hxxps://rosstrah[.]ru/osago/#calc

Analysis

user interaction
yes
max time kernel
1319s
max time network
1318s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rosstrah.ru/osago/#calc
Sample261107-ryzzaacw9w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
656	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{338EC1DC-E295-4A28-970D-047DD980FF9E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4980	1232	msedge.exe	84
PID 1232 wrote to memory of 656	1232	msedge.exe	85
PID 1232 wrote to memory of 4900	1232	msedge.exe	86
PID 1232 wrote to memory of 4900	1232	msedge.exe	86
PID 1232 wrote to memory of 4900	1232	msedge.exe	86
PID 1232 wrote to memory of 1656	1232	msedge.exe	87
PID 1232 wrote to memory of 1656	1232	msedge.exe	87
PID 1232 wrote to memory of 4684	1232	msedge.exe	88
PID 1232 wrote to memory of 5100	1232	msedge.exe	89
PID 1232 wrote to memory of 4684	1232	msedge.exe	88
PID 1232 wrote to memory of 4684	1232	msedge.exe	88
PID 1232 wrote to memory of 5100	1232	msedge.exe	89
PID 1232 wrote to memory of 5100	1232	msedge.exe	89
PID 1232 wrote to memory of 2096	1232	msedge.exe	91
PID 1232 wrote to memory of 2096	1232	msedge.exe	91
PID 1232 wrote to memory of 2096	1232	msedge.exe	91
PID 1232 wrote to memory of 2796	1232	msedge.exe	92
PID 1232 wrote to memory of 2796	1232	msedge.exe	92
PID 1232 wrote to memory of 2796	1232	msedge.exe	92
PID 1232 wrote to memory of 4496	1232	msedge.exe	96
PID 1232 wrote to memory of 4496	1232	msedge.exe	96
PID 1232 wrote to memory of 1824	1232	msedge.exe	97
PID 1232 wrote to memory of 1824	1232	msedge.exe	97
PID 1232 wrote to memory of 5044	1232	msedge.exe	101
PID 1232 wrote to memory of 1264	1232	msedge.exe	108
PID 1232 wrote to memory of 412	1232	msedge.exe	109
PID 1232 wrote to memory of 1308	1232	msedge.exe	110
PID 1232 wrote to memory of 4880	1232	msedge.exe	112
PID 1232 wrote to memory of 4880	1232	msedge.exe	112
PID 1232 wrote to memory of 4200	1232	msedge.exe	113
PID 1232 wrote to memory of 4804	1232	msedge.exe	115
PID 1232 wrote to memory of 3396	1232	msedge.exe	114
PID 1232 wrote to memory of 3396	1232	msedge.exe	114
PID 1232 wrote to memory of 4804	1232	msedge.exe	115
PID 1232 wrote to memory of 552	1232	msedge.exe	116
PID 1232 wrote to memory of 552	1232	msedge.exe	116
PID 1232 wrote to memory of 4656	1232	msedge.exe	117
PID 1232 wrote to memory of 4656	1232	msedge.exe	117
PID 1232 wrote to memory of 1824	1232	msedge.exe	118
PID 1232 wrote to memory of 1824	1232	msedge.exe	118
PID 1232 wrote to memory of 3140	1232	msedge.exe	121
PID 1232 wrote to memory of 3140	1232	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rosstrah.ru/osago/#calc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe87bfc188,0x7ffe87bfc194,0x7ffe87bfc1a0
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,8317646813225218394,15799400017726792417,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,6827107988125563549,17589625729224795695,262144 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,10399654961697847244,9250668546411278267,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,13986298794880851794,10318396888090271982,2097152 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,18345999111492044735,7665382283514738602,2097152 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,13386197227945478445,2900104874426972193,2097152 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,12820795184237362390,18403381905933508581,2097152 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,9910956186680065817,15633672502483033520,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,17445324993760269234,3072076233551886683,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,1541233691614500842,2141091077250311737,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,1541233691614500842,2141091077250311737,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,4304245649950056365,4170541149049577727,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16493307407874452913,1120964562441955608,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,17900277747753501814,6991742713259160103,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,3856227153814498920,2707815765654077203,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6036,i,2201462688955887347,13273699585759134203,262144 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9342128020851277061,6971334579933317474,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1516,i,11917364298953679229,5808333566732977753,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13161790842840469466,6707841194868706839,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,16381480393937398440,3418348149151496187,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,13213235715911308845,8947912901236825060,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,6773950175292124706,16763655437287999743,524288 --field-trial-handle=2296,i,4827887850020098241,2244555385580818566,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ad20263-0aa8-4010-9592-2573af436f35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ad20263-0aa8-4010-9592-2573af436f35.tmp
Size 8KB
SHA256 bff76f533c97a635353b7e18bd29494d469dc7659173a63c72d5a24ea47bb26e
MD5 b3b4a84ed97b72e5cdbd563564b85d91
SHA1 a0e706e1623ebfb6d6b34dc086f0cd6539d72767
SHA512 2bb63057ea91adc584e630ae9110e59571a38f3b664b21e79f0db6df4083e1e28a3a481b026386eb8ed499858d71db18071cfe23c4e081aeac3e667f9c09deab
SSDEEP 192:SONz6iDCQmiUyoQHq5u88PwuhmwSqDYfHU6:SONz6/eHq5u8irA4yU6
TLSH
T1A002F9386C287C7BADF3AD15B5873B179FA4113FE6941F84DAE81A2C01E769C1303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

951e2cb7-115b-4f57-8368-3d5379223246.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\951e2cb7-115b-4f57-8368-3d5379223246.tmp
Size 18KB
SHA256 bd57de8eb0eda79be39a4b734e9f6a2030f3309752a051af47f17040633f4cc6
MD5 c1bf692528ec094a2fbdd41d50338c34
SHA1 fdcaa4b3b1ccd146409c7763cac09774e09cf83d
SHA512 33419a3198363d03a1d82fbfd3ec86f40a3526d9b80d08674f72c424b435b1cb9bf88494fdffd93df244c77e7be842a6f777e75d29a0c259cdc4a064f83f9385
SSDEEP 384:7QkUSv0sNJFgyZ1bp5u8irABZ57H7vBEndX1IIlN:10NUDkrA57H75EdX1LD
TLSH
T1C4827C3168A86D3B5DF3A821F24B3657DE64816BE7CC1F80D8DD672C01DB6C8130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

2c12f639-ee34-4aa2-bc2b-9bdd8f4423ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c12f639-ee34-4aa2-bc2b-9bdd8f4423ea.tmp
Size 25KB
SHA256 d9b8a43a3fa81a0d4e0241702f144f69bead732da8e65ba867ef0569d0d621c2
MD5 632d1f601ff214f10eec79fb93ca723e
SHA1 8922e5e0ae9fda84a227710ca925c190560aa5d0
SHA512 6d5d36decdd0f76fb321ade9b486925de57f64f026be489ad291746d99a7a1aba24cb8a5dfd19f5abbf7db2ec5433fddacb693913b79e3089d94c324cb5bd736
SSDEEP 384:sxZmKm/fLs266s8qMpRiYnazAW8pZS15posJWeT+TdcVHbxxcXN:seKm/fT4Mnc7WeT+TdAHbPAN
TLSH
T1B8C20715A924C83B9EC35D1C693C7E33E9EC506222C9CEDA1AECCA1C019D5FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e408a79-053e-4af0-a552-62f35980661a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e408a79-053e-4af0-a552-62f35980661a.tmp
Size 10KB
SHA256 aa0712b1c7e9f8de734303f1178cfc0e5b08f35c0a55f016bb76c2407c0f6477
MD5 4577791936214c79304f9434a572d9ba
SHA1 ac776e89c3792b3ab1d182a7a903289a0ba72c50
SHA512 3f539d1a442acf69143f106ade1085f542df142c29ee4920b4869ea225673f22d31f668b5b267f4f79abd7ab9dc2ce5ed2f6b90271f5046461392101095b81c1
SSDEEP 192:sxZgRtWm/fLs/BDIdpemHW6+WNtNe/YawE+SiIgrJ:sxZgKm/fLs/Bc5HbS/a9
TLSH
T11222E8616E38A97B8CC7D20DBA15BF53E6F9503191D51F48BAFC861C04E6ACD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4521b7d5-5967-46b7-acc6-296a94817b07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4521b7d5-5967-46b7-acc6-296a94817b07.tmp
Size 10KB
SHA256 9a3694ea7e84eb39dfca2cb5e0f29e9c5c1b6222cc489e30f7a2b2a68de3ceba
MD5 e5f5e76dc7b2934c06d5eac05bd25628
SHA1 be89fe4c85bec97d56e20eaa074364c145b05647
SHA512 6e07926d3aa79da605f5f894722478075aa87e7b7e339c3b5fd44a1f4b21707e9ec759fc72e006fd14100418178d4d32612c8db565fbab94ee3a677f2d74311a
SSDEEP 192:sxZgRtWm/fLsYBDIdpemHW6+WNtHcXYa5EaSiIg5B6J:sxZgKm/fLsYBc5Hb6XfX2
TLSH
T17D22E8616E38697B8CC7E209BA15BF57E6F95032A1951F48B6FC861C04E6BCD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58ec85f6-e11c-433a-bc76-7f23dc2d1787.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58ec85f6-e11c-433a-bc76-7f23dc2d1787.tmp
Size 27KB
SHA256 f1c23c2ef2da1943d71c314029b1a2079159944fbf538de77150dc616c41604c
MD5 8facf1a71617da9013a08a944da1d7b9
SHA1 986221c592881c328e3bd14816c48d86e3b8736b
SHA512 ca8d68bee3d0860dabdb73fe38cf39481e8aa3021bdc06682864842fea12f500959b4d7ee2ebe327e187fa77b6f7196970d0ae1d8fa19e5fb92d8661216e1e9f
SSDEEP 768:gtyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3nrocZwL:gtyQRbrWvvlpZu1jaXKLf330cZwL
TLSH
T12BC2F93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

886c22b6-ad6e-4b9b-a37b-c7ffa10c82ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\886c22b6-ad6e-4b9b-a37b-c7ffa10c82ea.tmp
Size 10KB
SHA256 ae30e7e033835663b8e2ad9a4bce0c76128289811586ea9387ef32eafa6d07fd
MD5 ad35bc82c726056d8dfa55745a982288
SHA1 f2c8efc2a44b9aeb1b9cc1283092432d8db2a8d0
SHA512 87eb58f775f4fedec9f0c05826fc878670f690995ae6cf5364d9c02337db3a85c39e14120fb190117a8ca7bb31cb30a7d2dddf910ac34dc096cf3d594d437087
SSDEEP 192:sxZmRtWm/fLsYdDIdpekHW6+WNtRGZYafEaSiIg5B7J:sxZmKm/fLsYdcXHb2Z1XN
TLSH
T17C320961AE38A97B8CC7D209BB14BF57E6F9503251D51F48A6FC861C04E6BCD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 10a2b224be6cb4e3b4d186ef010607ddf0f37c795b454228d98a4a4340e03e7c
MD5 90bfaf37d6219ccb5827fded187bd88e
SHA1 f54d29f8c41ed0faf07ae8463948bb0082e55ea8
SHA512 6ce4c157544c3ef4af25f4e1f0be227baced5f9661cf4b7173042eacab077116b3dd2f5e13b2bb18cfbb40768342d434be873fb739dd43feaf8ecd2ec638bab2
TLSH
T1CFE0208804CDC61D5144644B01BC575C81C0365BD7C0EB8E2B0CDD497542050F7856B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 68fcae55ec4b01439dc52e227e5c12963cf5ba39098a918cfe8fcfb79bd0772c
MD5 b072e60321e6d26e3cbe1ebd4e7fb0ea
SHA1 1a347abb65872e61aad435efefa6682a1f5c91d1
SHA512 e9d8ab2d710ba6559b47f37ecda2cba0967c4c84d49c4206d28d68825ae2299bafb4a8b8e202edc940fdee223476ea9c9387d27f1fa767f89e62d97056eccda6
TLSH
T18EE026C944CEC22EA248748781B8635CC2C1362BD3C0EF1E274CC5CA7683490B6867B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 58f4b71692054dfdc532ea03d3917e0358f7523678a01080f9972c7a681fb4b8
MD5 1c2a04d3e4ff7e5f1824b48434bbf245
SHA1 868e8e236c2536c410b38478b59036a093960daa
SHA512 804529bfd2f9e0ce3592638ade55d964a68e092d51639a2135074b37b98de9c9120af8d44648ed0b5fe33e244b851388d75912f0f77427514c8d486078123bbe
TLSH
T147E080D827CDC65DA108656701A4A74CC2E1371F97C5AF4D1708D48D75426946695760
MD5 SHA1 SHA512 TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 71KB
SHA256 c890282dbd9c693664cb2d54629563971308af5f3c5e2f50f24b50f2fdfa3b5a
MD5 dcf2a5815b232faa274d38d756343cf5
SHA1 fcd5c4cdcf5c216e87f9bb916e5c3422d02f9fdb
SHA512 f33f9f4dfa6f50e00cd149461a71499dde47bf2922a01ffe56681df45f93faae55c0a755175be350ecb46c4c1f52246c1a20cb8467b5e267e56a847b2fd705ce
SSDEEP 1536:OHidIJcntsO35T4RmyVnLhb1n43mbX4+RcB1VCgK6omJ5jBNx5Fh:OHiaJasO36R5VnLJi44+RAPTSu5jP
TLSH
T1337301739350750992B5BA0005F8A2939B703E2A25D2C74A664ACE3F3C0F971CD7D7AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2f00b09a884f1f13c521e3b3e34504a9dafa069bd864008520085bcd95c27ded
MD5 58ebd450ac73ecb3dfb6940993006fe6
SHA1 8c87314a77d5f6d6c3a9f0a2317a2a3be2c22e84
SHA512 da815ba76b2efa13f3bbbae0643572dcfa8fbb25cba1a8e9571b1a9bdfe86a0d2fee19cf8e523a8789a0fb0f211872ff4cc69caaa506813caf631bbb594b1f90
TLSH
T1DA8193E22FA8AAD0F7F55B31B9C6248736F67570E5A30E0FD060D4B928467B40A1433E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 9e47762850b7833a13227a549e7ddb3ef0f56d56e72d28e62f03dc909faecf90
MD5 af7c81b54242246439a34bc7bf5d3a6a
SHA1 c35a8f93b8205cce28df13b4a12cc0492e188f54
SHA512 3df6682194bf6a10d462af25cf616f425a5ea8b97c6f1e86d9b8a3b71a8052efbb57549eb683adebed086e6970e25e2dd38c645fb96ae68b7b4b7ec80629ba06
SSDEEP 96:NzeTL0IzgpYgThT+yFFj7WL6m1+yINdXpvOLmQ0Cz7dvJ:NzeTL0IzgmKxFFfW6L4jzNJ
TLSH
T1D881C8E16F6899D0F7F55B3569C114873AF27861B6638F0FD024D4BA29463B60A0433E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea23f60f-657c-47f1-aaa4-a2571099df77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ea23f60f-657c-47f1-aaa4-a2571099df77.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

85936cba-51f2-4def-9a25-d3c637e1b143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85936cba-51f2-4def-9a25-d3c637e1b143.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

d8be363d-0ce1-422d-9d93-c4566af8a546.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8be363d-0ce1-422d-9d93-c4566af8a546.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

eed02a50-fe0d-46fe-9f58-0d1828d43879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eed02a50-fe0d-46fe-9f58-0d1828d43879.tmp
Size 3KB
SHA256 376f311b18e7e296d3f34ae6e482a25d015a0189a76dbb5f4f8d3935150fb0c4
MD5 a7c3d73b73f1450b4cdd5b29c85b9804
SHA1 586e40cb050e190bc68d8b05bcb91c74f080adcb
SHA512 02fe763ffbadcf17802b0471b4a13c24b5174a228fc2a337c89477c18f9aaa2b5fb78a37429e008945eb026b3eb294eb1004055c6684b0e1b9ba8fe9c472a898
TLSH
T14D718CF2C3D5822CC91216F4AB64692ECE590E5483283D3ACCE5FF0F93E2470D35499A
MD5 SHA1 SHA512 TLSH

Submit Download

f2c38d6f-7b5e-4b08-80f9-18fae615836d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2c38d6f-7b5e-4b08-80f9-18fae615836d.tmp
Size 3KB
SHA256 bc73ab2a0f1ed00a3b1a814fd22d733f93fd75178c8ab353155d77075a441310
MD5 ac9b797193a0f74364eb162bac104280
SHA1 500caa20c42418116c6cad0f7cfece8ce224b80f
SHA512 3078ccab85e065fc198f335e5726fbaab51270c592de5c8806d6439b5fe2ad28195a99e13fa3311635184553f4827ea74adce86853fc048a62412b5493ecbf15
TLSH
T1B851ABF293E1822DD90256F0AB586D2FCE580A14876C7D36C9E1BF0E93E2070E354A97
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 4adb4aba50605ee1029a7d794d8440911c55b4889668e4c6983cba7efe031810
MD5 3ae60eb5f687f2cbac4520e74f284419
SHA1 70edb65549a1338383ba732fec0da85320cd5bcf
SHA512 de2392dda875c964fbb6133794266e9d6bdab9765af49f3ff8edcbe31cb78ecb8689f3bd327be1d82bcd1b611ce1b3cb96332cfb78eda1223b99026fc8d237e8
TLSH
T126E068B73DE728009CFF83D1083140950001B8048959ED4E102A82C700A13412832CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 740601cc96193798bf7fb8bfc964f3d3364f382218c35315bc6e9cb7169218c0
MD5 162b669cf7f5d8cecd405f8a3b49c989
SHA1 da37ba98327f568128ce53df7fcf2664e4b7f5a9
SHA512 923b06d0dcd16d69a5281cb5d7a4348793469fcdceb2f849a07e3a6cb75867e76c69d1e8e9d6ae91ac4c0a8b463b3284f2b730794c29703937cae73e675db73b
SSDEEP 48:K03pYl5jn7UbHCfISRUK9R17Ux5EYCDZJyLAPGKQ6uvbG9mISivK9+1Evx4/YF2z:KU2wKrCee/yK8YLhKKCoK3
TLSH
T14F913104326B6290397E245941B5865B964231F3B35CF92F7FBC94A28E6BE141CFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4aaf1f9-5f8e-4106-bd50-e901f1274826.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4aaf1f9-5f8e-4106-bd50-e901f1274826.tmp
Size 10KB
SHA256 de2987b9698a77c8599ade0d20be78319315f1eb727626bf2b15a5dd142ec027
MD5 7dab5ff6a7150cc28a1a2f78e45778ca
SHA1 37a855f8eaa41e96899a4cd1159e876293442a4c
SHA512 ecb9e2f59acb128b20769fea85fefc1dc57371f6794f5cc59efd6f0fe6ddea7fee358e7a4e099b220700c65d29cc1f99ba8942af93a7146dc32e01eb438400c3
SSDEEP 192:sxZgRtWm/fLswBDIdpemHW6+WNtNe/YawE+SiIg5YJ:sxZgKm/fLswBc5HbS/aG
TLSH
T13822D7616E38A97B8CC7D20DBA15BF57E6F95031A1D51F48AAFC861C04E6BCD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1cf4c5c-f09d-4f89-a066-226613480de5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1cf4c5c-f09d-4f89-a066-226613480de5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

da18ad01-25d1-42de-97fb-2f78ae33616a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da18ad01-25d1-42de-97fb-2f78ae33616a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fedde050-2a79-4d7b-9257-beee9143d605.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fedde050-2a79-4d7b-9257-beee9143d605.tmp
Size 10KB
SHA256 513b7bcf0aed4286662ac399798c76534e562f7c0d26ad8634702fa56c2c660f
MD5 c771eff2f83f00ed257e28cd6357364c
SHA1 d012448cfcbf98ea4cc6815e3f06c371c7aed4cd
SHA512 d2fa55b306477c5072e837dd78e74bafbba1c209c5d94cbb98a4ebcaac1f9f4d5055ac8b1dfb1797a0e77789779a776ffb7eb510905e1d00158fcbe6a37dab82
SSDEEP 192:sxZmRtWm/fLsYdDIdpwkHW6+WNtRGZYa6EBiiIg5B7J:sxZmKm/fLsYdcVHb2ZDXN
TLSH
T19B320961AE38A93B8CC7D20DBA15BF57E6F9503261951F48A6FD861C04E7BCD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09e15eb6-835f-4767-a5a2-c9c7be8312eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\09e15eb6-835f-4767-a5a2-c9c7be8312eb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

af5a94d1-28fe-4152-9c91-5c7860c7074e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af5a94d1-28fe-4152-9c91-5c7860c7074e.tmp
Size 26KB
SHA256 1454d5f20a3599001d15c61cf6f71625ef745d85cac265f523075535c1dc2a61
MD5 145485f90213b098c2fde90e4d9757e8
SHA1 57e4272e7392e3ae61de06718587bf170d0dd1ee
SHA512 b02aee71fae635438561c77a2c113bd29eea04ce3ce7bfe485189f5ab55f7ceca3da9169d8201aa3587a8abc1f59672fe1d5e5ee44a56306097160b9ba029a4a
SSDEEP 384:oiFzQkUSvczsNr8TUNTUlIlFgyZhbp5u8irABZI7H7vBEndX1IIlN:zFdgWwgMUDkrAI7H75EdX1LD
TLSH
T179C217F258D7993AD9AE9B13A33E3E029E7CC067F5885A80F789551CCC861BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da793830-9a75-45d3-a069-8b94ae73a530.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da793830-9a75-45d3-a069-8b94ae73a530.tmp
Size 8KB
SHA256 be83846b7c716ede4417bba18d5bfc45183af8b4327c49e4d37eb87234920c4a
MD5 ffdf0bb3e9062fc2e847c0aa98b0cbf2
SHA1 3dc9bc670ff627779e97d991e92e7ea960f3923e
SHA512 2218868defb725be4280c5c2bd9d80857d8d807864bb8121ff5530e81a1615be66db64c0d098e019eb552f5d06b43a91ffd08bf8a9667aedbbe0ea3edc7c2ff0
SSDEEP 192:CON06iDWQmiUy8Q2Gq5u88PwuhmBUohFuZTqypU6:CON063g5q5u8irABZc7U6
TLSH
T129121B3568697C3B6DE3A861B58736139E64417BDB8C6F80D9DC272C02EF99C5307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7115262-785b-4e65-bbe1-98ac1b21cc60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7115262-785b-4e65-bbe1-98ac1b21cc60.tmp
Size 18KB
SHA256 0ea8dc8c94a9b5b2921c1e776a063d39e990ed9629721d1d33dad1d84098177d
MD5 d8681e0c4b60746e52949c599d10e85f
SHA1 a56ea77c20c57ce2d2b052035c161e7ad34b17c0
SHA512 a879fc09c572f86ce5e23ecdcb15e44fc97a9fd2eaddbba7ceead55210418fc4b78798c8f2d0c83b3930cdc5364ebdeacc8c19dd812556c020e223f938b55028
SSDEEP 384:kQkUSv0sNJugyZ1bp5u8irABZ57H7vBEndX1IIlN:U0qUDkrA57H75EdX1LD
TLSH
T134827C3168686D3B5DB3A821F24B3657DE74816BE7CC1F80D8DD672C01DB6D8130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6019c0c2-63ed-4e2c-ba4e-0d8cd41acbbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6019c0c2-63ed-4e2c-ba4e-0d8cd41acbbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dc9d7c423c903e50ff92ab6bfb68efcdecd9eb7f83eefce67266012de5f30932
MD5 96f3b16ad63387f1b97f56ed51ab7755
SHA1 ca9053480fe65f6a042c00cfb26153ce7eda9e0b
SHA512 8c0ca055d86746a23e6ca67f2c40adece9c76f5a6123b5ece0a909153e4bcdd9d94b7ed2973963fae953cf2f92d1a036942ef8f1e155ec77593c78bd590841d6
TLSH
T18941D958BAF91148B3B77F56AFF6A8AD487FBD372E06946D10110D4E0A62A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download