hxxps://github[.]com/Endermanch/MalwareDatabase/tree/master/rogues

Analysis

max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Endermanch/MalwareDatabase/tree/master/rogues
Sample261107-jbjpsaav4y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3408	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{ECA85AC4-02E1-41D4-B80F-659CE757D55D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3312	4608	msedge.exe	83
PID 4608 wrote to memory of 3408	4608	msedge.exe	85
PID 4608 wrote to memory of 2512	4608	msedge.exe	86
PID 4608 wrote to memory of 2512	4608	msedge.exe	86
PID 4608 wrote to memory of 2512	4608	msedge.exe	86
PID 4608 wrote to memory of 2408	4608	msedge.exe	87
PID 4608 wrote to memory of 2408	4608	msedge.exe	87
PID 4608 wrote to memory of 2888	4608	msedge.exe	88
PID 4608 wrote to memory of 776	4608	msedge.exe	89
PID 4608 wrote to memory of 2888	4608	msedge.exe	88
PID 4608 wrote to memory of 2888	4608	msedge.exe	88
PID 4608 wrote to memory of 776	4608	msedge.exe	89
PID 4608 wrote to memory of 776	4608	msedge.exe	89
PID 4608 wrote to memory of 400	4608	msedge.exe	97
PID 4608 wrote to memory of 3804	4608	msedge.exe	98
PID 4608 wrote to memory of 400	4608	msedge.exe	97
PID 4608 wrote to memory of 3804	4608	msedge.exe	98
PID 4608 wrote to memory of 6044	4608	msedge.exe	100
PID 4608 wrote to memory of 612	4608	msedge.exe	107
PID 4608 wrote to memory of 4596	4608	msedge.exe	108
PID 4608 wrote to memory of 4936	4608	msedge.exe	109
PID 4608 wrote to memory of 4088	4608	msedge.exe	110
PID 4608 wrote to memory of 4088	4608	msedge.exe	110
PID 4608 wrote to memory of 1980	4608	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase/tree/master/rogues
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff8451dc188,0x7ff8451dc194,0x7ff8451dc1a0
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8011365357167615616,3806539188418807960,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3712621326621854111,9012818946905263480,262144 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,16120087589318948060,17793868414080028355,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,11406415692495666394,8680052384195646315,2097152 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15328111754505314430,15821054225807550527,2097152 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,8338899059305438607,886298600186175112,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,11911771870799075124,9616011310596317812,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12365889415923603926,2698042674436657494,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12365889415923603926,2698042674436657494,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13840551817978003237,10075408632913481245,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,8080193882550376907,1536266829564951859,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10657923804321977434,13406370930042470046,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3756607042894499218,15359269107329120626,524288 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5068,i,6929204360470902091,14871029882085781097,262144 --field-trial-handle=2608,i,7381764364646442886,17022283237199615547,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01423d1a-f92b-4825-a548-79c182764084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\01423d1a-f92b-4825-a548-79c182764084.tmp
Size 26KB
SHA256 4161e23082ad1352150afe2ca27df623adcddb94e93715bcce83b5d807a78b45
MD5 62a6b48ff7a5a4d536269528e5b0197d
SHA1 e56652ec7e0d06b732a689be734dd76f454368c1
SHA512 bf9fcc536c90554d6a2fc67b4aa8ea0fb07c4b5a9bda7979ce8b5aca1519fa8b05821f0a761373356aa03663b4bd6fa8f2d98364107edb40c1086b60ae39e2e3
SSDEEP 384:nPiFzQkUSvsF3sNK8TUNTUlI4kxjh+WwOuthf15xCl8qH7vBEn0+gL/7IzfIIlw:aFd63lwgZUB/ClrH75E02La
TLSH
T1F1C24A32EC94DABBADE74F95A34A3647EEE08163C99C5AD8D9C91D1D00CB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f5ea981-e657-480f-bc38-c93bd8cd5dcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f5ea981-e657-480f-bc38-c93bd8cd5dcc.tmp
Size 25KB
SHA256 849f015bba385e4e50c9fcc49e3290a3b250665c322682219864975d0ad77412
MD5 756d036a1770925a2d93a98eb35202a1
SHA1 d18ead14f54c945e16cb14c8f407ec6c9f5cc9d2
SHA512 ad9b528985d28a15311e2aa29b836963087265f2ee7e1a739786674a47dcb80fc066294783221e78782fac7b40df8dde863d8f8cbe15204f0d687693cea5bee6
SSDEEP 384:nJiFiZcI63sNK8TUNTUlImkrjh+mgAthf15xR897O6R2FeoNQgL/7Izho0:gFQ63hwg5wA/Ro7TRRn
TLSH
T1D7B24A31DC98D9BBEDFA8F99AB4A7A17EEF00163859C99C8D5D81D1D008759D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46653877-1b60-4493-958a-9b1ad0ffa207.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46653877-1b60-4493-958a-9b1ad0ffa207.tmp
Size 26KB
SHA256 4b9eeebcb1e22f5d33fd5906731e9102584e2b25d3b87bd82b66dfa31fa9acbb
MD5 aaae771a6005987507ceb1132750e527
SHA1 c9b2074e3e1ae6fd936010848b729ca2ad72df9b
SHA512 c7d2ae5ed2c4907265fd6e97f8b8864d86125dec5f4c96a5fea99552f757c37dff09d1c68f3de327f3fe55b63987c4955b950712dbd6b499b439d74c37f18f59
SSDEEP 384:ntiFiZcI63sNG8TUNTUlImkrjh+mhgthf15xCX8q7O6R2FeoNQgL/7Izho0:kFQ631wg5lg/CXr7TRRn
TLSH
T12BC25B72EC98D9BBFCEA8ED5A74A7607DEF04163CA8C9AC4D5D82D1D009B59D030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87f5f485-5323-4dbd-acf3-6361a4639028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87f5f485-5323-4dbd-acf3-6361a4639028.tmp
Size 31KB
SHA256 016db43e81abffdc39e46f17021db02122658bf84118666c94cdf37bb39b5cb1
MD5 918c6142aba601e908eb8181ee8b565c
SHA1 a0260ea60de599130bb49b8193fc4ca722ddcdcb
SHA512 f3740eb0d9dd8952d06efd3709f382dfd99c059206b8e164bfbe4f9a982881539b12955dd77daa585215f5c012adf69469ace987618e1da81b97df8e005cfc08
SSDEEP 384:nwiFzQkUSv21F3sNK8TUNTUlI4kxjh+x7Outhf15xCp8qH7vBEn0+gL/7IzfIIlw:LFdM3lwgZoB/CprH75E02La
TLSH
T19CE2B2F298D79977E9EE4B87A33D2D0299BCC113B9885984B7C81D1CCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27341f426aa0efd6c484bc21b43d92cf90ca72c2333c8e492f256c83fd880a23
MD5 5e7e3b8030681bdf6022439fe49f75f8
SHA1 0ff916bc55fa603e71947fca76af181bf6a176af
SHA512 f028e8f02a0deeb001818c82b1b058d78b877b08dfffccd53e7636c6b399cea4a3f75d2e7d48b81a7bd267b29da417e86f7b980e8764b264d26bc3942cb86bac
TLSH
T192D02BA49AC8C8C0C84120361358420831C8D23448A3404244E00254CED126216A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

0447369c-5ef0-47a0-9f88-2533d4ac0168.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0447369c-5ef0-47a0-9f88-2533d4ac0168.tmp
Size 12KB
SHA256 cf4b0e9b58c35d1e3e4db6141d67065607c56fa20caf2dfc03691119abc7adde
MD5 156374af68591c44ed98ad88175928b3
SHA1 4c9925fa0c617226d4567398a5ebe78e2a867d10
SHA512 c4165cbe304ed0a1a5434f5ae2c33a6d597bbedc67e74639487db8f666f1994b839f82e42e71317acdb20962bed660765d95d4de6daf1f79ff3aedbfdad354b6
SSDEEP 192:sxZFRYkk/fxsKvXQLzodpvsEYHW6+WNY2U/YC3yEilLveIgj+J:sxZFZk/fxsKvXZ9YHbC/4cjK
TLSH
T1ED42D8565D28A87F9CC7D21ABA55BF53E3F9503294C01E48EBFD8A1C14E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23199414-3690-40a3-9dfa-e37b66a12ae4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23199414-3690-40a3-9dfa-e37b66a12ae4.tmp
Size 12KB
SHA256 f0000855a886894ad20b04317464f97dbb361710812ae99a691ec5cbc5ac2441
MD5 49a13b41569faf8cccb5c747373fab36
SHA1 114abddf22c93802672c83798cc04ef35da3bba2
SHA512 7cdeed76f49da5d86ee46693e9d3f4d12620bf026d3955d46e50e32a427c9a4e5d1dd44aef450b0626712cee0b7ac1f79ad00c74c5e28f5f386a07a7c92b1805
SSDEEP 192:sxZFRYkk/fxsPvXQLzodpvsEYHW6+WNY2U/YC3yEilLveIg5/+J:sxZFZk/fxsPvXZ9YHbC/4cBK
TLSH
T1D152E7565D28A87B9CC7D21ABA55BF57E3F9503294C01E48EAFC8A1C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dd1ffe9-106b-418e-9187-41bbcaed9538.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dd1ffe9-106b-418e-9187-41bbcaed9538.tmp
Size 27KB
SHA256 d13fe99a73ba75fa1d443f1e6be9e39c6546b620562039b35d66d9769fa83419
MD5 dc5907c3ed19db2269ae1de9e987d2c8
SHA1 b6c8ddf5ffac8bdcd8b60d6d25aff2e39f43402f
SHA512 5b570bd05ef0580abeb132ec1bbb0e96bdbfaf868405ef32b252d5422736c6ce2294593765ee00a63b05e95d91df1a28e5e513a20b9e5bab9e19d422b6561b86
SSDEEP 768:d8+S3v9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcwLle4ZvWrohMYd2:d8+S3v9WvhLvbu1japwLQ8vtKf
TLSH
T1B7C2E82F380CCB7E5FC01E9D9C5A6F9A6D9802C7A6588D4047FE994C03C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e550901-2d1d-4c30-9a01-54712f51fb57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e550901-2d1d-4c30-9a01-54712f51fb57.tmp
Size 12KB
SHA256 bf90f242adf3418848f4280d1da194ec395ba21a9e5371f2dab0e05ad47834ba
MD5 b1adba59e2068b5ce93eb9bfbaed6f35
SHA1 384858d015b7f7a932546c63e4c1900917f6ab42
SHA512 1640e32cafb2edabd7274808da324266da37df0f5b378f18f66838f632c4d95982759c2a017bd301fca9c4f7d8da5b3a77cdfc7a50fffa2918229a492727dc9c
SSDEEP 192:sxZFRYkk/fxsPQXQLzodpvsEYHW6+WNY2U/YC32EilLveIg5/+J:sxZFZk/fxsPQXZ9YHbC/0cBK
TLSH
T10D52F7565D28A87F9CC7D21ABB55BF57E3F9503294C01E48EAFD8A1C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 ca791c1561706404e52f41086d3639dddeb5c62e0bf98b89ec320e989d322a4a
MD5 b424bebd0afb4e81d40b30d1a7ea9e84
SHA1 6ded7f2479df73cec3c4edac7c0d4f437922e861
SHA512 f05b72c614c321441f451acb0a955cc4032ddf63752f896d5469c94306a802e6886c8ea25a6b1066c8e3d4191a5cb3b5307752d9bca8c87b0f6d78b1c50ffaef
SSDEEP 48:GojPpB+jOPe6V5wRtDsJ2ji/4U953ULJQBU7j/V7NmoQC4eD18u/zHTX0s6w:Gwhkq1wzogTU/kL7d7NmoQXO/zHTX0w
TLSH
T19CA11B15B5BE6C54E74EC07C88F0248E7A305EC250EBDFAD8046DA771B4E31F1AE2842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8f373c75c84248fbd7adb2f0b5896289b8ca548c728f090fe4cc6b6931f961be
MD5 e8cd65ca18789e3cb5f717cc3fb7a14e
SHA1 5dbd5bf44990a8ffd4874d0834bd2a097b60805c
SHA512 5ab4085e73e0dd9182dbbc931c3309525d58ef9677c6a9494d38cf84be1c4f09efd6d14b14740cff68e9d76844e6eb465436733f7f2b7965a4ea0d2f3ae53b59
TLSH
T1CF61A621B5FBAD98FB6C407C8DF4108FBE346EC0948BED3E01A4E4755B4E32762A4040
MD5 SHA1 SHA512 TLSH

Submit Download

14d674a9-9913-47ff-87e1-b2d67fa161ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\14d674a9-9913-47ff-87e1-b2d67fa161ca.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0bc746b3-eb90-4b56-9fa6-b592a5bee2be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0bc746b3-eb90-4b56-9fa6-b592a5bee2be.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9ca7a2b3-4ceb-4a6e-b23a-7daf51aa469b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ca7a2b3-4ceb-4a6e-b23a-7daf51aa469b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9f87cd4d-9e4b-4082-9500-273cdd24c007.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f87cd4d-9e4b-4082-9500-273cdd24c007.tmp
Size 2KB
SHA256 8ea861959406cdfaf2b9b3f73dd05d0a60495f58967ec43d7ad8ced22f2b116e
MD5 1f8773be2e6084e6cd600eec78567cc1
SHA1 d1e08aa6623e6ba4c5dbe28b16d3036137422025
SHA512 8985c1f386fdfeea1b800dd3507818d25b35582b11dd6e54fea081f9922922c0f05fb2b54583e3bc48329071b709480209695e8450aa8ef852e512ef09c358f7
TLSH
T1B75179F787F5866D9A0196F0AA18EE1BCE2C0510831C3C6984E0BE57D3E3471E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

f3b71c81-4e0d-4275-bb2b-de9e8af67512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3b71c81-4e0d-4275-bb2b-de9e8af67512.tmp
Size 1KB
SHA256 2d44f2dd942f84c5526a8b56fd598e81b992bb368477aa43af2cb593a2d76adc
MD5 04d3bb3b159884dde2020b0fa7464c2b
SHA1 d22c33bd9e6a1d1950a2ba7807ffc2cce2ba3c82
SHA512 79ae69cac575828a6291e17654a599b33794d52a1907d0a858da855b2fbf0a6aea893807b1386394152a77a5d4033e9b522b536d9bc208fb1f00e4a05f755c30
TLSH
T1A7419DF3C3E4866EC90056F0A718AE2BDE2D0914832C3D59C9D4AF6BD3E3471E14165B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8032c03b2127bd192aa4a7f82c2787d040de7342c5c52a2dfd73f99ba72ea11c
MD5 a5e1236c11995fed58a007a63b30b9c4
SHA1 0cd453d851a0efe472114dd8954f4a048bb4461b
SHA512 0270198d774d616267929d0bf7a4f5961523c72eecd09b624f51c1c289eeef463df2602d697e2059288a81305a995d85aad8633c916088535fa4d15480f8f50d
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQv:yjNB/XORbkJNlzjk517HNRZh7Pvb
TLSH
T1A4B2EE1571BB0200387E2D0C81B59B6E9A4271A33068EA7B7FBD44A5CE6BE055DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bea5347a-9168-4590-9f1b-2a4e3b1551fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bea5347a-9168-4590-9f1b-2a4e3b1551fe.tmp
Size 414B
SHA256 e10a88effe6a8dcd9424fce7c0301b0f6e30979222839e33f7ebaa0ef1f618cc
MD5 ea024e5ce9bd392f08c315fc65ba64f4
SHA1 2a9f31a058b999c496b1314ce8755299d26fb6ab
SHA512 389efd59de055b2092a54261204ad18bb83efa701c4f074238a67aff1c9e0f1e1275ed1525d7071d61b1b905ee77bc95682e278550be160c95dbc7f64ada6a80
TLSH
T100E02BE9DE21AC2B2CFD071960A50749E75103877A80488F763D4209CFB4637858787C
MD5 SHA1 SHA512 TLSH

Submit Download

d5f1e085-dc64-49d8-8c11-0511107a9231.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5f1e085-dc64-49d8-8c11-0511107a9231.tmp
Size 26KB
SHA256 572907344e51865769334ca8801e8c1a2ba1e906aa9bc3788e47edc9ac887929
MD5 c81f434c2e93711cf182ffd72c18e5db
SHA1 d19ab17acad1abfb71de413ac0faa866892b1089
SHA512 dd09ad401c43f6a4514325547fdff6ba0c4972bf660c13b0e4a6846d4792f144fbfa4d21122234f89d22f94c3124e16011c5aec7f6ac99bdad3ec6efdf4cdc8c
SSDEEP 384:nNiFzQkUSvsF3sNK8TUNTUlI4kxjh+xwOuthf15xCl8qH7vBEn0+gL/7IzfIIlw:EFd63lwgZvB/ClrH75E02La
TLSH
T1ECC25A32EC94DABBADE74F95A34A3647EEE08263C99C5AD8D9C91D1D00CB1DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8209acae4287a0ef94a3ba38ac8567653eb8f34b4184bde4087c3f18eb1d1416
MD5 5da685923c93343f01460b6b32f6d59c
SHA1 84665140e3e8750221d417ce5ae02e14cd5838e9
SHA512 5899c9353596eca7cf64bd3e9d4025656431646f0cb260c19189252307ed170c402d2fee504d14e27a3da74c5eabb7be583a42bd638b3f478367b2d109fdedfe
TLSH
T18141E958A6E91108B3B76F1AABF6686E487FBD772E06D45D10110E4F0B62F40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6044-350-0x000002AB80000000-0x000002AB81000000-memory.dmp

Download