hxxps://www[.]mediafire[.]com/file/96367cmoobirhbp/coldwtf-src[.]zip/file

Analysis

user interaction
yes
max time kernel
748s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/96367cmoobirhbp/coldwtf-src.zip/file
Sample261107-nlabbaxybv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{41CDBF91-0B45-46EF-8AE4-622A3982CEDC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1664	svchost.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2960	OpenWith.exe
3444	OpenWith.exe
1268	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3800	4728	msedge.exe	85
PID 4728 wrote to memory of 2616	4728	msedge.exe	86
PID 4728 wrote to memory of 4708	4728	msedge.exe	88
PID 4728 wrote to memory of 4708	4728	msedge.exe	88
PID 4728 wrote to memory of 3064	4728	msedge.exe	87
PID 4728 wrote to memory of 3064	4728	msedge.exe	87
PID 4728 wrote to memory of 3064	4728	msedge.exe	87
PID 4728 wrote to memory of 4932	4728	msedge.exe	89
PID 4728 wrote to memory of 3404	4728	msedge.exe	90
PID 4728 wrote to memory of 4932	4728	msedge.exe	89
PID 4728 wrote to memory of 4932	4728	msedge.exe	89
PID 4728 wrote to memory of 3404	4728	msedge.exe	90
PID 4728 wrote to memory of 3404	4728	msedge.exe	90
PID 4728 wrote to memory of 2124	4728	msedge.exe	92
PID 4728 wrote to memory of 2124	4728	msedge.exe	92
PID 4728 wrote to memory of 2124	4728	msedge.exe	92
PID 4728 wrote to memory of 1144	4728	msedge.exe	93
PID 4728 wrote to memory of 1144	4728	msedge.exe	93
PID 4728 wrote to memory of 1144	4728	msedge.exe	93
PID 4728 wrote to memory of 3392	4728	msedge.exe	98
PID 4728 wrote to memory of 3392	4728	msedge.exe	98
PID 4728 wrote to memory of 3456	4728	msedge.exe	97
PID 4728 wrote to memory of 3456	4728	msedge.exe	97
PID 4728 wrote to memory of 2104	4728	msedge.exe	99
PID 4728 wrote to memory of 2104	4728	msedge.exe	99
PID 4728 wrote to memory of 2104	4728	msedge.exe	99
PID 4728 wrote to memory of 3628	4728	msedge.exe	102
PID 4728 wrote to memory of 1976	4728	msedge.exe	108
PID 4728 wrote to memory of 4968	4728	msedge.exe	107
PID 4728 wrote to memory of 1976	4728	msedge.exe	108
PID 4728 wrote to memory of 1976	4728	msedge.exe	108
PID 4728 wrote to memory of 4968	4728	msedge.exe	107
PID 4728 wrote to memory of 4736	4728	msedge.exe	110
PID 4728 wrote to memory of 1256	4728	msedge.exe	114
PID 4728 wrote to memory of 1740	4728	msedge.exe	115
PID 4728 wrote to memory of 4048	4728	msedge.exe	116
PID 4728 wrote to memory of 5060	4728	msedge.exe	119
PID 4728 wrote to memory of 2696	4728	msedge.exe	120
PID 4728 wrote to memory of 2696	4728	msedge.exe	120
PID 4728 wrote to memory of 2696	4728	msedge.exe	120
PID 4728 wrote to memory of 4432	4728	msedge.exe	122
PID 4728 wrote to memory of 4432	4728	msedge.exe	122
PID 4728 wrote to memory of 4392	4728	msedge.exe	124
PID 4728 wrote to memory of 2336	4728	msedge.exe	125
PID 4728 wrote to memory of 2336	4728	msedge.exe	125
PID 4728 wrote to memory of 2336	4728	msedge.exe	125
PID 4728 wrote to memory of 2172	4728	msedge.exe	127
PID 4728 wrote to memory of 2172	4728	msedge.exe	127
PID 2960 wrote to memory of 4736	2960	OpenWith.exe	129
PID 4728 wrote to memory of 1692	4728	msedge.exe	130
PID 3444 wrote to memory of 3452	3444	OpenWith.exe	132
PID 1268 wrote to memory of 1756	1268	OpenWith.exe	139
PID 4728 wrote to memory of 4040	4728	msedge.exe	141
PID 4728 wrote to memory of 4176	4728	msedge.exe	140
PID 4728 wrote to memory of 4040	4728	msedge.exe	141
PID 4728 wrote to memory of 4176	4728	msedge.exe	140
PID 4728 wrote to memory of 3332	4728	msedge.exe	142
PID 4728 wrote to memory of 3332	4728	msedge.exe	142
PID 4728 wrote to memory of 4520	4728	msedge.exe	143
PID 4728 wrote to memory of 4520	4728	msedge.exe	143
PID 4728 wrote to memory of 3512	4728	msedge.exe	144
PID 4728 wrote to memory of 3512	4728	msedge.exe	144
PID 4728 wrote to memory of 3336	4728	msedge.exe	147
PID 4728 wrote to memory of 3336	4728	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/96367cmoobirhbp/coldwtf-src.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff8c59ac188,0x7ff8c59ac194,0x7ff8c59ac1a0
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15204380103599538321,6176436583728572512,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,15986640125301036063,17522720603575279481,262144 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,6323372158678755667,14107178854970903115,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,11488030822139489750,13487797628147697339,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,4656230315889927730,14749502034884549266,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,17568221760864997487,11784647373276678186,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,10164752947733214781,18117997166827772313,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6966155461481500161,4249974073938692884,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,481395407647502199,2771283626190844753,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5784,i,9299313966642562303,4472064406036903377,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10234624708901693352,10092895856289129069,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10234624708901693352,10092895856289129069,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,14058369700394248729,4143582633541678307,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4128,i,14703077865740774257,2425411697692127064,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,10887463118159623482,3463405927799269491,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,10977295151641010830,8013606377611173573,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4175654783886832716,17965113888539369573,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6950029886661066098,233852750563412015,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,7680637834198466373,7660115745045542596,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,7680637834198466373,7660115745045542596,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5868,i,16152875172282484139,7118573604774086603,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,9021403130686584947,5511993378407435596,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,16773504602697667644,8053066834041998116,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,16773504602697667644,8053066834041998116,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6956,i,13222027716620373660,15278778642605319082,2097152 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,8353013833925444803,16090455103335028798,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=560,i,351386206692357112,1793661495359206404,262144 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,8832535555977585388,16672763047851270293,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,5320522514026649952,15863993917866737825,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,14908246442625283974,2998826718430650520,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,12685257971432637082,10132370450006875044,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,8298744317303284009,2734913403784396757,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,8369355853327044396,10935101743744631601,524288 --field-trial-handle=2252,i,11945081305753778422,16089359689994523775,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\coldwtf-src\tools\crop.ps1"
  2⤵
  PID:4736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\coldwtf-src\tools\shoot.ps1"
  2⤵
  PID:3452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\System32\SystemSettingsBroker.exe
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
1⤵
PID:1820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\coldwtf-src\tools\smoke.ps1"
  2⤵
  PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

store.jfm

Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Size 16KB
SHA256 a7f18b22218637872099e2f83ee9d4ee0b93165161689b7a1a669da467adaf42
MD5 35045c50da49e5d9aad57543821d15f3
SHA1 61b1e8785c97fa9a600ebb8bb99bedd04bb743fe
SHA512 817a5d7a34790b2a18bb01f7371aa46335959dac2652c7e8093bde66815b07db5085564ab7e81bf238b93903253dad3f4ea086b94dda599b641d6114dd1609c3
SSDEEP 6:C18xKlWbb2tXsiubKlQVtsWldRQip9lsPltMR2t5D/45/lWPplkPvl+ej95Ppj3q:G8kWn2tzuqc7/yUylzx/4mi3zfN3Ol5
TLSH
T18C72E56A378C1F8AD1562F78CBE94302A3AFDCA407440ACFAC7A1500DDD61989D960E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05d26e49-ef2c-4762-9597-ba22d65d3668.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05d26e49-ef2c-4762-9597-ba22d65d3668.tmp
Size 18KB
SHA256 377d311585c691e4f6c293398f817fa8cb184ca868c78cfaf0422645c6330cd1
MD5 0f517acb7bb62e7ce752f92a1f9f0486
SHA1 6789243f5987cb75c74dca0214fd9ba894753757
SHA512 bc4d4db9cb8b7ea00384b9360103ef2fe16089c5ce3e03dbf8c547ae0744b0fe17469db50e26d9085e68fa6f5602478ca6577e984deaeab3d380894caaf29ea8
SSDEEP 384:QQkUSvGsN/dsxpuvEw9iX5FX8E3OzXdJr8NOH7vBEn13IIlQ:4Glp0apEdh8UH75EhLi
TLSH
T1A1826D35B8786D3B4AE3A604F10A3553EEB4D017DBD81F90D9ED9B2C01DB2D9234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07bb54d5-b857-42d5-9181-3dba7db12a2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07bb54d5-b857-42d5-9181-3dba7db12a2c.tmp
Size 18KB
SHA256 fbb91ba2cb4872e333b945ccea3c0962c0be8adf8049c973f8eea31ea47d5818
MD5 ee6b6e2380ead0168b3ff7082c83362a
SHA1 ddbea98578da07cc945c244768fa7886ffca908b
SHA512 3643f78765d139fed12e548916b5849826f04c473975eef98f075c695f181632917ee2e602a82c86e195456c0469cf7e78c62daa3385448e25ea5e32b51bbdeb
SSDEEP 384:6QkUSv0sN/8sxpuYEw9iX5FX8E3OzXdJr8NOH7vBEn13IIlQ:i0Mw0apEdh8UH75EhLi
TLSH
T128827D35B8785D3B4AE3A604F10A3553DEB4D027DBD81F90D9EDAB2C01DB2D9234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a721a0d-f59a-401b-bae9-c02fcf92fa3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a721a0d-f59a-401b-bae9-c02fcf92fa3b.tmp
Size 26KB
SHA256 83723c15d741e982b60fe6b2a5f5b459b15f76fa0b38dee4b47f8b92e9967cb1
MD5 6069cc5ee403eb1e29acca08802a1b95
SHA1 6ff2d9b0288edb5e54ebc9153399a83a8e86cdfc
SHA512 12012582b0b78ac95a70c8f9d983cb70a64854cc1a24cd55b3a0c6ff384d42fb515f3f062b95031a6da4603f2e90d3823ed669f667210e01a17b3f8d2f8a50a3
SSDEEP 384:piFCQkUSvHHsNu8TUNTUlIldsxpu9WVw9iX5FX8E3OzXdJrLNOH7vBEn13IIlQ:AF6nJwggeK0apEdhLUH75EhLi
TLSH
T16FC219F268D7893AD9AE9707A33D2D039DBCC057F6945A50F7985A1CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49c78307-3192-40fa-87f1-d7918398f292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49c78307-3192-40fa-87f1-d7918398f292.tmp
Size 26KB
SHA256 b009323d031edb037bdee314c78599b72068804276b6f245938be7a7cfe2cbcc
MD5 fbf6fcddc753b60bda8c449e41125ff0
SHA1 25180c491085915b9de341726a57520bc1f18813
SHA512 e0eb9238b74f0642069260865579eebcdda695c602e99087d52ec6ad7f5f1a7d3fa9bb3454666e884285f75a1956d1bf8c518ba11290ec8a13569e4586ae5442
SSDEEP 384:piFMQkUSvHZsNh8TUNTUlIldsxpuvVw9iX5FX8E3OzXdJrnNOH7vBEn13IIlQ:AFM5cwggY0apEdhnUH75EhLi
TLSH
T115C218F268D7893AD9AE9707A33D2D039DBCC057FA945A50F7985A1CCC8A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

644101d4-f635-4b47-bcd4-94f4831b8ff6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\644101d4-f635-4b47-bcd4-94f4831b8ff6.tmp
Size 26KB
SHA256 652f6ed1d50abe86d75cb74ec2c9b44d22191b172bfe41fb7b8de541cbbf3d5c
MD5 30fe866fd661f44e2552be38ef4a12c1
SHA1 0afead849d4cf446823c1e3215eda60dc0181668
SHA512 92be9d350d09f147d53012f8b4e6da9c4b3fb3e8a97dd8d7d86863f2e9eb94c99b6bdc63b36f2522798be172ae23373e6eba563d2c99338aa0eff183be850afe
SSDEEP 384:piFLQkUSvHDsNu8TUNTUlIldsxpuAVw9iX5FX8E3OzXdJrP6NOH7vBEn13IIlQ:AFFjJwggV0apEdhP6UH75EhLi
TLSH
T1C5C219F268D7893AD9AE9707A33D2D039DBCC057FA945A50F7985A1CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ef4279b-44ea-4652-be38-8c02f316621c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ef4279b-44ea-4652-be38-8c02f316621c.tmp
Size 8KB
SHA256 b7dc23f9297ba47344c82fedd7de27e78838146a2ce1849297946ed823938d1b
MD5 0f96a743978918207a43510a37899b3c
SHA1 4a8f05207490f2757099939382283a20fc8c4aeb
SHA512 bd9021db224c546c274d430a9822d0dd02df4198937720f0fba2b6080abe2973822a1076654d6f066c539925b5184d6a43953603091beb5c347fd86d1dd0f71a
SSDEEP 192:LONU6AmwprQmiUyJj6siX5FPjzorE3O+JiN0aBU6:LONU6ipde6siX5FX8E3OrNDU6
TLSH
T15002EA35BD786C7B8AF2AE49B54737139FA5116BEB942F84CAE81B2C01D764C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

76213b27-3f41-459e-bad9-46d0dcc79f3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76213b27-3f41-459e-bad9-46d0dcc79f3f.tmp
Size 27KB
SHA256 e038f34f66ed50eb81b6e1626ffa043a8c832a3d0e6318f571e01b8a968844cc
MD5 50ba45227b49f99da59d047215163f77
SHA1 c62e5a2ddf73093436d2b3636f1cedbdbc4b6708
SHA512 c4fc9be5221dc851bc5168bee6d02b21a6d0278f564b986e2782130f7320153029cfdd713c6ac54f257a77b324603b95715634b48f9383ea1c588329404b567e
SSDEEP 768:Ll30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72UrolZMx:Ll30AbSWvS299u1jaLmLZ12/q
TLSH
T1CDC2EA3B640CCB7E4FC01A9DDC6AAF9B6F9802C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b0cc1b9-ec1d-4d46-be1c-9c99181d8f2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b0cc1b9-ec1d-4d46-be1c-9c99181d8f2d.tmp
Size 9KB
SHA256 81137e6a8c5fd811fd8bffbe68c91ae598ab8a981f6980047d2b18492d50ec5d
MD5 cfed0be2730d7db4cd851691a551d05e
SHA1 bd8ea117e40cb49ecb7e461b213948b7b6dff0de
SHA512 64ec3fcfaba1e1f0dbe7df9caad8d9382edfc5502d04732b4a823970d57108fcd3855fa655b713d309e431fc958e764e72554cd5efb213bc6d65022c16902abd
SSDEEP 192:sxZTRtn6/fPsjoIdp8aHW6+WNmuF/Y305AIIgrJ:sxZT76/fPsjZrHb1/v9
TLSH
T17D22A7126E38A97B8CCBD21DBA25BF53E6F9903252D41E54B6FC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9061153a-ed73-4d86-a61c-992dde7bd261.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9061153a-ed73-4d86-a61c-992dde7bd261.tmp
Size 10KB
SHA256 d6a367876e00d7030f1c2ae3725074cfa855cfde0bff430d2edfd4f35d67b31c
MD5 198bc7db6a86da5512a9f87f9430dc70
SHA1 b6c3b92fed4f83359976a5a29aa7d7a42846c501
SHA512 7400e4e797543051c175d1c7274594cd9c46d7af8434158a971308c60382682872c8488f455cdfbbc8c23a283620943f16e860bc2b5e78d3a5e429a13ff01d08
SSDEEP 192:sxZTRtn6/fPsPoIdp8aHW6+WNmuF/Y305AIIg5KJ:sxZT76/fPsPZrHb1/v0
TLSH
T16422B812BE38A97B8CCBD21DBA25BF53E6F9903152D41E54A6FC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 4371c9ca42ff77956434713716b7834cf6ee4658f8dbabd5a5473c0a0ba5213a
MD5 f9b19a21c912c9d45816b623330aeb65
SHA1 4981583cf3cbd30fb67cb0799dc7f784d7461bde
SHA512 3b4e3a1126cb921d5b2b1f0c567139b48fc19ee98bd933ff7c8fd1c9401511c5fc43d597e275805e72c3e9a8e44901d9bbe8889ff1aa66831b9cac414c69ffe2
TLSH
T1EBE020A947CDC69D514C648B02B4630EC1C0362ED3C0FF6D2F0CD44873824406A8D779
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 1299b383ad134c24a4db35dde63e49b49c5d6754c82b7d6bb7462e1d50d88129
MD5 22b3689f8f24179c9a7d8305a1c5c2e3
SHA1 ca8265a174bec18a4e51b0c630cfc90500d4c6d9
SHA512 308a2d6abbf98173627398261dae7f7b0d1d115a8be2f40e20ac6627ff1543cb8bf3a96104730edb0998eb66255ffac0e3d22818f15dad72eec18b0772ee2b60
TLSH
T141E020C807CCC62D5214658701B4674DC7C0361F93C4AA6D9B44CC88710385076C99F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a8e2a791f2c01a8b1312190c38af932b87a14dd9da5dca0380f740a823b03674
MD5 233e3a7efe242b95f5ce50482e03b81e
SHA1 d14d64ba4ad85fbea026f42f76cb5120f0e69c0e
SHA512 d6133e07a883f9c7a54778196f86d3e682b12fc7876d4b93ba422ea56e5ece8ad32ff910bfc8e12068377769a50f47d745cbca56e97ca5cd6fabd415e6c77ea1
TLSH
T170E026D804CFCA3EE608649711F8934CC2E0365B93C0BAEE1F18C4897243884B39B6F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c075662d7ebdf1cb05c4e759fa62fd88529f5a356173cf17003a8b4c0244648a
MD5 e36e3f403e98afa0ef8254931ef2a19e
SHA1 cfd4cd3fc0d7470320daa988cf346317cb6ef20f
SHA512 c81546718fad84656b90b087bdf6e500cbc547a33b54d1ec8a62252fbb5f766f7b7aaa8c61c75627f1353bc936b3fc339389001a7f372607107c81eafb83e0b3
TLSH
T169E0208907CCC61D5104A54701F4734CC2C0362FE3C0EA5D5B08C8CA7503244E2CD970
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3ce9734c9773c2550c8c06fb8bc5ec55c03d6bfd04791e58816bf705b456745b
MD5 e1985b49bdb945e8a3bb18a118ab349f
SHA1 24ad6c00e15b828a3dd9e7bc8fffb8c9aaeb8403
SHA512 23d1d88bb977037ff58d2737cf380564cb749489374ac5b9cf058dc94c343d68c3bb60018628c0d18e061e87a3dcbedcd219e627052cbdf8615a9e0104bcf1e5
TLSH
T11D7150845798E0AFFF6BF8B079D627A7F4388EE275D3EF021978C4B4589A7905034850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 66334a5b9c4dd8795d93b6cb468fd6fdc5c97630422fee69a0f10d851b917e3d
MD5 9e46a338ed15e8b2a2996cb3953c1de6
SHA1 12f78d061e7bff259040792d64dd4168e852ffc7
SHA512 c334791189e9ba011386924f89bf6f4085142a451566533522f52d167cd2a6ca3289cfbce14544cccfb0e56c8207b003f8949664a8e0b376fb48376d30b697cf
TLSH
T1296183885684C1EFFF6BF8B0B6E62387F9354E9375D3ED4221BCC8B8189AB545038850
MD5 SHA1 SHA512 TLSH

Submit Download

ecd1314c-3470-4417-8ed6-64ff5d1b0ccf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ecd1314c-3470-4417-8ed6-64ff5d1b0ccf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

5d360d4c-0d53-423c-8f96-b1a7c2d03650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d360d4c-0d53-423c-8f96-b1a7c2d03650.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

63e86e37-a177-4df8-b216-cdf99815004b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\63e86e37-a177-4df8-b216-cdf99815004b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a922a5a3-04ea-4c01-9aae-e49e1f1f3538.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a922a5a3-04ea-4c01-9aae-e49e1f1f3538.tmp
Size 6KB
SHA256 2eef922ddbe2ef21e1db8b7f48e120d4cc7373a39d4703a768783271b24eed2d
MD5 36253803b6884d263d187f47647fd7f5
SHA1 2ecc56b254bfde31ca3eceaaae8e5591253af220
SHA512 fd1374400a41e3a972306137e556e09e8e8156d94864a4b7d3b5080054bf81f1ca5f09af5b6d05346070a460bf7d652e5176a7e790b4659f213322010dc5e02c
SSDEEP 192:DNmjtJs3De+214q2eVYkkPGvhT4Vtod4RKoLLHT:DNmjtJs3De+214q2eVYkkPGvhT4VtodK
TLSH
T14CE179F7C2D5C55E88015BF456146E1BCF1D076983283C2A88D6EE8BE3E2472E25E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e70480ac-dacb-4693-a9d0-6d48f5d98a5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e70480ac-dacb-4693-a9d0-6d48f5d98a5c.tmp
Size 5KB
SHA256 84f4c2532654759ff35c146658381a1b9589a568b2be46c9af9bb8b6d36dbe08
MD5 24104768790c9e458f52ac722f7f7e90
SHA1 5c37a876cbe537d8b3058a8eaeaf37c26c43d422
SHA512 328aabbf9fbd80c8b1f53f8eba89bcc76eac60c1fb7804afaa1c0f04840c735233e1281893fa64a37f5d81f06957be0ca5f997e376b0eca250e9fd8cfccaef2b
SSDEEP 96:D/OGo13Qf0+1+WvZfzB4q2hVYkkDOsoxxT4VRe/A41oo8ByAHwdJGj4/3:DWGoJQfd1+YZf14q2hVYkkasixT4VRoZ
TLSH
T10EC176F793A2D55E89015BF49614AE1BCF1C0729832C3C2589D1EE87E3E3072E16E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 768B
SHA256 4367b6cd19684a7aa0b020e7107ef25ef22d0d1e9e577cc35fd0b984ec17a82d
MD5 d54f2dbcbb8dcfcd72a27173743156f5
SHA1 677900ca2ed610714942cd645e91812727dcee0a
SHA512 f056a3d3084e8089f2fe55003289c3e8b991744c37e3efb0b974871a5085bc8e535f8213d9018f95d4ae12b616cb73e4e2a9eb566c2644d467c4583129c2426d
TLSH
T1CF01C0DA45138B47FC0403719A3DA416617A91486394774FA3EBA166DC53780BD83EB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 768B
SHA256 cea19fe25c8a9357f5999326f892fd418c5e2d366cdab356f0bbe4f3da2b59e2
MD5 205f484630f107b27298be30428df3f7
SHA1 032aacd7f9635e1838d367e2d05a4da2110a334f
SHA512 71bacccbe2c0e0aaa949baba41934886120f9bc162851148f813ea4da2f268359521c786ac5a0997f1d2777efe3e064f7b1288535d5df83cbd29c128051777c7
TLSH
T1670120EB2C138E07FD150275703EB449A5B602DC53903B1FB2FDC12ADCA2B90BE416A8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 6ce2152e8faa80ef33a98c216e63ce71da97780ab4c30bd95a1748ff832132b9
MD5 8ba28a4861f77f41f7508a75201cc75f
SHA1 a4b8d5f9ef78f5768dd6feb01edbc0cf36e838b5
SHA512 0477ddd35b750bbde2d018c91382977f2380ff1e7e9ecfbf42b5a1ec85e16dc7526131cad1cd5e0e28025984326b6554eccb94f12940c0673038638c941e7662
TLSH
T19AE0C0F26DF71890FCAF83D4147088F181057894DB08FC4F10AAA3C7A4703153845C50
MD5 SHA1 SHA512 TLSH

Submit Download

a1f9b8fd-c2b2-433e-a1f7-fa45b57a99a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1f9b8fd-c2b2-433e-a1f7-fa45b57a99a2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b00fcdb6-bf71-47ce-b7f1-a3ac5db6cdcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b00fcdb6-bf71-47ce-b7f1-a3ac5db6cdcd.tmp
Size 10KB
SHA256 8ebfe9f2572fa5f90d30754d1562de26b913e7d4f958e6e6caeadebaf8dd5f1f
MD5 02d318d7d30feb0816c77b9dd03c37ad
SHA1 409ae49f16056e20c038ed662f241345dfcf5d56
SHA512 1c286222c75d11ba3850d95363f1b48708c39a3a2c156ecf6c6524d167130b193ceabc9067ab1e368d5054bb7b999650ebc3149d63e8f1b04b500a4ea48d9f06
SSDEEP 192:sxZTRtn6/fPsPoIdp8aHW6+WNmDXXY3aI5AIIg5gJ:sxZT76/fPsPZrHbOXjie
TLSH
T18422B852BE38697B9CCBE20DBA157F53E6F9903252911E44A6FCC61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd03a537-cf2a-4482-8e23-8d95abd987c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd03a537-cf2a-4482-8e23-8d95abd987c0.tmp
Size 24KB
SHA256 78590bfb0b4fc0a6c16fbc1475b82d480e861339b8b37712ebdb75435ac4f356
MD5 3ab49e469898b44751bc77d06adfd443
SHA1 5e83775c7b406aa3caf42ba829a1ed0f40a76f30
SHA512 c187ab9f47b4966b318210fdc0a016501a54be6ff77658694c65538d710b7d30a245d639252ce95b434bfd453499e2c3464ba6c51614510c84ab6bcd062b7876
SSDEEP 384:sxZT76/fPsx66s8qMpRiYnazAW8pZS15posJWeT+iZBHbodaCe:sL76/fU4Mnc7WeT+irHb4aV
TLSH
T1EDB2F805A924D8379EC3AD1C653D7E33E9EC906222C5CEDA16ECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd10733e-3d3a-4913-af3d-a36edae3e1e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd10733e-3d3a-4913-af3d-a36edae3e1e2.tmp
Size 10KB
SHA256 e5f26c84508d79d660c8720ea5d2ec6ce9f37b05fb36d0c10bf23cd978042099
MD5 0e4f36ada1c4f6bf6333fc9ea410504b
SHA1 a69c99eb54ee29d1fb865863e48dd88f1e0cd9dc
SHA512 08674e0b9d71984a11fe0151dbac2febb3b33a39258d9a5a25de1e20669db63b62b6fa5e519355b9bd3d53ec20877de88204bbb68e3aa2d3045a34096477f6c9
SSDEEP 192:sxZTRtn6/fPsPoIdpuaHW6+WNmDXXY3LIKAIIg5gJ:sxZT76/fPsPZBHbOXqde
TLSH
T11B22B852BE38697B9CCBE21DBA257F53E6F9903252901E44A6FCC61C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d2421b8e-07c1-4a45-97dd-ac5bf117ead2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d2421b8e-07c1-4a45-97dd-ac5bf117ead2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac95b4b0-e0ab-4e87-b5fa-25c24792fd13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac95b4b0-e0ab-4e87-b5fa-25c24792fd13.tmp
Size 18KB
SHA256 269c5096f9cdfec47e938112550ef12b6de5bce00d487f9fe8de6b14dc09dd00
MD5 1dc4d2588f0fb4241c9e9037ad948cb6
SHA1 f93e0aaad24d6fd58557b642b7f3c1f6b36d6037
SHA512 e8a0d256ccbd47c5fa64b4533878179c27a3b0725171d104ea82d6cb89dee34bd11e160caf8226a61a899971bc174d264dfc0e04c0592656793aa90bded80e12
SSDEEP 384:3QkUSv5sN/BsxpuvEw9iX5FX8E3OzXdJr8NOH7vBEn13IIlQ:J5Rp0apEdh8UH75EhLi
TLSH
T11B826D35B8786D3B4AE3A604F10A3553EEB4D017DBD81F90D9ED9B2C01DB2D9234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7146549-a9f8-40a8-b5c0-e7322e98a728.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7146549-a9f8-40a8-b5c0-e7322e98a728.tmp
Size 26KB
SHA256 e3a626a9fb81a0055072da934e7479f7290783f7878abba6a425d79fd23c25e5
MD5 5c0d78efd14a0869bfb66236fdc18946
SHA1 da328e4ff378658df621bd066e846927f96735db
SHA512 581dcad2bfc05fdd709fbe1625fb9e752892e163f8668e1ecd4bb12f4ec29240fc09d552807c73fe27d7f9fb2868222fb371edb9552e7fef01d1abe4285c5ac3
SSDEEP 384:piFgQkUSvHZsNh8TUNTUlIldsxpuQVw9iX5FX8E3OzXdJrP6NOH7vBEn13IIlQ:AFI5cwggd0apEdhP6UH75EhLi
TLSH
T11EC218F268D7493AD9AE9707A33D2D039DBCC057FA945A50F7985A1CCC8A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9a686ab-690a-4944-91ce-bc78e0fec9fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9a686ab-690a-4944-91ce-bc78e0fec9fc.tmp
Size 8KB
SHA256 563355aa6ed24e3085ca1cc3ece14eed78379dec65ac229a765490f76c819990
MD5 a26150c195ff833829d7d404a23269dd
SHA1 5d1860fdafc9f3883040cb72e39807f1de02c038
SHA512 7cbee6a598c37e4752e1ac2af8bee5bf6e859e94c5a14348b3840e2764bb79b7f730734a2362ea0a31e078f181175d4e5d728efc60fa89e5e49b212927d66f7f
SSDEEP 192:AONC6AmwpDQmiUyqjwsiX5FPjzorE3OzXCSJr6lRN0HqkU6:AONC6ip1fwsiX5FX8E3OzXdJrINOU6
TLSH
T1B0121C36B8786C7F5DD2A555B04735139EA58127EB887F94C9EC1B2C01EF658530D833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f921fb64-22e8-44e5-b87c-0a616d09b6ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f921fb64-22e8-44e5-b87c-0a616d09b6ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8ec40f5748c9292e2047991df910729b166a6a4ed8a81d0813e320147b87736
MD5 69b6316d417879d17216e81bb55d5bda
SHA1 84ff02cc8a44b64069fa4932a2ddc6e0381c74f9
SHA512 ab9a4b7ac7f798298d415f06135f10ec78bae7e63f99aafbfc3cde935119b57f72ec3d314c27e4761bcd1bfe94f58ffcd17cbb2c29ca58d0401fa2fbc3eee476
TLSH
T1FC412358AAE91118B3B77F59ABF6A96E883F7D771F06D49D00120D4E0627A40C8B173B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1664-442-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-446-0x000001B35B8E0000-0x000001B35B8E1000-memory.dmp

Download

memory/1664-447-0x000001B35B8E0000-0x000001B35B8E1000-memory.dmp

Download

memory/1664-448-0x000001B35B8E0000-0x000001B35B8E1000-memory.dmp

Download

memory/1664-449-0x000001B35B510000-0x000001B35B511000-memory.dmp

Download

memory/1664-450-0x000001B35B500000-0x000001B35B501000-memory.dmp

Download

memory/1664-452-0x000001B35B510000-0x000001B35B511000-memory.dmp

Download

memory/1664-455-0x000001B35B500000-0x000001B35B501000-memory.dmp

Download

memory/1664-458-0x000001B35B440000-0x000001B35B441000-memory.dmp

Download

memory/1664-445-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-470-0x000001B35B640000-0x000001B35B641000-memory.dmp

Download

memory/1664-472-0x000001B35B650000-0x000001B35B651000-memory.dmp

Download

memory/1664-474-0x000001B35B760000-0x000001B35B761000-memory.dmp

Download

memory/1664-473-0x000001B35B650000-0x000001B35B651000-memory.dmp

Download

memory/1664-444-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-443-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-441-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-440-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-439-0x000001B35B8D0000-0x000001B35B8D1000-memory.dmp

Download

memory/1664-438-0x000001B35B8C0000-0x000001B35B8C1000-memory.dmp

Download

memory/1664-406-0x000001B34B240000-0x000001B34B250000-memory.dmp

Download

memory/1664-422-0x000001B34B340000-0x000001B34B350000-memory.dmp

Download