hxxps://rosstrah[.]ru/osago/#calc

Analysis

max time kernel
900s
max time network
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rosstrah.ru/osago/#calc
Sample261107-ryzzaacw9w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3764	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{BD9555B9-8B41-4024-BDA6-84B8B24464B6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3320	1264	msedge.exe	91
PID 1264 wrote to memory of 3764	1264	msedge.exe	92
PID 1264 wrote to memory of 4976	1264	msedge.exe	94
PID 1264 wrote to memory of 4976	1264	msedge.exe	94
PID 1264 wrote to memory of 5268	1264	msedge.exe	93
PID 1264 wrote to memory of 5268	1264	msedge.exe	93
PID 1264 wrote to memory of 5268	1264	msedge.exe	93
PID 1264 wrote to memory of 3196	1264	msedge.exe	96
PID 1264 wrote to memory of 3196	1264	msedge.exe	96
PID 1264 wrote to memory of 3196	1264	msedge.exe	96
PID 1264 wrote to memory of 4652	1264	msedge.exe	97
PID 1264 wrote to memory of 4652	1264	msedge.exe	97
PID 1264 wrote to memory of 4652	1264	msedge.exe	97
PID 1264 wrote to memory of 3944	1264	msedge.exe	98
PID 1264 wrote to memory of 3748	1264	msedge.exe	99
PID 1264 wrote to memory of 3944	1264	msedge.exe	98
PID 1264 wrote to memory of 3944	1264	msedge.exe	98
PID 1264 wrote to memory of 3748	1264	msedge.exe	99
PID 1264 wrote to memory of 3748	1264	msedge.exe	99
PID 1264 wrote to memory of 1364	1264	msedge.exe	101
PID 1264 wrote to memory of 1364	1264	msedge.exe	101
PID 1264 wrote to memory of 3216	1264	msedge.exe	102
PID 1264 wrote to memory of 3216	1264	msedge.exe	102
PID 1264 wrote to memory of 5700	1264	msedge.exe	104
PID 1264 wrote to memory of 4552	1264	msedge.exe	108
PID 1264 wrote to memory of 3308	1264	msedge.exe	109
PID 1264 wrote to memory of 616	1264	msedge.exe	110
PID 1264 wrote to memory of 4308	1264	msedge.exe	111
PID 1264 wrote to memory of 4308	1264	msedge.exe	111
PID 1264 wrote to memory of 3404	1264	msedge.exe	113
PID 1264 wrote to memory of 5996	1264	msedge.exe	114
PID 1264 wrote to memory of 5996	1264	msedge.exe	114
PID 1264 wrote to memory of 4412	1264	msedge.exe	115
PID 1264 wrote to memory of 4412	1264	msedge.exe	115
PID 1264 wrote to memory of 3952	1264	msedge.exe	116
PID 1264 wrote to memory of 3952	1264	msedge.exe	116
PID 1264 wrote to memory of 4136	1264	msedge.exe	117
PID 1264 wrote to memory of 4136	1264	msedge.exe	117
PID 1264 wrote to memory of 2084	1264	msedge.exe	118
PID 1264 wrote to memory of 2084	1264	msedge.exe	118
PID 1264 wrote to memory of 5852	1264	msedge.exe	120
PID 1264 wrote to memory of 5852	1264	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rosstrah.ru/osago/#calc
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d0,0x7ff8216ec188,0x7ff8216ec194,0x7ff8216ec1a0
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,9699887953539764215,9251108304037053153,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,4820989406333758319,4881829728480481606,262144 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,10225521661623725470,7777426604869780594,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7155072801842275754,396391206005716559,2097152 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,16555615620670685394,14623518630571814239,2097152 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1958228830493368139,11474786189868248678,2097152 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,4110646498735617367,8137845062965493884,2097152 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12539645784670052174,6690105769588865808,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16539852938614045566,17233608206418040307,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11405579277473813876,9894692815241782767,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11405579277473813876,9894692815241782767,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,5359128807810462344,15319773567710890607,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,17706244645603957635,1353464215459547822,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4907143346076908286,12468546451277561282,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7020613704619856636,1469943937700610372,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,6500859703062996345,8074982097181312833,262144 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,242698864434247846,5921199204045254932,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,16454673578610878618,1156017757394123443,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,7637598822862224070,10872263403030615618,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14709240201268617028,2578242746429212463,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,16253889545545352741,2503312901122853172,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,17373986465106606656,8882756325615984952,524288 --field-trial-handle=2412,i,10292648252146726911,15066959415678428450,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3308

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2181dc4d-cb69-4b00-b2c8-53227edb569b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2181dc4d-cb69-4b00-b2c8-53227edb569b.tmp
Size 34KB
SHA256 9e4403377e76a9688cf6b095851111d19a63497d3d309ed01a7032793b5145ea
MD5 976b5cbde40026549fcc0460c88d3221
SHA1 be44f73d9689439e1301a6d83363cb025a41e9f6
SHA512 59605761c2951b2755676e8cebada82eb55d8e8e050a34285c8d65a4f386ffee4824371cf604e16ce4cf1fa233aedff6cd98e2eef93f42e481e2a35ada92527b
SSDEEP 768:nw3QhZyLK/lbE57Y0GZxJsXBdK8ZnE75ErbLE:nw3Qhm70/JsXf7NkCbw
TLSH
T12EF2BF30E8A19E774DB7D690720A36C7FEB486A3C5C94F94D9EEAB0C018759E134781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b11c906-22ef-4af0-946e-8f23fbc6df34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b11c906-22ef-4af0-946e-8f23fbc6df34.tmp
Size 34KB
SHA256 81f3407f70ffe315bdf2daee688eea8454427f49f7a27c99eceb8a967d859411
MD5 81411e2a93b70e5ec11e2f21c0a4af54
SHA1 2593bfdcf3dd078d2e8a852ef9ac5506542ed6f4
SHA512 5b85af47bd1d2c982b0b516d5d9e48296e1ae18070d20f16c4e2db857e1bb6d54c84cd9b037ef7a8a2d2c5cd5f890b36a41c7e6f5a5f618013abffd407d95ee8
SSDEEP 768:kw3rhGyLK/ldE57Y0GZxJsXBdK8ZnE75ErbLE:kw3rhv70/JsXf7NkCbw
TLSH
T1AEF2BF30E8A19E774DB7D690720A36C7FEB486A3C5C94F94D9EEAB0C01871DE134781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

0f86ddf7-70c4-4d85-bc67-e6c583d29a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f86ddf7-70c4-4d85-bc67-e6c583d29a36.tmp
Size 25KB
SHA256 fa65f8ee78ca58f7a9bead85973d137336bb37fc19759f1df75d38498ada8e05
MD5 687ab9f60bec0299fdf1272294a1ac1c
SHA1 3e3672ccd667d215f53b024a46e58ad8a132ad78
SHA512 923d770fcec119ea3b489ff005499b6941ec9f34b9d114c063b15ed66716503ffa40e0771ac70be7287a3fc27d119461d9c16154ae334e84eacdd4152edb769e
SSDEEP 384:sxRpAMm/ffsh66s8qMpRiYnazAW8pZS15posJWeT+tMW6y/51J/hL:seMm/fG4Mnc7WeT+tM6/57Z
TLSH
T16FC207159824C83B9EC39D18A53D7E33EAEC506222C6DEDA56FCCA1C019E1FDAB47417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52e6880b-4b60-4d63-9047-2f74ca232221.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52e6880b-4b60-4d63-9047-2f74ca232221.tmp
Size 11KB
SHA256 cd4fd8d9153a98137b28cea59f530592b224229581fe0077319c91b7a4bff74a
MD5 82f650623cd92195624e7c16fe0b2e50
SHA1 9e77c1ee7eca1c87ed99eee37b4799174b4c47d7
SHA512 16686a2f0aa1ba4abe910187e508c6fd684a1ed2759ad5eb835371b86084373c643aeb2221e319041859805a5ad1a6169b479e7e936472e246c1b9480c367e9b
SSDEEP 192:sxRpzR0bm/ffsfcv0/zoA8pjoy/g6+WNLxI+/YU2RfbR+GnIgIJ:sxRpzMm/ffsUMWUy/51J/Ws
TLSH
T19832A626AD28A93B9CCBD60DFB557F57E2F95032A0D51F08A6FD861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65dae01f-38a1-4672-aec3-00bb7aa7b788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65dae01f-38a1-4672-aec3-00bb7aa7b788.tmp
Size 23KB
SHA256 41e010f429e425d1093c1a4591c639d89aba86458b523556f0bee938961b2fb1
MD5 24cedc163a580d2120b81ddb473775ab
SHA1 ca234ac2884e14944234b1788d3b94c1e9f05121
SHA512 0a94b58f586f16cec646a166a9d3fde090a86c74076cec412a6b8ef1de15720709cb2435b91400084e3fc030d3ea4dbb98b62893d06d092017b16ae1c0ddae3b
SSDEEP 384:64qajXwfCtgmcFfsO7nKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV+a9mWRuRro+:6JajXKWgm0fsO7n8F1+UoAYDCx9TuqhW
TLSH
T10BB2D93B640DCB7F5FC00AAD9C19AF976D9802CB96588D4047FE984C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 80f67695a66e9edb8ff96863cc4d85269404ed7a2eb908deaaa49d038326d6e2
MD5 94bdb83e8334777b4a4477961739722f
SHA1 79dfd51a7fc2b18c921ecc84c2b9adb5201b2e53
SHA512 1127ffc4fbd98802ff2005815e0ee381b698648d84b173a7b76884093f9fbe8e284ed84e404ec8bed4f84a5e0cd5ec9033eb388ffe3e139010c9cb1806b8fec3
TLSH
T1B6E020C50ACDC21D5246745B03B85F4CC1D13A1BDBC4AF9D2704C4C87743440A289561
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 84fcc2fb438324836d38efa41d7f8b72b44ac96413fd8fb420fba7afa5a05670
MD5 d15b2bfb3537745457ec9cae85fb6e87
SHA1 478abe55274913f905a9e8eb990e313ac99824c8
SHA512 c0b5e7f4c78b8c7d692baacf6328b4c86bd844563b833d6ed9a9797627aa497a2312ab0f397c836d1c2a934c16fd04e720698718da4b26453466c2fb3a92b633
TLSH
T1B5E020C857CDC61D9314654701FC530C91D0361BD3C0AF5E2705F4497B464807286960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f0cbdead4e819bbc83ee7325c6d27615e01d88cac0bc895996e64296544cad00
MD5 268cde21343933f1010588c8dccf0e0f
SHA1 698adf53d7f366f52eee38f8168fe57cf59be997
SHA512 45f9cd76c487e76cec54f1d5c08cbe21af8cc5c6acb090e5c47aaf0392b85d1ae9976cfe556fe1e8f6364b7afc3c297a6e942367ff8475aecffe571245661b2c
TLSH
T135E026C406CEC22EA24CF45B02B85B0C82C0361BDBC1AB8E2B08D8887702840A6CE6A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c475d47fee6b9ac9b18e2bbfb9703ab1c1373415e5fe15f6ea4e8a037296a708
MD5 bf79b3c85e4a7c932f9ba00909c55d88
SHA1 da7ebfa1d96dfb706ff0620826ac46aa7f7ea9f4
SHA512 ba1e9b0d2884c923448dc3198c3d36f5ed17dce27753434c581634bd8710bd6cc494b5eac052c5f094d0d9e7ad692184104db6c0056ac4f21a97c14b4bf1b67a
TLSH
T1FB718451A158D276FF9E0078D8DB6E823972E97FDCA31F018558E43664C6367CB4C358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dd8ed0219c3094bca815673be18db7a711256ca3827c89f634e05c421c0dd152
MD5 687525122bc250a075ef8532775d8c38
SHA1 ca9bf0d4abe5a79aab0fa0aad97b42a5f36886ed
SHA512 92227683820ff20aa147959f4048fdb8e3db91daba6ea228ffff6b871124439f3e07fae61947d0574c70f0d1ad1230315f99e3646f813c5c188db6247b1e3dcf
TLSH
T1325152609184C072FF9E04B8D8DF5E823970EE8FDC832F525698C53958C6267CB8C359
MD5 SHA1 SHA512 TLSH

Submit Download

3c4c1c27-44db-483a-8477-148835760752.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3c4c1c27-44db-483a-8477-148835760752.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3936b41f-2143-4a01-9244-4426518e9992.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3936b41f-2143-4a01-9244-4426518e9992.tmp
Size 4KB
SHA256 1e942a9acd7ba318a8a3c47aa5193d4d5f46b67a8b61c2cabd83b3daafd71ad8
MD5 6ad3b1c61808f62eae542a6111b85535
SHA1 e306d51b1000ef31a587741869f368cfe6af85d8
SHA512 23b1d3027d16c66d47ca7ce1d6d592f04237318ee5bedcaf692af7d4d7171a4214eaf8073ffc0d23dfd71a834e6587abe2be437c3bab787e53efa978da27c7a2
SSDEEP 96:DmOuIuwuC4utsVaaijhnPzBum2uSuHuruh3uqau7u0vugwQ:DFxD74EsVaaijhnP1b2Z+qiAuPzT
TLSH
T18191AEF7C3E4862DC91256F4AB142D2FCE5D1914832C7936C8E5BF0F93E2471E244A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6552d014-ab62-4ad0-90ff-77df00b83079.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6552d014-ab62-4ad0-90ff-77df00b83079.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

669df6d9-212f-4409-a9f8-7514faa4b749.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\669df6d9-212f-4409-a9f8-7514faa4b749.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8affcd00-6abd-44f9-8e8d-dbc829c20a40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8affcd00-6abd-44f9-8e8d-dbc829c20a40.tmp
Size 3KB
SHA256 61d450168f9faf83f2b18d94dce80628c7cab6126a7970c4e3f13fcd10fe9e1d
MD5 62dc76b80833fb311354508b3e051949
SHA1 e7eac15a7b989bff045868103d4ca1b8d933dbae
SHA512 e27c11a47677ce4733a5a6c3d073f2fa17b7b62e2da2f46d8fa75634c9175f8c6eaea30819b5ff08c29cc1e7d5ce118154761545c23d93e1756c6980bc5b0852
TLSH
T1C681AEF783F1822DD90255F0AB546D2FCE580910836C7976C9E0BE1F93E3471E244B9A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\temp-index
Size 528B
SHA256 6f36dff5d40e4979127c58eb506db84ea23e4e42813aa62c79dda449eeb0e61c
MD5 27a044b16c6d28bf8bfe2e794741c4ee
SHA1 09db9144a8a63efc3aecafa274f20ed859921ee3
SHA512 aaf7ef15b715942b7969e559b6773578f17e6a4af761fb0915a3b9691975462ba946da8f338457fa058469f0529b4c8cf75170bc598b3ad23ab7ac45b9a16c38
TLSH
T137F0F15D0E13170DDC19113030397D54537C11CCA3419D4B60EC451D8C96394FE8214C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc2e9447-353c-47c3-91dc-c2db3d743cba\index-dir\the-real-index
Size 528B
SHA256 9f0b9c028204335bbf860ce8de1aa8f2dddb989887cac3602ea30ec6fb046634
MD5 41921b3081d95626dac51155ba5312ac
SHA1 882e25a347b45fc64e1f49817e4e38721d7f75e1
SHA512 207f259041049a57e54989a0b2a8c983de818daee64429853bb3f7b1ad74506757ad3e8ca752ea5e0a993fa3ffeb72f952d6ec5bcb2a1da7ea208e47231eb79e
TLSH
T1B8F0608802239382FC0411B37539B69862712000A348AF0FE2E2441ACC807D4EEC239E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 5c63206b4339cabe7851870cca0b6792a31fdae1c470720b83da138a5811b9db
MD5 adb5b05ee7ca7b6592efbf42e429257a
SHA1 38fa1e92ebba308d64b6f995ccb184fa8dac6168
SHA512 f679d88a81f6e748d5f001f78c9732676df77b9f9da4799f84b4721721b402a462aaf39319586da4751807749bfcb265790a2dcc01b46d8bab97e03e6fc62737
TLSH
T111E0C0FB2DD31800FCDF83E414F344A400457854C4406C4FB42D91D380E13543A97C32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b9104f74-0a82-4e55-9467-176e606b3f9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9104f74-0a82-4e55-9467-176e606b3f9d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5f428a9-4c70-4ed5-9196-14b0530e7a22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5f428a9-4c70-4ed5-9196-14b0530e7a22.tmp
Size 11KB
SHA256 4ef94a8ea55aad37d091b8b337f2ce8b54b319f33d085632ecefd2646b32aaae
MD5 c4a3030fa2ca97291d2ae5696c896095
SHA1 1f14d2abcf2c556bd1959c3ce92f1e9256ce6cb9
SHA512 d894625a80d018a1b7b33248e0aab0b7646ca9eab8ed630fed9e6fa711c515c79e27d26b5b53aa4cd09c03a30e17468f363a756781038505ddcc9b5a170818b6
SSDEEP 192:sxRpAR0bm/ffsOcv0/zoA8pjoy/g6+WNLxI+/YU2RfbR+GnIgDzJ:sxRpAMm/ffsPMWUy/51J/Wh
TLSH
T1C732B726AD28A93B9CCBD60DFB557F57D2F95032A0D51F08A6FD861C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcbd1c6e-0ad9-4995-bca0-9277bd7a694e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcbd1c6e-0ad9-4995-bca0-9277bd7a694e.tmp
Size 11KB
SHA256 48872690aa191de5542023ac27f6ba54ab8e2b8eea9793a52381499e7ba710b0
MD5 ce8880d8138fe7b056e4477bb792b8ac
SHA1 6f0e758fd57910d2564578f523e29e9539b2fc66
SHA512 50caf1be587e0f0041d34fe5190ba09826d1bbd4b0b4f839ebb23321e2e9a785dae267eda38ec614ee1d7d352638464a387b69a09e07e78fd0cb4eacc03ec723
SSDEEP 192:sxRpAR0bm/ffsOPv0/zoA8pjoy/g6+WNLxI+/YU2RGdR+GnIgD1J:sxRpAMm/ffs8MWUy/51J/hL
TLSH
T16132A626AD28A93B9CCBD60DFB557F57E2F95032A0951F48A6FD861C00E7ACD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e2e0a6a7-7179-4a4e-a571-90ffecfb8bf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e2e0a6a7-7179-4a4e-a571-90ffecfb8bf1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9d12fbe7eb545c8f9fa7625a0fa03c146508bd11badc1a19fae8836cca0ef323
MD5 c9bfddf76e4dca0276611f4dad8caad7
SHA1 c268855af1b5a61e9a065bb852299d3452642b22
SHA512 4a9490e6220664a840306ee0ea269ac647c9a3fff7f6655ab1aac692c131a6e2ea77beb3a6087a9440f98ad36094805e7c7b5642d44f02e70342bb97170483c1
SSDEEP 768:G/UxvxjgC+I3EthK/lpE57Y0GZxJsXBdK8EnSHUPpMs:7Zj3+I3i70/JsXf7+Sfs
TLSH
T15103C034E8A59D735DF796D0360A7387EEF44AB3C5C54EA44AED6B0C028B2AD430791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae97420d-afe1-4abb-b212-1b34cab9bbc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ae97420d-afe1-4abb-b212-1b34cab9bbc4.tmp
Size 41KB
SHA256 13fb15f74b69bfa1717ddd926baab435a144a8216493c84a69f681d94e265848
MD5 a804571554e76ae0339adaf39ed26327
SHA1 2bbf9cd26baafebcaa6a562d24c204d8d602f472
SHA512 5064e43b7f3c508f137771f77ad22a476d32da62b6108cc8a913cbc2310b441dc10a626bec95fbfa7f2ca54be2cd819ae9d3d606fa9b509c1140b1d1eb9b754f
SSDEEP 768:wFdH31wgOhDyLK/lrE57Y0GZxJsXBdK8ZnE75ErbLE:0H3Shk70/JsXf7NkCbw
TLSH
T1BB1339F094D38A36D9AE8B93633D3E86ADBCC1A3B4854A50B7D9590CCC861BFD347815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3c774c1-a86e-4d93-babb-14df7c497077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3c774c1-a86e-4d93-babb-14df7c497077.tmp
Size 37KB
SHA256 4d1baaf3f446378093f286077fe60e1100a988ed8dba94bff6fa8f6ba4cf4d34
MD5 44bf1e8f8aebbfd0910ee3f0ffa06381
SHA1 6bfeb79562bed4d94b3ca5344729315505c58ad9
SHA512 db636b52c2eb40d35142169f4da028c5bf56f4bdb626c08db27e84541cac23f6f316a168938755b62335e11d796fefbb3a06f17c4dd66914ad605f0804b7dd42
SSDEEP 768:A/UxvxjgC+I3QmK/VE57Y0GZxJsXBdK8lxSHUPpMs:tZj3+I3Z70/JsXf7DSfs
TLSH
T12A03C034E8A19D735DF79390360A7397EEF446B3C5C55EA88AED6B0D02CB26D030395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f39a8a7-ec56-4edf-877e-51f9fde159ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f39a8a7-ec56-4edf-877e-51f9fde159ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download