hxxps://rosstrah[.]ru/osago/#calc

Analysis

max time kernel
899s
max time network
734s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rosstrah.ru/osago/#calc
Sample261107-ryzzaacw9w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1824	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3202520547-175870679-441661622-1000\{0FA6EBB4-8C43-4013-8792-21FFAF175BB5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 4080	996	msedge.exe	83
PID 996 wrote to memory of 1824	996	msedge.exe	84
PID 996 wrote to memory of 4100	996	msedge.exe	85
PID 996 wrote to memory of 4100	996	msedge.exe	85
PID 996 wrote to memory of 4100	996	msedge.exe	85
PID 996 wrote to memory of 1360	996	msedge.exe	86
PID 996 wrote to memory of 1360	996	msedge.exe	86
PID 996 wrote to memory of 3008	996	msedge.exe	87
PID 996 wrote to memory of 1844	996	msedge.exe	88
PID 996 wrote to memory of 3008	996	msedge.exe	87
PID 996 wrote to memory of 3008	996	msedge.exe	87
PID 996 wrote to memory of 1844	996	msedge.exe	88
PID 996 wrote to memory of 1844	996	msedge.exe	88
PID 996 wrote to memory of 3340	996	msedge.exe	90
PID 996 wrote to memory of 3340	996	msedge.exe	90
PID 996 wrote to memory of 3340	996	msedge.exe	90
PID 996 wrote to memory of 3884	996	msedge.exe	89
PID 996 wrote to memory of 3884	996	msedge.exe	89
PID 996 wrote to memory of 3884	996	msedge.exe	89
PID 996 wrote to memory of 4120	996	msedge.exe	96
PID 996 wrote to memory of 4852	996	msedge.exe	97
PID 996 wrote to memory of 4120	996	msedge.exe	96
PID 996 wrote to memory of 4852	996	msedge.exe	97
PID 996 wrote to memory of 2784	996	msedge.exe	101
PID 996 wrote to memory of 4924	996	msedge.exe	108
PID 996 wrote to memory of 460	996	msedge.exe	109
PID 996 wrote to memory of 404	996	msedge.exe	110
PID 996 wrote to memory of 1172	996	msedge.exe	111
PID 996 wrote to memory of 1172	996	msedge.exe	111
PID 996 wrote to memory of 4348	996	msedge.exe	112
PID 996 wrote to memory of 3388	996	msedge.exe	113
PID 996 wrote to memory of 3388	996	msedge.exe	113
PID 996 wrote to memory of 3492	996	msedge.exe	114
PID 996 wrote to memory of 3492	996	msedge.exe	114
PID 996 wrote to memory of 3620	996	msedge.exe	115
PID 996 wrote to memory of 3620	996	msedge.exe	115
PID 996 wrote to memory of 2344	996	msedge.exe	116
PID 996 wrote to memory of 2344	996	msedge.exe	116
PID 996 wrote to memory of 5036	996	msedge.exe	117
PID 996 wrote to memory of 5036	996	msedge.exe	117
PID 996 wrote to memory of 4904	996	msedge.exe	118
PID 996 wrote to memory of 4904	996	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rosstrah.ru/osago/#calc
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdbf77c188,0x7ffdbf77c194,0x7ffdbf77c1a0
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,14508345212521020442,13649916413301535250,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,9181969814757070881,8990255527823882184,262144 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,16065114065028112362,18036586554704370558,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,18399415278661741528,14420630630705768877,2097152 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7971830619865764662,14110535583439674526,2097152 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,2064185416374265960,15488679126840140448,2097152 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,17561415202949278319,3813647015643394415,2097152 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,18431912611891616912,13011492260718388115,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,9698238327454059347,16388427652452081971,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,5203667771451424261,18101807237959544919,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,5203667771451424261,18101807237959544919,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3415525653795624301,2911437597229892369,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,17237886021151505622,2262482487369648397,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,8077758036298252568,13735413652228044208,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10717332017190658759,10738396919265693183,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,17770762090061246288,8517920631007754706,262144 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,3115939302937297037,9966918443869609811,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,13333826529895810764,14532042599375724172,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,232010264161282243,13586741631034665446,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,15444022865400139890,3749183331652665943,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14344016063310172104,6616891896219017961,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,13717321196725137768,5166537666065728728,524288 --field-trial-handle=2016,i,1939942040782940846,4545494560190801703,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39a7231b-69f4-4b52-b39d-cfdd5fca2bfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39a7231b-69f4-4b52-b39d-cfdd5fca2bfa.tmp
Size 18KB
SHA256 13d3cef2f51e05ded1118128c2b8f1e8db69f510c644c4e25cc738b53ba97fa8
MD5 3b03661904d4111ad344812062d0a51c
SHA1 1a261c8428a30274b0f09e2a1c100946c4df0238
SHA512 74e41b3542b958480543557c1469eb8213170f90a23da4b12a08fb1182518105187c2b96df3a8c41d030a771ffed04f0c3a75d9b42cf09f0eeb2824dee2800e7
SSDEEP 384:NQkUSv0sNAkLdL6puF4Wgtk7hoz3+2xCH7vBEndXuIIlN:30PsjoLlxCH75EdXuLD
TLSH
T106827C34B8A86C3B4DA3A910F04A3A5BDF78812BD6CD2F90D5DEA71C01CB6D82347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4603fd81-e547-46a1-a3d4-f79461b72fab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4603fd81-e547-46a1-a3d4-f79461b72fab.tmp
Size 8KB
SHA256 e18775e5742e56221ea451bda3d479e65db4cb9b9b689ab223745c999cafb992
MD5 c9f19d584492e7eb4800fccd6f98dc57
SHA1 a4b8f2d3f1230db63c64f325798ed685ce2179a5
SHA512 2719d250f56454832f6b16e5abb391535f0506f7cd179dd71725cd9a57bbb2e0c7d14bc4fab8cd6c6158f8c9e0233ccbabf62cd0f6e82dbd63b1504521e851d8
SSDEEP 192:kONx6v6mpdQmiUyn7Ke4WgrpZi7hodF3+2GpoUrqMU6:kONx6CQ8Ke4Wgtk7hoz3+2rCU6
TLSH
T107121834B8B9AC3B5DD39950F48736179FA8413BEB8D6F90D6DC2A1C01EB69C534B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4831e2ba-f84d-492d-b0e8-b4ec7fca924d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4831e2ba-f84d-492d-b0e8-b4ec7fca924d.tmp
Size 8KB
SHA256 0f716b24811940a1c866977daa66915ef6a541bf4c129ed785074e27760702ff
MD5 38c7a59bde41e82efd5c00fd28bc023f
SHA1 99259ae0f68a719dc834e717624af05bf9716a63
SHA512 c07d80c312844c7fc1634c5d0713c21e1cf0421e4afb9a804f6a790286732bdb31f46f891cbd8773cc340d60a8034982d3b986e270386708081d8d5487246fa0
SSDEEP 192:3ONF6v6mtdQmiUyV7Re4WgrpZK1banLdU6:3ONF6C80Re4WgteOU6
TLSH
T14002D734BCAC787A9EE39E05F4873B179FA8113BAA952F44DAD41A1C00D768C1353926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74cba864-2052-4590-9478-9fbc1da41304.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74cba864-2052-4590-9478-9fbc1da41304.tmp
Size 26KB
SHA256 2e6c3978f833d32ed7c3e7e77752c44478aa9ed004ad8ce52555cdf32e32c3cd
MD5 0721a3036dcfb241b0735b1ec7119942
SHA1 fc6c0fb993791fff5e693930a1104cbbb16b0711
SHA512 c2b392c6eccfc28a4ebd8bea9d5417bd92149b54abbae243133376bb068d2602528c84a1be35fdbb0d458dc4720076d6ade79912988463d3d0d2b9bcce3e5f5d
SSDEEP 384:4iFzQkUSvZzsNA8TUNTUlIlkGdL6guF4Wgtk7hoz3+2GlCH7vBEndXuIIlN:DFdZZwglsjoLlGlCH75EdXuLD
TLSH
T1D4C218F258D7983AD9AE9B43E33E3E078E7CC027B5895A90B789551CCC861BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55379bf1-25db-4f07-9612-37177f3d5f7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\55379bf1-25db-4f07-9612-37177f3d5f7d.tmp
Size 105KB
SHA256 53485fcfaed759b3ae05094c9f1150d6e1c50d1a0e9bb27d696de6d6429b7818
MD5 a7d2cdb3119dfd7ea29822c54c6f0ece
SHA1 5b850ca662487e25232f620f16facbc61444c635
SHA512 aca78959fe95451863b05890fcbdb6ec48b6a9aef876ca4090e16c304335e69a8463c92279dc8c0d579a8aa17f77bb22b1c391863085832d28715efd806898d0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6e7a1b2aff313d1346d95d5e3a8efc635bcb45e12b921b6caa44f7d2b0a6d934
MD5 1bb18b6794073806108c1d692527dd16
SHA1 66a573c5f1e596662c9a583c3c9450152c9d999c
SHA512 c4eee9b498d62cd05d36bc16bf3e650a6012dfaddf245e99541b645344a78328b98dae04caa3ff74b060e1097c15d2c1e3feec0e072caee0ef663adf1316b22b
TLSH
T1F0D02BB083A82630E862343401A0C2227089E5004E0637024083515508D57E200D1115
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 de64f2d04fcf5130505abf8f452033663f6c6f34ad6043cda2754984ae410dc7
MD5 19b889df706bad8784d27cd37cdb015a
SHA1 158b81f559403bc7ae8d54199f2448874dd6cdff
SHA512 f0083b19f9cf0962840e70074f3d283f5e54647d8a694c758de3836209b5a0b5ba6a2609dd982fa7ec2ad9302ede78222bea21348b57341073054c425d0622b1
TLSH
T102D02BB0C3682230E462343401A1C2227089E5004E0636014083515508D47A200D1115
MD5 SHA1 SHA512 TLSH

Submit Download

2ae50ecc-ce52-458e-8047-9b469e2fe703.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ae50ecc-ce52-458e-8047-9b469e2fe703.tmp
Size 25KB
SHA256 ce7c5ff905cb7094f0bb105ab72f9cdc7658e506cc44d1ffc2a6d09a41734034
MD5 d3ec13aa88fcb00ca45d2e4d4b79a2ba
SHA1 d8998ea83eed078b03947debafdc37ff27840f18
SHA512 52c2d6bfe8ffb1d1d321e8d29f0b6229cbd8fd01343d80834b55a45a2a64938bf70d064f4e74dfc8c1b45a3af65b163cd250e342cc27c72ee6aba0ffa1d699cf
SSDEEP 384:sxZoSA/fLsM66s8qMpRiYnazAW8pZS15posJWeT+68IHb7/H8:swSA/f14Mnc7WeT+65HbDc
TLSH
T147C20715A924C83B9EC36D18693C7E33EAEC505222C9DEDA1AFCCA1C019D1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8854b0fc-4128-491f-9ca3-19e011f7faee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8854b0fc-4128-491f-9ca3-19e011f7faee.tmp
Size 27KB
SHA256 1b62de5ea20feb76871f00935902bd4190876fa00422d21633876caf9afa64d0
MD5 df93db591273675e65f8e32bfc4e0616
SHA1 4b5d82a387c332875eb1bd7c9dff73d738528a23
SHA512 a0ecc5f99aff12a422326f200c95023d3fbe4e3884f2c578c92bab9e1d4e751ca62e762d0994857e60a0b98ec2587b2246f366f07c18e294df5c444b5369ea19
SSDEEP 768:L/OtS3IWvUgqc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3LlTtsbyroKoh:L/OtS3IWvUgqcu1ja83LNWbpKoh
TLSH
T142C2F93B680CCB7E4FC01E9DDC6A6F973E9802C7A6689D4047F9994C02D77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

901227ed-9bcb-4d42-900b-5a1f9d2c9ffb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\901227ed-9bcb-4d42-900b-5a1f9d2c9ffb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

948352a6-79e5-4d38-a6f7-a06e5fdd241d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\948352a6-79e5-4d38-a6f7-a06e5fdd241d.tmp
Size 10KB
SHA256 b0e684f659febdcee177e71929ced703b860d62d14d364222aa600287688051d
MD5 89dbc54e818a496933abb52d07c34b8d
SHA1 f66f5829960329e04f9ccc1b9736268443ab2e67
SHA512 2c045e2dfdf28980103709477810e6500969de36e2cc617438cfe0ecd156f89a31cd976e7fe01ba69818cf0e10d4f0bed9bdd2bd4bc9e14ee1fcb0bf42e2ab47
SSDEEP 192:sxZoR9WA/fLsSjIdpeNHW6+WNt7h/YtXvw4IgrJ:sxZoSA/fLsS8WHb7/C9
TLSH
T15C22FA226E34A97B8CC7D209BA15BF57E6FA503291D51F48AAFD861C04E7BDD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b8f594a56a7e32f72db6fa071ad51d2ec149737d1f4fd64e38f49ea209b8928f
MD5 6042cf3d74214660805745b2f3688373
SHA1 0d4a6466af1ca64d9e9d1021a42a2e9ce7a77089
SHA512 6bd2023e0a5c9836902c8addece280af0ceb14d12ccc0fde09a0422f36b8d6fb2e8731fdcf300a947ea8cb2d51ecd9c19394da15384526ad0d47a081839cfbb6
TLSH
T1B8E020C514DFC31D7106A487019C5B1C81C2361FD3C0AF5D6718C888B5420806296561
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 70d1bfb4dfb85e65d971d08e734060a4f06831e525330423477ca9af24ab4df0
MD5 b04bc27baa95233aa01d3bdc561e8738
SHA1 1e669ade3c99fd9e5578c5fc42e5a718172701c6
SHA512 74d702f41423c476a5e9a79f8deaca139e1713fe92279bc2e6101ac4f2a20a58c149ea1e9f0146b709d82690b8380e3ad782f108b8a6b69df18cb198f9cbf063
TLSH
T14FE086D816CFC6AEA208A58711B9A34D83D0365B97D4AE5E2708D4887643544A69E6A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d9f29fa51023179a11a8d3de7c2a3721ebeba839477c8d62a49865009de86dd4
MD5 037ca39ad00889e9a0cbe60662ab7699
SHA1 82a68e69dd3084cea142d372fc71e73c920c7511
SHA512 9a4f7e6de312c20f50487709b7ff12a227a8e3c6d9f1c5e16f2e44e6ec2a354e5c9d68b936914b6bcbbbf15d869f086cf62221e05633122edd987e3a69b15101
TLSH
T1DCE020C404CDC61E520D648701B5A31C82D2361FD7C1AB0D6714C8C8B5024507A855B9
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 53acda404d8df583b4f53efc392662bcac28dd9ba7aa6ff4d46bfa8267e0c7fc
MD5 09a330ffea818e2d8534d130e817f860
SHA1 902834b18dc5a2262a9a98345d1894f8d379347a
SHA512 bcdd500c0bb8a12e90239dcff110c0121c317dac8fefdae03c6e43357979c699fd0b06d1f2ce9733113be7603ea0f155e482eb6329d4d28fd1501eb7b369e407
TLSH
T176813C820C588284FF7583378DE0E0867E3A46E651E3EF190569F9BEE4C632452C1D6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 74d120fc7344aad2065b9c51d80a65fd5b642b2f64cf5c827dfd06b6fa30e958
MD5 456f34ed8d22100d2f4dda3ce9878187
SHA1 5bdda9a99b43edff44a4ab32f69fca9e93e3fe88
SHA512 7fe430ef28c453ca99de1de0dce6eee506087acc0e1cefe598c7e7bc419d914badfb5fa5575c9a7bc72b15d55cfdda3cf7d9e0c196c9b3f387b858e282b03873
TLSH
T15561E7861D51C498FF79C3378DF0D08A3E2546C661D7EB6A0599F9FEE9C222881C5D8C
MD5 SHA1 SHA512 TLSH

Submit Download

2efffc59-656e-4cb3-95cf-55e18e20cd0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2efffc59-656e-4cb3-95cf-55e18e20cd0a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

2fc523c3-3a27-43ba-b1f0-981cf69151ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2fc523c3-3a27-43ba-b1f0-981cf69151ac.tmp
Size 3KB
SHA256 245bcd0c15ef35909e2f8b03b048c515cbd21005257f22f31d27ce3ee9ffb72a
MD5 65eabbac6dbe2b95083999527d0e2492
SHA1 e9f8ed81587703c46a3dff6cb28716e1259e972b
SHA512 237bb0dabe016b38b97226a9f40a30f11732200caf708c56b9e758ef163d35d675ea53b00b0b17c60f987b66485f94c0803cae6a77d6115472b3056b49933562
TLSH
T14C719CF2C3D4822DD91226F4AB68692ECE591E1483283D36CCE5BF0F53E2470D354A9A
MD5 SHA1 SHA512 TLSH

Submit Download

55c3bc6c-8fa0-4f4b-8b6e-8770ed844063.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\55c3bc6c-8fa0-4f4b-8b6e-8770ed844063.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

70fc19e4-8deb-4110-b011-9e2f8102fdf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\70fc19e4-8deb-4110-b011-9e2f8102fdf9.tmp
Size 3KB
SHA256 4b721a2ab6451b9ade5fd2fe2e5d6327be39532af765a9e4812582f15dd17293
MD5 887abce285620e02b059b3c0f1e08b21
SHA1 1989c7fd292e017a47897ddcd826a761eb2141ae
SHA512 69a1d3577d5071704c83464c49f6b521a27b56a91c18cfb4dc94d0599e9c43a8e193873abfd59cc8d1ce4813863eadfe980aec866c731413be2f0dec91964b6b
TLSH
T1B551CEF283E1822DD90256F0AB586D2FCE581914876C7936C9E5BF0F93E2070E354B97
MD5 SHA1 SHA512 TLSH

Submit Download

86e422e4-bc3d-445d-9694-40313ded568b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86e422e4-bc3d-445d-9694-40313ded568b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\891b14ec-12c6-4526-adf2-d3ce99f593f3\index-dir\temp-index
Size 1KB
SHA256 61cb58decfd6eae3aa3f912a0733c5cedfe6956a2700558e552deffe759ee9a9
MD5 2bc2e2bd4da7f9ba118c66373f060f3a
SHA1 80392d2d452f3da637e7bac191899ef04a7b7fe3
SHA512 e8886ecb5ce4d4f31c5b214540681d732bf7ca5f00134129421c421dd5d4b9ea6d0057ef5cfe394baf7ee24e0f181f0dc3ffca69197d930eb68706e820cb0c2f
TLSH
T1E62135475E500F97EDB05274243964D5B334A2CC1344BB2B92FDF136ADD2B40BD8599C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\891b14ec-12c6-4526-adf2-d3ce99f593f3\index-dir\the-real-index
Size 1KB
SHA256 5e006b5807c0f07bfce753d4b6b1b1dd88f41091be15b339b74555bb30e82e30
MD5 3ca5ff674a4886e7909658ca72adc79a
SHA1 e6736c20cf848dceb3d2b0e352081f3dfd9f48cb
SHA512 d09d78b1f9391e0dc55a8a979fe7dc45b0a39ac67fa4a4b49cf0d84bf3975a8ba515255bb788ae27351f94f14461bebd45e9437f3f6740d90e4e50b16760dd98
TLSH
T13C21546711B20B67EC8422B6546C69D63335E6081348771FA3F2F13AAC90B88BD969D4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 765d5f044ab9e2540aa9ccc9375e673b8989087d973c91d9d390837b505f0f8b
MD5 d64e726b5595cf210e5b23a0d9f82663
SHA1 3bef39e9307cf06b558c9f6196e12f78c45c5ee6
SHA512 1780d4ad1dbbe0d621777ef37a30e2e4093f44e1a10c9943df0415aaf75aef87ba1232b440fbe784687dd94827273e37800d45ed6f5320dee34809aedda76546
TLSH
T170E068B72C9B2C60E87F83D768709460001ABC648844AD4F606D95D754723112422C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 abff489fe9cb1bed7b758d4f1ca91b11e00faeee8f5e1c8926841c9d30520691
MD5 441e8a85acc16849287b84a27132ed85
SHA1 1da50a11234675e46c13547773650b4c2da7236c
SHA512 13bcf6219e18e1b0bae813a279cfb1cc20035ce3260c8f8a124b0f35dd7edc658d4017e37f3171550beea3253ad0d95c52e7bad597300f199fc122ae1ccd41a3
SSDEEP 24:KBnwT4rInKXhm1KSDm6EH7no45lk15oLPIOLkK/HhnFk1xD0SDaJrZD5yXapmtki:KkMInKRmUYcIrKpSUTyZeInKnqQXM
TLSH
T187914390307B42A0387E6D0C81B5972A868236B37178E62F7FBC54968F6BE541CFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d4c5d4-3f8c-4898-b350-bafa5804ce91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2d4c5d4-3f8c-4898-b350-bafa5804ce91.tmp
Size 10KB
SHA256 afd8c84816ba36fda30f0ff5a6ad57a004908192d943e0e297b55f5e020d5368
MD5 92dc2ab8cd2fb0d889c7cd491b9491b9
SHA1 bdf03ec96ca389325f6cb19f77bb3744fb05349a
SHA512 47cb12c1b859bc01d275cfc65316299ff6c10fb3e4952c939cb56c1e7a0832f1b48fb7bd533dd0a31cf5042bab6a623fb2d44967b3bba3e5f5af8cfe95d727c0
SSDEEP 192:sxZoR9WA/fLsTjIdpwNHW6+WNt7h/YtNWw4Ig5CJ:sxZoSA/fLsT8IHb7/b8
TLSH
T1FE3209266E38A97B8CC7D60DBA14BF57E6FA503250951F48AAFCD61C05E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c756d398-124b-407a-8024-1bbac895c414.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c756d398-124b-407a-8024-1bbac895c414.tmp
Size 10KB
SHA256 24411e467e5c0de7165773f302b1e2a92243e22df094ceab4a4c1ec9775090c9
MD5 6f928b1381ee4efb5c094ebd3d4bc896
SHA1 25b5d529ffd529ef88ae4f3532ad30bd3b22f6a7
SHA512 52223a39a1a033ebe15b5132d5ac6c98fff0b21d9e67db37c17482ad0e8e0243d35c77b9e8a56e035b3b4577f78c29b15c005729b01ad8d4961f694e8a51098d
SSDEEP 192:sxZoR9WA/fLsTjIdpeNHW6+WNt7h/YtNdw4Ig5CJ:sxZoSA/fLsT8WHb7/A8
TLSH
T11C32F9226E38A97B8CC7D609BB15BF57E6FA503251951F48AAFCC61C05E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf09f97d-17e9-42c5-b111-9bb58f90bdb0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf09f97d-17e9-42c5-b111-9bb58f90bdb0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e6875485-1726-4506-904f-f80dddf6ef4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6875485-1726-4506-904f-f80dddf6ef4c.tmp
Size 10KB
SHA256 6dc088ffa6853616750b074879d3185a1d7407f0c5948184c708b33043120476
MD5 f806b0db07e2b27af7046d37fa897db2
SHA1 453d4051590373f71eab6602b1650848ea41f3be
SHA512 48e83c050285cfbc354da2c87dcb4a34bd6c1ecc91ec7591f1685968893145c7a16628ca2262d5d1b2a732248a6e2af4f8d89ddfce89b16b413e7d689969a976
SSDEEP 192:sxZoR9WA/fLsijIdpeNHW6+WNt7h/YtXvw4Ig5QJ:sxZoSA/fLsi8WHb7/CO
TLSH
T10922F9226E34A97B8CC7D209BA15BF57E6FA503291D51F48AAFC861C04E7BCD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7ff68f3-ef42-4ccc-8b32-5419aee565c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7ff68f3-ef42-4ccc-8b32-5419aee565c4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ded5daee-47e2-42ae-9b99-5f8220912632.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ded5daee-47e2-42ae-9b99-5f8220912632.tmp
Size 18KB
SHA256 277a0eebfa2673f4817908e1cbb1532fc14c437ddc95825106cca756f65878ad
MD5 797eef46b1e8eb6789ade76c23545df6
SHA1 78f815ca71b717105362bf3585488bdd418f1edb
SHA512 2eb9e418467f9d7c06a937c2583a7e76f2b2febc1e13d988be68df876bc65cbe8d60b4618351f43890295b4d2d7066a9a02189faa6753b54762e0c5249032640
SSDEEP 384:gQkUSv0sNAkGdL6puF4Wgtk7hoz3+2xCH7vBEndXuIIlN:I06sjoLlxCH75EdXuLD
TLSH
T1F7826C34A8A96C3B49E3E910F14A3A5BDF78802BD6CD2F90D5DEA71C01CB6C82347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ef24dc9-5f5d-420b-9e94-53b6f3dcb653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4ef24dc9-5f5d-420b-9e94-53b6f3dcb653.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed52c3712454b9209b579f52dd5de49a9513d3eb7ccea6f620cae63cd295c6b5
MD5 5df6cf33ac5417fbb8ad742c651a55d0
SHA1 1f0be2a9d100282fbf09f6d4ad78511f1dfb0ab7
SHA512 5152d60b5615bbc4ac97303685df718a693ac4dcfe6a244b5819657689306a897f858a98cb453f0c470255587a3fae2050b303b6b5361bb827fb15749d84beff
TLSH
T18741275CB6F91148B3B7BF16ABF6686D487BBD772F0AC55D00010E4E0662A40D8B2737
MD5 SHA1 SHA512 TLSH

Submit Download