6240dc268564d193fa9a3f02fd0fc
SSDEEP 192:EONQ6hZ0QmiUy9Npc/+jV0jzor2e5wOZCdlU6:EONQ6oEpu+682t2ClU6
TLSH
T19A02DA35A8787C7B8EE2AE45F48737235FE5116BAD956B84DAF85B1C00C769C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 331508ae196daebfc0c190fc7e7469aa5b202662803c22f7c5ac4c184199aee7
MD5 a9530e159d25d23bba244ec21f575b59
SHA1 884d3bf6f1a610f90f6ad259eda28be0b7e9f8ca
SHA512 e19497a733c7849378de142e8c5b950f3fbc0521c9c633e097aebdd083f0bb65cb7337c19f4d21404ce8d4008e3acbd35b3a9e3f50bcb5813def2109b868bb76
SSDEEP 384:fZcIhsNgguqBZ3Nf+682IXeLFDivhuhof:3hqtGQDi5uhk
TLSH
T140828D325C78AC7759E6E281F08725178FF840279BCA6F8095FCAB2D00DD6AD1317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce96da438764f2b71c8f9cf38ea9b842f5240870214e2c8fe8d26ed469db0fd0
MD5 e6d3f7936a99f8514ba09b97718321e6
SHA1 ebd5be44e3d799c89a6bc660d015ff7bf51b749a
SHA512 47336e7b3cd3383ea94894ebd1aecbd90bbaed67a5d4e9a3cc51f7fe2f9d716d15f2e19832ec2b0315363bf1a9b0bc13999863d7ca10015b13d35d76199e416d
SSDEEP 384:TiFPZcI4sNg8TUNTUlIlFT2qBuV22f+682IXe4FDivhuhof:+FH49wgO2mGRDi5uhk
TLSH
T158C22AF248D79876D9AE9747E77D2D038EBCC067B585AA40B3D85A1CCC991BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4363164eb6e285890f409df1f462d9bbd382dafda79b902387b75880c6fc0260
MD5 6687f089ceb681b1d254075bd7dfa9f5
SHA1 20ece5732b3373762f8d28b4870e2d5b13abf061
SHA512 45c62ce290999a9057aef1339746b598f645cb0a63f1b397ce63b6e0b04731d06faea51c3953f02c1ce9d15f95d095f53c9365bbbb36f716f9340df880835124
SSDEEP 384:pZcIJsNgFuqB03Nf+682IXeLFDivhuhof:hJYtGQDi5uhk
TLSH
T1DA928D325C78AC6759E6E285F08735179FF840279BCA6F8095FCAB2D00DD6AD131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63f81a3a642a9d2db0c7a75990208e52305bbb42eb4aa67f1f525ac44dbebeab
MD5 44dcf28a75f3a6c5b4a8fb2942ec3a52
SHA1 189f0031306f94a3eea59d3e614be226cc9fb5f8
SHA512 99ce73c439d7fac51229bd22d0378d933606f91bf3e9af2dc058f0ba83aefe9c7ea58f775d695d96f09c411e4a3be2b7869e8c9c62a3a4e7b901e775f0c3cb7a
SSDEEP 192:PONh6hZyQmiUyANPc/+jV0jzor2IXQN2L5cOqLq8U6:PONh6iPPu+682IXez9DU6
TLSH
T10D12FA36A868BC675DD26651F08736139FE45227DEC67F84E6EC2F1C00DB6AC135AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b85e58db9400aaf47d2e5c93fffa99f7e988777cb39010cbf3c222842230ecf
MD5 9d8ba49eee3846382b7dd01e3535b55e
SHA1 3e2971492e75eeeb3124b030bfa1f252ba53cca1
SHA512 f57a3475337ec82167b5d280437c71800ce3f2cee922b8e6b27ddfd03d21dc1a64b10f3b18ac952c483f476ca43349099a311c6a11809f6323fe7c68cfda549c
TLSH
T1C5E00203D30440DCC014073001431F115B97C0B526B103475F2551583C233003C51740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bb0e3402948b9a128537139df12aa38064cadcf223015281386678b9cf45b342
MD5 61b8f09ac11bbdb1159edcd374560d0b
SHA1 91c52a1ffce289c4d1b654b306cbaca4bdd50961
SHA512 953f85339eb14a5653f8a5bc0c122fb0925926eefa5cb82002379ccf9e99afe795453773883682fe1f613820d75b4a1b008a76c90ce1030a51711dfdbba96eb6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58c241.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c241.TMP
Size 392B
SHA256 64abadfe207b73ae71fe3aa2302c3ba95d394d3bcf3010cfb6c054ed83ed1999
MD5 44dce682d66d1766a07a71633f0743db
SHA1 3125a8ed9711f5673a76bbd8556dc67deb4ba9cd
SHA512 389a8625bbb3f0037fb5d663a7cea5daffe1fcea4ab2ec298eab855bf556837a94c92df51a56dcd54a78b04d178f95b71e398a8667a7c0f690a76c76bd1c388e
MD5 SHA1 SHA512

Submit Download

8a9054c5-8a79-4e86-b60b-5b412ef64a23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8a9054c5-8a79-4e86-b60b-5b412ef64a23.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0e05a7ffd895a9696c1209b759b8b2338ba22650381f726f5b6174aeee58b381
MD5 a6b2419da885516fb20149bca0adb45c
SHA1 dc5335ca1dc3994793d5ef80d826c41eaa2a819e
SHA512 8e303a201af464cae261b690856f499c871240f75fd33e493d7167cb33c0e980de712c2c1ec15835fc76d8710b89baa44b46acafb2b3fd2a8a0c3db8c8c99a11
TLSH
T1EE410B58B6E91048B3B76E5A9BF7A96D487E7C772E4AD05D00010E8E0623A81C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

install.bat

Path C:\Users\Admin\Downloads\install.bat
Size 292B
SHA256 8d9f640e175e10417093e15ffc7a8433002892b75eb937823691a90f366dfc96
MD5 4336723610395fdd63cab23cfe77c9b8
SHA1 ac061c95ab394077a47217ff0a0025a537801e57
SHA512 4bdf34de002c4002bde31101fe90e9208dd6c6d19a1e694baa48048d9b9547f4614affcfd4c5c2bd1c89729ae5a59c4ec33df21d89c1e6cde609d9113a675c86
TLSH
T12DE08026534381A8227127E0946955723451511367841D34616B527FEA4EC42316F57A
MD5 SHA1 SHA512 TLSH

Submit Download

main.py

Path C:\Users\Admin\Downloads\main.py
Size 2KB
SHA256 df998d7f52c90dfb5e12b4ceba307a7a2ac52814668340e61361c4675297e0f9
MD5 bbae2bda06c79a31c7abd277d39b5f21
SHA1 4b7e6cd3cc6794c5ede719e3218ee9d3e34577e0
SHA512 2cdad3038ba0f9970a317800801166f908645349e69d338bd5e840d36449e4f48ad699a528f982a7fd5792d0f4a1a719d7a0a764ff3b868a64b777425c6e473b
TLSH
T138511E3B3C4E455E8A71156C38CA9422E52450035767342AF4ECA0BAEF31997BDE8BDE
MD5 SHA1 SHA512 TLSH

Submit Download