7f5352bf93f673b0a4fce9536b2c16277506b29fec3b27a2bb5749f9e2924c06

Analysis

user interaction
yes
max time kernel
899s
max time network
878s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rosreborn.html
Size 28KB
Sample261026-tm3l5sty3j
SHA256 7f5352bf93f673b0a4fce9536b2c16277506b29fec3b27a2bb5749f9e2924c06
MD5 18d5e1c37799a45e72020356b814eafe
SHA1 d943d95afcf9ce69435ef71ad44be86285ad7c1c
SHA512 4758b72907232efe731928ed717c098cb3aae404f66a1f204c6db9e9ff12fc696a24c40aa68b5ec888189909e41d5d6e97f4509bf5647b4a1d8646f5fb4a32b4
SSDEEP 192:cbJeYIkwDqelBzjH0niN1AoMZoVNyJJgM1POj4PKT2Zd5QuytmrWuz0aETEcE6w1:cAYBENlBz7wiN1IoVN+gyBtY/Tnx/0
TLSH
T102D21267EC0889AC61313E8ABC7AF0DDC185710F8C6AD934B2BA561F1521FC946A7C73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
39	discord.com
40	discord.com
42	discord.com
148	discord.com
149	discord.com
37	discord.com
38	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{D0231AA1-750B-4C1E-A3E3-197AED2D74A2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{16840A54-3B3E-455F-B40D-54C816C48A0C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4336	1212	msedge.exe	89
PID 1212 wrote to memory of 2776	1212	msedge.exe	90
PID 1212 wrote to memory of 6024	1212	msedge.exe	91
PID 1212 wrote to memory of 2776	1212	msedge.exe	90
PID 1212 wrote to memory of 2776	1212	msedge.exe	90
PID 1212 wrote to memory of 1060	1212	msedge.exe	93
PID 1212 wrote to memory of 1060	1212	msedge.exe	93
PID 1212 wrote to memory of 5648	1212	msedge.exe	94
PID 1212 wrote to memory of 5648	1212	msedge.exe	94
PID 1212 wrote to memory of 5648	1212	msedge.exe	94
PID 1212 wrote to memory of 4644	1212	msedge.exe	95
PID 1212 wrote to memory of 4644	1212	msedge.exe	95
PID 1212 wrote to memory of 4644	1212	msedge.exe	95
PID 1212 wrote to memory of 1264	1212	msedge.exe	96
PID 1212 wrote to memory of 620	1212	msedge.exe	97
PID 1212 wrote to memory of 1264	1212	msedge.exe	96
PID 1212 wrote to memory of 1264	1212	msedge.exe	96
PID 1212 wrote to memory of 620	1212	msedge.exe	97
PID 1212 wrote to memory of 620	1212	msedge.exe	97
PID 1212 wrote to memory of 6108	1212	msedge.exe	100
PID 1212 wrote to memory of 1956	1212	msedge.exe	99
PID 1212 wrote to memory of 6108	1212	msedge.exe	100
PID 1212 wrote to memory of 1956	1212	msedge.exe	99
PID 1212 wrote to memory of 2736	1212	msedge.exe	102
PID 1212 wrote to memory of 4484	1212	msedge.exe	105
PID 1212 wrote to memory of 4484	1212	msedge.exe	105
PID 1212 wrote to memory of 1300	1212	msedge.exe	106
PID 1212 wrote to memory of 1300	1212	msedge.exe	106
PID 1212 wrote to memory of 1300	1212	msedge.exe	106
PID 1212 wrote to memory of 2568	1212	msedge.exe	107
PID 1212 wrote to memory of 2568	1212	msedge.exe	107
PID 1212 wrote to memory of 2568	1212	msedge.exe	107
PID 1212 wrote to memory of 2916	1212	msedge.exe	109
PID 1212 wrote to memory of 2876	1212	msedge.exe	110
PID 1212 wrote to memory of 4824	1212	msedge.exe	111
PID 1212 wrote to memory of 4084	1212	msedge.exe	112
PID 1212 wrote to memory of 1680	1212	msedge.exe	113
PID 1212 wrote to memory of 1680	1212	msedge.exe	113
PID 1212 wrote to memory of 6536	1212	msedge.exe	114
PID 1212 wrote to memory of 6536	1212	msedge.exe	114
PID 1212 wrote to memory of 6536	1212	msedge.exe	114
PID 1212 wrote to memory of 6828	1212	msedge.exe	115
PID 1212 wrote to memory of 6828	1212	msedge.exe	115
PID 1212 wrote to memory of 4636	1212	msedge.exe	117
PID 1212 wrote to memory of 2472	1212	msedge.exe	118
PID 1212 wrote to memory of 2472	1212	msedge.exe	118
PID 1212 wrote to memory of 3476	1212	msedge.exe	119
PID 1212 wrote to memory of 3476	1212	msedge.exe	119
PID 1212 wrote to memory of 5776	1212	msedge.exe	120
PID 1212 wrote to memory of 5776	1212	msedge.exe	120
PID 1212 wrote to memory of 2640	1212	msedge.exe	121
PID 1212 wrote to memory of 2640	1212	msedge.exe	121
PID 1212 wrote to memory of 2640	1212	msedge.exe	121
PID 1212 wrote to memory of 3220	1212	msedge.exe	122
PID 1212 wrote to memory of 3220	1212	msedge.exe	122
PID 1212 wrote to memory of 2652	1212	msedge.exe	123
PID 1212 wrote to memory of 2652	1212	msedge.exe	123
PID 1212 wrote to memory of 1588	1212	msedge.exe	124
PID 1212 wrote to memory of 1588	1212	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\rosreborn.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff853e3c188,0x7ff853e3c194,0x7ff853e3c1a0
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,9202482112405716437,3984036001880934080,262144 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,8341634517420563080,2092544343761396989,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,6072035573706480667,5147298824515388655,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,2732885114916255797,1103177909863880795,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,10144853091384989467,17479165103363742259,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2802721226429787578,2252304644764863274,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,594477003253791944,628376879389502420,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,3275884934367581204,18300782147086929298,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,13976668210030184392,17740194485808685780,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1694016936728254204,3698328204410045663,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1694016936728254204,3698328204410045663,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6543634217794318152,3584447874225970903,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5156,i,14983594785545477496,10250133907192787339,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4192,i,4477914430431234036,7483557894417094753,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13485862764674748092,13674632391574684610,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,13118009483214266489,17822027003769626326,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,16855907566928678454,13080129290458282099,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,5040942822024016484,12543003503818003948,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,1406139587311524309,8101748984618143433,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:12
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6548,i,18188008667619140548,8407292751458655149,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:6536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,16856199685529756882,8404996114577061018,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:6828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,17293850648321424649,17106931269830868151,262144 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13722908643932043692,684673773237910349,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,14473092502833560158,16567210865903847673,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,18411155033273453106,16129176051370772018,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4288,i,2675913324415875029,168062049614205146,2097152 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,16270454723636792694,15477821247402107054,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:14
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,3687525486961209221,11740340809338193646,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,9333344691012095837,11310932171868284321,524288 --field-trial-handle=2532,i,5670830033786938370,13780841172407580475,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3888

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ca3ba84-0695-4e28-9bee-e02db76b917d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4ca3ba84-0695-4e28-9bee-e02db76b917d.tmp
Size 40KB
SHA256 3310f565c64b05b2f734f18f225cd9e2c10044ffbebd4bae633d431f1120224d
MD5 4add0a306f5cd1fefbab99359a43c6cb
SHA1 762a956723ddce5c1d29b3f308322481ea689308
SHA512 09537d704f92188388d7175a6412f411fd98536485b1a85f21a1e0dd21a5876b4085eea945fad3570b7f91ab21fed0d02d96d581208f29338549ce63fb9d84dc
SSDEEP 768:F/UxvxjgC+y3Q+UcZ0rfZWcINqbBw4Ot5AEl94BHYjHD6+v:oZj3+y3obBVa5AEncHYjjLv
TLSH
T1A813CF39DCA59D238CF6EBD4B60A3347AEF19063A5C15ED49DDC2D0D0A8729E534B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b280b7-d155-4a7c-b57d-08ff661e38df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65b280b7-d155-4a7c-b57d-08ff661e38df.tmp
Size 34KB
SHA256 0de56c4c21c492ae858be05c876485b17abb2bd79644b142858bade0ce849218
MD5 63e34f590e6175a9b37f5fb4a5bf5910
SHA1 94a3b76632a3cd21f4284c35be136b9e98e36c4e
SHA512 671d5ecbf98606e83e6947e5a2fefd060f09fd81c3f7bb644059f7786f53bd61726c55df3e421d55645b0be77db65b6ce35f8008bf24802d314061172e65ee40
SSDEEP 768:5O3FaUcZ0rfZWcINqtBw4Ot5AEl94BHYjHD6ELM:5O35tBVa5AEncHYjjXg
TLSH
T1A5F2AE79D8A58D238CF69BD4F60A3247AEF19163E9C05ED0D9DC7D1D098729E234B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

071e0ff5-6165-4919-b57c-4eba7a1759e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\071e0ff5-6165-4919-b57c-4eba7a1759e0.tmp
Size 10KB
SHA256 ecf85fcd216fd2ca1d05c456a07c8a9936c74cff42fc826f734e80dab1699b84
MD5 cfef3c419b0bea5a7bb56e2a04af7499
SHA1 2fef7fd2d25755e33180671965da173c3a4937a5
SHA512 873ec5c0c8115bc50a6f4db579956dfba760f222e0f569c937d403374a17640c42ad20cb0944112c44aec8ae79fdd206de6e9afdfb941b053bdef97b86c6facd
SSDEEP 192:sxR6RPbF/fvshSRzoA8p4c/g6+WNIYijRaYGkIgIJ:sxR6ZF/fvshSMV/5IVs
TLSH
T18F32A555AD28A93B8CCBE20DBB65BF53D2F9503261911E58E6FC9A1C04FB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

497e94db-0cfd-4fdb-8a40-7643979505d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\497e94db-0cfd-4fdb-8a40-7643979505d3.tmp
Size 11KB
SHA256 1882947bb630bcafd8c4f417bd60a202b821d96acedd0610d575cb0173504b71
MD5 3a9f7ce10aca0f7e063a9dad4ce4987c
SHA1 f9afc1bdc8a294454bbeaa02c3a7f0b1fc6db2cf
SHA512 62ded26db234bb1f6f242a5ae694212f077104bc99287d040f568af1a1427259ddb7a741d6141f9dbb031ce10923922d5e384c4e9ac45dc19cfec4b7ee05c0ce
SSDEEP 192:sxR9RkbF/fvsvRgRzoA8p4D2/g6+WNps7dYikraYGkIgDYJ:sxR9wF/fvsvRgM5/56d2A
TLSH
T19732D855AD28A93B8CCBE60DBB55BF13E2F9503261911E58F6FC9A1C04F76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50702626-2846-48c2-ac4b-bdca7b8a17de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50702626-2846-48c2-ac4b-bdca7b8a17de.tmp
Size 23KB
SHA256 aa9ba45b8c164fc80e177427213d836004c8dc65d358e31a236b81baaa9a176c
MD5 f52819c590b7703ecd014ddb397dcf6a
SHA1 c2c7f6e55373857e0fe9cf78912c5c0737b2bd4d
SHA512 68cc0d129a3367bf70af6de6cc2d99cbe35fb31e153c9e8f26da4c9be28daa28d3b04c9c6f9779de7adacb540fbaac105673193f446f02c7eb5ed6b5c6c91ec0
SSDEEP 384:XLMDmVifCtgvdFfnvKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVC69lLRRDrohZc:XIDmVoWgvHfnv8F1+UoAYDCx9Tuqh0VC
TLSH
T136B2DA2B640DCB7F4F800A9DAC296FD77D9801CB9A588D4047FE994C02D77EA921A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c0f5081-57a9-4da9-9c80-c0e16cd120cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c0f5081-57a9-4da9-9c80-c0e16cd120cc.tmp
Size 11KB
SHA256 be2a17999019863f92dd0d12a12e30e9571edd312e07d8238b5515775e317e3f
MD5 3d14272e4e33a50a20f091b416ee36fc
SHA1 6d564ec1136c04d0a47fcb988fb74843edf19a4c
SHA512 799995f9eb152cd72661c4c298878fca1149e75cfddbd17c6e2d5dda264424663713d05b0532f4c0226396c811758e25baf0752ba66742e360949bb5b331dd02
SSDEEP 192:sxR9RPbF/fvsvRgRzoA8p4D2/g6+WNpZ3fYilraYGkIgDYJ:sxR9ZF/fvsvRgM5/5DfpA
TLSH
T14432C855AD28A93B8CCBE60DBB55BF53E2F9503261911E48F6FC9A1C04F76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88901703-059c-4ee1-969a-ed41b47584d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88901703-059c-4ee1-969a-ed41b47584d7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 1d7271f1829be0a9405b3c7cbe23c27eabe229db408d6dcd2a6e2226d24f3560
MD5 625451965bc80d156239c310f3885209
SHA1 d2fd1e482cc7bcb4946c77973769e8dbf3165d4d
SHA512 99c191d60553b284c2e26e1f92259b25117678ffa3f849d621dd95080492ef86bcebb02c83eaf84498b7d886f427b30c3d57ddcd6705540e8a4d6db425edcb45
TLSH
T10DE026C414DFC36EA25974C7037CA38C83802A9B93C4690E2700C58C7086040B382790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 e1d6e5d361ffdb33eceb2d8a84e91660335149b96b65023622a199d76ac2f719
MD5 1960217a8f15a1aecfd589d896dce8e8
SHA1 06c6fb81796f4cf0b10ae69e33acd717ed1f306b
SHA512 c05b0a56dd5a8dd4f24c293d2a4d30a29ea8f5f869aa1ceaba2d93744450749e7ead6dba9a5b620dfbdc4d2184a69b4070be4d4fb0ff1f610e00de30b79acc46
TLSH
T1EBE026C404CEE32FA25864CB026C9BCC8780669F96C0A9CF7704C588B487180E382691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 fc93120bdc2f821c639d63fdcfdca21ff3b54157b98be452cd4a15a7510ca858
MD5 06c1472fbb333846420353205b22aafa
SHA1 e8c56023c72d57bacc5858d8321efa509d0b23b8
SHA512 20679423ca440bc483b0de5a50151857326e07205e1d276e82f30bea46fd125ad037bd2f03a9fe5d9d05162285c6df4a539051c8a53b5a3ee2a26ecb69d93685
TLSH
T1CCE07DC405CEC22EA2CAA8CB036CA78C8BC1369FD3C06D7E9F00C5AC7005040B3C2690
MD5 SHA1 SHA512 TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 51KB
SHA256 b872be12d70f372c6d999e8ffa1f7ca4a5b9b3d41702577126d31c4336e43b3d
MD5 f93451de8485614c5fc27f96cc9d2019
SHA1 e57f5d848c23901ed54f7b3507a5f8a263c32a2a
SHA512 f393a8d7177daa358c687e63db99411a51228b74d781fb9367efb290ecdd32dffe62fca69c791f244cbaa350eec288821a8ef4207593bf155aee2d90f9b341fa
SSDEEP 768:D+9wma+pXsk8/6Bdq1aAQBZM2SAd080ZCRYF9SfQEfhSNQMH4LUzha7oMIZtUWOu:D7d+38/6BdqlQ7ldUlvEsShUzhumZqVu
TLSH
T17F33F1B731FA6DC8C6440D71E4FE0C0D8E3C19717A67629A7E1A22489DE0DE2D788577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 38KB
SHA256 ae99aaede2f373187a4fe442a2cb0ab9c2945efbab01cf33e01be517c0c4f813
MD5 71d3e9dc2bcb8e91225ba9fab588c8f2
SHA1 d7e38ee4c245f64b78eb18e6ecd7b9f53b3254a8
SHA512 deda05ebd575d413aa2277876991ecc2ea238907390753485ba1b487ede2f432363c46daad5f3f240eaaf8d3258150829a3ae3d2d9c420ea59567cfd440361a6
SSDEEP 768:90TMDBOLlFMKbQDweRs+mkq4oY+VT6p+0t5LMXTkfm7s/U2Uq:6TppGKMDwtN4orTAHjMDja
TLSH
T17103023ECBD95DEDE717731B5C822B05683C2B18D0BD9C498995A2D04ADBD01F8CB2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 37KB
SHA256 8e401b056dc1eb48d44a01407ceb54372bbc44797d3259069ce96a96dfd8c104
MD5 3d6549bf2f38372c054eafb93fa358a9
SHA1 e7a50f91c7ec5d5d896b55fa964f57ee47e11a1b
SHA512 4bde638a4111b0d056464ce4fd45861208d1669c117e2632768acd620fcd924ab6384b3133e4baf7d537872166eb50ca48899b3909d9dbf2a111a7713322fad4
SSDEEP 768:YLYEgWfC/zlP948Q4NxhBiMwYatzdYZyXSihSZ9ia6UBJlly12m9U:YLYEszTFQyxfiMwYmxYZ1p9ia6U7r4U
TLSH
T17C03F2A4977838297C5335AC14A12A4FF94104FE67EDF4FDF206251418C36269857FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 197KB
SHA256 26ceebe6058245c901eb4e6661d41e216ada774708ffe2ed0fc59f1f5b4089a8
MD5 b8929831b98a1a51fe88fb85a1e3d336
SHA1 414f1f0fa346ad9b9f522be63449a0be7122f778
SHA512 127fa8f243b3675559b5ec34b5fafa06e54bb9f8470b7fde23fefc2321a70c7263becaaa3f1d7f8d9bfab797a5f4bd8429168e678c8e9435fcf062f89411b56b
SSDEEP 3072:rJjIkbfQqx0zd4yfRBbEJKzS89usUF9CB/Uy8biDlDLp4rsoA+lEZ8K4c6ZK6:ekTJ0zeSbEJK2WuxFk6xW5DLOA+lBKgf
TLSH
T1801423A093BF3F63D4C79B498818AD33C53C761B703865CB52C99861F5B8EA9121E17A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 628KB
SHA256 41c5a54733f83cdaa3d00c3d953843bf23d9b694e05259f67b336f53dee6b379
MD5 2eb6444d04a28c141e3cf935565b8111
SHA1 0e2d03175abcf9e84319f7201d685f577a5acf41
SHA512 e360505a76e85488ad1da5ff5374b1af04c68b0ab2f67004d5f510afcd7580203d0994c2f9aa939d409eaf4502543d07020af3038df999f6ca6417b8aa89e7dd
SSDEEP 12288:TunyWeQsME68JibU85Sj23B+HG2Uk48r3CvO2hFXv5xOnWhtCiEFX21:TuyWTs1MU851B+HX487CG2hFXxx5++
TLSH
T120D423D15E3FB6AE18E8C9443B8275FF700EF5B14F9005133ACA1A2980225D9BFA5C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 10KB
SHA256 797b20f871bad132623c2a3e481a46feb3c8b86529aafb26c4e248d9b9e153b4
MD5 f2e614ced7372404037565fea4fd0544
SHA1 8864fdc833b3baaa66b0bfd48808de9718ad0fb9
SHA512 f48ae693e00525a13271a728a360bb041633a3b5f3b7555783b685458819ea8c0db7b07ac3d62770b6c35b09a1e3b39aaebd1dfec5e8eac20a23f22c2b121ebd
SSDEEP 96:i5Ehfmh+8AWsiOAyXy66t/Z9vLNY8z/kjMIsni1J0qMC5y5NEy7ZIbzejrMSsd1x:i5nl+XMB08Op+lrMT1dPiygaRdqBxwR
TLSH
T19422C4888DA7D081F78C11FE90C41D8236B0738B309F7E53559DF5BB6A86F9921D9889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 10KB
SHA256 363a1d717451e4a122d31f43cf1f066117ac1461a63e76cf46efba9993ddd734
MD5 384ba71973790267613a88b20a5dac02
SHA1 dddced5d87b6d6a8baade51a6af48e91f7f9d9a1
SHA512 18ffdb98b38f8b9c188702543401440e26780935f2c47bee5372a110d42715e87b1d985b2190f30e01416ddabdb8a6302fd6804aef6fe9e51c392ffe0aaab325
SSDEEP 96:yPEhfmh+8AWsiOAyXy66t/Z9vLH8z/kjMIsni1J0qMC9NEy7Z3bzejrMSsd1dHh+:4nl+XMBN8O/KrMT1dPiygaRdqBxwe
TLSH
T12622D4888DA7D081FB8C11FE90C40D833670738B309F7E53959DF5BB6A82F9921D9885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4890d06e02c031f185735a82be8567e65d77a981e2bfc7e8e8a957c5fa48cd07
MD5 01d2ec4027e3714304b36c15f424f82d
SHA1 5507d3484906d9f3e913731b33878b22435b4647
SHA512 009b78d60fe6058ee7d74fab003218feeb96a54aabbcfb5f9bfcd26a17a7bf25e4cea00b20a09e377c230920200e6629218323edb4f883f1e4fc6ed3bd6508a8
TLSH
T1B56196CC56B09104F7840137E4C49D873AF0A5CF60A3BE53A6D6CAF4ABD239E72948D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba8e161e2a8ae25cd0e9fa6f36f71504d7f78d0ef54159b1c9753e30aca4da40
MD5 90b298cf97ce7c735d16adf678ffd193
SHA1 18385f8ba6bcebf63038a6af4d4a99dfc9a02a0d
SHA512 3f6b1218f224d7022e1decdc6c0e92d1f7e9527b7586852300ec2435c6d521f80970b45d4b040dc0f1a47fd7c789eea234808a7298e4a16705da7bb52694b2ad
TLSH
T11861B7CC56A49104F7840137E4C49D873AF0A5CF60A3BF53A6D6CAF4ABD239E72948D8
MD5 SHA1 SHA512 TLSH

Submit Download

0f400118-5668-403d-8c5d-c00f450b34fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0f400118-5668-403d-8c5d-c00f450b34fc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

387a92d6-b85a-4e36-bba1-a527876174e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\387a92d6-b85a-4e36-bba1-a527876174e6.tmp
Size 4KB
SHA256 1f93e60d726ffd597efce84041c66c3c67b14a91ddcc76b3a842d33ce88cdc06
MD5 52bc839c2edd4c9836660b2609a7bf24
SHA1 3760d73a52d35451249eee06d61efd58b0999263
SHA512 099197af7093f82ebe58ab6899b19cba889a285c7f332d43e5b29a951a90945c2975e9d3605ba55958c2a639c71416696ec530cd9c7598a301d661d6a5c9ff8e
SSDEEP 96:D/OLfSuvuAuBufuHu2uPuvuxaVZaizkHusguuuz1ueujuiwBu6BuDuCZuqj4/QZx:DWL6ITwuCvsmqaVZaiaofYrujdkr8nT5
TLSH
T1F3A19AF787A4836DEA1156F49A086E1FCE2C1824471C3C7DC9D1AE5B93E21B2F1C1B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f3fa127-7577-49b9-934c-6a4732767934.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f3fa127-7577-49b9-934c-6a4732767934.tmp
Size 1KB
SHA256 c719abf979aea0176579a98cdbb15049d6b37cc6044e2dabf4f13d959a0b0df7
MD5 b4abd01d5c056d42fef323773ca2f3cf
SHA1 a6535894ebc6da939952fa5a6a4118c153973edc
SHA512 a26eade434aefcfb205afb16d1c2f88f85638700dbf73edd6c3d3bd36f592a4feb95814b77957934f77df38509fbbae59c70a03c5b2da6186fba09364a6b2859
TLSH
T14B21CEF7C2F8467D8A0192F866146E2BCE2D0810531C3D5AC5D46B5B93E28F1E24095F
MD5 SHA1 SHA512 TLSH

Submit Download

624b3f35-3770-45b7-9997-497892d0fc4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\624b3f35-3770-45b7-9997-497892d0fc4c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6f57950e-d707-45d9-b64a-9e3acec1a23b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f57950e-d707-45d9-b64a-9e3acec1a23b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b6024e3e-a2a7-4d47-b166-3f34f76a3c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b6024e3e-a2a7-4d47-b166-3f34f76a3c04.tmp
Size 5KB
SHA256 25253290204b79bdad5b8e2eeef696381d4dfb567b670152e1c8e0a2fba00da7
MD5 ce27c363b2f27ab0a44b3d4d2dcd2412
SHA1 b078416939dcf7ce4a792356240ac65c17aa8d15
SHA512 e1699048bef6cba14657b8b53e2c23753f72802337e722d19428e433f4486cdae7ca88b78dac8b2325c4aba21aec41b7cdd79a79061bf46a21b9e086cf3d7207
SSDEEP 96:D0Ohc6SuRupuxuvuXuDaVZaszzdxHusguuuz1wBueuXuiu6BuauTuVu6uKuCR:D/urSisi+SaVZasnddofYcruXdn56qlj
TLSH
T1A6C1AAF3C7D9872ED91556F49B183E1ECE2D186443283C2AC8D59E5F97E20B1F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3785b23-7d28-4551-bfea-c95b2f354e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3785b23-7d28-4551-bfea-c95b2f354e50.tmp
Size 6KB
SHA256 8a05614b93cb5e1ecbbcc6190ee0e63245f042d2d7f07b2543b6605d9bde527a
MD5 dede4c428ba2ef1c2d8ef0a6fc98650a
SHA1 fe7ee04e88afb1d04e6ea5634822c9af7c90cf58
SHA512 3369f764f16b6cee2d0303b753149952d75904c274b0de2196d2aac4c9f73946b565bd9b28f8ba4665f4d8175dbe6c18ca50b6170bd6af23418d151d28074ff8
SSDEEP 192:D/urSisi+qX/PaVZasnjofYruXdn8Zo4txUOhD:D/urSisi+qX/PaVZasnjofYruXdn8ZoG
TLSH
T111E199F3C7D8832DD91566F49A183E1ECE2D1C6443283C2AC8D59E4F97E21B1F18264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe76d382-8aab-4c1a-97bf-6e9838fa5317.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe76d382-8aab-4c1a-97bf-6e9838fa5317.tmp
Size 4KB
SHA256 ff2624db18d836d74a0c2913e22c5e80145d446c61afbbd95f1468942301c00f
MD5 40aa8ee58cc7ade22add1be8d61a8a3e
SHA1 90af268effa170ef5cf57d3c096fefaea182782c
SHA512 8cf7858fb870fe1ab5a45b11af298607403dd46101b3458cfc54cc3b84623e81a581ae2417071ef8d764711c1ee6aaf44891abc2d3569f43b814c477e1e7e4bc
SSDEEP 96:D/OLfSuAuBufuHu2uPuvupuYaVZaizkHusguuuz1ueujuiwBu6BuDuCZuqj4/Qpz:DWL6TwuCvsmyHaVZaiaofYrujdkr8nTz
TLSH
T13EA189F787A4836DEA1156F49A086E1FCE2C1824471C3C3DC9D1AE5B97E2172F181B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a1e6a30-bdfe-46e8-ab61-5ffbdbe7063d\index-dir\temp-index
Size 360B
SHA256 32cf4432961d8aa6dd7db1a71cc5f88fb25f226a8a4643a7ae926b4a37c1b28f
MD5 25a4d5a93d50ec0de0ce052e12a7b5fa
SHA1 92c69da1ed065ffd0907c0c2c7a2799ac22aa683
SHA512 c1364f7f2e2af9cd3eafb528fc75834e4874ed84d520c03fc9344e327977d3e9b7d9bf0ec84af975a2435dba552e96a819e075a9863f58ef6a119ce3fef1eeb9
TLSH
T1A8E0C20A5E226206EC08517234B974A9A73125EC93042F0A60FFD12E8D84284ED42608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a1e6a30-bdfe-46e8-ab61-5ffbdbe7063d\index-dir\the-real-index
Size 360B
SHA256 8e5a46dd94b9c2a4ca31d07f06efc55e0ae55ff19e0209ecb55795e112b8915c
MD5 82239aa9528c080506a37a3231ac65d2
SHA1 08d1712039d977995d0f749a5e5c9a470d2a4efd
SHA512 4facf84b9a6281422f23226ea5fa8b2c6246d89d8653688e82b364f3569b7c2d44b2f5580db6d3161a7c224c8700a7db41870b9f08bd447347f763feefef70a6
TLSH
T1E3E02B491633E242F80451B23879617563721444A354260F61FB909A8CC0B94AE02709
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 c78e77760f85c5828acf2f2816be802fb7010dd71c4d2e189aa8510469b29031
MD5 bd82a4e0cc81eb01b3434911844a0074
SHA1 54df58581cae1bd0588b0c82d5dfb256f46159b7
SHA512 aba5a95d61040486416be642dce4c45c962c2d93c5312d33634a5e8aa6dfec5a71639eb12bc61c081fe95f6896be9159589b3e1a6a6e0ba95e8f11de29581066
TLSH
T184E020BA3DE76C14FCAB87D5647154B001417DA4DD44BC8F182BD2C760A131424A6C65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 da92b709588f2314c7d041817c1ecc94bf8bbe0225c83dcc6899faf13d8f635f
MD5 b48076999be85adf587c89a2c4b70ce6
SHA1 c4002e0d5a1f913bc2498c90aef9ce664bb5977f
SHA512 d1d995e3df2ffacaee3acf5881d7b5897a21ed68e90a0c931c6aee03802d48a68e2eabf319c1286eeb601bc4b28c689095b80147812e3ac1bb06c5edcfb7dad7
TLSH
T18DC02BA3F16003108B1143D0063B14CE43052CCC08C1C18D711334187070F33E202EF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 78627c95680937372387603bf24d394b31b4872f6fdf8b242f0f362661c24132
MD5 25ec4f115c07a9b5096b78f3cdb96dc5
SHA1 475515efe0d7677989ef625ecbf269cb595e2a5d
SHA512 467ef1e84b784b4531634595b04a492f662ba35538296f09285c0f7d43b365d3870819652a99cf8615dd0c45703501315f41270c51ccaaa825e57706f1d30e06
TLSH
T17FD097ABE1218AA0C77687C00E2318DB02512C9808C4918CA212202C64B0B63C222EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 d40947d9a47151ff3d263edaab3caafa457a6481148e33e5f1b3ecc322aae10a
MD5 61e4af90eee141c49c7e13f7639604b2
SHA1 bfd82d5425f855f5d3fd3b42549d0eb42a3ea4b7
SHA512 160ab4378ee49c27378cb7430870568b5660c668a932dfa4591c34fbb42da78030e3cadd8c1cc978ff4011f7f7c27644b54cf68a30e263fd0330e2ece16d6af8
TLSH
T100D097A7E16187A0C6BA8BC00E2314DB0201389804C8918CA212002C6880B63C213EA2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\a0ff9644-8cf5-4b77-bb4d-a1bfa457a5f3\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\a0ff9644-8cf5-4b77-bb4d-a1bfa457a5f3\index-dir\the-real-index
Size 48B
SHA256 b275376d49e7e5170bc9bee1a169606e5f3e77c91077308b25690ffa41fd2b8d
MD5 b7d050027b793367c79d3b2f793cad32
SHA1 273e5363989c1ce310b84ac043cb000cb5fe2015
SHA512 c73ab6983403d9985573d6571621a0a2416d3ba37646b4dbcd3e79f428d0cd9d30f28441eecb56eb04ccca1ae802f8d93130d9429a3d9fc754b706121f11dfdb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 7db7860b316da46a27a7cbafc057c40c462685a37b55842a8c0bf643fde641f0
MD5 bdc1358842a8cf6111dd2bdb96846160
SHA1 ba14bd0f43cd90f29b133ed674a348e3c7f9f5fa
SHA512 f1bd9ec04acc965d6dc38eda96fe84663b21fedf4e06358da06eacfbb001326c8c0bd5a9bfb030fcd7fc3ad7ffa9165bb650fadeebe24f1c8e6f28fc0673929c
TLSH
T18DC08C772082A9D2BF7A2CEF915732C8C9B63FC84CC4AA8C8472300D3238C2B1000D60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 178B
SHA256 be3bf88f4032ec510dfe42b4b6b418251a3b6336dc7d28f25b5892a4c896c3dc
MD5 34d13d90433734b1703b04e7cdd6a922
SHA1 3cf8546cd1661b2828a3cd6401cd55b3596699f1
SHA512 642118d3df21a7cd7f9c5caeba8eba419b95cbdb9b413e9cf9f868ef1e4638893ec8439f9492670cb637aff5fece45e06814562f5409b26a2a02d108ad3af70a
TLSH
T18BC08CB710C6AAE26F7925FB215732ECC9363FCC5CC4AB4D84A23009323482F6601920
MD5 SHA1 SHA512 TLSH

Submit Download

e8fa45a5-67eb-42da-b2d3-90cb94ea4b81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8fa45a5-67eb-42da-b2d3-90cb94ea4b81.tmp
Size 10KB
SHA256 7078a38321cf2c423f954b71035ea47ba46298a1798c212bfa256cc30bbab953
MD5 dbd416eedf490971cf7b267f0c4a1588
SHA1 258649d9dddc14ccba6cbfac8b459d7d9d9a2c23
SHA512 e4ef2e9fd012235c6a14e598118d179169fa35fb2db7408c0a1fffa45fa0f1a230dca0c0a52c5601299aab3210815e29a9f7c3388172a227135c893d9d8c3c3f
SSDEEP 192:sxR9RPbF/fvsESRzoA8p4c/g6+WNIYijRaYGkIgDiJ:sxR9ZF/fvsESMV/5IVS
TLSH
T1E032A655AE28A93B8CCBD20DBB65BF53D2F9503261911E58E6FC9A1C04FB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f70259b7-84f3-4cf4-9c31-84790960d2aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f70259b7-84f3-4cf4-9c31-84790960d2aa.tmp
Size 25KB
SHA256 9ce1a683012fdf617716e35f4b4f6a8dec80f57855156ecf219d5aad5fc3e8ac
MD5 d880803c31c9ae1356d1cc6bdde4c161
SHA1 1b48952352fc4fa063fe4cf57c761cd53541ae98
SHA512 e350154d707a8215ef1a8a1969eda70da5e96c04dbb79a7ad2070fbecebe8b815eec306a279f945328150eb9044c244038242409e85f359c808b2e1a1cce1f78
SSDEEP 384:sxR9wF/fvsY66s8qMpRiYnazAW8pZS15posJWeT+1RgML/5xLxA:sBwF/f/4Mnc7WeT+1mS/5Zy
TLSH
T197C20805A824C83B9EC39D1C693D7E33D9EC506222C5DEDA56ECCA1C01AE1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9fbb90d-39a2-4e25-820b-2fb19ba82917.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f9fbb90d-39a2-4e25-820b-2fb19ba82917.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aec01a7a53d0c28fdc8e7bb820a379f0f771d2043da1953baeb67de478512195
MD5 791cda2cd705e36ad35c2461a987909b
SHA1 ed2a67266dd907105f9d529f9985f9dd12b60507
SHA512 a891acda6ed6d6abca129a41ff092b4ab2fa1d88396123f7e810edb1692b20bf95c9585fc97c80d676340493423f56bc6fbe1dd51506a5d5b88bd8fe88d0cfbd
MD5 SHA1 SHA512

Submit Download

c47baea0-48e4-47e3-855c-0cc7708e46ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c47baea0-48e4-47e3-855c-0cc7708e46ad.tmp
Size 392B
SHA256 cf3775442de7f50e00299b362b019fac93a54897e0a8b541e72cf45699e0fa74
MD5 0e5c64a48a0ef81d8b51623566a4e01d
SHA1 c80e609f2db62e526771c2b822753fcdbc412658
SHA512 c900273dc6c5508a8b057b3e186a7d08610fe7c6dcc150c92ea8f597180171d8b0dea256dab8a585c842a3a37f76cf90dc866ae1d182a673c0d2ac272b822164
MD5 SHA1 SHA512

Submit Download

c65bf036-02cb-4575-97a4-3d82f191bf0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c65bf036-02cb-4575-97a4-3d82f191bf0b.tmp
Size 34KB
SHA256 1d38c8593c7271aa3b78e33dd247e485b832312b623d0abda583a64fb8adeced
MD5 dc7f349b1857cf56825fa7a256cf8363
SHA1 a7f38392f4f656965ca17ac7a4bade655e4febf4
SHA512 a2318873b60f0c20f97ac26de5def7f56b986d8551d5f9d80607f98100c009e6e7c90503ec7fdb3b2b38b6297b66addc5c47e032295959fb1fdd924cd841ba97
SSDEEP 768:yO3cXUcZ0rfZWcINqtBw4Ot5AEl94BHYjHD6ELM:yO3ztBVa5AEncHYjjXg
TLSH
T1E7F2AE79D8A58D238CF69BD4F60A3247AEF19163E9C05ED0DDDC6D1D098729E234B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d88e3330-f53d-4421-aa32-78620bb674cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d88e3330-f53d-4421-aa32-78620bb674cc.tmp
Size 38KB
SHA256 5abe00cea1fac1f228193e76a8a9f8692d5a53e57a5a2ddb1cc0ee74c849e84c
MD5 afb5b101d74abfe3cb8e39c4ef14a309
SHA1 95dd1ebc374476ad54c60e1a001e248e366acdd3
SHA512 e2018c29ca2076d5421c958db49fc19592849105a035c420c56285510144653023c20b723d178b8d121ab36c03ec8c47ffff706c2c52f9058f6ed728a858ac27
SSDEEP 768:J/UxvxjgC+b3lacZ0rfZWcINqeBw4Ot5AEl94BHYjeDAFTN/:8Zj3+b3UeBVa5AEncHYjUAFB/
TLSH
T1F403BF39D8659D23CCF6ABC4B71A3387AEF1946395C15ED08CEC2D0D0A8B25E130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb8f533e-7cfa-453a-bac2-3f06f562dd13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb8f533e-7cfa-453a-bac2-3f06f562dd13.tmp
Size 41KB
SHA256 b5f4606a3ba8450dea9e53c49d25dfdd078720cc43db9c33afc27fa995885789
MD5 462b0d1f5c93e2f1f51990f03839487d
SHA1 f984c85e24930e2f83f5d248a9d033c4c978c231
SHA512 749cf77bcdbd1d64fd8c3ca43e5133fc11c84e1facf728fac898bf4161f71d936569707407c88e4806581a936dca1b90672929d36e4ae689da5fb76bc0ac4f2f
SSDEEP 768:rFdL37wgJ/UcZ0rfZWcINq2Bw4Ot5AEl94BHYjHD6ELM:bL3c2BVa5AEncHYjjXg
TLSH
T1B8134BF588D78937C8AE9B87A73D2E429DBDC153B9805990BBC8690CCD471BFD246806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df528d4f-0dc7-4932-a903-e5b82441bb85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\df528d4f-0dc7-4932-a903-e5b82441bb85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f987f597-22f9-4f2d-9be7-326da8148f90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f987f597-22f9-4f2d-9be7-326da8148f90.tmp
Size 38KB
SHA256 1ecf07d21a32e3e34272ed19373594fa46cc7f283de03e59b8b74eb645fab3c1
MD5 3604d73dfe270d6c7ea57dd3b3818e9b
SHA1 c127965556b5809055ee1e0e7b222b415f976b32
SHA512 6a3381c1c1289c86779c2b7f4ef1a11cb803045d32be0db526310d2f2c1aa38c5f7182d7e6d6e6d49af68ceba2aacee26279934e82e7f6d5df4796db21d2a723
SSDEEP 768:z/UxvxjgC+b3sicZ0rfZWcIwBw4Ot5AEl94BHYj/nAFTN/:GZj3+b37BVa5AEncHYjfAFB/
TLSH
T18B03CF39DCA59D23CCF6A784770A738BAEF19463A5C11ED48DEC2D1E1A8725D130B84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download