hxxps://rosstrah[.]ru/osago/#calc

Analysis

max time kernel
899s
max time network
898s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rosstrah.ru/osago/#calc
Sample261107-ryzzaacw9w

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{1358B3B7-6D0C-4E85-B1FC-4D49CA0E8A78}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\Total = "0"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{C9493B34-2534-485A-B335-1B73C248FFDC}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4495"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost_ = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4495"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7590"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8079"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8079"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134336241737926386"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea07090042006800670079006200620078002000760066002000700079006200660076006100740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000008fac55191c42dd01eae9a2cb1c42dd01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070900420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000c0c116041a42dd0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bb = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "11174"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomains = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bb	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\ = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
3472	explorer.exe
3472	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe
Token: SeShutdownPrivilege	3472	explorer.exe
Token: SeCreatePagefilePrivilege	3472	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4184	sihost.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe
3472	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3472	explorer.exe
2008	SearchHost.exe
4500	StartMenuExperienceHost.exe
3472	explorer.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1832	4692	msedge.exe	81
PID 4692 wrote to memory of 3288	4692	msedge.exe	82
PID 4692 wrote to memory of 4340	4692	msedge.exe	83
PID 4692 wrote to memory of 4340	4692	msedge.exe	83
PID 4692 wrote to memory of 4340	4692	msedge.exe	83
PID 4692 wrote to memory of 3332	4692	msedge.exe	85
PID 4692 wrote to memory of 3332	4692	msedge.exe	85
PID 4692 wrote to memory of 1664	4692	msedge.exe	86
PID 4692 wrote to memory of 1664	4692	msedge.exe	86
PID 4692 wrote to memory of 1664	4692	msedge.exe	86
PID 4692 wrote to memory of 1244	4692	msedge.exe	87
PID 4692 wrote to memory of 1244	4692	msedge.exe	87
PID 4692 wrote to memory of 1244	4692	msedge.exe	87
PID 4692 wrote to memory of 2292	4692	msedge.exe	88
PID 4692 wrote to memory of 1592	4692	msedge.exe	89
PID 4692 wrote to memory of 3984	4692	msedge.exe	90
PID 4692 wrote to memory of 2292	4692	msedge.exe	88
PID 4692 wrote to memory of 2292	4692	msedge.exe	88
PID 4692 wrote to memory of 1592	4692	msedge.exe	89
PID 4692 wrote to memory of 1592	4692	msedge.exe	89
PID 4692 wrote to memory of 3984	4692	msedge.exe	90
PID 4692 wrote to memory of 3984	4692	msedge.exe	90
PID 4692 wrote to memory of 1232	4692	msedge.exe	91
PID 4692 wrote to memory of 1232	4692	msedge.exe	91
PID 4692 wrote to memory of 1232	4692	msedge.exe	91
PID 4692 wrote to memory of 1044	4692	msedge.exe	94
PID 4692 wrote to memory of 1044	4692	msedge.exe	94
PID 4692 wrote to memory of 5020	4692	msedge.exe	95
PID 4692 wrote to memory of 5020	4692	msedge.exe	95
PID 4692 wrote to memory of 2828	4692	msedge.exe	96
PID 4692 wrote to memory of 2200	4692	msedge.exe	98
PID 2828 wrote to memory of 3868	2828	msedge.exe	99
PID 4692 wrote to memory of 2084	4692	msedge.exe	100
PID 4692 wrote to memory of 2080	4692	msedge.exe	101
PID 4692 wrote to memory of 2596	4692	msedge.exe	102
PID 4692 wrote to memory of 2956	4692	msedge.exe	103
PID 4692 wrote to memory of 2956	4692	msedge.exe	103
PID 4692 wrote to memory of 5112	4692	msedge.exe	105
PID 4692 wrote to memory of 3976	4692	msedge.exe	106
PID 4692 wrote to memory of 3976	4692	msedge.exe	106
PID 4692 wrote to memory of 4304	4692	msedge.exe	107
PID 4692 wrote to memory of 4304	4692	msedge.exe	107
PID 4692 wrote to memory of 1804	4692	msedge.exe	108
PID 4692 wrote to memory of 1804	4692	msedge.exe	108
PID 4692 wrote to memory of 1712	4692	msedge.exe	109
PID 4692 wrote to memory of 1712	4692	msedge.exe	109
PID 4692 wrote to memory of 1584	4692	msedge.exe	110
PID 4692 wrote to memory of 1584	4692	msedge.exe	110
PID 4184 wrote to memory of 3472	4184	sihost.exe	116
PID 4692 wrote to memory of 3068	4692	msedge.exe	125
PID 4692 wrote to memory of 3068	4692	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rosstrah.ru/osago/#calc
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffabf92c188,0x7ffabf92c194,0x7ffabf92c1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,15871723349794590602,4986826445756428782,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,9466995590210196600,17161850200510656458,262144 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,5156371774439832538,10949288411563108545,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9565343249602767072,1396402310985090715,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,7172202264228007100,15074367106411819395,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,9011348557079148346,11685307993628235207,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,6154215707353640623,13105163869883316517,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4164,i,10552440915648136989,3724798391278181872,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,8306676621900384180,3221865409659067458,2097152 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,1579737230703062627,5119624679298200995,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,10249922738536091200,5503897523062154216,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,18152307924349006657,17843269320484396292,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,11330177308815473541,16145273568450417040,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,11330177308815473541,16145273568450417040,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,18061261525753907808,12778397885861174739,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,14322688639072233748,8961871162794535958,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,15926950170286947810,15788543306778687258,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,13631304669612443221,8071326695192768330,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,2012465620620585941,12814981004418381342,262144 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,9418229256916242592,436639266292133038,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2684859855533558728,9409870068925990696,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,6368441885754349783,18056103863582661728,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,15607961447867197094,8347897069929345306,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,2282906705157427570,12629043682643242025,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,8183958269676082688,17499517423311614702,524288 --field-trial-handle=2032,i,11851679328299146528,14279416053404560684,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:14
  2⤵
  PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3168

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0df466f3-6c02-4315-b284-4e695162d2e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0df466f3-6c02-4315-b284-4e695162d2e8.tmp
Size 26KB
SHA256 c7ab6cd44bda7ebdc7c7680252cc6a2bb5e84741a94d553d098f9dfde9685697
MD5 5f031eb37f89f728fb58d1fb5ea1a05b
SHA1 a1414a3b994f95676ba10c656302e2beb5faa557
SHA512 16dd34e027a0d43a1856231e22a79e55ac74d7db3ec1ec9724539a82abc321bc6957d73677f8155a8078ff5eddec76af749f6f57fdfbeda4f408f5b951284cc9
SSDEEP 384:niFtQkUSvc8NC8TUNTUlIl6nMBrHp1c9ckX5mV8S6+z3SR0i3H7vBEndXYgIIlC:iFXc5wgXP1/sAX6wuh3H75EdXYgLo
TLSH
T1DDC229F298E7583AD9AE9B07A33D3E179EBCC117B5845A50F788591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d967402-afe0-4c85-b801-c38f42cb426c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d967402-afe0-4c85-b801-c38f42cb426c.tmp
Size 26KB
SHA256 494299a5b9131abb6dbf98f26059f0d842a13b98b49dd4d96984b0a11af8e260
MD5 05a8a9fa7bbf12329d5c05b90a509a0a
SHA1 64565c53cc7dc1b8f7c2b17133139cc134ab6127
SHA512 c51c9327aca635d72a1bc893528cf955b1300b1e35700e3060103b0fcefd3ef464b1655cbef070b2f2dad7ae326607c4b7e56b4d62173466dacbc4d2c5e4f6e4
SSDEEP 384:niF2QkUSvN8N38TUNTUlIR6QMBr7p1c9ckX5mV8S6+z3S40i3H7vBEndXYgIIlC:iFWNKwg0b1/sAX6w7h3H75EdXYgLo
TLSH
T116C229F298D7583AD9AE9B03A33E3E079EBCC117B5845A50B7C8591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c5fcf13-c32f-4aec-aba4-8b7b6f2c0809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c5fcf13-c32f-4aec-aba4-8b7b6f2c0809.tmp
Size 26KB
SHA256 fd730f5554ecba6570c8eef75c842ec34ab872222a2368ccb8326e07a660fb71
MD5 0f429650382630d84f71639f898a21cf
SHA1 f2ce997f76fd119b2ce7610d5de6be24cb2421a7
SHA512 1e6aebdc33e893430f15f02045f6775b868d660a4e929379fb2430a63d4539643df350bc8c06759bb2d0fc05c2d140a20de6a7d02849daeaf31456a315f52b2b
SSDEEP 384:niF3QkUSvf8NC8TUNTUlIl6nMBrHp1c9ckX5mV8S6+z3Sj0i3H7vBEndXYgIIlC:iFJf5wgXf1/sAX6wQh3H75EdXYgLo
TLSH
T115C22AF298D7983AD9AE9B07A33D3E179EBCC117B5885A50F788591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ddf43df-d7e9-49c0-a4ab-5384ed93d103.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2ddf43df-d7e9-49c0-a4ab-5384ed93d103.tmp
Size 18KB
SHA256 4a6d7071cb9fba10c50496df6dceb7fa84552006e90a404c92661d67be8abba4
MD5 86c2a88a7bbc756f38c7a3fb75a48632
SHA1 cca504d80841f60523f753f6be49da8c256c6cc3
SHA512 934bab47b3b4bd1d40926dbf4d0804d262f1bb022878a47bf3ab27c476b5b4d68679d42f516a89bfc4e4eb5de1a94801eb685e636acebe67a1881b0bba89079e
SSDEEP 384:iQkUSvp8NQU6nMBroT1c9ckX5mV8S6+z3SR0i3H7vBEndXYgIIlC:apCM1/sAX6wSh3H75EdXYgLo
TLSH
T197827B32A8396C3B4EF3A514F11A3A5BDEB0D10BEAC81F94D5DC5A1D01DB2DC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

355ebdd3-127a-42b8-bd8b-63eb565226ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\355ebdd3-127a-42b8-bd8b-63eb565226ce.tmp
Size 26KB
SHA256 0aa47fd9ba1747d62cbd099c950d2233678915e32dd87740aec0827d6f482c96
MD5 ad26a52251a9892bdc1b6c0764429092
SHA1 6cbab1854e8634b0671623b2b77618dfdce089d0
SHA512 133be30e71bd53206cf4cd4e13d372e4e4ab0e0978063017f9ef45d0b28ba3131358b1af505bf647ee4f971f5658b9e14fd932496a09fbf1d7431a511c2ecb6c
SSDEEP 384:niFvQkUSv18NC8TUNTUlIl6nMBrZp1c9ckX5mV8S6+z3SD0i3H7vBEndXYgIIlC:iFx15wgXR1/sAX6w0h3H75EdXYgLo
TLSH
T166C229F298D7983AD9AE9B07A33D3E179EBCC117B5845A50B788591CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c9a3d64-739b-4230-b6dc-113aca967ccb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c9a3d64-739b-4230-b6dc-113aca967ccb.tmp
Size 26KB
SHA256 8ef8d793013c1b8839ae0a3ec7b8392cc7fd3af348a271aa878a78b97128b34d
MD5 01020c8ed10835fbd5d6163ff27c7ca5
SHA1 3e37584f3ec13e4bcd7468af7eea82e71f5cc856
SHA512 2894c0a71381bc0f6d0e1f94e31e8aaf97a03acf12b2e22820c83582f75e595fe34c8ce46e3db6610c43ff24114eec85bcad01e65d3f5739d1a72b8639c3a572
SSDEEP 384:niFkQkUSvb8N38TUNTUlIR6QMBrtp1c9ckX5mV8S6+z3SG0i3H7vBEndXYgIIlC:iFUbKwg0l1/sAX6w1h3H75EdXYgLo
TLSH
T155C229F298D7883AD9AE9B03A33E3E179EBCC117F5845A50B788591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4076e605-fe9f-40b4-8096-139444868008.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4076e605-fe9f-40b4-8096-139444868008.tmp
Size 26KB
SHA256 b03d6c49f47101b5e93593f3e9b9a289a52603b5a01f5816ee798708410eb845
MD5 ba4b4742d3722e00d45f68f5f180abfe
SHA1 fdae33a8f2d9afecec9ba2b33b687cd2084a1dc2
SHA512 d0ca268c90b008e3314e3decd31b1d6b69d43a52d0359d9c16856ef532683d087ca2a900d09a9407501243665bfec068eb0779a536c380fc9433703358d9cfd2
SSDEEP 384:niFIQkUSvO8N38TUNTUlIR6QMBrLp1c9ckX5mV8S6+z3SM0i3H7vBEndXYgIIlC:iFAOKwg071/sAX6wDh3H75EdXYgLo
TLSH
T16BC229F298D7883AD9AE9B07A33E3E179EBCC117B5845A50B7C8591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49f458dd-0f2c-4d07-8c49-e8e411dce1bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49f458dd-0f2c-4d07-8c49-e8e411dce1bc.tmp
Size 26KB
SHA256 ea1d7fc4cdca313317e7dbd1037470133a368548dc147c09bff35480f94d9fd9
MD5 7d8c641f43373b9c9fd6bf0e56bd6580
SHA1 f6582348b243172b6d0417ec1cc1f57ec465307d
SHA512 d2d2daf0ce65362dd8ab63d588ca296a8139dcafdc09b63b0515c14f5fa142ad99be26a19b1af2a58fcea47cd15019048328538319c1a97a4fd548d398eb4e85
SSDEEP 384:niF2QkUSvcX8Nx8TUNTUlIl6nMBr/ip1c9ckX5mV8S6+z3SZ0i3H7vBEndXYgIIo:iFWcXowgXVO1/sAX6w8h3H75EdXYgLo
TLSH
T121C22AF298D7583AD9AE9B03A33E3E178DBCC117B5885A50F788491CCC861BFD346811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50e19546-d006-4634-bef3-ce7062008350.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50e19546-d006-4634-bef3-ce7062008350.tmp
Size 8KB
SHA256 03bda33cb3a2c5d83281a4e32bca730582e12c368cc03306fbba6f1062f33282
MD5 44f501cedeb24dd205827c233d2f4c4a
SHA1 1030ff1a99ec98dcd2706cadcf180b0d5242c1f1
SHA512 d60f038afc6c1fbd2be44cd0ef8a04ee8aa26634c322d62d5c2e16a82c2ac3914a559442af8ab8b8d97c4512ef5bd472edd84acabc8a3122fd22d98153e9456d
SSDEEP 192:AGNM6WLkQmiUyWm5GLEbnckX5m9r8SC3+z9U4l0iiF2VU6:AGNM6a0tGGLQckX5mV8S6+z70ii4U6
TLSH
T1EF02E939A8786C779EF3AD15B54737279FE1112BAA852F84DAE80E1D00D769C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64334731-221b-4415-8eb1-d8e51b91a608.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\64334731-221b-4415-8eb1-d8e51b91a608.tmp
Size 18KB
SHA256 c9ae5d829007be5ff0f157a7a7dec804f512d8fc1a30128c0103ca6138306baf
MD5 d74f501bab1600daed437a49e62f68a4
SHA1 3c1a1885341eaddacb6075fddf7409440db6302f
SHA512 0dc2766a0f56056dfe505eb60070b1776aee132415b447ce5dd169129ccc95a141eaea1dc3bb9b81d5bb471fb146b9f9dc8a5f2b14d8432e41272856e96d5649
SSDEEP 384:tQkUSvO8NQU6nMBroT1c9ckX5mV8S6+z3SR0i3H7vBEndXYgIIlC:XOCM1/sAX6wSh3H75EdXYgLo
TLSH
T1D9827B72A8796C3B4EF3A514F10A3A5BDEB0D10BEAC81F94D5DD5A1D01DB2DC234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65acdb40-4540-4834-bdce-ab2594270dd1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65acdb40-4540-4834-bdce-ab2594270dd1.tmp
Size 26KB
SHA256 0338d02fcf1bf9c0921a36716e582dadf9447d803b5a3dbf4af88b8fd808bf70
MD5 d0247e0157d3b1c11f34cf63bd9c8e77
SHA1 dfebf1e5f22b770e4892451f3a1885fbbb6ce2f5
SHA512 59185101fdefb4e8c646c61654cb405918fca6863cd720d2cdb7ea27c7aceba08ee5f443d9b2eba123373e0e3a9f1fd90805f54bfe058ceef6c5c072d2d98322
SSDEEP 384:niFgQkUSvcX8Nx8TUNTUlIl6nMBrHp1c9ckX5mV8S6+z3Sj0i3H7vBEndXYgIIlC:iFIcXowgXf1/sAX6wQh3H75EdXYgLo
TLSH
T1CAC22AF298D7583AD9AE9B07A33D3E179DBCC117B5885A50B7C8591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69ca1ca6-6f80-4251-ba31-83adbd3f31a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69ca1ca6-6f80-4251-ba31-83adbd3f31a3.tmp
Size 26KB
SHA256 f984f52ccab06efad43c83e563927bb59fb78a0e04069625290eedbc0639216a
MD5 33313777a025edd08dae0b7c76646175
SHA1 3e7dad13e785fc729237ddf3ee9be565cff5b69b
SHA512 f6d7aed945ffe044810413e70f7946ab10de7fba29b34c8a311ef65a600eca0b83cd4089e1e79499ba84507d230cf09267ab8b9b2340a27d6c5dba91ac2768ca
SSDEEP 384:niFwQkUSv18NC8TUNTUlIl6nMBr3p1c9ckX5mV8S6+z3SU0i3H7vBEndXYgIIlC:iFY15wgXb1/sAX6wfh3H75EdXYgLo
TLSH
T1B2C22AF298E7583AD9AE9B07A33D3E179EBCC117B5885A50F788591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d8d6e29-1b20-4004-9b90-6f6cdb321b7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d8d6e29-1b20-4004-9b90-6f6cdb321b7b.tmp
Size 26KB
SHA256 072ed40684efc3b7c050f2445d8fa3210ea92efb9e019c06c1f99a003f86f9bd
MD5 06a7b6f046331fa2a4d6e3d8519f8585
SHA1 a8eabd53d2a215277279d1c5032cb449823262a8
SHA512 2f1c367d52e1e93c8bbdaed3657d186871da670e3825eccaae0e295ea49947574dff691e3867742354cd1f299d7059de81cf84c703c5eb385b77147b5448075c
SSDEEP 384:niFzQkUSvu8NC8TUNTUlIl6nMBrNp1c9ckX5mV8S6+z3Sz0i3H7vBEndXYgIIlC:iFdu5wgXh1/sAX6wYh3H75EdXYgLo
TLSH
T14AC22AF298E7483AD9AE9B03A33D3E178EBCC117B5845A50F788591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fe2ab9d-c7e9-45bc-a733-e3c3293ecb01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fe2ab9d-c7e9-45bc-a733-e3c3293ecb01.tmp
Size 26KB
SHA256 bed7b947422c5d0c50eae52f5528076fdcc63fb4df5af6a05a23f38ae6f8d16e
MD5 ff2ff39aec607cff10f459830710d0d0
SHA1 8d2be5bf3cf60c4d832594a000abe02908eef0bd
SHA512 d38fdecefeea12b6f47a789c83c8ab9f09b3ae1d213c926ebfd57dd31ebccdd24559264f3af5244c57c2105c837d38392c224662b0ffce32356d5e9026276d49
SSDEEP 384:niFrQkUSvP8N38TUNTUlIR6QMBrWp1c9ckX5mV8S6+z3SL0i3H7vBEndXYgIIlC:iFlPKwg0M1/sAX6wkh3H75EdXYgLo
TLSH
T112C229F298D7883AD9AE9B03A33E3E179EBCC117B5845A50B788591CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e71426d-fa7c-4250-b01e-753e2ed82fbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e71426d-fa7c-4250-b01e-753e2ed82fbf.tmp
Size 8KB
SHA256 757556a46994f65cb46b55e09ebc79a59cea8c1d4cc190516a8c93c66ceb843c
MD5 7df3d173bab7db2fdba95522e0376b86
SHA1 de6117b9554bb446c210e1a06b1dc4c576a0b1bb
SHA512 3a5254c5c42e45fb34231452dd2e59e73b7fdbbb3d2784e17b4fbadec50777befcd4f2041743472a2040e0a39d77fc7792ae771aad414a9e427a9b8affb8eaaf
SSDEEP 192:PGNq6WLDQmiUyE5GMEbnckX5m9r8SC3+z9RSEMe0i7rqYU6:PGNq6a1pGMQckX5mV8S6+z3S60i3U6
TLSH
T1E1121936E83868776EE3A955B54B36179DE1821BDB886F90D5DC1A1C00EF69C230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8319aa48-c5b0-4114-afb8-43811503bdb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8319aa48-c5b0-4114-afb8-43811503bdb3.tmp
Size 26KB
SHA256 0167d6856198a51e99b5ffe1e28b1e56e3afb804eb2aca9d3ec0dae731b4bfdf
MD5 631fa606f37e71b2ce541f365145eba5
SHA1 e87e1f935d37b2dddf1a06c8a6930afee3f32ede
SHA512 87bc8f017cc657a299de6517d39d7bc117e7771ae3d0cfcfd2884e2529c7f8fca4f2644da85bd13ccee761dbc450ec5e72e8a3b151ada4865a8ffbaafb644fe7
SSDEEP 384:niFUQkUSv88N38TUNTUlIR6QMBrEp1c9ckX5mV8S6+z3S+0i3H7vBEndXYgIIlC:iFE8Kwg0q1/sAX6w1h3H75EdXYgLo
TLSH
T19FC229F298D7483AD9AE9B03A33E3E179EBCC117B5845A50B7C8591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e82a648-b25f-422b-bc39-7c24367b4b2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8e82a648-b25f-422b-bc39-7c24367b4b2a.tmp
Size 26KB
SHA256 433e93d3d1de1af7225078820666e8372e4983d449abc15f0a5d9ca440afd44c
MD5 7a4bb8bab14c7601ea832d88baeece2f
SHA1 02a4ae4029038225fddbe5a5319c8751a46e0390
SHA512 3064d05a299ee2748230e2054fe5d9cb8762db5c252f1d96b230c6cec8cbdeaeb8edbdedef21cce62403ac55414ccb747b8a29e2e80cd8155a927b4d54626cbe
SSDEEP 384:niFbQkUSvc8N38TUNTUlIR6QMBr7p1c9ckX5mV8S6+z3Se0i3H7vBEndXYgIIlC:iFVcKwg0L1/sAX6wdh3H75EdXYgLo
TLSH
T1CCC229F298D7883AD9AE9B03A33E3E179EBCC117B5845A50B7C8591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
MD5 7fe12d00d13e30949f1419fc02757c7e
SHA1 7fe9042bd95f9f143a17aee8b65dd97f8f4eb44e
SHA512 c9251c530a2927beaa3f58a69cd075267ab37b951ce23f2f159ff17f194ed9b03a08d41f5cce2d4dd1a091898135db5440df49406cc67c2f8fa1bd50c44edd4e
TLSH
T1B1D011A2FB32008CE0802238A23B2B282E00820000C30000AA2000AEAC882A2AABE028
MD5 SHA1 SHA512 TLSH

Submit Download

0c6083c8-5281-42af-ade1-64762c345b22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c6083c8-5281-42af-ade1-64762c345b22.tmp
Size 10KB
SHA256 ed7e1a12266829aed8892f71521492538d071c60c8b34791ee12409b12f05896
MD5 cf4e38c4d480ea19a964cf81172cd4aa
SHA1 29babd468cb910ca8f141b3de8ec36d418d3bde9
SHA512 89f078a08e75f85142b987878407db888ecf069675bab9bd58e1065fad7dabbe79011fcb320a44f284ac5cfbbf5089bb4b853a20b92b6bd7637b7799c0c47885
SSDEEP 192:sxZJRVb3b/fisj7i9IdpVh/W6+WNtcp/Y0HD9g++AIgrJ:sxZJb3b/fisjtH/bu/5K+H9
TLSH
T1AB22D8256E38A97B9CCBD209BA25BF53D6F9503291D55F48E6FC851C04E6BCE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a49d104-3896-4c7e-ab85-6a6b7d5f7725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a49d104-3896-4c7e-ab85-6a6b7d5f7725.tmp
Size 28KB
SHA256 552daa55a83b4281ea21029c2d41cd254c5b00527458b33ecc4abf7895535088
MD5 7ccdff2bba6147382ef470b3f2ba1040
SHA1 ae7a8a7600305a20dc0bd6198d866322517791bc
SHA512 22497b154d1e562a122a08cea6c350e12ea9efca498425a11d6c4231ead7e9f382844316d162b76730de26d8244dc024f18b4e83dcbb34852fea8e4a22a302b4
SSDEEP 768:HMY2I87M23TWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NyLl/cu0yjkroBT:HMY2I87M23TWRmjdQVxu1jaKNyLpc3yN
TLSH
T162D2E93B240CCB7E4FC15EADDD1A6F976E9802C796688D4047FA894C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44863497-0a38-4a4e-89b7-ce3e4277aa28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44863497-0a38-4a4e-89b7-ce3e4277aa28.tmp
Size 25KB
SHA256 92aaa3341489ac62768197aff1fd89ece67a7023766a33c9485203b14dee5dcc
MD5 4ddfd5d3a40a692025672b1eacba7f37
SHA1 ca43f86e01b3d5b01d543610682e1a98a94a257f
SHA512 203da819fac5631dea04f359f20f10002cd2ef70b2ae3dba4f52094f951a906c318612c0312d2af1b4349d5c5395dd2797ad89f561ac8f09ead5e3d18fd6ae84
SSDEEP 384:sxZJb3b/fis366s8qMpRiYnazAW8pZS15posJWeT+ntZ/bu/5f+9b:sRbL/fh4Mnc7WeT+nj/bU5f+l
TLSH
T1BAC21715A924C83B9EC36D18643D7E33EAEC505212C9CEDE56ECCA1C019D5FDAB47817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63d53767-b8f3-4628-a7c7-a7ebedba1faa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63d53767-b8f3-4628-a7c7-a7ebedba1faa.tmp
Size 11KB
SHA256 771594dc08cba18b7c35e048ab3b76428c13c9e2c2105c7e98b647a3bed81bc7
MD5 8a26b59cd01f901ab0a2df6fc5499d6b
SHA1 7d9b79ceb61e41cf433d228387953b397dbf296b
SHA512 6fc1086bd558a69ef58205658e2b495b5e1eae99241bb19101a3d145d9535984fe01d78cead7715d8e0b04a1248ef1e94f38283f986694b214cd97008895263b
SSDEEP 192:sxZJRVb3b/fis97i9Idpfh/W6+WNtcp/Y0HhKI++AIg5rJ:sxZJb3b/fis9tZ/bu/5T+Hb
TLSH
T18F32E8256E28693B9CC7E209BA15BF57E2F9503251D51F48E6FC8A1C05E6BCE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 5ae440f43bef591bff456df2ef1b8060aec696f0b75392b59926bff1ad80bd89
MD5 ec66248de6f0de0fd8a2888f82ce8be2
SHA1 e873ee7ae33b9b508f6b4335d7c5b6b2142189e9
SHA512 234e652d4c27b299ecaf71a70e3f5884bdff1a4ea78a982d78f76e56693a6e70b267c62bbeaaea69b13339f738e22d1e05ebd9779d479e168f7327a517b723b5
TLSH
T174E026C906CFC23EA20AA45B11B8570C83E1361B93C0AF1E2F4CC5897603040F6876F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3da878983ad730b0724ccce90a2d5d837d900355f7eb9f0afbed277db945fc28
MD5 98409a4d3591e4d92d9986088a25826c
SHA1 915126cbb1ab9fae02dcd0829dadf40650f22d16
SHA512 4730bee3f553806ae530aff1a332e85fec2fdc45a3e086c2653c8561ad10b6c73fac28eabaa21918037ecb66d97fccbcf237d8eb156a031091cd2ff75062a4ef
TLSH
T1F0E0269804CEC22FA20C644B01A8572C82C0365BDBC0AB0E2B08C98E7642184BA86AB4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0a51ebe51de9ea940dd5280b38c66ac71a0b47b40857a8b6026437b5f887bbb2
MD5 2e5edf9cfd552671f3c853fb4dd68e8b
SHA1 ccd06db56634432e8edcfbdb344e976a294fd267
SHA512 4d8349b4a0fde4ba584112b16801f4fbfd9111e38a9c5c6d8e5aa54cd977474013fbbbff845e60f76f6a42e564f0e3329ce981fbf8a05bf8b306561351daefcc
TLSH
T16BE07DC816CECA2EE2C8658751FE630EC2D03A1BD3C0AE0E2708C4CC7687440B6CE6A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a48c14dc4a4125795b696f0c07b486f5f865988a0b5ed38a2d45db71f9db3c69
MD5 12363c08e6bed1e522554c204125f16e
SHA1 367b10100f8635391c702c5a5d08fc6a10a59243
SHA512 3d6b25673cc602fca3cdbb2fafe3d417b36dc8c72e4dab2a63d4fe261e3cfacc7156e2c92a51980b4cf88f22f6eef7836f55c1572e2d81c3a43ab6a6c0697a97
TLSH
T1B08164826458726ADB60917865F722863A3E757037A32F2F0C7CD435AC9773D52638D8
MD5 SHA1 SHA512 TLSH

Submit Download

8bc1be36-5c66-47e0-8136-4d39711a690c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8bc1be36-5c66-47e0-8136-4d39711a690c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3f656414-b31f-4584-999c-feddbd733f59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f656414-b31f-4584-999c-feddbd733f59.tmp
Size 3KB
SHA256 aca9dbbd5ead8f7ce1f7bef67ee09d4249fe2e18c0b538a9da87c2a15be04856
MD5 471cca0a14ea79915de225998b3dd5f3
SHA1 979323ce7e0aabe9e5664113159c2e3631a651bc
SHA512 afff673196038b57b22d9cd6290b2b26298cc134260fa9efe065483fa7c0648668356ebfaf17c938edf1adcb3b09b0806f1df77098ea14218ed81569d2481eb8
TLSH
T12D718BB2D3D4822DC91616F4AB18292ECE590E5483683D3ACDE6FF0E53E2470D254A9E
MD5 SHA1 SHA512 TLSH

Submit Download

40f82220-99e1-467b-b992-1fda4d13c9c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\40f82220-99e1-467b-b992-1fda4d13c9c7.tmp
Size 3KB
SHA256 34dc4a0af597bedca1c52bdb980300b875aaa901391c5d6a7421d5c4e41994f8
MD5 ba538aefa666d58bd1c69cee7d4ff051
SHA1 4b0a64f35cda548807111ba802e61e51bc9aac78
SHA512 80b59bb877624d0ae14fbe81bbecea03756fb83e9bd24abd192f12c8ee5af880d62bc1973c27db7fe782c681efea7a87d9e0ad70d68cede8abe68b49701e65fc
TLSH
T1BE51ADF283E1822DD90256F0AB586D2FCE580914876C7936C9E5BF0F93E2071E354B9B
MD5 SHA1 SHA512 TLSH

Submit Download

4a3ac8a5-58e0-428e-9044-446358eafb86.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a3ac8a5-58e0-428e-9044-446358eafb86.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

c63f9ddd-f58f-49d6-922c-9bbdd2c79714.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c63f9ddd-f58f-49d6-922c-9bbdd2c79714.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\904eaa8c-5b5e-4f51-8012-a32578e989eb\index-dir\temp-index
Size 360B
SHA256 b03c37169d614bd7b6f21a0197fd79a1563b174cab7127fa1dec9b862b5aa7e2
MD5 65c3c0935b59e2774b267cd9181dda6e
SHA1 d59ee0e4bdfe004c9ce589bf776e6403c48f92bc
SHA512 dc17bca4965af46364e39ab21cf02f88bde6e6124107e8746917fb29eb915a881a31a600f89bbc1ca5d4185896eb7823e99b7c0ce0d958dd9ebb04b328bb629b
TLSH
T1ACE02B9A1D235347FD0540B5203D64B6B63224EC63242B0F60FDD026888A384BE07668
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\904eaa8c-5b5e-4f51-8012-a32578e989eb\index-dir\the-real-index
Size 360B
SHA256 243d7164c96cc66e5abbec65259122341a7531041e5836b3aa9ee9ec1831a35e
MD5 c49c95f76175b51bfcfcee8f970bdee7
SHA1 4ea40ecdbe1f357b21157a6a563b206751728506
SHA512 853706460d3663b0da4317d1a1d30c394e307b6f9837c486edb6a6da03d04322d2b3cf50711d203135cbb6347ec4e0a7bb254a6a93d4068ba5a5e931bd7327ed
TLSH
T164E095994623D286F8080031347F61757671140CF330270F61EFC055CC83F545E02F14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 1c4050934723a8056c75c7889822799ab9b72b9a7b6217b33d0a436289e821ce
MD5 5210c9bcb8c51ce5ae35fbc4411fd424
SHA1 ae886ad3dd1d0b22523395fe66457075073f8040
SHA512 a9ab796b49413282b96ed5044d880889072e7561d09838388bc3acff024c9720d5bd520347a96f919331f0dbe35f2398efa72cc7cf9b509ec3b34753493de45e
TLSH
T192E068B32DE32474B9AB83DA30B480A00185BC588848EC4E406E63D790B2361349AC5B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 71bf43ed29503a111044e0fa4f896c7095456f181dd930c4cf72473b45a432e1
MD5 fc2d888d7c6c91d4ce2c423437d07293
SHA1 068305bd594e9b9d345d9fcedcce82579df5e890
SHA512 9f83cca3046131f58dcbe18696908903a365ec2da967f50deb3610b3164f23805d7e2ddec7a3a6336ac60c4c5dfb124247674625defba360e06e2d9f526d3770
SSDEEP 48:KgPIZKcwELyB5ylZ/XH2xXA9IGZ2KPTHL2bBmQo7dZIFKao4Xya:KgPqKcwaymgKbqEZWKaoKd
TLSH
T1C8912F64717B02C13A7E2A184379862B468235B73518FA2F3FBC84A16E37E141DFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a33b916b-5f53-43a1-a633-e6c979cd0904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a33b916b-5f53-43a1-a633-e6c979cd0904.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0187b27-a344-41f3-a6fb-a63d7096c94c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0187b27-a344-41f3-a6fb-a63d7096c94c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bed3e030-fa2f-44c2-a8d8-1fabf5b2dd7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bed3e030-fa2f-44c2-a8d8-1fabf5b2dd7d.tmp
Size 10KB
SHA256 328215b26a548a2478598bd7b2dea9ef7350e2a4192f27c78f0ae479de417b05
MD5 e317d75865297d26738c4c8d723fe461
SHA1 5c680cbf0168c06d1cd0eaa20e3df28d96dcea71
SHA512 538d29ef58a48f828ddada04fd8faa5ab8383d7992e3ee3f0b976797503fd4df1c52ea43f8daac0edeca249c0158e2221bf7cfa581fcb77f0906f164dcf26fac
SSDEEP 192:sxZJRVb3b/fis97i9IdpVh/W6+WNtcp/Y0HGXg++AIg5rJ:sxZJb3b/fis9tH/bu/5B+Hb
TLSH
T15432E8256E28697B9CC7E209BA15BF53E2F9503251D50F48E6FCCA1C05E6BCE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1724b87-aa66-499d-a409-4eee72d61469.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1724b87-aa66-499d-a409-4eee72d61469.tmp
Size 10KB
SHA256 c8b4533ff3fe41c1208929cde8459034a14ab96be60dd7a25ef3ccf7f28f7d1e
MD5 77086200279a6cf14c5b77de43e32376
SHA1 4d4064ce715571a7548057d2d548585b381f1c2d
SHA512 9d2812fd85d399d25bd118ff9902af0d4c78539ac0a3750bc3a807d024c2a33ee345721c98f97bb33736525cc1e9b6bf273bda3eef7ac263e7634d5f2628d952
SSDEEP 192:sxZJRVb3b/fisD7i9IdpVh/W6+WNtcp/Y0HDrg++AIg5xJ:sxZJb3b/fisDtH/bu/5g+H1
TLSH
T18A22D8256E38697B9CCBD209BA15BF53E6F9503251D51F48E6FC8A1C04E6BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b3eec2b6-f1f0-41db-9a70-88ba1788993e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b3eec2b6-f1f0-41db-9a70-88ba1788993e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2864fe2-6092-4ee5-81ef-9fd2194d3bca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2864fe2-6092-4ee5-81ef-9fd2194d3bca.tmp
Size 26KB
SHA256 0357fb4be84363c9c549750230827ae35578d64d8b0eb0412d0bcda22ae214fe
MD5 1c2d761a6c1d7b07080c33463ace9262
SHA1 a361df445aa8a6993f4d14bdc65eff820d27a3ad
SHA512 a57f2f972f7ab72d4344bd234f78765bf0f9ac79dae9b89828c56924aa4508d755c7eb0535bdf91fb39c8b470c0d75b44cbe00fb9af796e7518d57d6fbbd729f
SSDEEP 384:niFGQkUSvs8N38TUNTUlIR6QMBrUp1c9ckX5mV8S6+z3S/0i3H7vBEndXYgIIlC:iFmsKwg021/sAX6wgh3H75EdXYgLo
TLSH
T1B2C229F298D7483AD9AE9B07A33E3E179EBCC117B5845A50B7C8591CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b01fd049-6d01-4282-a02f-a010ff03082c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b01fd049-6d01-4282-a02f-a010ff03082c.tmp
Size 18KB
SHA256 3ac7468747fd61e55a22252936f635b577e3617e7efceb55c934104e3049a053
MD5 3da7059ff8892073fe1ad47655c3a162
SHA1 88f34440538eac05a8cf33481fb0dec2c8308262
SHA512 90711ae7e7a9a8fad4129eccc1b65ace05a1137293556da96abce4b11f4385b96761ab4d5bff3593924951d865dea4c75cef4b93a294a14e0f6fd4d49f9dee04
SSDEEP 384:JQkUSvz8NQUtnMBr4T1c9ckX5mV8S6+z3Sx0i3H7vBEndXYgIIlC:rz3I1/sAX6w6h3H75EdXYgLo
TLSH
T17F827C36E8396C3B4EF3A514F10A3A5B9EB0D11BEAC81F94D4DD5A1D01DB2DC230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9446ea7-12a8-46e8-a98f-e3c895f5553c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9446ea7-12a8-46e8-a98f-e3c895f5553c.tmp
Size 26KB
SHA256 443777c1ec1e439696298157505987ea369a4ad6a2413efd386650b84a273c9d
MD5 176dabb445565a9ab9c0d8c77f7e9be4
SHA1 dcac7465b4bc5b4f2f4b73d2fbc9c4ad06a4917e
SHA512 c17f7b11e8d0fcde8c3b11b7aecd34b12b988a5ebeabd0f2a798bdfb96146c3aae755db2dcff0ca081773196acfdd8976ef69ddfe73140cdb709696808dca53f
SSDEEP 384:niF3QkUSvf8N38TUNTUlIR6QMBrbp1c9ckX5mV8S6+z3Sy0i3H7vBEndXYgIIlC:iFJfKwg0D1/sAX6wdh3H75EdXYgLo
TLSH
T168C229F298D7483AD9AE9B03A33D3E179EBCC117F5845A50B788591CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bccbd00e-f7a2-4410-b28e-a0cb8a8ef10a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bccbd00e-f7a2-4410-b28e-a0cb8a8ef10a.tmp
Size 26KB
SHA256 67c08e711ae3e2d38416b409c2b46e0e0f11dc99f2c92ffe334b5a9e5f25278b
MD5 dcb84112c42f20bbf3c7a007b658306e
SHA1 ef89cc0493994002469147ef92b413263fbbb76d
SHA512 e20f0572db8dfcbff4872b4436b6c2dab9c28acb373978ae95ca993fe80ff88ea1fe1f2c130c472813dc8bcc804ab939f50ecae2ebc483032084c11b3d3a2a53
SSDEEP 384:niFDQkUSvE8NC8TUNTUlIl6nMBrgp1c9ckX5mV8S6+z3SU0i3H7vBEndXYgIIlC:iFtE5wgXW1/sAX6wjh3H75EdXYgLo
TLSH
T148C229F298D7983AD9AE9B07A33D3E179DBCC117B5885A50B7C8591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c737d672-6398-46b2-b7fc-1c41f77915b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c737d672-6398-46b2-b7fc-1c41f77915b2.tmp
Size 18KB
SHA256 a9b9686c03ae259ec09df9337d13fd1b5ae2cae7303230a95584a97e50b57b78
MD5 91ea5b048f06440e99a3c94a676c5703
SHA1 8e401fc626c951e3c5cd83da0f27a47be1210c76
SHA512 c6cffabdf7c0993ccfdada69a9f42acfb346020454954825c7db01df5790ae75071e3aed09df2378dd5cd86bd7f837a4a83b2915c1485df8f976ffe8c6be7092
SSDEEP 384:xQkUSvj8NQU6nMBrrT1c9ckX5mV8S6+z3SI0i3H7vBEndXYgIIlC:jjCV1/sAX6w7h3H75EdXYgLo
TLSH
T131827B32A8796C3B4EF3A514F11A3A5BDEB0D10BEAC81F94D5DD5A1D01DB2DC234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7b0359c-36a5-4b61-bdf7-d74f8b765b7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7b0359c-36a5-4b61-bdf7-d74f8b765b7a.tmp
Size 26KB
SHA256 6426476ef1e4a78f261f4dddc4d97e2143bbade980c8612e0bb121712fcde6fe
MD5 fa02e882d595485c09f065b6c82db594
SHA1 e002f77abdeee98fcbae16c340dff0c8dd2ae1fa
SHA512 7cf6ff6ac6f48c0802186a141c31ea7ac25f1906c6ce1d6947f3889c44ca7ec56beaddbe918d073248bde40279d884bfb40bdd5dcf4140a1751f9b5ae4fe5ca0
SSDEEP 384:niFGQkUSvL8N38TUNTUlIR6QMBrYp1c9ckX5mV8S6+z3SC0i3H7vBEndXYgIIlC:iFmLKwg0e1/sAX6wRh3H75EdXYgLo
TLSH
T118C229F298D7883AD9AE9B03A33E3E179EBCC117B5845A50B7C8591CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e614f2fe-819e-497f-8e9f-52f928bae69a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e614f2fe-819e-497f-8e9f-52f928bae69a.tmp
Size 18KB
SHA256 fd3d68e0dcbd05947c18e45bc08387372aed69fecafb4b29e466caafdb551532
MD5 55ea1b380f826ce1293526e3e363ef9b
SHA1 95b7f23611983fe4d96cf64e8e68f3a755d51ce6
SHA512 62f71ec1c573d0f838ae63a246f1afadca965424807846cda1b46da6da3cf311e57b18c4da3bf7f8ce28954b0f81c39de7c7cee35514fd537e4f7ed31e30a6b5
SSDEEP 384:uQkUSvz8NQURnMBr+T1c9ckX5mV8S6+z3SQ0i3H7vBEndXYgIIlC:ezbe1/sAX6wTh3H75EdXYgLo
TLSH
T1F8827B36E8796C3B4EF3A514F10A3A5B9EB0D11BEAC81F94D4DC5A1C01DB2DC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e99d7874-6947-4f15-8821-692036be6d73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e99d7874-6947-4f15-8821-692036be6d73.tmp
Size 26KB
SHA256 72b0a677785eaf58886a731bcc8e33c13a422c18a2b84ff4c0b9a4c43fa46769
MD5 b425d8b84c1d47535088844084273491
SHA1 caf01a512c397be8b3c426d6b655e2fffeee7916
SHA512 199077af066813f0bb56500ebf5137ad1f2db437afa2d0c1cb2ca84c512583d293f797b6136da295aefb28f059ea8ea99afbcff44bf048a60e3ec5e2aa8621b7
SSDEEP 384:niFJQkUSvj8NC8TUNTUlIl6nMBrxp1c9ckX5mV8S6+z3SN0i3H7vBEndXYgIIlC:iFrj5wgXt1/sAX6wmh3H75EdXYgLo
TLSH
T1DFC22AF298E7583AD9AE9B07A33D3E179DBCC117B5885A50F788591CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20d45344-02fe-46fa-ad03-9560d28eada5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\20d45344-02fe-46fa-ad03-9560d28eada5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

www.bing[2].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HJEGGMEO\www.bing[2].xml
Size 6KB
SHA256 03f75cae011f453df9ed9755ac00fb6529210d12fed68e3918c94c13f95a92d2
MD5 52000bfd4fb113249904c9de11fe61e1
SHA1 f1046c70b7c76a19330bf6003a3a1b59fa90a364
SHA512 38b8d0e7405cceaf5829343f2e2eccbad77cb907117ad4bb77d0f16d240d38e925ee9b6009ab60fd29bde4ef748999ebe161bfb9e45911d6ca3dba3a80196c65
SSDEEP 96:GE6aguvFGyZn+KglSHv6aauvFuyZn+Kg8HxR6aUuuOk3/FnG7jFHP6aUzuvuaugw:ayQlaEyQkrZBpNbKz+2R
TLSH
T140D19A72E1F3DA7A496E71A1E664BF4C93CFD71B6BC1ABF694018586239410E4E230CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-722-0x0000018349820000-0x0000018349840000-memory.dmp

Download

memory/2008-802-0x000001835BD50000-0x000001835BE50000-memory.dmp

Download

memory/2008-721-0x00000183498C0000-0x00000183498E0000-memory.dmp

Download

memory/2008-713-0x0000018236800000-0x0000018236900000-memory.dmp

Download

memory/2008-684-0x0000018237AB0000-0x0000018237BB0000-memory.dmp

Download

memory/2008-681-0x0000018236640000-0x0000018236740000-memory.dmp

Download

memory/2008-671-0x0000018236800000-0x0000018236900000-memory.dmp

Download