discordrat | hxxp://kittyyworks[.]com

Resubmissions

07/11/2026, 23:19

261107-3bce9age3910

07/11/2026, 23:16

261107-29lk5ssv8n10

Analysis

user interaction
yes
max time kernel
688s
max time network
685s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kittyyworks.com
Sample261107-3bce9age39

Score

10^/10

discovery discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU2ODYyMjMzODYzMzg5NjA0Ng.G0smdR.akU2ttdBSkoXs0t8TZLemK9dOZAEVyRxl6Ndpc
server_id
1568408459865628814

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Downloads MZ/PE file 2 IoCs

flow	pid	Process
159	4940	msedge.exe
173	1076	EDITMETOLOOKLESSSUS.exe

Executes dropped EXE 4 IoCs

pid	Process
1076	EDITMETOLOOKLESSSUS.exe
4552	EDITMETOLOOKLESSSUS.exe
4964	EDITMETOLOOKLESSSUS.exe
3448	EDITMETOLOOKLESSSUS.exe

Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
142	api.gofile.io
168	discord.com
173	raw.githubusercontent.com
175	discord.com
210	discord.com
233	discord.com
141	api.gofile.io
172	raw.githubusercontent.com
174	discord.com
212	discord.com
209	discord.com
236	discord.com
238	discord.com
144	api.gofile.io
167	discord.com
171	discord.com
234	discord.com
240	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EDITMETOLOOKLESSSUS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EDITMETOLOOKLESSSUS.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{11FCA167-0A3C-4E68-B305-D9B574CCDEF5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	msedge.exe
3036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	EDITMETOLOOKLESSSUS.exe
Token: SeDebugPrivilege	4552	EDITMETOLOOKLESSSUS.exe
Token: SeDebugPrivilege	4964	EDITMETOLOOKLESSSUS.exe
Token: SeDebugPrivilege	3448	EDITMETOLOOKLESSSUS.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 968	3224	msedge.exe	84
PID 3224 wrote to memory of 4940	3224	msedge.exe	85
PID 3224 wrote to memory of 512	3224	msedge.exe	86
PID 3224 wrote to memory of 512	3224	msedge.exe	86
PID 3224 wrote to memory of 512	3224	msedge.exe	86
PID 3224 wrote to memory of 3092	3224	msedge.exe	87
PID 3224 wrote to memory of 3092	3224	msedge.exe	87
PID 3224 wrote to memory of 5056	3224	msedge.exe	89
PID 3224 wrote to memory of 5056	3224	msedge.exe	89
PID 3224 wrote to memory of 5056	3224	msedge.exe	89
PID 3224 wrote to memory of 2708	3224	msedge.exe	90
PID 3224 wrote to memory of 2708	3224	msedge.exe	90
PID 3224 wrote to memory of 2708	3224	msedge.exe	90
PID 3224 wrote to memory of 4860	3224	msedge.exe	91
PID 3224 wrote to memory of 3792	3224	msedge.exe	92
PID 3224 wrote to memory of 4860	3224	msedge.exe	91
PID 3224 wrote to memory of 4860	3224	msedge.exe	91
PID 3224 wrote to memory of 3792	3224	msedge.exe	92
PID 3224 wrote to memory of 3792	3224	msedge.exe	92
PID 3224 wrote to memory of 64	3224	msedge.exe	95
PID 3224 wrote to memory of 64	3224	msedge.exe	95
PID 3224 wrote to memory of 64	3224	msedge.exe	95
PID 3224 wrote to memory of 1392	3224	msedge.exe	97
PID 3224 wrote to memory of 1392	3224	msedge.exe	97
PID 3224 wrote to memory of 1392	3224	msedge.exe	97
PID 3224 wrote to memory of 3556	3224	msedge.exe	98
PID 3224 wrote to memory of 3724	3224	msedge.exe	99
PID 3224 wrote to memory of 3556	3224	msedge.exe	98
PID 3224 wrote to memory of 3724	3224	msedge.exe	99
PID 3224 wrote to memory of 3984	3224	msedge.exe	101
PID 3224 wrote to memory of 924	3224	msedge.exe	107
PID 3224 wrote to memory of 924	3224	msedge.exe	107
PID 3224 wrote to memory of 4324	3224	msedge.exe	110
PID 3224 wrote to memory of 4324	3224	msedge.exe	110
PID 3224 wrote to memory of 4324	3224	msedge.exe	110
PID 3224 wrote to memory of 3180	3224	msedge.exe	111
PID 3224 wrote to memory of 3180	3224	msedge.exe	111
PID 3224 wrote to memory of 3180	3224	msedge.exe	111
PID 3224 wrote to memory of 4136	3224	msedge.exe	113
PID 3224 wrote to memory of 4472	3224	msedge.exe	114
PID 3224 wrote to memory of 4496	3224	msedge.exe	115
PID 3224 wrote to memory of 5008	3224	msedge.exe	116
PID 3224 wrote to memory of 5008	3224	msedge.exe	116
PID 3224 wrote to memory of 5008	3224	msedge.exe	116
PID 3224 wrote to memory of 1568	3224	msedge.exe	117
PID 3224 wrote to memory of 1568	3224	msedge.exe	117
PID 3224 wrote to memory of 2000	3224	msedge.exe	118
PID 3224 wrote to memory of 4956	3224	msedge.exe	119
PID 3224 wrote to memory of 4956	3224	msedge.exe	119
PID 3224 wrote to memory of 1076	3224	msedge.exe	120
PID 3224 wrote to memory of 3400	3224	msedge.exe	123
PID 3224 wrote to memory of 3400	3224	msedge.exe	123
PID 3224 wrote to memory of 3036	3224	msedge.exe	124
PID 3224 wrote to memory of 2708	3224	msedge.exe	125
PID 3224 wrote to memory of 1064	3224	msedge.exe	126
PID 3224 wrote to memory of 2708	3224	msedge.exe	125
PID 3224 wrote to memory of 1064	3224	msedge.exe	126
PID 3224 wrote to memory of 4788	3224	msedge.exe	127
PID 3224 wrote to memory of 4788	3224	msedge.exe	127
PID 3224 wrote to memory of 5056	3224	msedge.exe	131
PID 3224 wrote to memory of 5056	3224	msedge.exe	131
PID 3224 wrote to memory of 2420	3224	msedge.exe	132
PID 3224 wrote to memory of 2420	3224	msedge.exe	132
PID 3224 wrote to memory of 1708	3224	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kittyyworks.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffad3ec188,0x7fffad3ec194,0x7fffad3ec1a0
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,3068936276776127749,12457644665357029798,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3512244140128599963,1474242646047314050,262144 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,6628017233663586323,15245779050337463869,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4200885084665063181,7499822280098612485,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17111925739206039479,14303642474955148155,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,140983296470267354,9316698389475780194,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,585248823083679846,12733106661419423313,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,5161621401667471276,4261674426509787093,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5172,i,8787431173617009337,3553515748559491107,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16632235948070220928,16967266452204775395,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,904268991676405712,12148818867667987185,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17824073598592559239,18132781762454411428,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17824073598592559239,18132781762454411428,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,4415999254764525189,6869702954431925870,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6656,i,15924233754911856062,14434291591763484007,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6344,i,8456588806603638288,5541333513584045041,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,40773783833837626,9648405588286393392,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3884078985650374308,3619630643879819208,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4111605357525788630,15238268507787502387,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6996,i,17244912882216430647,9647015672870085286,2097152 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,7909720185269909652,124573869000712956,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11846191728868230958,9687154023678467956,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,5164515991996051620,409111512830754051,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:4956
- C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe
  "C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,7228064013045086500,14334697198937384436,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,10671692437461426498,10239674727376132881,262144 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,2864843150553059902,10411561235836626824,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,17348415749923950628,5772176496456492028,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5945116934718074846,14402644045396904776,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,4810785623709257123,12958840297939337638,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2868,i,2435498186609786455,5087999681700004480,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,5799075380444439529,10008902970184189965,524288 --field-trial-handle=2276,i,4839607193670102904,3277907707789614854,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4704

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:944

C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe
"C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe
"C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe
"C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32ad1426-5bc1-4041-96af-b09e7c856e0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32ad1426-5bc1-4041-96af-b09e7c856e0c.tmp
Size 26KB
SHA256 d23ff09057a43d183e250054db5fbb23259409dd5a7e4988df460e4110a509b6
MD5 07054d0b307d30506ab51e88b9045975
SHA1 d054ff732f1db4547fe7c3eef0c5bfe27f427fb0
SHA512 acbe26821925fa8e38cec0e4e428df78a63b68c32593f237dfd30da41eb2edd2b597d06c69596444938c75de45b395fe0e17374f634432527be27c5878349d76
SSDEEP 384:bKiFgQkUSvdKsNO8TUNTUlIRHT7un8382p5u8iNLEDqaaX1L9tL8SIIl5:tFIsbwgm838kkqDqaaFBtLLz
TLSH
T160C228F268D7983BE9AE4B13A77D3D028EBCC153F6845A90B788590CCC961BFD206911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34aeea22-1095-4ca5-ac83-84035961d3c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34aeea22-1095-4ca5-ac83-84035961d3c5.tmp
Size 8KB
SHA256 68f6f42977619145f6c7f830e3cdc3000508a18e12066e725901d6dd6a3d5306
MD5 d76de657158e9de2a71ca573b33c7bb9
SHA1 2d146443a59d662709aa209d4c9b6a56c91522ca
SHA512 5006aaff4e441eb558252c0c6e0b58407a56e4f1ee7404d19d7365ddb790f94ac4f1ecfad7eebf25cbb9fb04d99cfa664ccb297dee42fc5f0b35b26c0027865b
SSDEEP 192:+ON36iDrQmiUyjxOZq5u88PNLbethuZ8q9U6:+ON36EkQZq5u8iNLzDU6
TLSH
T18A121B357868BC7B6DE3A864F48736139E65427BD7886F84D5EC2B2C01EF59C130B512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ec0d759-122a-4414-87df-73c65cbb2564.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ec0d759-122a-4414-87df-73c65cbb2564.tmp
Size 8KB
SHA256 1434cf1591e2bd075a0dc81610c7d04c063aa04aa5663c4e52435db39c5ff98d
MD5 5eb4404553c9861e2cedf48dc0fe95a0
SHA1 b8fb6c00a257def86e1a844e057db68257b3bd6c
SHA512 7f250a6e8a7728c8f986ba0274ac50d2841b4bf8b77a27b5b5139d20167cde0b0ebad6ed8e286c0daf18ff23321d26cf3e91562b304722560d22d9865873ff5f
SSDEEP 96:PqONkwQsjpfwDISp5ih/cIPURHl8h4otop5TmDuBfPGxvw45RxmJm78lFOxVeYu2:SONU6iDCQmiUyMOHq5u88PN0Sq4BxsU6
TLSH
T13C02F8387C687CBBADE3AD15B44777179FA4117BE7942F84DAE81A2C01D768C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8713b576-eb88-4ece-bce7-6dd7885dabfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8713b576-eb88-4ece-bce7-6dd7885dabfe.tmp
Size 18KB
SHA256 9906bbb79819ac706e66cb0814217f3523ef688a471dc51740110537e8df1a0a
MD5 472bca64f844295a1c7edefb8abe0819
SHA1 6ebeecd761ec81adce6b84dd94c49814d0b4adb8
SHA512 e87d6b3b27e2b3050a30c6bbffca3dc8128f6a5fe69c66df4f3db98ca91e6ced90ba51fb31eff4742cddb2f9c8774a8ad0bb4492ead84eea1118bd59287b44dc
SSDEEP 384:MQkUSv0sNmOT8Pang82p5u8iNLSDqaaX1L9tL8SIIl5:M00g8kkEDqaaFBtLLz
TLSH
T1F8827C3678786C3B5EB79521F54A3603DFB4C167D3886FC4DAED6B1C01DA298230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

900253f6-be68-4f7d-8774-915562ca3bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\900253f6-be68-4f7d-8774-915562ca3bf6.tmp
Size 18KB
SHA256 965ac0bf643d0ab801a313a090e311f435cbd4558338582cd2d762a73830a222
MD5 b76ba5e635c12dff91d277dd9cda43d1
SHA1 60e924249aad77bb59cd8ae3428883d8bb91ca07
SHA512 9a68a3e27033eac6de6f26ffae8915c196b96ac77f221a7b4eeef6325dabf729c2938eb734c83b9532940a5dbbc8f7275d461913d2a11aef904b75e2636738ca
SSDEEP 384:ToQkUSv4sNmzT8Nnx82p5u8iNLSDqaaX1L9tL8SIIl5:k42x8kkEDqaaFBtLLz
TLSH
T15D827B3678786C3B6DB79521F54A3607DFA4C167D3C81FC4DAED6B1C01DA298230BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

931a95f8-d82b-45d8-8f82-9ce786290d2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\931a95f8-d82b-45d8-8f82-9ce786290d2c.tmp
Size 392B
SHA256 fd2f83c8e219c90006404b1d0f5058c492d50abebf9a492f8d786c2835dd1c85
MD5 0669b8efd0c2b0326e18cd7bae510170
SHA1 98acfd5a1148d8bc6e755dd2d24ef41b3849ae1a
SHA512 6d3ce643bd514c868fd7f1067be3f0b93ac444fb506fb870bec54717169515acb53a9d16d95c4e8599067805c96e929b2132d3cc7265421fd75b49d591ed6982
TLSH
T1BEE002015311457CC05C077080131B2856C1816114F00B65063201961C532001A31F80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

01d9a27d-63bc-47ed-865d-5c09b5324c56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01d9a27d-63bc-47ed-865d-5c09b5324c56.tmp
Size 14KB
SHA256 3f3532dabbc30390691dc8f6e0a826dd4591dd2f5d78c9f33ed30701b67642ef
MD5 6704488578f580e923d4ef23e1e3842a
SHA1 8c4c10625f35278e3cd8213864a9160c0e4f8c6c
SHA512 a3c2e711c3b8f6f94e519d9be78e688419a4d4b598af33121fbfe308180ae8dfc41c72244ca77a8e6509cca9a3d9539c6171add4d84f38c813ea630af7055c8d
SSDEEP 192:sxZQR3nb/fJswuBYq7ddp4YlqDyHW6+WNyQMC8SABIOSOoXYaWF+cIg54j8jHdst:sxZQZb/fJswu5NsyHbE0wt0X+1Ddst
TLSH
T1DE62F752692499779CC7D619BE35BF16EAF95032D8910F5CAAFCC91C04EB7ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c99f475-e3e0-4a16-90cc-37e0025064e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c99f475-e3e0-4a16-90cc-37e0025064e2.tmp
Size 14KB
SHA256 793d1c5b4e106f9d22f151356ee18c2a6f8742d2ef9acb8dfdc798b5790f809d
MD5 f8d541174001f4fd91e706bd68942fca
SHA1 3e8cdf62c547d2887a0820d6364b0f0bf637e89d
SHA512 69141b6dc100979fa6f111ce772f9e6faca671382aba4f41cb8b4a00a43aadc325321cd70087b4acad28f7de41c06625bb2cb865f3a9dc77d2960ce5c9a024b3
SSDEEP 192:sxZQR3nb/fJswJBYq7ddp4YlqTHW6+WNyQMC8SA7XXp4OoXYajFK+cIg54j8jHdW:sxZQZb/fJswJ5N8HbE0SmXG1Ddst
TLSH
T1AC621852692499779CC7D51DBE35BF16EAF9903298910F5CAAFCC91C04EB7ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8927211f-3c18-469b-860a-3aad8ba520cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8927211f-3c18-469b-860a-3aad8ba520cd.tmp
Size 27KB
SHA256 2b13fc805057cdb4fb82d64d1cd074182c744c0f39890effdf74f10da525bee9
MD5 0bd081e787610f903f8006ab018a20f9
SHA1 a353bb5564bf13f13bcbf3ca90c1fa1c588d9ed2
SHA512 f0e0af6af93467d79f84e442554cda2bb2bef0bace8c8ba0b8da7687d89028c5489816bf0a86164ee603236b14d512b72a79bb8acdf8751f27d9e0a032519c77
SSDEEP 768:4hyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3TroUwZeO:4hyQRbrWvvlpZu1jaXKLf33gUwZeO
TLSH
T116C2FA2B640CCB7E5FC01E9DDC6A6F976E9802C7A6588D4047FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96fc2d1b-c686-4857-aa5f-d330a2fff4c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96fc2d1b-c686-4857-aa5f-d330a2fff4c2.tmp
Size 14KB
SHA256 2dd5667fb1f8f0d2c89db1bf18fca30e4a13d619a7f952faa78cdfd270b49954
MD5 991099226630e100113309337205b432
SHA1 6a8136fba7a8ca997473d1dae466a0ff9f2e7dea
SHA512 f292b44367f0df905cb9f20254eb0d58133eb4bb01c6069e75a497441f0ea529e7300c1ef775162649ba2a4a4ab777449dca96dbfe6825dd60c6d882aff4dd6a
SSDEEP 192:sxZQR3nb/fJsw0BYq7ddp4YlqFHW6+WNyQMC8SAlpYAHOoXYaZF+cIg54j8jHdst:sxZQZb/fJsw05NKHbE0TAHXh1Ddst
TLSH
T18462F752692499779CCBD519BE35BF16EAF9503298910F5CAAFCC91C04EB7ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a7b1c28-f6fd-471c-928f-316c19b880f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a7b1c28-f6fd-471c-928f-316c19b880f1.tmp
Size 13KB
SHA256 ca4983695f4e2efccb5eb3e113c91d04894964b37465265f6503cfd26b521d41
MD5 9a14da4900b12ba2f708d23c76505bdb
SHA1 811c6efe8765640c0d301e89fc4de6eabba099c2
SHA512 d014b82e83c34db9f1062d785ba0b95bc6c65c0bb0f502116b9b110ec91420a1bb6e90c0f22e27ecd6a5d8d06ceea1dd28f1b14aa7304055bab148c54eab7cc8
SSDEEP 192:sxZQR3MOb/fJsAnBYqZdpmJ3HW6+WNjYnqOoXYa7K+cIg5Sj8jHdsP/N:sxZQCOb/fJsAn5d6Hbo8X0fDdst
TLSH
T17352F8526E24D9779CC7C619AE35BF12DAF94032D8910F9CAAFCC51C04EB6ED221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c4fc85b-1bbd-41b0-81dc-3a26bc159716.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c4fc85b-1bbd-41b0-81dc-3a26bc159716.tmp
Size 11KB
SHA256 ad69b4e4adfa77b9fe5f2a75065745d9595fab49e9068222b201a66195d2a5df
MD5 c9d60bac134905c71907a25f795aaa29
SHA1 8058da4e9d3505cba4b743695953e31d9d1185c1
SHA512 0829995b027bfa646a51aec0ed8014e7cdbae82626df42ee92863a509b2ce47714b9ea7554c8b5bf32e6a76463a1fdb90a9c9be08527980ce7884cf0eb0dbde9
SSDEEP 192:sxZQR3MOb/fJsXnBYqZdpmJ3HW6+WNjYnqSb1/YaPK+cIgrJ:sxZQCOb/fJsXn5d6Hbod/Y9
TLSH
T1CB32E9126D28693B9CCBD21DBA25BB17E6F9503295D41F98E6FC951C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d23d935-e106-4418-81c2-b45ac3a12759.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d23d935-e106-4418-81c2-b45ac3a12759.tmp
Size 14KB
SHA256 780661474fb0245865410f510581ea23729920412a3379fddfec933dbd0f2315
MD5 f4174744e7ef31fe3e960eb0bc37a96a
SHA1 70d069d5590b1c3c65dec9261e24efcc5fc06ef6
SHA512 dcf815af3485ffdbb20bbb5c5013540dc1a53382a39e3d7b154d49d695460a521fa20e327936f47b9dbebf953c5d9ffacd7f1f73e4cef8fd78f710adb2109e8d
SSDEEP 192:sxZQR3nb/fJswrBYq7ddpmYlq3HW6+WNyQMC8SAYnqOoXYaLu+cIg54j8jHdsP/N:sxZQZb/fJswr5N6HbE078XQ1Ddst
TLSH
T128620952692499779CCBD519BE35BF16EAF95032D8910F5CAAFCC91C04EB7ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 bbbaf674e1aea7aff40ee37e0743bdb0a1c97f3668ae2ed22ebbce1e1021ee1a
MD5 0c09742aa3484d6c98db01b650ecf266
SHA1 0dbf261c88feb04ddf747770e0f654385af9521d
SHA512 664ea3db5a68c5c48e6f44abaa8e932e2b00a0a332671b5ab3ab134dd69b8bae8b754cd18d5a7ee0f6500b16efc03e84dfbb1ca4cc7e62c2da5341d7900fd08b
TLSH
T1A7E020C504CDC31DB144648711DC534CC6C5361F93C56A8D5708CCDEB041C8C62D5970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a0e4120e089775f6cf574e75eec17a0d00b88f584ce4a355244dedcbe29402ca
MD5 17d36ca9efb9a4c9dc41a10d19e499ef
SHA1 86752d5b40b043bf2ef1e8d67f9ddd15f48c04d8
SHA512 2a5d6dc04ed7c8d0ef23b85013603270506fc21be3c54b0897adcba0d248d4e2744615fd135c8731f30357e3f2561597d86ded3c52ab6a5388d29ed8015e3230
TLSH
T1CEE020C605DDC31D7145654F22FC470C81C1362FD3C0A9CDA704C448B846490E2F7B70
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e0cf0238ad0e697341da393a41d0857cec1f05fef43db97d142d15e3624ee211
MD5 89352109d4d9cd3246c67c6376dfd8e0
SHA1 e4bae7486f08a30339ade64dc13bfee9ca6b986d
SHA512 7a325be7eb6836382bbbea995fc3660d8faee82146b87a3cd3736ccd12b86712268f6b1df7ddd134afbe2abfd53734e6b023dfe8489a30bb86144273cc817412
TLSH
T1A0E04F9506EAC36EA208648711A8435CC6E2372F97C46D9E2708C889F581588A6E6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 123KB
SHA256 cdab7f07ae266539590d37b709fede21c78e3a96a14908c8075a84480eac6f39
MD5 323674ec2afee723746a1e2b98e90e19
SHA1 d3dd4db65bc17507268004c6ebd15d6ddd752081
SHA512 999b7d080d5965758c424676953b5a31bd1ea22003379e71f8c0bc29402f0e35831869ca254eaaec20a803a2198ebbd981c250af2b7d041cdea0a394956cdd0d
SSDEEP 3072:PKDPFQeuZ4VFtZm3Q7MrmMFISiQgtPg0unAh+hPYnktJ0c7:PIPieuZ4VrgA7MrmGIwyj3hcWI0k
TLSH
T148C312BDF49325B0AB1F406ED688A451BDFE3CFC938676BACFC85B4D645219A04B4843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 24KB
SHA256 7e170ea7f2ac873c595b9f72cf35b8c15af17b5bfd3488b101bb5aca034d07cf
MD5 85cec2f36640165630285fcfde07831a
SHA1 680a959b7128688ec8201e5af72ab129474f7b4d
SHA512 74167696ce9516f43be0bc2a75524910e3193ae47ff75ffc339c33eb68594c09873099966a22701ec66978b5e7cfc372e257065387c0619860acfaab0da53170
SSDEEP 768:n/FWnQ1G+lImP9UJSz5TeKFMI6Nc+n820:qQ13IuSJSzFeKtU820
TLSH
T1F0B2E1346D581B27F1D251B57AE48EE8E1A31A05B4521E653F8E02002EC13EFE2E64DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 102KB
SHA256 b3872b22bbd31a251930d167d0a58d2e7caa8f81e6d9dcd636b01ac4f2ac8982
MD5 226c9c614d3cb21262ce545da7f7fdd5
SHA1 b9d89307d468aa84d23a67b94549e02a657c379c
SHA512 e6dc257f0a0ac0c9c33836729d79300bd6290edb6cef9864240aa6c7aa468e48b2be1aac0dfb466b21df5515689f125cd06516a50966292d3ea03226de771cba
SSDEEP 3072:67SvKCy+OUdKhsh2Yx/A5g/cEaqUBgCkRd:SSvKoO8KhepiEyZ6Rd
TLSH
T12AA31298BD47B9EE2402744D30211265B207D92F1DBC05F24EF790D61AA9956EAFFC2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 253KB
SHA256 ee2f4679eb39d821fecee18692b8211a759938dac6389294a4186ebf35c510f5
MD5 c9ed4a93ba640aae1a2dd8aec390c4d6
SHA1 14861b55e187e5b23c1c65daa8d5937e2e3ecae7
SHA512 cea767e385e0f2596855cd3fafb8d4bc1f7f6e1e0b52e903ea13f33c7a345037c496d16bf816e507ea3a372119a8dc512c78b6a93ed9f9718bf6a4615e96b50d
SSDEEP 6144:Yay31lUTjUFz7qlmB95aWB7wZYqKq+uWqwTQvtwSgUq2Z35:Yd31lUTUel0zWdJz2QJvt35
TLSH
T19844232C1ED4EBE41768AFC4FC2DBF64E711C530E1E6269AB5C704A58ED3E063A52079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 16KB
SHA256 b4e56c7dc88878968d4583f86276c0fc4414b65e7ddb06f04e9cce66d008d33a
MD5 42efaa5a1430874abb5bacb64d377871
SHA1 899ce66de8ab7934835bd88593a0ff9a5905bfeb
SHA512 086a94192163b3bd3864be68859b934dbb05223491a88a322222e317144bcf2f7f215dfb8f8498227a2b53526c709655cf1f0553a7227aeca70cf2a039fca009
SSDEEP 384:N5bQTsXQI5KUAJerquGkiaK0JiKFYEUm54DJ9P3Zgl8:rbLXQXU8erYkiEJiKCrmCPpi8
TLSH
T19972D1FB1F35CE24BD338125601BBEBCB058398B944AA49B7BC20195E7532126E97771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 36KB
SHA256 3ceb939a9120d5feb53077a292141c2fabce06832bda8a9226bb56a125257b64
MD5 5977d91d264b3b9b2d7675ba50b82a90
SHA1 6232c56131e6bd27150177edf44b3e1a80960459
SHA512 a7dc50a0a22dc272bf0f493e828d36b0aaa3c9f125dc72512c1ca2425c41fe1ad114b9d0a9c7280f08bd5f7c96ace37ea10a9cba1347fcc4877f598b9e6c589d
SSDEEP 768:DbWmAN5NU44v73EKTK/TuECtAUynjS3Rn+X1q9ZFE1ekQTrtTB3t:DiFUBYKCuECthMjw21q5P1tl3t
TLSH
T124F202B5777D14F64E3E0D68E9FCF8281598C6067BD35B8780CA281C2A12F819DA91F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 40KB
SHA256 0e816113b559bd68f44aec6132a96c272232d85dd7f6f8894fd031912bebbdfa
MD5 c9c05738ba8134a9f981133da69d5998
SHA1 d5e87d399d56e15d993da456360e15d9a6c061a1
SHA512 936d2d2099e941877518731d5d646ba6b3137f8e3707aa25f6c31e32cf67e38d95b9e9931802b4c0ea8bed504b97b7a2a962f100ba8c4376a4afb40784f2c0a6
SSDEEP 768:ohhnd+fnNS27k+/YYvTkAF5w6b3Y+ip90OC8CChFYmgl1FXHUiBX:whnAfNS2Y+d5F5bIlvpvF9o1F3bx
TLSH
T1E61302231E07E09D6344B9F0672C0618E1C25A8A41E4BBFCDFA097AF6B260677C5756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 65fa15231d62e87dc960939ebb2e619061cbf33b6212a1fe1ddc590b08fb2bcf
MD5 a78d741e3f1f57ed99d91101b21f1ee7
SHA1 c42c292c4182ac86e975fc85055b0a115fe218d6
SHA512 32eceb0353a3bdf2ae376a538bd721a7a20168233a67b882136b08f00b9c0371961c9436c7c28c4c75bc58e5221a35f01c9951ccba116ac12ce7fbe7eb6f3792
SSDEEP 96:i1TyS0e0ECnB4pzrCWZCBJR8wLBVL6B49BvceFBp:i1TUe0TnOHZ6fVL6kvlFBp
TLSH
T17BD1FCC451ED1E8AFF58C038C2E13A7A3234986586A39F7E7089F8B63C523445ED8858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aabc30dddadee48d2ddeb34fb568445499e42aad89eba15e04edc01c2d474a2c
MD5 ba4e5d59b8eb3e93f7234a636fddfe36
SHA1 4e52c59f962ac7fc3d9dff474ca2374a13be4454
SHA512 780bc8e2796f99bae42ae9f5d5d4e4e7ab46fc6c8f29576a6570177820d3f9b4d3e85233e0d46b36f0bc3795631439c93bd4f09a330d526e4d5f2656e3b33c37
TLSH
T15E61E84581A00F5BFF98003892F672BF3674A88288C3DD6E30A9F8795D5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

8f3defa1-8580-4e49-bf36-e31bd499ea70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8f3defa1-8580-4e49-bf36-e31bd499ea70.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0f556900-5d57-46dc-a1f0-9811069931c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0f556900-5d57-46dc-a1f0-9811069931c9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

4fb60bf2-0cbe-4b84-80c9-9b42985367c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4fb60bf2-0cbe-4b84-80c9-9b42985367c1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b41e9489-5c1e-4a95-816e-a38052e68f39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b41e9489-5c1e-4a95-816e-a38052e68f39.tmp
Size 3KB
SHA256 51e4e3b95e16d0ad1806ce5225eadc72a7c0e6e61cc93aa8303132b257fdce33
MD5 1e53ea992a7baddcb4b242adf379d988
SHA1 deeb5578cab8b0557026b39c405c613e541ad776
SHA512 4cd49b5eafd662fe06b79bf7df7779d6d900fc2586c228ae85e4e7d3bcaaa1bab0bac72fcd3df39a84625973c6b8444046b3d23129f90daec26dd6ad295f2620
TLSH
T1A6818BF383F6862DDD1191F09E146F1FCE180456436C396A85D46F1BA3F28A1E151B8F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 816B
SHA256 1edbabdff4bdfa086399691b02896e13534877bfcd428a9e6446bb3c1c02bca1
MD5 c153cdac927df60a4838ccf258f60af3
SHA1 47f312478e51f93ea38c5089ed621e6166b0b1d1
SHA512 1a96c93515f8263700f17f0e6b682bac5a4ef300596c407fac8d949ab3d6cb3d56d6964557f691afc4a279e35acff071779fef1192f7ba23c2bf534cae760d43
TLSH
T1220147D52E134A5BFD600335603E945862B401CC13017B4FA3BFE1278C93F00BE01AB8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 816B
SHA256 bac007216592e088f8100d277f5b450074e277ffa43fbbb30f0921fd937faf3f
MD5 517eaa2bcbd67be4adc1b1f206ffa373
SHA1 25729db04027df8539df2c354617e377a050d003
SHA512 f586fe28aacc8d9aa5dc912e20ab1b480408c1baf064afea809a670f9b60593671061daebd93161e3d4bdeb80de2d211935bc80f2defea40866bb84df799c5f7
TLSH
T17F0126E50253CF46FC440371D96D9555617541445350778FE3EB6156CC92B806E43FF4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4063db0a-222f-4758-b526-35797ab11dab\index-dir\temp-index
Size 2KB
SHA256 9b0de1ceb82a9ef4eb52eefe1250ef3862da96a0c3f927fb006a2f72cddf0fe2
MD5 b6584a28a489365ff9b4473ea887f41f
SHA1 4573ce2de288262ad27aedeb9e20fe171c763299
SHA512 073a7ba5edc58a8b3698c07cfb3a3e613bd34445c218bbff1b023e00ff603e47b15a160111a5838190c682baa840d9384a5c28fcdf8f04f35042fb353c499510
TLSH
T17B51FA4E4C035719C9BC12B139B644843B3D3CCD9A8C095764FC9138B9836E91D6E6AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4063db0a-222f-4758-b526-35797ab11dab\index-dir\the-real-index
Size 48B
SHA256 f24c2d0b21cc2202930e818dcb98159d8d18e65a40dde7d5ed2fb7e87cfa8624
MD5 9081d6d78d4f2d5d03944acd7cc4e9ac
SHA1 f335cebdb8f3cbfdb3bf36cbfff6e07677b4cf59
SHA512 27361210e11ef85279fb70b339f5333659bdd3dc05766e5ce360730b5f2c03d193804e1ce5fbea20eeb590906f2ed14756b9a0fd176e593abe44a3b589cb9af1
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 5e96c3f32a07ccae83b550f2e9c735290b9a3212199d2371f05ed6960f5ddb0a
MD5 903a62fc57c192b31046ea36b7a84b11
SHA1 d23a69a0b2427ed8e7c9378611e457f768b002b5
SHA512 1332c630a4f375cf9db482500ca46c40db5892a8fc6142e19e16d4f99db893f7c3b0f790e31e356d6a833237ad26db05391d516a060cef80c4f86b01eba46731
TLSH
T1DBF05C773EF32411E9AF93E2593104EA014ABC148D44FC5F515BB3D714B13552639CB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 484B
SHA256 b31e9f728f7b64e63c219f110fc31a4fd3bfa7ec5ae8383495854b72b9621748
MD5 6564a08c6a1deb42b576eb6f15a22bd2
SHA1 0a273a01440065c9a1b251e42edaf80f1fe92207
SHA512 eda055feb1d3fcf95b307788a51e422877b326f2a6e00a63e8e677e32d7b25625cadc5f348cafd4a5628d4ad07c6cc01dd5a980256f5d4a13139de0e2578bcc7
TLSH
T1F4F05C773EE33811ECBFA3E5193044A60146B9188958FD5F502B93D704B13552466CF2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 092ec133c3fcefbc9e521c7f2def594ddbe627d2c0d134c217e28f0b865ed396
MD5 e8e465201d3282501c9dc3beeddaf7cb
SHA1 70be59470e01703d4414e241274f2131b437be89
SHA512 ff5bd472f0d26fe0e14545455a227fd97a335333d84d2d8c3fc63463db27a24e231c3994cd57e9789dafa67aaba823894298b8bb1fa964450830b5b59a4e5fce
TLSH
T1ADA002110154005DD4041274B4474FB7621088681605A33182F4E15CCCA13D0476250C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 68dd751f77523480485ea697155906294fb30e6d2f78b4a1bf53457a94e46234
MD5 cfd5d2939d446b621eb7ff1a08e790e3
SHA1 79d7e080303089dbb9ea043461e03de879f4aaa4
SHA512 51788f83f5e870583fd754165630f222aa09e2d6de9958540c022fccde58e08242690c9548054f81964f4e60a63b27183c93c0e0de2dbfb32695054239447eb7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0ae797c525c241eaaa84d9a1a06fcc4a959361d53d9e61a4f4caa62213d15d2
MD5 eb12384a78191963681ba7cbcffcd627
SHA1 d7f30c64ed9efbf5936752c9427f4be69ab50dc1
SHA512 b3018759c72c61c777f0f96d236dc17b5e2d2ef1f8bd324e3875ac39955d2d93df59156e6d275f8c6160cf205829a7bb34cbf91092cc063d7de7a3e466b927ab
SSDEEP 96:KkyAKvqe2d+F6RlLzD2NzI9Dl2K7TDn2X9FA3FnWp+tpX3XKNf85D5KK7/DB:+DHF6RlLzD8zIllVTDnY9FA3FnWp+tp1
TLSH
T15E91555531BF0211397F255550B8892A869135F33218F96F7FAC88638E6BE580CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab977b51-973f-4f17-856a-64c0b0a7d1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab977b51-973f-4f17-856a-64c0b0a7d1ba.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 1e672ad0028510d8819a0d54fc840b4435fdc951315250f512d45df94082694a
MD5 f69619620eca678cc9f4e4217bf3d4ab
SHA1 7406de4cda84c58d96e7768f482df6817711a3b4
SHA512 ffadc3c0096b86f50adb0e95b1c902cab5e6feb797baeeea3b5679667de4696114b9e9a589de7b766c48c2e39c00d0c23fd6c02b22cf30c1035568ce9e9699a5
TLSH
T16B11FFC1A2DE11957F8AB981812E540398B12BA7130D6CB9632DD8F58F48C284A7FD75
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 aaf17b36223527ebcccfba6548f814b220d42cbcd53f8de2d2b1eb2b801c9e9e
MD5 a4ee1ea1d613046646e4a5fc4719fc1c
SHA1 d3b18c1b2fa83551b444dd6f621edbcd4275a0ef
SHA512 c66eaeda4ddd75d9f90669f5a3ff83a9397318b97655a38ae10c1da8ccc8d97bc3c90cdc2acef0efe40789aad4684adfdbbe435bf12779057cf73da72d0049d3
TLSH
T16621FFC1A2DE11957F8AB981812E540398B12BA7130D6CB9632DD8F58F48C284A7FD75
MD5 SHA1 SHA512 TLSH

Submit Download

d326817d-cce1-443d-a25f-74dcbc625d84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d326817d-cce1-443d-a25f-74dcbc625d84.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 840075945ba145f8e6c2aff083d644441fb5a369b9ed7bebb22181a0533fcfb2
MD5 e8db750ceb699ae50167574a66caeb3f
SHA1 0f0d17604c1b95ad532b977a1d32ea734f3e3656
SHA512 93378b059b766d64c919fdbe4465ee3380ad44e45722c47a8052c58b58bf786bafcf3d1b50f20bc6f769b0d573552cb45da12cf75f224acd6d68fdc799b248c0
SSDEEP 384:bKiFzQkUSvdLsNm8TUNTUlIlzT8Nn8382p5u8iNLzDqaaX1L9tL8SIIl5:tFdR3wge838kklDqaaFBtLLz
TLSH
T13FC229F268D7983BEDAE4B13A73D2D02CEBCC157F6845A90B788591CCC961BFD206911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d7fedb546bc241d946120c0381a141ad3d4923b91adb40eb0a8c3c8731f4df47
MD5 48abae8055371a7975f7f3f48adcf395
SHA1 62a8e57699b2794ae1bb9a084addd18a7c919cb8
SHA512 20f131d3f56492324040240c5993d06f461209237a10061d943ffab62174900821390e271ac77ef9111775e53557fd8ca5ecc6f7b735d4c2260a1667f157c8bb
MD5 SHA1 SHA512

Submit Download

b8527466-2546-4693-8d18-5f288d2ec820.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8527466-2546-4693-8d18-5f288d2ec820.tmp
Size 392B
SHA256 1d138d7334e4047cbb007d8d9fb6b708fab797bb8e4ae1a114e83647b66e249b
MD5 88a957e1fd20c40dfb673f0d7e25c751
SHA1 237657a7d21eaa93fa14e7e077f5b91df5914a1e
SHA512 30a41d2dd6b7bb6ecf6c1767d8629e46d202b7326ba12d4a6d1ed2f81959f631118a559c450a525dd566b6384e9de59bf9a6c04fd19f34b9e57e9266629d6638
TLSH
T12DE00202D31145FDC05C077080131B285AC2417114F00A650B32019638633002E31F80
MD5 SHA1 SHA512 TLSH

Submit Download

dde099a2-5008-47b9-8e59-d456754c995b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dde099a2-5008-47b9-8e59-d456754c995b.tmp
Size 26KB
SHA256 1b4926cf8668f0fe9fc978ee22d7329d408d92db3f44d70c6fa54cffefd512eb
MD5 9d50cf1503033c19f2c2be1fe7d466ee
SHA1 3f1793a664c1d64d6858d8dc6b9eb64ff58139f9
SHA512 cc56d80e0bdd176013829b99a2a68571184dee902944b831eb05a01a50f456054bf86769035b969e9c1bb8863d70b7f5513d82f26161b4e3aecc0bc4c6ab2c8a
SSDEEP 384:bKiFsQkUSvd+sNO8TUNTUlIRHT7un8382p5u8iNLEDqaaX1L9tL8SIIl5:tFsUbwgm838kkqDqaaFBtLLz
TLSH
T190C228F268D7983BE9AE4B13A73D3D02CEBCC153F6845A90B788590CCD961BFD206911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d5e0534-112b-467a-b13d-f3f472f1d598.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2d5e0534-112b-467a-b13d-f3f472f1d598.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2f6f7b8006d206879ae95ff2083c111b2bcde921ce076c161dc3eabd6dd6adc
MD5 2901f68002ecc288a15fb7259aa5d485
SHA1 8ed4a1a442bbdea2e56e88b74507e79908955e86
SHA512 371c66a2cb447d0a62fdcb5aa287d8a7b51e8d923c0c794d136c449f8d27522faf539965f22bf10df5a1db611d37a0b3b403f751e4ea0499aacc00d29fd96953
TLSH
T16B415B99B6EE1148B3B36F1A9BF3A46D847BB8332F46D15E00110D4F0A23B41C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

1332a224-2d81-40fe-a918-13b9af7246fe.tmp

Path C:\Users\Admin\Downloads\1332a224-2d81-40fe-a918-13b9af7246fe.tmp
Size 15KB
SHA256 c48b71160401accb97157981aa4e5c6beb7018806ba3a4efc45028055d3b74c4
MD5 bbb2cdf9362d483326f80790a327602a
SHA1 c67fa06254b2a6d0e934d8e036adab08549b069e
SHA512 6d8b95e15ffe51a8ffbe07ee7bbcc46a9757cffad9fb726853da354c044c6e0b6b0f0a3e388cd4fbede84ac39a658de522b73b9cd618f097ae6aa670b5c36646
SSDEEP 384:uaKnHmjhiUNzEsv16uf/Kw1MmtRrlu88GN:gGjtzEkl/iWlu3GN
TLSH
T1F6620ED92B6D8D13EBAF9EFD9061125743715A2BA122F2894CCDD1E121D7361A80CBCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EDITMETOLOOKLESSSUS.exe.crdownload

Path C:\Users\Admin\Downloads\EDITMETOLOOKLESSSUS.exe.crdownload
Size 78KB
SHA256 d065324752a067d86b87f0d0e86dbb0a34878e1ae2175c3045458e0b4def39b5
MD5 a7df48df5f592c87448346aca9124f19
SHA1 a421dc493d95fa66d1a310d3c9a4c47ef4514263
SHA512 518292f007b21add6cee39fb992a8dcbd20a12ba5e6c351ecba7ae85d6d229db3806b7c5b5bf7983ff7ead7a94df5f7223ec92fd9e4cf0b4e873a644b3ba1b91
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC
TLSH
T19B73C8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-915-0x00000154E70B0000-0x00000154E75D8000-memory.dmp

Download

memory/1076-910-0x00000154CC2E0000-0x00000154CC2F8000-memory.dmp

Download

memory/1076-951-0x00000154E6720000-0x00000154E672E000-memory.dmp

Download

memory/1076-911-0x00000154E68B0000-0x00000154E6A72000-memory.dmp

Download