hxxp://coolmen[.]joe[.]dj[:]8000/?grid

Analysis

user interaction
yes
max time kernel
80s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://coolmen.joe.dj:8000/?grid
Sample261027-e1kwxscf63

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4828	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{AA55C51F-A88F-4891-B29F-A878CC1C3FAD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3660	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4952	OpenWith.exe
440	OpenWith.exe
3024	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe
3660	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 696	4968	msedge.exe	85
PID 4968 wrote to memory of 4828	4968	msedge.exe	86
PID 4968 wrote to memory of 3816	4968	msedge.exe	87
PID 4968 wrote to memory of 3816	4968	msedge.exe	87
PID 4968 wrote to memory of 3816	4968	msedge.exe	87
PID 4968 wrote to memory of 4368	4968	msedge.exe	89
PID 4968 wrote to memory of 4368	4968	msedge.exe	89
PID 4968 wrote to memory of 3244	4968	msedge.exe	90
PID 4968 wrote to memory of 4404	4968	msedge.exe	91
PID 4968 wrote to memory of 3244	4968	msedge.exe	90
PID 4968 wrote to memory of 3244	4968	msedge.exe	90
PID 4968 wrote to memory of 4404	4968	msedge.exe	91
PID 4968 wrote to memory of 4404	4968	msedge.exe	91
PID 4968 wrote to memory of 3060	4968	msedge.exe	92
PID 4968 wrote to memory of 3060	4968	msedge.exe	92
PID 4968 wrote to memory of 3060	4968	msedge.exe	92
PID 4968 wrote to memory of 404	4968	msedge.exe	93
PID 4968 wrote to memory of 404	4968	msedge.exe	93
PID 4968 wrote to memory of 404	4968	msedge.exe	93
PID 4968 wrote to memory of 1936	4968	msedge.exe	97
PID 4968 wrote to memory of 3180	4968	msedge.exe	98
PID 4968 wrote to memory of 1936	4968	msedge.exe	97
PID 4968 wrote to memory of 3180	4968	msedge.exe	98
PID 4968 wrote to memory of 4636	4968	msedge.exe	102
PID 4968 wrote to memory of 3864	4968	msedge.exe	109
PID 4968 wrote to memory of 3768	4968	msedge.exe	110
PID 4968 wrote to memory of 4952	4968	msedge.exe	111
PID 4968 wrote to memory of 3524	4968	msedge.exe	113
PID 4968 wrote to memory of 1524	4968	msedge.exe	114
PID 4968 wrote to memory of 3524	4968	msedge.exe	113
PID 4968 wrote to memory of 3524	4968	msedge.exe	113
PID 4968 wrote to memory of 1524	4968	msedge.exe	114
PID 4968 wrote to memory of 4760	4968	msedge.exe	115
PID 4968 wrote to memory of 2012	4968	msedge.exe	117
PID 4968 wrote to memory of 2012	4968	msedge.exe	117
PID 4968 wrote to memory of 4600	4968	msedge.exe	119
PID 4968 wrote to memory of 4600	4968	msedge.exe	119
PID 4968 wrote to memory of 3940	4968	msedge.exe	122
PID 4968 wrote to memory of 3940	4968	msedge.exe	122
PID 4968 wrote to memory of 3940	4968	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://coolmen.joe.dj:8000/?grid
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbc930c188,0x7ffbc930c194,0x7ffbc930c1a0
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,16713919211195741541,4864860869013266544,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9287908163917394551,9316119070669991782,262144 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,789234757811950279,15625595544217114736,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,9634215724636962409,10322872772323177439,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,16564502875983139083,3019947282263018496,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8321479614766689104,9101271101335917382,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,14562618774449273900,9682866574566499188,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11880630986652615943,15834860349084260302,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10983327161369397503,9371874457892802260,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,264071603421398963,16949972901497221483,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,264071603421398963,16949972901497221483,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,11823293266793232160,4259573915650411792,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8251188557847001296,2462349983126298677,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,14235978077872131755,17990658399937445669,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4280,i,8004786745982115880,9008787539175846142,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,15939708520946811231,13964877113488355595,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,2056698341095090081,18250802133329770306,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,6881389864958148081,14644082143137751385,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9367825035267206634,9040988551172650536,524288 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7116,i,5770076393531914283,16616886051290525630,2097152 --field-trial-handle=2248,i,14125926104416982241,8470915327805032959,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:440

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3af2625f-c770-453b-8a85-317f74e34148.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3af2625f-c770-453b-8a85-317f74e34148.tmp
Size 18KB
SHA256 ce9f004fbe5d71f93f574a1d1d60057bc943fe4d153f3281d3e977e217940789
MD5 eeae78314fef00bd01c8e308901cbfe6
SHA1 09abea86d5134629a784e3c711fed0e0275396e3
SHA512 25dd36bc467324685a1c7beb2804ebf51f41e3791cbe9a62e0c5566f4bb149bac47e9162e3580c72c379e10a8cc55ba3f2c6cc617aeacad4a689e08abf2a7612
SSDEEP 384:/QkUSv0sNLp25eXTBGYX5EOv8bOXCxvaTZcEbtCRIIli:B0DadGYuO2eCxvaTZcWCRLs
TLSH
T188827E3698B9BC3B1DE2A154F54E3603DEB4912BDAC81F54D6DD6F2C01DE189230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b40f093-f408-42fd-8bdf-6db7fb568c0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b40f093-f408-42fd-8bdf-6db7fb568c0e.tmp
Size 8KB
SHA256 60ed90f332151e66541e78ca97ce5db0c8eee2fec33a0764e4f81bf1e88ba3ce
MD5 50703b2a80ae0d202a838bf91f230b3b
SHA1 ad708fc7f39e9078d2299358cc6e299c2e6b7a04
SHA512 70f8c7aa94c1aeb51f8e48190fd1037820a737032572ab86745471cadc9cb8d9c15836ccba83a316be7bb6e7601898e554dee2d2b19f7f2f26a6dbb8b213db14
SSDEEP 192:LJONS6DphmqQmiUyEXq8wGYX59ezXCHjzor4Rukk7pgU6:lONS619vRwGYX5EOv8RKU6
TLSH
T1B102E835AC78BCBB5EE3AE45B54B26139FE4102BAA952F44D6EC1E1C00D764C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4573c71d-2572-4236-a656-3680429c5223.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4573c71d-2572-4236-a656-3680429c5223.tmp
Size 31KB
SHA256 0ab208e7f2ffa61c21763e7f92242b9be63723cdea702518263050d953a14f06
MD5 5cb06fc5c01445bea6faeb9da3e681f2
SHA1 931210028a7380f3dc7b72f5ce85afe834ae1969
SHA512 f809d48f1de0d2899845d66ec50dc9a17b9d1713884d33c56bd7b8cdb91505023ccac174772864c68a5a2370da2213060c45fa850e4b4f89445d541673d9b5fd
SSDEEP 768:yFhDqwgGu0wGYuO2ekhJSXL9aUivaTZcWCRLs:SDlk28MUiy7CRA
TLSH
T1FAE26EE184D79CB6C99D97C3673DAD0299BCC037B8445A18B3E8692CEC4B1BFD316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53791fa1-5c67-45e1-a937-d13e68842b65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53791fa1-5c67-45e1-a937-d13e68842b65.tmp
Size 18KB
SHA256 50e32c934571634cc8a8642440fe2eb9c7b9c0ae088d4ad71e1ef43bd9f38b71
MD5 c754a4f6b4bdd84ffe571b1764782faf
SHA1 2a6c5a6eae02afbabadd7501806ff3abab740ca7
SHA512 bb141baf4cb0478fd01160478ca2d468607575b68332e6907a77bb91760d452cfa8534419e7a0fbd0cbdb91d79ebe8fbd11e60b3e7ddedd37a6facb8a666755f
SSDEEP 384:yQkUSv0sNLc25eXTBGYX5EOv8bOXCxvaTZcEbtCRIIli:q04adGYuO2eCxvaTZcWCRLs
TLSH
T1AB826E3698B9BC3B1DE2A154F54E3603DEB4912BDAC91F50E6DD6F2C01DE189230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8aabab89-dd71-4170-ba68-da8b786b966d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8aabab89-dd71-4170-ba68-da8b786b966d.tmp
Size 392B
SHA256 a862cadd846b0897d8398b74f7ea908947306571e094e16254c34b332585da29
MD5 12144f3dbfabd315f97acae78de1c02e
SHA1 9d80c5bcdc0bb03dee4e58aa78214b9bbe4accff
SHA512 f2f99ed8d91ddcc0d38fe8c18730ef5b8eddeb3525bcf80c3aa1d5a3410b23cf34b79c50fdb8569d792d1a996536bdb5e6d933c976af04c63c32aec99f6bdbee
TLSH
T13DE00217DB0451FFC03C033065D7152031E744B407E205040500016135023040F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

492616b2-153a-438f-9f83-fbe007a7ca1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\492616b2-153a-438f-9f83-fbe007a7ca1d.tmp
Size 105KB
SHA256 70186446beefb5f52a8af72dc666f019127ca772ab346b24c242d8d83b3dbd41
MD5 8d16574ea95ad59e658fb6fff1145f82
SHA1 42a86208229e0acc976e3871eed70b257d3c129f
SHA512 ebf403f83599040727e9e64202ac06775ca09653730607a6ba8c761b4cae67d1081bcafb880105f893dabfba290a649f0680da526b9ba72be3a3764ea147eb6e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ec9f3225a36b6095e8a072aff3977b6c72c6f861a6c339c4c341dbacfcabd0c
MD5 e099eb95a648ea38aff2773c3580afa6
SHA1 b16d4ca0fc492601803a2b8a12e254385f767f7e
SHA512 95eaa01bc1a2e460b0214a4a48369f37b222bf53e085bb61210a0f6e3ccc4421b5ec242c42f8a8098383d4db3086bbcdb25ce0d03ede13027668e705420b97f0
TLSH
T168D0802165753FDDD12F5035041585844E44CA3356001115571F1D2D16944D62D61DD4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

22dd9f83-4d87-480e-9afb-a9e6da7d2758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22dd9f83-4d87-480e-9afb-a9e6da7d2758.tmp
Size 13KB
SHA256 107660ab30b79043e84e05b078ba7ad51583fb736cc8d3f126b109c0cf2f8855
MD5 d0be9559c72fdc0cbb1510997c676e95
SHA1 5bd47bac3e81c50b0e17f20cd83e9104e4b9de9c
SHA512 87f31938b7f680ee83ac84fcbe9f27e9e1fcd5d07031ddd5c321dbd6101bdf110f511399959311a8070e3b851f286a0d1ef566422ef15cd16158b68d5f596bce
SSDEEP 192:sxZmR8nB/fmsIWpVU/SWY4Mddp4U5HW6+WNcmleuUh+/YYeH+YIgb++J:sxZmwB/fmsIWvUaw21Hbp//0Z
TLSH
T13352C955AD34A97B8CDBD31DBA25BF13E2F9503295911E44AAFC8A1C04E77DE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3aaa80e7-c4b6-4181-b0d8-bc99a76932c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3aaa80e7-c4b6-4181-b0d8-bc99a76932c5.tmp
Size 27KB
SHA256 e811077f2409e0fa010044c83135d7b6c32c9016676e0e12b141b2c810fcfa18
MD5 990f61304acf151b7c94ca736b0d78a6
SHA1 2c36d45d17b14470d01a1db0fc51d51cac1d0227
SHA512 00824b1af29266ee89596f7a741448ff015afd5aa27139cd64da2ba182ce342c13a19aca32075b37279013e40068d1f2146b53766ca9e873d51e52cab8306789
SSDEEP 768:UlichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXznrol1on:UlichfPWvPZplu1jan+LKgz0To
TLSH
T11BC2EA3B640CCB7E4FC05E9DDD1A6F9A7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a57e24c-b5bf-42f1-822b-b13272e88638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a57e24c-b5bf-42f1-822b-b13272e88638.tmp
Size 10KB
SHA256 79be6dfb024b40c8d323de0616a901dd16fda3b06c0a319ec475936660ae1cf3
MD5 69900359e4460f31f8a6df4b099d9c0e
SHA1 02cf1a0d52f7edd722475b0cbb377e4fdf0d0cf7
SHA512 ad7053e391c8a33aacce5d6742511fec29416b4fbcbe6125cf9bf39bf463f40701aa15223f3ec5954b05688823203e34eb377a4f6b93a25479917445a022b8d0
SSDEEP 192:sxZmR1nB/fmsOnIdpW5HW6+WNpeuxYgzioKIg5++J:sxZm7B/fmsOo2Hb5xMH
TLSH
T10232B6516D38B97B8CCBD20DBB25BF53E6F9503296951E48AAFC861C04E77DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fa1585d-185c-4148-adf0-a2e3ba58b2b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fa1585d-185c-4148-adf0-a2e3ba58b2b4.tmp
Size 10KB
SHA256 8409b562502f2cc222ddf93eefe4e191b68db5d662fd78e7624c2cf221bc7b79
MD5 58554093bb194395d64bd15b889939b4
SHA1 1d5e4b6779de0facbcb4f9faa9bc0a19fec2bd8c
SHA512 4beb87ccade0ec93c5263a30c5ebf1d145f467d9fc5a5feeec4bbe5e10deef3adae7d7da55153550b573df9abbc53169f323d9f1027ba24c966397a34231148d
SSDEEP 192:sxZmR1WB/fmsqnIdp05HW6+WNpr7/YgungKIgrJ:sxZm6B/fmsqoUHbF/C9
TLSH
T1BA22B6516D28B97B8CCBD20DBB29BF53D5F9503195951E48AAFC861C04E67CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c8882ae-1e7a-4e53-b874-adbefcd90f2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c8882ae-1e7a-4e53-b874-adbefcd90f2d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f8121cd-6d15-4e94-b4a5-f87882295d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f8121cd-6d15-4e94-b4a5-f87882295d28.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b789c50ea2ec92dc237cec88edf24e49964eabf7d256ae886d205c312eac3bce
MD5 73ac634b52cc8d76bbc20780744f1136
SHA1 2a7ddfc9f42ef8a9153ebab012386eca54b3fb76
SHA512 99bff35a94cb9837f5c97395ab42eb71e6a5e72fa162b927df7ff8fb162d29238c9693480d182684f852a90bc397ca81bd3b5f4a7eb3624c86caa12b9f7dc0c9
TLSH
T1D3E086D405D9C32FA32864A74678534CCB91362F96C4699E1704C9C87687548EED76D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c4bff746c59b11eecc0dcf7e738a878902ba9b4f23070ed8df66ef35eb651ea3
MD5 c7f6b9a9210c0559afdc8ee7546c90a5
SHA1 510713264df06dbf3b0477c85215108a5376b7a7
SHA512 17232113524b2fdf288536f196fde8213d20a79d757bfba4aa1c7ff72f7372504820fe7a13f6ee32cbcec0198af7e4426fd112cf9d758fbcea343648d86abd39
TLSH
T16851B6C467D8A778F79480F082D921B371F886BB3D875F4B00E4F9795A0AB2A4D07B60
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 957b34214c97a4026128e0a4715ff1d55e4242a6fa95188b3b6ffa3a6e77ebd6
MD5 b33ee7688582f1be99b691ba5583dc3b
SHA1 901d2631f9d6e67ee3b3fb39ea7e9a4991338464
SHA512 f9db7a2150e7a1c727f528aef3ff485d3207d67bacee68f5553a986f1bbceb8d1687f84aaf2c356806dd997d24de14a1a79fd94079e001bf9bd561be6638b67b
TLSH
T10D71B7C423D8B379FF9480B499D9A5B771B5857A3C971F1700E4F478691B3BA4C06B60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4c4fa8d2b9c569f4bb07e09860665b0f6c522745b632a405c3cfa4c8e7598c2c
MD5 eeca3dd92038bb6fc21b0e3df6c02933
SHA1 03fc75b78d5fb2fa0c419ab8a55e67fef0017a1a
SHA512 3c1af2d4f24da8c19af6b111f3cee34e2de50b4b98b5b5be33c6cd84dff209d1ba747914a6761b337c4c32ddf861e43b500954cb474b50f677ffb38ab86c26bd
TLSH
T1D651B6C027C8A278F79480B086D921B371F885BB3C875F0B00E8F9795A0EB2B5D07B64
MD5 SHA1 SHA512 TLSH

Submit Download

2ac5e9c9-5bd5-4a0c-8dd2-faa4b65ad0f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ac5e9c9-5bd5-4a0c-8dd2-faa4b65ad0f7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

042fd64e-2a55-4c5f-bd00-15335b91df71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\042fd64e-2a55-4c5f-bd00-15335b91df71.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

325564a1-d74f-4ca7-822d-5aae731bfc83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\325564a1-d74f-4ca7-822d-5aae731bfc83.tmp
Size 2KB
SHA256 04487af2b8c7ba39f1740d5881ecaf2b61e39efa003333d22719cce2dd54b374
MD5 117b9f6a17fd27113d0657dbf896f5d8
SHA1 c0b63684b82b85431eaceb5377550395091f5ebc
SHA512 ac6c61f16d0fab204ff5f8ff8bd293b4f3f91a77921bdac04fdf9212ba49dffba345e88c1cf5e78d8f1f054953652e96385abe2c935c3bf2991f20f1d2ed0799
TLSH
T11D4199F3C3B1456D9A1195F0AE14AF1BCF2C054303AC7C5985E4AF27A3B28B1E011A8F
MD5 SHA1 SHA512 TLSH

Submit Download

5313fc31-08a2-4a08-9574-6ea0b9f58c48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5313fc31-08a2-4a08-9574-6ea0b9f58c48.tmp
Size 1KB
SHA256 0961bb3fba6f7b15aaebaa1e942df09c48c7dd753bc78398c37804f6454f528e
MD5 b9d3e61ab7fb566e6635599070a7c67e
SHA1 d1a0bd5c2f7705458df34f9cb6c57ea00c949068
SHA512 dce21d55c72fe3eda68fb9f46280169cef340ad7c92227a37f23cae3d99f27e49e53cd9d34784ea3d32b3c74553748397264d080dbbc2dc15d0b53387fceeae7
TLSH
T163217CF3C7E185AE8A1156F09A24AF2BDE2D0506435C7C1985D4EF2793F3475E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

e02667fe-2627-4e51-9dc2-50dbf0a958e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e02667fe-2627-4e51-9dc2-50dbf0a958e0.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 48B
SHA256 0ca9fa4f8141d1bd26c78a2a1a115f2da9c483b70f3e735b7b7beebd4a23cbb6
MD5 dbc4de319a013a1e256c5fdef16777b3
SHA1 c07249754d04079f05ad08244eb61dd8b08670f2
SHA512 653920ff2b39202d048ccc668895a15d2d56a1407992959c91855961c431bee78a089c2703f7e0f350282c1b11b09b508d2525a822131efa7499f872908c73ee
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 e6808c2bdbf787c78b17c392422d9077083a37c15c29bea805e5a361a7dbe56e
MD5 7f5d1274572ef5042eddcd7e75bbea83
SHA1 c1ead464904c0a4448aeb1ac94de9fc8586a70ad
SHA512 5a5e2712ff7f46416da925cfa427a07b85e4a8b38105c9232a14cc6ae2b5de8189217780194054fe0884dbf750706424372874c5c942ac99f5e1340dbc248250
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fb7ab9afadc3944c4524fe09417d9d7836e6765536772e931eb30102351eadf8
MD5 fca2e11019603f4ede1f6d5e03cf05cb
SHA1 c1956e97da4e85dce68ac3458acf7a1c6c67974a
SHA512 4d679017c6963ae20a176f20a72b0ffcaa4d751a26f0d99df79ad0064a99342f34e22940f7b66cfeafe16218dc5d8d6b342e1ce194fa29e2b9128a84cf8d6e6c
SSDEEP 96:KjeX0QeEkxVwFsfIxKn4f+x7WO9IkS60wKVamPOKwQWx:ceX0QeEk7wF0Ia4f+tWO9IkSPw1x
TLSH
T1D6915500357B5601387E2A4981B6866A524239F33058F57B7FBC82F15E6FE041EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abbef681-33c1-4ed3-b616-d9d0e3d154f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abbef681-33c1-4ed3-b616-d9d0e3d154f6.tmp
Size 10KB
SHA256 1290c76e95c4c5925b959a8b2658db5104d04ae627fa60c32aeb48e3a6074a86
MD5 2e4be3110fbaae5637e393df62e8b4d7
SHA1 aa42f56dc71d5bd65fe5c2b62e077ae64348ac6a
SHA512 c2dec1d05b85df0d41166778006fb482c56694b6e9e45a1af8a7b8c75c9a2580247f2222ae9cf203a8ee180041af3da1b909676ff404af18e2bb30c30808ae22
SSDEEP 192:sxZmR1WB/fmsOnIdp05HW6+WNp9aZYgk1gKIg5++J:sxZm6B/fmsOoUHb+ZUH
TLSH
T15622A7516D38B97B8CCBD20DBB25BF53E5F9503255951E48AAFCC61C04E67CE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de96f372-9a77-4708-a6e4-bb72c8b5c9ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\de96f372-9a77-4708-a6e4-bb72c8b5c9ef.tmp
Size 10KB
SHA256 c6551fa1b5de8559e4a3f28e0024c23fa2cfb852555a30896728b0b2a60d85ec
MD5 1d9a8543a2fe8586d708e32fc18dcdd3
SHA1 25c161535dc222cee0cccab10319f552a9e39b74
SHA512 595f816fb85f0c05b3f99cff0acff30f13c3a923a0d2ca3445b4e0d51c2528f45a88d6bccba019d6552d38a666518b706ed26b63395d987a7115ae725554b70e
SSDEEP 192:sxZmR1WB/fmsznIdp05HW6+WNp6ZXYgfngKIg5+MJ:sxZm6B/fmszoUHbuXrh
TLSH
T14E22A6516E38B97B8CCBD20DBB15BF53E6F9513295951E48AAFC861C04E67CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8674da4a-13b0-47a4-a127-6b2884dcb963.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8674da4a-13b0-47a4-a127-6b2884dcb963.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 c175631bdf540edc48a486fe8a36e34279cacc87e8454798aa740c701b3a4a81
MD5 052b3da3e4197438a41c209aa7cace6b
SHA1 5f056cb07f6d6fb03a9d72dc093b80432128a7f6
SHA512 96875b430fc8921e441563c4e09116d431415f9fca84dcc179d0083ce29a7d0c1b3128b10e5f3f7571c6ea1f26cc83638dec78542437250559c5109b14bebc90
SSDEEP 3:MsEllllkEthXllkl2zE/lMYKl:/M/xT02z0Kl
TLSH
T17E44040CFFD03507CD141570D071C3545370F410071357433C5544735CCD7400D04400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54b88e35c557e54da380a78479cf54811a5c0380dc11ae247611992ecaab0422
MD5 820c3235e63c424ea1b26b4d1f9cf0ab
SHA1 31e7917beaa5a63dd388edbbb09d1cf2241c830b
SHA512 85cc29084750e56970ed485faaa2759821d90208d456f7c405faa5669c199a9ab1feedd6364564bdf29b0589681d5d69f397c1d481aaa97583605ac3d021f950
MD5 SHA1 SHA512

Submit Download

a685034e-5e80-4dab-b6e1-e4e10e542c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a685034e-5e80-4dab-b6e1-e4e10e542c04.tmp
Size 392B
SHA256 af2eee24c926b4a1163baadfa802f7b4fe0000bdf7dd188614470eba912e3948
MD5 8cebf40629a9d054143e002e95e5967f
SHA1 b0e114d4686aba3d6b44e06c23e01f43146500ff
SHA512 55f4e6bb4ccdcfd852190d01058bf597a3528904b6edbe31139dc2744a089aae112150e4db2600f99748ca0ff06c948fd82a6a486ec2e0e968d6b441e169ac88
TLSH
T166E00217DB0451FFC03C033065D7152031F744B507F305040900017135033040E34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

a8060acf-5fa4-43fd-8398-d3bdcddc1b98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a8060acf-5fa4-43fd-8398-d3bdcddc1b98.tmp
Size 392B
SHA256 ab6aa83628160783199b9a99c621c84ef6acacc4f4d02a7abfd12743d85e836d
MD5 006c4b26f7ea1aa3cac897d002c1aa26
SHA1 fc8244c12d258f385c5f7448694858dc21a4f930
SHA512 b7c05cd02977a761eea55433e69c759bc403173e76c261d3a8ee8e273ee8d0b4bfcf6c6a4dcef0b5316b3a852afe254ae95ab4db72be1dc6f525bd6ad83aacef
TLSH
T13DE00415DD0451FFC03C033075C71D1035D1441407D105040310015D35113401F34F40
MD5 SHA1 SHA512 TLSH

Submit Download

aedd5e48-8e6f-437a-a869-77557688966f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aedd5e48-8e6f-437a-a869-77557688966f.tmp
Size 26KB
SHA256 2d917b47c13bbd67dca0b71d9f1593530c449eb5aabd1f2df081743a06b1ce61
MD5 5817a5f9f972503ae4210a4f77ed55fb
SHA1 71b6d1a7a4fcd19b258dcfb2d422771ba4588e75
SHA512 7da48428a3c5bf83bc8a423ed3edcb2cb5a6c21dc1ce5c05cf80a5fd77568c2c9ffc0010d22043522ba21e0f7344392097934cb5ac5764d1c1d1eea5d5983571
SSDEEP 384:3iF8QkUSv8MsNV8TUNTUlIlo25nYTBGYX5EOv8bOXaxvaTZcEbtCRIIli:yF8HUwgvydGYuO2eaxvaTZcWCRLs
TLSH
T1CAC21AF288E7983BD9AE5743A73D2D038EBCC117B9845A50F789591CCC8A1BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53d6af37-3f4d-43ae-9727-c3793e080edb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\53d6af37-3f4d-43ae-9727-c3793e080edb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f21b7ef3-56c4-4517-aba3-37e083d255ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f21b7ef3-56c4-4517-aba3-37e083d255ae.tmp
Size 8KB
SHA256 61d1beec4bbc0e31cef0619d1ac4aa136d362749624fd739879413eb7d895676
MD5 32884fe5cd2d81d6ec8bf8136d83b922
SHA1 bf87b6d46e5555698c23f516d17a50aa89cbdb64
SHA512 248ac2584b45963a61a79ab45439504db9e5f00df2c044a1df52df002b98d5778aebbc5a9b43f126f773d1e0b9c0c15a4b6b781f407ab49315d7eb101ef4caa4
SSDEEP 192:JONe6DphXqQmiUyOXBwGYX59ezXCHjzor4RyOX+eZkIIKrq5zU6:JONe61MXBwGYX5EOv8bOXMxU6
TLSH
T145121836A8B8FC7B1DD2A554B44B35139EA8512BEB896F50D6EC2F1C01DF58C130A93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15b8dd937cd181f7aaae87812dabcf4cfa8a74a8529c7aa60bfdc3b89e14b003
MD5 ce6b30053f2c094f4c5a1798d37ade17
SHA1 8c15345e0037a8a4cc069ad71a0354f053e330fb
SHA512 e74e3f8b9ac329ee92624dfeabdaee5da52b47c68c480f3a9332f87510fef51aa54c0618cf4727c298c0d870ac7b42744766f4185fc677d786e33a35e9dd9259
TLSH
T1ED41E758BAFA1148B3B72E9A9BF7A8AD447BB8772E06D59D00110D4F0A37A41C871737
MD5 SHA1 SHA512 TLSH

Submit Download

00b8f0d6-5aa3-4b9d-ab25-b77301147432.tmp

Path C:\Users\Admin\Downloads\00b8f0d6-5aa3-4b9d-ab25-b77301147432.tmp
Size 5KB
SHA256 949c624c86f5aefb78645030a88a109dc63b2a2aff2fbbeca861c36623d92b6c
MD5 6070a989bdd112c1e7a9ad62981d9d11
SHA1 eba5ff5432f7429fc8440dde25e87e9fc62bc386
SHA512 865fdc221d7c4f0b9965559f2a69511255aa2bfb5b5f60bb8cd0902b0931ed4658696ccff20bc044cdddd1f7d437233f43d0cc3a3742bfa84b477f6ff9a62a71
SSDEEP 96:WQlyNXDGmaFlSMTdR2CaCTy2sigwaK4lRsmmYRTNEKuFN:WoyNTGRSMT82sigH1rsmmYR5sFN
TLSH
T12FB17DD998D8182D8E7E58B12501477C1E66AE90AF207C600FC1769BC9FC998E6948D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ROBLOX OC MAP (SFW + NSFW) v1.10.rbxl

Path C:\Users\Admin\Downloads\ROBLOX OC MAP (SFW + NSFW) v1.10.rbxl
Size 2.8MB
SHA256 11ea74d4b97a6d0080ff2870634bf7c29b97b85ecc7ca29b012b1e10653d551d
MD5 d6285c9ce3973ee63da0ef27be7801a2
SHA1 52cd87ef2dcf2d581560a4c59197830b9b85045a
SHA512 54982edec85e67d40ad4dc0e33a84aba1a2197c68772968e7308eefcbd71969130ab085a0746b4b68e334c0b88a1a62d2d7ee1cf0967723c5b21e0719edc37e7
SSDEEP 49152:m/kU2QM1xpneUtkfNZms8y9omaintVUKHjNueS1qF2BlG3VIIwjc0T7gp:3HvTZPAYs/9omjueS1qsnGlIIF0ve
TLSH
T105D501F6F915CB6FC16154B3ECE08A5815062ECA4552A347C2E9B33332BE1B927DE25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads