7f5352bf93f673b0a4fce9536b2c16277506b29fec3b27a2bb5749f9e2924c06

Analysis

max time kernel
899s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rosreborn.html
Size 28KB
Sample261026-tm3l5sty3j
SHA256 7f5352bf93f673b0a4fce9536b2c16277506b29fec3b27a2bb5749f9e2924c06
MD5 18d5e1c37799a45e72020356b814eafe
SHA1 d943d95afcf9ce69435ef71ad44be86285ad7c1c
SHA512 4758b72907232efe731928ed717c098cb3aae404f66a1f204c6db9e9ff12fc696a24c40aa68b5ec888189909e41d5d6e97f4509bf5647b4a1d8646f5fb4a32b4
SSDEEP 192:cbJeYIkwDqelBzjH0niN1AoMZoVNyJJgM1POj4PKT2Zd5QuytmrWuz0aETEcE6w1:cAYBENlBz7wiN1IoVN+gyBtY/Tnx/0
TLSH
T102D21267EC0889AC61313E8ABC7AF0DDC185710F8C6AD934B2BA561F1521FC946A7C73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{7CB57D5E-4580-4F6D-8110-88992562F91A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1928	1440	msedge.exe	83
PID 1440 wrote to memory of 3336	1440	msedge.exe	84
PID 1440 wrote to memory of 720	1440	msedge.exe	85
PID 1440 wrote to memory of 720	1440	msedge.exe	85
PID 1440 wrote to memory of 720	1440	msedge.exe	85
PID 1440 wrote to memory of 4392	1440	msedge.exe	86
PID 1440 wrote to memory of 4392	1440	msedge.exe	86
PID 1440 wrote to memory of 3828	1440	msedge.exe	87
PID 1440 wrote to memory of 3828	1440	msedge.exe	87
PID 1440 wrote to memory of 5008	1440	msedge.exe	88
PID 1440 wrote to memory of 3828	1440	msedge.exe	87
PID 1440 wrote to memory of 5008	1440	msedge.exe	88
PID 1440 wrote to memory of 5008	1440	msedge.exe	88
PID 1440 wrote to memory of 1816	1440	msedge.exe	89
PID 1440 wrote to memory of 1104	1440	msedge.exe	90
PID 1440 wrote to memory of 1816	1440	msedge.exe	89
PID 1440 wrote to memory of 1816	1440	msedge.exe	89
PID 1440 wrote to memory of 1104	1440	msedge.exe	90
PID 1440 wrote to memory of 1104	1440	msedge.exe	90
PID 1440 wrote to memory of 4388	1440	msedge.exe	95
PID 1440 wrote to memory of 3296	1440	msedge.exe	96
PID 1440 wrote to memory of 4388	1440	msedge.exe	95
PID 1440 wrote to memory of 3296	1440	msedge.exe	96
PID 1440 wrote to memory of 2372	1440	msedge.exe	99
PID 1440 wrote to memory of 4772	1440	msedge.exe	108
PID 1440 wrote to memory of 4860	1440	msedge.exe	109
PID 1440 wrote to memory of 3456	1440	msedge.exe	110
PID 1440 wrote to memory of 4212	1440	msedge.exe	112
PID 1440 wrote to memory of 4212	1440	msedge.exe	112
PID 1440 wrote to memory of 3456	1440	msedge.exe	113
PID 1440 wrote to memory of 4184	1440	msedge.exe	114
PID 1440 wrote to memory of 3324	1440	msedge.exe	115
PID 1440 wrote to memory of 4184	1440	msedge.exe	114
PID 1440 wrote to memory of 3324	1440	msedge.exe	115
PID 1440 wrote to memory of 2324	1440	msedge.exe	116
PID 1440 wrote to memory of 2324	1440	msedge.exe	116
PID 1440 wrote to memory of 2608	1440	msedge.exe	117
PID 1440 wrote to memory of 2608	1440	msedge.exe	117
PID 1440 wrote to memory of 2880	1440	msedge.exe	118
PID 1440 wrote to memory of 2880	1440	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rosreborn.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7ffefdcbc188,0x7ffefdcbc194,0x7ffefdcbc1a0
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,8916519583930540406,7285530277732136554,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17486550472350316636,13014847199576561221,262144 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8370346876226419131,15130949858202089839,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,3667421889883495851,17473741931502405676,2097152 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,9008035601598324193,15110520893926224814,2097152 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,4939254301896132223,11753661728363657595,2097152 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,5094763665222633251,9012233874069752383,2097152 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1715862317026748183,5351444056452412084,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,10559665471173458942,16322665104334507963,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13284908151234584300,4367485816894244811,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,13284908151234584300,4367485816894244811,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,1579648836398493713,4951345982466660316,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,2041245060842694904,13604286142216111046,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,6296483503456495860,3879940590405511599,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,15762153654141192115,13251430716822435429,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5784,i,4751770760046056873,11577554171527321841,262144 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,7172305073505826440,4836100507289134809,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1504,i,1062086807368676875,12073999933922539417,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,5170811936980861276,14291842122362077313,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,13531663476522325423,9144751478809038224,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,17172178395660283627,16016509496475413509,524288 --field-trial-handle=2092,i,1509847835842964397,4976381948141870633,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7c37d95d-cb56-4eaa-855f-2e18ea50059c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c37d95d-cb56-4eaa-855f-2e18ea50059c.tmp
Size 8KB
SHA256 09caa471bba37fbdc36809e20eeab2a5643dcfba8eb0ab8d4d557c6150da1b21
MD5 5c333a548b8539e7e97e9d3a844ef097
SHA1 3e4bf74bb24804a2af45259c62bbc7d738a9ea21
SHA512 2757ae28c104a715abb6e29c52437efebe37207468495d4d95d59b319f6f8a6ef218d274f46374039bb952c52db7412439efd04da2c9543c9276a340d029b889
SSDEEP 192:SONA6iDCQmiUyJTHq5u88PPuhYY7Sq+rKU6:SONA6/UHq5u8imnhVU6
TLSH
T1E902E8386C687C7B9DE3AD15F5877B139FA4013BE7941B84DAE81A2C01E768C1707923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87dd1718-69fb-4dee-95ce-4d26d18a52a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87dd1718-69fb-4dee-95ce-4d26d18a52a8.tmp
Size 21KB
SHA256 7b523d6a64ea967fae6511ec9de49a26397085665a00a483c68eae3ab065b132
MD5 2f9f5348b850e8fe1157d99d8373dbdc
SHA1 16c4a229b1e632c20902b7506f92b0b999d64604
SHA512 79bc6b796d7ce6b0588d9e06cecbf653276b856e59d3f28f20b975d384261071660bbba596f4f5ab75c7f1c31cdbd1a072d9dcf0cb85a065ac69384101ea2061
SSDEEP 384:aiFzQkUSvNzsNE8TUNTUlIlb99e/p5u8imn4ladW2IF8IIlF:RFd1VwgEXkmPdW5eL3
TLSH
T18FA25B775C98993BADE79E50F64A3613DEB080A7C7849FA4E7CD6A2C01DB1DC130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

3f732650-5afb-47ce-ad57-b1ea71df8024.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f732650-5afb-47ce-ad57-b1ea71df8024.tmp
Size 10KB
SHA256 8b2fc2379fd23a00380d24fdf1331f3696a1e856cbd68c6751254c4b06f55374
MD5 fcf46f0d727e5294fd20c24a8025fb6f
SHA1 41d12fd0fda9be2b1f55bdb6ea701bdcc0a001e3
SHA512 9ef35ee57a7066af678d108522bda6715ee8d86a2f2d847df958a688be7811304f393604039b8939b5f837897bb4519958f65e5ea3007b31a15ae4c16829c4de
SSDEEP 192:sxZVRsWG/fIsZKcHIdpdIHW6+WNGYa1uYjIg5EJ:sxZVJG/fIsZKcIiHbGX6
TLSH
T1ED22C8556E28A97B8CCBD60DBB15BF43E6F9503251911E58EAFC8A1C05F7ACD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81a576f5-0857-4c80-ad80-582643ae66fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81a576f5-0857-4c80-ad80-582643ae66fa.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 0bb1a014722fd3eb734d138aa0a505c0fcfb37b8f0cbfb987ea56ef995cafe8c
MD5 88c7f06f09a0408c1cd87fc1e5a9e550
SHA1 eb9b54a159276b0c9d3736ed21b977b8bc22350e
SHA512 8ca0c89c411614689af7d71adbf5eb911763e31586c0e566b411673049d630ffedfa1cce67b6c4aba1b0b567b5632a7fcfe0635346d1121cd05051d5ed3a6a8f
TLSH
T1D2E026C45ADFC22EA35A68D7027CA38C83C0279A97C0690E6B00C58C7006040A3C2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 9235ce1adc47dc596a47cc0e28ececc650dd13e3a9df090b0fbfd2eead5208d8
MD5 76cd585b9df7a0d61e3440ad131fbdfd
SHA1 f7b578796e0b7521ade48e9a28b4facb04b470e0
SHA512 316b28e4b6f89d2ad5d8defa064d21ce2ecd19189e3dbfd405ea073d0bc84221d4052110aa1213e10f589e82dc5eea40138990655c30cf52e4996657aebc0a7e
TLSH
T10CE026C414CEE22EA6C8648703AC538CCB80369FD7D06B2E2704D5CA70090C0B3826A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5cec8570ec6496eeb248bdd427b723b1a0cae11fb5b328a72cb96d6a2ede108f
MD5 2fb4189c821225170dace051ef34da1f
SHA1 f67ba38ac4cf6ad66cd6407727c5b48fc2d348d5
SHA512 bee6fc0010361633898ea29c1acb45413e0370bd03d52b7c63380af65d244cee3d8b854b5fdf84e64e86d28fbce996885603f977a3e40e0aeef15c7ad2476f6d
TLSH
T1F9E07DC514CEE22FA29A74DB436C57CC8BA136AAD3C0690FB700CD887007240B7C2A94
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ca209450d054bc405106ea6d2d1c072d7286b3dcf9d9808a8387f9b6f2cc14c3
MD5 7f1ac354c9c715377057452084cf0e0f
SHA1 a4de51604b1f0542063fa10bb05deec466ba7d7a
SHA512 a62bd3498fc8177a5ae6d804015215833ff61c0f2144263643a4b42e54fa9891e6d3edb7f81b18a43d3d7d22109db260ee621eb547876989918af5fe0c3b12f1
TLSH
T1CC61A4A35A4460DEF7AAE577B3E5219B3E70C08091832DE21E58D4B758C63FF518ADB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c2b66e51b03d4cece6f973f3cb5e8ad7516f8986120a06455107671ef203405
MD5 7126d15eda0c9e914c1f02a839718853
SHA1 b83ceeb39e127d5c1156151059e0f6a03a55b22b
SHA512 8e11ba33e8f978426985094b5294cdd2805cec8eecd802a0f26a01981495d796749d3399d2b73ac674ff67e6c66ff9091b1cb48bd1e958e5f4b270ba4411cc13
TLSH
T12861C4A35A4060DEF7AAE573B3E5219B3E70C08091832DD21E58D4B758C63FF118ADB0
MD5 SHA1 SHA512 TLSH

Submit Download

899b1316-28cf-46ab-9ffb-a27caab67652.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\899b1316-28cf-46ab-9ffb-a27caab67652.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

4bdf91e6-4618-417b-b887-24dfa2e4e7f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4bdf91e6-4618-417b-b887-24dfa2e4e7f6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6e2577ae-7762-432c-9461-163f6365ab49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6e2577ae-7762-432c-9461-163f6365ab49.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

896c88de-9da5-4e1d-95a2-461894efb563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\896c88de-9da5-4e1d-95a2-461894efb563.tmp
Size 733B
SHA256 84cbddef13807d6c3d9efae919d2813abc260edb01a18b17674d6c07fe267db2
MD5 7f87a8b218cef4510f3102b03dc3b5b9
SHA1 4baa220eb730ecf9b8c12576950d8b563fd06809
SHA512 7cf0f3d8567b1ce2a0c5ce8a3745c45c88067a3b5800e921adbc373fa467f41fbc1ea5b1fa47f36ea528c548ed82c1a8575a166c0d312486d31fd8067aae23d4
TLSH
T1E30168B3C3E495AE8A0092F06A18AE1BCE2C0516421C7C5A85D4AE2BD3E24B9D00189B
MD5 SHA1 SHA512 TLSH

Submit Download

9ac40b65-1a70-4131-920c-f1aa1db53f38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ac40b65-1a70-4131-920c-f1aa1db53f38.tmp
Size 928B
SHA256 d9098863032c69924819e9e54c8752dc2a2f3efdc0a2aa00eadb7e8413088163
MD5 e2e34cc06e47887b095e6b734fb1bc01
SHA1 d41dcb5912fab005b1313de938ba37052f5f76f1
SHA512 8bab460977a3e7dc0da584d990aef2fafe3382645354e4fe663f55450d03be736e58b7f2fb346414bcc3ab14afbc5ae5656838543a3f54b298660b68069c4b05
TLSH
T15B11BAB3C7D4816E894552F05A286E1BCE2D0901421C3C1985D4EF2BD3E2075D00199F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 720B
SHA256 eefe235178100f7ee57740a6681d4cf18cfd88c3073c7fa714bb158378d2c022
MD5 dccbfc92bba4772b1d30a441af5ded63
SHA1 860ad4ec7cac2a2f3eb27444dceac7f7b4673d30
SHA512 4628975b75ede27baadc2334c2f6efe8fbca6b1a9261b96264dac9f32e657de09aeb6a64eb7228cb32d4e3f71a9762ed24abef737c80e6aa72a78a7c1dc7f0a1
TLSH
T1E70175DA1D134A9BFD300239703DA858A67801CC53513A4F70BEE4269CA3740BF01AF4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 720B
SHA256 a356779a55dae909d51b4ca992503199a5b579b8401f25bc468ba231dc37c2b4
MD5 3b23f09da4135126bcbc78167e10dd2d
SHA1 9d3e6bb30a4985b87385205515b13a9f1c83095a
SHA512 aa4c348a8b0f4d18b982bd1b9dc97aee0cf4f6c0f10286e396217f629e0c1cf605af585a0ec12d36068325cea8337eadb70e70cfb4426c5434966cf1b4f6fd24
TLSH
T1CD010EEA01138B47FC0402B19A7CA559617A814C93517A4FA3EBE06ACC92780AE43EF4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 ba6d3dd687b6c680d910160409587a1d1d91544863dba9ab289d1a42a173bb39
MD5 1bbc693da2acb31396dde8abe9dcbc00
SHA1 188854e7be33af69de7427ee839d53dd07e91c5e
SHA512 a8077882c8690e1e1dfc55b35ad22d48b1cbdfdd87e4a6c3f2fc669e447d59df729fc5326bf54645c2e668edc2582827013ce3c09362a78d3385a1b16782c4a2
TLSH
T19FE06FBB3EE72800ACFF83E2083140A50401F804A999EC5E202A82C710A13823832CB2
MD5 SHA1 SHA512 TLSH

Submit Download

cb34f41b-4a3e-472b-ae03-d2de2863e39e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb34f41b-4a3e-472b-ae03-d2de2863e39e.tmp
Size 9KB
SHA256 8a758afe2646509f84eaf8f2dd785ec0906fd7be6c6880985331461b198e404f
MD5 2b3e3bbd0acb7e753ce87f792616f813
SHA1 68873330c5c8a067ef5e5ef32518c1e67c1bca91
SHA512 2cf9c91b9b3467d9787e320242641fdf7e724c0dba09fa906067aca93266271a2837e3323d67a9b6e5c27690d898cdd063516d44f33f92150b9f737c8286d6bf
SSDEEP 192:sxZVRsWG/fIsZHcHIdpdIHW6+WNGYaJKYjIg5uJ:sxZVJG/fIsZHcIiHbGTg
TLSH
T10822C8556E28A97B8CCBD60DBB15BF53E6F9503292D11E58EAFC861C04F6ACD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfb5de66-8ab4-402d-ae8f-102d25254469.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfb5de66-8ab4-402d-ae8f-102d25254469.tmp
Size 9KB
SHA256 ec746e8345b6bd4d932bc4df7d6c705bae8b8ff831a731dfc74da414808a4bf2
MD5 a094d124c8291f70ebdebd09e7e0ffbd
SHA1 d6df22ef2947d240ec07f5b724c12036b146c073
SHA512 a3e48d3b808b5b14928da38a9377eea6dd9c0019f3a69e60f7d18bd9c47ecfcaa97a9bb2de1e7499ebe65f43b50531d237c6fa440d9c82ee3c77d227ea857a63
SSDEEP 192:sxZVRsWG/fIsncHIdpdIHW6+WNGYaJKYjIgrJ:sxZVJG/fIsncIiHbGT9
TLSH
T19122B8556E28B97B8CCBD20DBA25BF53E6F9503291D11E58EAFC861C04F6ADD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2866fb0-6b52-419a-964d-23a5757e1996.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f2866fb0-6b52-419a-964d-23a5757e1996.tmp
Size 10KB
SHA256 5717035bc951243ea99c99a34003e61cb4cd20dd92ce5697a519615b8653718f
MD5 24a1674a00ebb5efa677e36ca5592bc2
SHA1 2fd97309e2dab869b10324bab4acdc7c96fceddc
SHA512 4f7461872af08e32ed5d538ea8aa8cec0a5e4e6a40c586f5f536f78f74c6ebe30fa9c296706281e2277e677716616880ef49b6e9d696008c423df027ac224d48
SSDEEP 192:sxZVRsWG/fIsZKcHIdpHIHW6+WNGYaUFYjIg5EJ:sxZVJG/fIsZKcIoHbGx6
TLSH
T16922D9556E28A97B8CCBD60DBB15BF53E6F9503252911E48EAFC861C05F7ACD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9752d08-fe93-4cf9-ac0a-e42ed3354389.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9752d08-fe93-4cf9-ac0a-e42ed3354389.tmp
Size 27KB
SHA256 2f750d72370c038195f5a15d947be80464ca9f6458e8cab512a3782cbf1f5f10
MD5 22f54084f30330acf70b3d3279716fe1
SHA1 a04f6d6a93a7bfb4bb8e58a4f025730aff206598
SHA512 19b6d37cd06318e09f1a96d6ba3143dc599b07ac40e172a59df8dbf1ecd872a4c390e58a59a23fdd6ff47f98b055ca1e0741cc7ccf247db7672e99b81bfe7fc7
SSDEEP 768:9CyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3OrojZbx/:9CyQRbrWvvlpZu1jaXKLf33FjZb9
TLSH
T148C2F92F640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e602d96-9d9c-47d2-89bd-8c63e3b4f6d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e602d96-9d9c-47d2-89bd-8c63e3b4f6d2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a84d25c7-4c2e-4772-be53-19d8aa9f61ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a84d25c7-4c2e-4772-be53-19d8aa9f61ed.tmp
Size 18KB
SHA256 13f9ccb430610a937843f9c8f7c1f456a49ba364a83e7f3da57cf243986b7404
MD5 293b7a0de53466861fc48c8ca2d01bba
SHA1 80772c2c843846f8ef04c6b9564de6cc526f9af0
SHA512 a3371ed87fd322098dc95fcc15d7e2e41b7794c5f0586279875a315d9c08dd21258cc44b01c79391333926b6e27d9711a73f3b1664831d073a271d604c781597
SSDEEP 384:tQkUSv0sNM899e/p5u8imn4la8W2IF8IIlF:X09XkmP8W5eL3
TLSH
T128828E366CA86C379DE79960F24B36139EB48067D7C45F94DACD6B2C06DA1D8130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd2801c7-78a6-4346-90ed-905c61fe4233.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd2801c7-78a6-4346-90ed-905c61fe4233.tmp
Size 18KB
SHA256 787b46074a5eefd0f9416fc9ede57edd0059a89565ec58bf20d789357e6cdde1
MD5 5278e22ac3980f1ec7121c788aad56ca
SHA1 51daf4e0c9e02c1ae81e21e224df396fb7233d44
SHA512 7a7f0d810d6695d9c2737e7bc437973a521950acc7ad3f8962a4562592d573294cde89f014d050523ed1b2a06f7e7ff86597e780f8d223d4dca4a527a3d8a0e9
SSDEEP 384:3QkUSv0sNMb99e/p5u8imn4la8W2IF8IIlF:J0WXkmP8W5eL3
TLSH
T164828E766CA86C379DE79960F24B3613DEB08067D7C85F94DACD6B2C05DA2D8130BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46370bf6-8dac-464a-9540-b4c86ac41b63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46370bf6-8dac-464a-9540-b4c86ac41b63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

faebfe4b-d669-4a9c-a8e2-81b8f15fe4ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\faebfe4b-d669-4a9c-a8e2-81b8f15fe4ba.tmp
Size 8KB
SHA256 eb45e43288c69473559aedd18e01f0eb3cf62405c8c3bec43eb364c901102cce
MD5 b0680c1e7ddb1df0b73ce9ec7c50af43
SHA1 a0aee945c6e24116f22756caf87d97681baf685e
SHA512 f73b89366cbae8fe6e01e152acf2242009bf084f8c6f326d9b1092d917c19071c9a441c2d2d0e94e0f2fd7e915545b16dd0600f2cd09fd9f63ebc01d9a44101c
SSDEEP 192:4ONF6iDUQmiUywTdq5u88PPuhYY4laIuZNqPU6:4ONF6V/dq5u8imn4lavWU6
TLSH
T19E122A356C68AC3B6DD3A965F54736239EA4413BE7886F80D9DC2A2C02FF5981307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a59d42da59c3b93fcee65e719decc7467685bac691e49e3c544c2ecc649fe7a7
MD5 1a2fa8318dd2671da17d21b834c4cb71
SHA1 88f2f45b013203a6db88bb7aabce8fc9c0e32ca5
SHA512 4a162a025cf17040524969d3a68db3fd63a7f67285d2c8563bec92380d0c1a9ca58ff884d8db53ddf732de3a9cc9845e200bc001ed553005d5f7bc1c68e0bae0
TLSH
T1ED411A58A6F9114873B7AE1AAFF7B86E447BB9372E0BD45D10110D4E0662A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download