4eaeeda72c1352264f13d2ceea4d43306d5f175f0d3c37979f9fb0fd60c553ee

Analysis

max time kernel
113s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12/05/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MalwareRepository-main/LogonFuck.exe
Size 8.1MB
Sample240512-jtkd2aag78
SHA256 78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8
MD5 7ee3aeb93b0fa8dc34893e8b3c0f5510
SHA1 faedf76ced4d16de8832d084be985ed8b32cf20d
SHA512 fba2326c80a69841fa9c97198aa69b0b019fffa591a5f7bd8b38da99f8eb8baa0662c8a4dc751ec38dc7892097175f3b760a7d7e1116aaeeb4b2ffe04b821d29
SSDEEP 196608:WIAlVbD80eclAADocTlPP6H442TXmN1baBwPWQySi6dFNq:FaD80ecaAsqVjlXm7bR+Q95d
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	LogonFuck.exe

Disables Task Manager via registry modification
evasion

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5044	takeown.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\LogonUI.exe	LogonFuck.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3112	LogonFuck.exe
3584	msedge.exe
3584	msedge.exe
4064	msedge.exe
4064	msedge.exe
2520	msedge.exe
2520	msedge.exe
2964	msedge.exe
2964	msedge.exe
1892	identity_helper.exe
1892	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
5100	msedge.exe
5100	msedge.exe
3508	msedge.exe
3508	msedge.exe
3036	identity_helper.exe
3036	identity_helper.exe
1860	msedge.exe
1860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	LogonFuck.exe
Token: SeDebugPrivilege	3112	LogonFuck.exe
Token: SeTakeOwnershipPrivilege	5044	takeown.exe
Token: 33	4608	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4608	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 5044	3112	LogonFuck.exe	77
PID 3112 wrote to memory of 5044	3112	LogonFuck.exe	77
PID 3112 wrote to memory of 4064	3112	LogonFuck.exe	80
PID 3112 wrote to memory of 4064	3112	LogonFuck.exe	80
PID 4064 wrote to memory of 424	4064	msedge.exe	81
PID 4064 wrote to memory of 424	4064	msedge.exe	81
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 2820	4064	msedge.exe	82
PID 4064 wrote to memory of 3584	4064	msedge.exe	83
PID 4064 wrote to memory of 3584	4064	msedge.exe	83
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85
PID 4064 wrote to memory of 4420	4064	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\LogonFuck.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareRepository-main\LogonFuck.exe"
1⤵
- Disables RegEdit via registry modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\System32\takeown.exe
  "C:\Windows\System32\takeown.exe" /f C:\Windows\System32\LogonUI.exe
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kaspersky.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1577745396529901648,16934438385087101290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.norton.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14886097068667596870,874999216377984733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
    3⤵
    PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.avg.com/
  2⤵
  PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com/
  2⤵
  PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.avira.com/
  2⤵
  PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mcafee.com/
  2⤵
  PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bitdefender.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcefb53cb8,0x7ffcefb53cc8,0x7ffcefb53cd8
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,4018556413049760100,15437339995977362410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:1204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d
MD5 0c705388d79c00418e5c1751159353e3
SHA1 aaeafebce5483626ef82813d286511c1f353f861
SHA512 c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cd139b39f26f095dfddd23c2cd952fc1c406e892484ba85e721f8facdcd7be0b
MD5 f9fc35a076573b2fadd8b301c01c0a53
SHA1 ed84db6a159793e0c78e9ae1fb86e2aff6970c72
SHA512 8586f1cbeda359def57bf88ad31d0b8fcf82b58481d74ce0f59d13e33381df071da58a9db922a1a1015e3803f78f1c7b77af021d11a3038c252a60c1c50edf1b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e
MD5 0d84d1490aa9f725b68407eab8f0030e
SHA1 83964574467b7422e160af34ef024d1821d6d1c3
SHA512 f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 938c618698073136c56241d989b9d619645784fe6649b9754b9ea3ef80be71b4
MD5 b93e7a3e85e5edffc185b271f3d8d6ce
SHA1 da29b9e9e5087a54089dc4b0d9d0b2c1c2e8e2c9
SHA512 87d8807a4a0ab71f50371115af93fa621099fdc9e2dbfe33ff259d7fe7505990d3c9f884b7891323541ee118cb81c9c20dcae97135e985876888209a7d25b548
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2fcfacf40ae20379c061bef8f565607c4335a58540f0c8feb858a34bd890ed55
MD5 8962256ee620d9924416bd432ff3f0bf
SHA1 947ae0913d81463764ba86c2cd00ca1aedbd1a83
SHA512 57515889972816bd909e486e64bd66d56bfa6caf67235acbecd13f3c9788800650afc18613b0d89f4e862bc80a82b83554e5c437ac4bc165aca8084b73f8a9ba
MD5 SHA1 SHA512

Submit Download

26e49545-cd10-400b-8968-77d4a6d3f607.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26e49545-cd10-400b-8968-77d4a6d3f607.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 cbcea3274939b09a159b7ef61a684b1bcde6c40c32deb70f24ce48d14b3c3c54
MD5 83d0beba0bde7c119907954f3b1e184e
SHA1 340bf6cd1bea2127f5ffb1000f0ed58f69fe05d2
SHA512 b364e04e9a219388eeda34119058098b86cd42efc4b39b8323405eb13773eafffe7770cf986e8bc6f4b63b91f909728ce8a1167d18a32b4a7e095260177e6244
SSDEEP 48:umKSFIcDGA9FGkud7OV2+gND0TdjgCfe0F7gLCzRn+Yb2XnG64dDgWep:u71sGic+gND0TdjdfetKN+YbLQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 c345e5ebd0914b724ffb0dd88ced24d86c765713fd053eb3cc76f068b97a9eeb
MD5 84101ed519e2a779e940ccb7a87108fd
SHA1 22d6ec74f0466000ec1f4dffeb127c1c68cd182c
SHA512 ec978b1426897fa64178661e99f83399db5d173e74181b8c65a5c53f2ffc1fdb204801fbe7bc779f89dbb0aea91f1209a4054bbe0790d3b7293927183827eaf1
SSDEEP 1536:spmpwpUpvpjptp9pYpFp5pJp6p6pkpBqpCpCphpBp1pMpwpdp+p1pMpUplpppRpi:
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 b0bc31710b565b8acc06ef67463c3b5c80c2a7c31d27aee4353b31a238999ecc
MD5 36341116c666a2c3ac968d71b88cfee1
SHA1 6400fece79abb3614b56430286720e731655af59
SHA512 f0521fc92af6bf89483fded5079169377c98f38718c38bd0ad729729853a07dd0e4fc9f77c9e5fc72061048d10c75a6cc66f7ffdbdd84a6a94fbbc7394d14023
SSDEEP 768:AIowVEuCVGbQ4VdTs9qP7QYxQCqs6h3ceWirSeJ+JbBOc1ajU:swVujmgwPsYxah3ceIJbsccj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Size 4.0MB
SHA256 d11bbcef929fa7bb038031639daa8966456531bd84e440ba33d9d6f2c3bedba4
MD5 2bea8fd5bb40632c08c3a6a9a65444f6
SHA1 d4cf2c4e3c5ba3c265818333f41471f7d854f79d
SHA512 84f638d9cb916d2444b60a732d6318c2c939bae734620c39a934762f1a2bc9b146e8d0d5658eb8200bae2872b37e89959a5eb0a4ce10b12f0a35fb4e43716117
SSDEEP 6144:t2aiQm3Vb3HYy2bqIjJbG1rFx5E+NNHUal3x4vwPbPL3WW6f:Zh+VJ2bB9bG1pDE+NCy3xE8PL3WD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Size 36KB
SHA256 3b14ad4d4df0e681fd5aba556473e39e52b31ab98f51dc3db4937bb641a6d667
MD5 62fd1704573f0a1ae4c7db83f9f5b470
SHA1 09d03a37492cfd0580ed3b819386bbc4ff64d960
SHA512 c8108393f8bb91c018ee06ad51d746a33e24ad9041d5cd84792e4c59fb55639b8042ed5c1a424b47263652182ceafe516d0b6adab147e33bbf261d6aee1d3f84
SSDEEP 768:tT1mHj2nizU2Gv+doCRUI2k1aj/nL9esQZQIzYbgmrg+6nBYRH:tceiIIR4/pesQZQoYFOnBYRH
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dfb60baa43c17f0772033772f51e62594433b868951ab950b2a9de1a906556c5
MD5 d7f2fb5c851afde023d237091f1bafa4
SHA1 e00b7f91b28797a28973da0bbb7a81b168104fbe
SHA512 02b077c54baff0a65108de2f1a5d4308ee4c2dc80a23b24eb91e5f20858a5ac5eb007feb654ffeda0e680c2e060037cba1146b11a488ca899b7c268dc9e5ffa3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3ec69225c4f221d8f02063ef5213209b5afb1a8038bf8e99f21b2962d40ff953
MD5 1af3164933d62985f1691a3563c1505b
SHA1 c416f98c522a59f4ec1f8c632ae25cff17f10ddb
SHA512 f5f6acbd74effd8c08c6cdecfc621d854e4bde1f4466acb4d660158911185108340ffc67a2d5bd4f5a6e373b6125340b3d3bee91a8e284714eed55214eeed6d8
SSDEEP 48:UJau65FTz2UegHuChjM7aoIyohjaIO+Ks42rucWBnT5tLZIHmdt/CUnjMj2GY0H2:n3f98WyETmb9u4UAyHwTD5YWmy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 20KB
SHA256 4424dc1845586f5d5a449587ea0a70da3fe56d1400068b061116397437e4f42e
MD5 601d2af32651e2eca98abe3531d7ba03
SHA1 463f51abc326033a65bf8d5935789143e0875079
SHA512 df74c86440ec8b7d89877ca4c85850d31415262abc800ce86291dc2937e1429a722101b2eeb3663bf4464ddaeb82fafe77ae777806416f35ab70b317381ca1f5
SSDEEP 48:TrLOpEO5J/KnvmopUOZD8BNikRzR7BYj3AjODl6dI15BdOmfb:TNwCz2sZWeXhb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies-journal
Size 12KB
SHA256 7ef682ae441878b120b3c910871d818eb97f1ead1802ea958091657d3473298e
MD5 a6850b27a7c25ab9dfc41815b8b3ab4d
SHA1 e6ab27db4f02f60a0ec4ac07742e16db3e7e69b0
SHA512 096cd255c4093645c5961df61f8103779004df6513de295ea106f693f67f4467b0c816a6641230156af95281cd9aff4d01064a1a97f3c8d9cac8f6ae4925077d
SSDEEP 48:t5BdOmfeikRzR7BYj3AjODl6dIHyqrLOpEO5J/KnvmopU4:tXhnZW0ymNwCZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 116KB
SHA256 cbc705010c78384fc311b7f0e9d1e8ffa5aab79290a2b4b71c7fcd16c0445cf2
MD5 fc1a9e219000329db84c40c1d15fa9e4
SHA1 c37616b56cd4300f63db01e9c2d959d7d8a76b3d
SHA512 1a38df9459f0fefa9c6da57a0dd259a6905ef32153c0717bcfc770ed5149b1a66cf5a701ec294e4c6d1db57ec480a82d78cc6812968e0ce6bfc6f7f21627635b
SSDEEP 96:gLcU2TWIU+bDoYysX0uhnydVjN9DLjGQLBE3u3:gN2TWf+bDo3irhnydVj3XBBE3u3
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 1KB
SHA256 d8ce6cc0fabe94ddef64da93aa28eb9a5548ecf49e73da9bb91538a68c0e4e48
MD5 2412747d21ad147d58aa2a8366c84f5a
SHA1 ce0ed319d0fb9634dfa1ff89d744f31b617ccaaf
SHA512 e55eef61f4d887ccf756520a6ad17a4b59c29c5730718b86c4bf4f2544fdb08d18ebf741229d19f83f07ec43e4ffd885ce4b2422322a4aa572252ebcd7d46a27
MD5 SHA1 SHA512

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 28KB
SHA256 c22f5cd33822389605ecbd00560e038dbd6a4225843423ffb098366190d72292
MD5 9e8cf66deac4add270ce1f0a61c77227
SHA1 e559c498731bbbbaeb354b94c79dfb50941a2443
SHA512 2b73d231166d77f2d0beb1c080041430e995a02b417d1cbe0dfff618a1ffd835b86116a4ceed52a435c1540d11dc922629fee97996bd3f948840f9ea7009a2b8
SSDEEP 12:p2AxdxN2dFWlqfQ7V/NPf9J7V/Nv0fqy7V/N439Lj0DNs1Em2astMtBhMiE2T2h/:fxmFWlpZJZ+Z6N0DNuenih22T2J
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 680B
SHA256 31eaa5d1825390cbf59cb45d9d9bbe5a51ec1468e751cccd977bdfc1dbec0cd3
MD5 8e66ddf0a29aa152e7a0ba9857d8abe0
SHA1 2944fea540545e50150dfb1ea572372120930131
SHA512 619a7c7c56a9d6b14606a6c9953b1584ce650d522a961ede5216f4dfadc36835d31614bd5165825f500c47496914c6dc86660f1bd380792dbd9467abf6f8fa83
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 651c6f01059d186496cde1bb0b318dc10ae346e39481d12717e13e94a045efaa
MD5 0aef21ccee7fdfe564a5bd5c206d6071
SHA1 c10218c68ffc64250615168cc610e2614b1be0e6
SHA512 de4d1320420d3712b0a1f9b585633f2ec34f827e9949b1649e59e5851da8bb9228005b0acd40dc8fb92a8a7f2a7e4c63b14807f84f9887b9537af2cefb581fca
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 720B
SHA256 802f9aaa3d4fdee474fb9a54ef221c955bc1c49a19c5571c9daaa7323a085df8
MD5 0acc6ebefe47863aad7c9f3492e808b8
SHA1 5547bac503466fbb5e8d093596c7f9d984091b2b
SHA512 76ecdfa6fbf65f335ab488a34adfccaf0959f432409c187c909afad3d70fc53b5ba913714dcd851ef334708f7db231de980b7c7741f96089a2720583146fe593
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 96a0620951057880b19f8fb7c7a7c0f80dc9263d1b1378a7348d7c10d0604153
MD5 4ea76462af90f981bdeac6db21d61796
SHA1 f4137809670527695f8b3c08b2b04f44f3cd3169
SHA512 bba3888498501a0cae6123ead3c6afc1be69ac4ea2a0cfbf56f6202d6c45561079a26c0187f4985a9e32c42ef6fb00dfc503838d54aa038e08b03eb61b56a678
SSDEEP 192:JIMQRmMd5gPKyyUaMN2fW6QO+6Sz6Qpzeq+yzJ60J3W/6WNCRJwBXO2y4JtF1R4E:JZmmMd5gPpyUaMN2fW6QO+6Sz6QpzeqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 26827d06fb9cc6bbbff98a897346f61861f675a8f1798b65ccaf6e0ed12c750a
MD5 628812852379c3c1641e22a7adb9e8b0
SHA1 1c4128f69acc0e080a9898e3dbc0c0d907e359ef
SHA512 92484815918c0d6e04a3aee88dab45f7b2938c634830082c7b2cda2009decf683770746d3fac73d3c0e0510a2c5ff94e7486c4deff447eef89bea58b97a9c0ff
SSDEEP 96:nSk3Txm/pQYmt4lk5nwSv0MoiVmdHIfJfvc0WQyV+VuziX3wI3:nSk3gCOlk5nv0MAIxfvcLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 79419cfb5ea9c44fde3ed1cc0e382280be2769993952edd73d190a7e7891700e
MD5 e5aa7fe5e49106586fcdeebfd4a5677c
SHA1 864ad938e67dd6e3b1b0c8e21d35aa1b2c4329b2
SHA512 ef56285eaf5c002ee7f2bae521494a2eca695015bf8d9c6e8fd1db421edafc615fb1a4e992a524a47f736e222f1b42164ed0920cb2e1e666260e72913b503604
SSDEEP 96:nSk3Txm/pnmt4lk1nwSv0MoivHYR5mdFuIS1/2IqJVvu60WQyV+VuAiX3wI3:nSk3gwOlk1nv0MAEuHB2IgVvu6LH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 16ec970b33e546aed8e896b18e16dfddda2ec9e8e3914b7034edf481197f99ad
MD5 941e96db4f0f5a6b9aab22b7db2cae06
SHA1 4fe25518fe12b6585a62294870013235ba787f17
SHA512 50ec8ad4695cb3665ab828b40ec68ef0934566fa92f807c04eb4fb62bd0805b162c3149089ce7088fc326075318bcd4370e84dbcdbceb2e0dee6723a6d7cda69
SSDEEP 192:nSk3gtOLkUnv0MAduCEuqbuHAbu3C7i1W2Ir2VvuoNLe93:nSeFLkC0LU+AeCVr2V2oNC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 239fdbaf9d70267f604970c6211185d6ec0b4713a035acdf6057155cee8e84ef
MD5 55008f1af7b94694bcde96dc1c486233
SHA1 ca223285435f3feda270da9a1a5382988a9d816b
SHA512 74a3f2eefc2b1583cfea8526894839da4d785e57ef002c49484332ad92ea125e64216e3c36ed723151e9432c57920cabe4920a37f54a3f9167d825785b30b110
SSDEEP 192:nSk3geOLkfnv0MAduCEuqbuH7i1W2I6Vvu1Le93:nSe0LkX0LU+V6V21C93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9cbdbe7a74b4b14a7a0bd4309f321d7faf640425e0b3c67e1561d959ad180ab7
MD5 f13306471d7671bbf16f82042d7dd72d
SHA1 b45e43c26006fd8fcc5da3c205b7141562f7b3b9
SHA512 701a427de37962cc24c0b5526e31c343fa841fe40984f4b1c87b1b2f64d50183d950103f2c5ae6a9af9c7789363e88f1c09f053839b4286c8f7ffbaca1916951
SSDEEP 192:nSk383OEkQnv0M3KKdiCeduCEuqrUFFuHAbu3CMuA3Mg3FuYmme925weKeyWYJhk:nSepEkO0KOUSgAeC23qZCj1a2okF93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 6002d62e3a9df47d09263dd9ca188abf253d916fb37359fc31d84ac109dce81c
MD5 d0348afc29c6afb7711c51ac4d4a51db
SHA1 0b568e8e24887392e7bb0cb97750e92f33bffa5c
SHA512 2b7b8eacb7bb0e68024a49e1c2fb483ab6a4d5e7f84a06b0c74b273342c0f6768170e5b919b20f0b6a8241e009d6818e4fdf71f2d0f4fab7ff5f5101e3b12a50
SSDEEP 192:nSk3ggOLkRnv0MAduCEuqVufbuHAbu3C7i1W2IgVvuorLe93:nSeALkp0LUc+AeCVgV2orC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 43b208b39395c994ef27193969099cd9eca16e10cb23f12fc3e8422bb9ab992f
MD5 02136286c417c19a23ca6d9843899a62
SHA1 fd7b92a7993c072d695fe8b3aa06d54ac67c6a8c
SHA512 ae5d14eabae5ad2392c0d7d91192891cef9d6fdb5e0d82b112669299504ff7d33a1adee92ef0cb403e255d467dca501914d9228b7ac7ff42bdc106bda886b585
SSDEEP 192:nSk383OEktnv0M3KKdiCeduCEuqrUFfuybuHAbu3CMuA3Mg4iq3FjDpTd1Kv5kiV:nSeVEkF0KOUSX+AeC23q1tVa2okC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ceb28434966572b60199f12b9c81deb4fa32ae71b9ed87f8790292a5736c57f7
MD5 9b28ecb1ec7dfafffbda03be44dc143e
SHA1 ff00832410944152c042a93d995b30c10adf16f2
SHA512 c4bf61c7cee23a1ec7e185db2eb7877d72391b51411976ad19e3fb5a97ca21ec846426bd21551eb5a8b0dfa39e5f08b18bdc3d08caac3f68b4992ae25a848e53
SSDEEP 96:nSk3Txm/pnmt4j3k1nwSv0MoivHYR5mdFuIS1/2I3JVvuW0WQyV+VuziX3wI3:nSk3gwOLk1nv0MAEuHB2I5VvuWLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 2006218ec7135f4cdd592e611b230b434e6eae8894302835e0e7c0d0712eec5c
MD5 cc4ed1e49486255baaa03bd153b6ed67
SHA1 ff79016a21ac6804c4cb6531b72c214639b083b3
SHA512 fba695510a047e2659edce9778bec3f12ef6daffdbcb40d19a2dbc48650153442ae50124654fdde0b72fb53a61dfda3e58e91e5cdf99a65b65960b08456291e4
SSDEEP 192:nSk3ghOLkCnv0MAduCbuHBW2IXVvuWLe93:nSeZLko0L+gXV2WC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5f03d18d09e8813d78bbf0bf6d85b19b740cf0089296bdb1d708ebd1b4a2abe4
MD5 993eea7f36db805d0ccbcef161c78bd8
SHA1 ab0dc58ed5346aaea2a67b1a7c2be3e6b6af47f1
SHA512 3110ef1bdefaa5c51b56759ee08d6373d72d2641a7165a9a9eb8fdd5e7cf413cad8725dd54cf5ca43d683d28306c49c22644ff3bbe99ef0d44c2dea7d94d5926
SSDEEP 192:nSk383OLkQnv0M3KKdiCeduCEuqrUFFuHAbu3CMuA3Mg3FuYmme925weKeyWYJhC:nSepLkO0KOUSgAeC23qZCY1u2ooC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 23b94dd4db892916bfddcdc509909e6706b88effa724ad74a1e9371cb3f8b679
MD5 4a022063f04ed0e5310e98053bb54e4d
SHA1 8827cf6efeadc895778f1da9d74932081e01603a
SHA512 3e6e4d4dc77fbc6a8d0ac749b23fca1de71f5308474f097935772c84f7849052752f869183a3c651c0ca0ea983456a34972c82dda1144e869d1e9bb269a985db
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582bed.TMP
Size 48B
SHA256 d085547a8f4b712812bb1f88ba895b51441d0d728a23f07cac7c0cf94593b5af
MD5 36e8f0494c99a68bd6c8149d6bd2824a
SHA1 813bbdbad7a7faaa4c900d3aac162d2fc6bb3c84
SHA512 0e3dc6986b82eda998eb04b6cd3a3644edaf128fe7de210f423d9c2e08496c5e2e443fe2e4c7e928ae682d8a24948d35e277596c1adcfb3783f451186febd264
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 440B
SHA256 c14ae4231992718549feb7e62fe09e7a4151677a2e57faa82933af917737e35f
MD5 bf64f9fd8ffba44b8cf3d286d06a0802
SHA1 c143840f87746f4c71c20efd723074b83e4b675a
SHA512 cac4a72e0f8f6613a1d34b3e81ad5aef772d3d6901e3e9c119147ce00b725a56fb54fdb5fb4f36deb9649c6ac320b841c2d9db7f835f796c20ad030c0617903e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 05acb565e855d42525559322e7ee3bb290abc6475ffce1753ee4b4f8f3dcc047
MD5 45fdf0f1ab681778bf0b2272b60569f9
SHA1 5c9ef599d7312345d47a2da8912c1ad44586d2cc
SHA512 598335294a1dbe86e294d6513f7b08f8a704711e6cc0bfbeb71da821c8ca9d71aabb0ee319351db7b2aa7e8abf4035bec7518d6164113cb9d13c88656920c2cc
MD5 SHA1 SHA512

Submit Download

Session_13359974291654964

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13359974291654964
Size 1KB
SHA256 9fd809552ef9eed0fc2fb02c0f953c301b39d7c1a191c47ca11c72d078ca3af8
MD5 942e8ef89819fafdf8823e55dc393331
SHA1 006cceac5dcb8cafdc118a89e834ded14cc0c694
SHA512 0767f40c74ae8ae1165a47fac475c2e3405a05acb41723d7069a644a4a42a59d29a512c289a5eee34b1a23d44f5e37c37a2a90222195cc83ca70999f47da6633
MD5 SHA1 SHA512

Submit Download

Tabs_13359974291960964

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13359974291960964
Size 1KB
SHA256 ac44153cbe9c6ff49aabcbd6726fd2cdffaa8c41bf3f423220d489f7f7a75a8a
MD5 d146ba952673a5a41f0634e9b07c74d9
SHA1 6ee237d91e9083f9453f8f34099f0d7e32ac1e13
SHA512 e69d5357203c70383edfef96f949befddb98ef19537147cfbac0ce7abbacf08d965e6a9ecc15bf202b835e9afded786bbf1a1881e44856d4e43788720ae4658e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 5a53ac6db998cb6564ab09f9c2c5d21a4e3530de9fe88b96ee146d9671830b42
MD5 b14bd8910473ac3a74fda90beb99ea42
SHA1 a671bbc30a4e9f9f928ac918bfa7f618e4c2360e
SHA512 d73a69fa76e3ba90413d02bbe11927e356c027a2c547a667ad4c40dfa221962c26dc6f37eed8c54e14929ad0dceeb6f9e07a2219317c4dcda4194bf4ef1da42d
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0ac67e7fefd62340bb4c14e2d08b27050a9653481bb0333ffb50520cae1a2b52
MD5 cd03fc01f819decd3afe0685cb53d6f5
SHA1 fe82c822f43b749d824e6155c4da3067e6541e87
SHA512 d9a4987bcd6839ec3704d9224a93d56a838411dfd1f041d65e40f06d39ae6478091bff5dd11372ba7f474a1f2aef5df45ef2ba4826198dccc7112511b752e577
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 df855fa12547c6a96c9b275cbc50a44a710d6e82adeb8f06fcc1c683642b4187
MD5 b4b80afeb0314b0d6f78cec33122aa07
SHA1 d5f1d28232fe60c764d8f5338ea0896d26f666fe
SHA512 c19db1b55fa0d07b6d506fb10b23c6f1f979145edd9a3d811f91ad9bd45dda9d2ecf149690a3344fae28d6b274b85c6b7f86d2a09b058a7f8c84c76ca8cc8985
SSDEEP 96:KUUuLUwUf+UhUbU2UheieUMD+UuU3GUJULU1k2UG2UvUekU37UVUYUYU/UgUQUd4:KUU0UwUf+UhUbU2UhKUMD+UuU2UJULU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 82cd4f4290e870e9f311cbe504b6017b4358af2252ad422b5176910fcdcfc0f7
MD5 c7274cb0a74151b03b805ab7a1f1dcfc
SHA1 2d1155aaa4053c7a0ed9616abada73767c4a3496
SHA512 cbc051890f19136a2845607a6a6d6914cd080d2337417ba55b37808836556e6947df89446cf9dc6c73ba83ba3cd8f33dfda99afbd5bbf9dd84f6b83a0d133257
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 8KB
SHA256 2ebf3da7eb63304424d0d5e13dad924e7e928b7e05207927557f6c87f87fa092
MD5 026d6035c7637cc9070d27f951a9246f
SHA1 5751507c0bbd80694baef3d878fc77e0d26f9f29
SHA512 aa34ea9b72410f0c0cac8f039de3f864fcf8280065ed268bddc66806e96e89b02ce36384cc4ed1fff9909f8737c29d961ad26bdbd700f21677059cc08eb9d63d
SSDEEP 192:KUU0UwUiYUV+UhUZUFU2UGUuKUsD+UuUGUaUyUBUJU6UuUK2UG2U6U0+UMU5UxZ4:KiRxYXAU4HrvKXD+TrDZm2/fOabt+BAB
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4cb3461e09ab713157b6527d4124d384dbb84850eb9594da526d6c86cf25efac
MD5 a3bacff6d9a6d04cefe955c3c5b50e75
SHA1 56ab5522f69c22cce13e2d94f6c178d869745386
SHA512 45510b400f151110f2d8ad96c79bb658876341bcbf3e90a4354a4e26a7841cb1b904c670d5cf7678f0e0eacf462348153d8663b0b959570494026898f9170792
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 31f732d553b626d555b85d2f829fb134347aa722c9765ad7138eb8c4a2204bd5
MD5 0529d45572cc73783b87f84eee3f8714
SHA1 9bd4947c9843037a9880a29b61c8e5260edcdfa0
SHA512 535013004419517dcc7c984e3ccbc2d1040a5ad24e59b05890c74fa3d3b461188bdcd5478ba73c4905bac570de2e48b43fbd66753ab1399f2fdebdcc09a92d3e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 7KB
SHA256 aeb2960c102c31b4ce4bea0e91861feeb4ff9da52a0d5345a3ba507a8c002eff
MD5 7b1a739d792cd9e1f89d82801bd31ba7
SHA1 b362766f52fc362e874d9e03d32a9999108e0a50
SHA512 a682b0359f179ac8ceb4ec89ab688a0631cc4aaa21123e3ebfb112d4710b87a9d54cc474cfac7245a92f85c33e21e61bf1524d02f42570512a67cab73cb81287
SSDEEP 192:KUU0UwUiYUV+UhUZUFU2UBUZD+UuUGU9UJUBUJU6UuUK2UG2U7UTU5UxZUakU37o:KiRxYXAU4HQWD+TrUam2/fOaWWAKwI7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 3KB
SHA256 6df92cbb817061202f517446d6282db95e0dc75d739060819f325a4de74e35d3
MD5 837a06c5255c19d0b1e1d46b6878d13d
SHA1 8d5df5000cadceaa100f6a860cd074f2afaf089d
SHA512 7f267fc3fe4e4f6b833c014a1ff650e7d6d5b2be32de0449d6340ea61c144a978e169af52cdbb858df396547bc125744aa0d4aba2ed1fc6b607a66376dbb9870
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 67e5997f506dcd0b97b7284a0721cca3863e94de1ef199d73c92b121249244d8
MD5 e9313eead9a7f34596174696f6a67e8c
SHA1 6e3618e9fe2ca06213771b3e9f9c4cf58da7f6df
SHA512 08f844bb81d996b828574ae491b2503ef025c56d7f6489658983e195437c76f166d4c7a370c74c2794d19af14054b263ac798186000c3dc619cf387ccb4a8b97
SSDEEP 3:ImtVcukl1R4wRbl/SIKqXl:IiVcrJpSbqXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 579KB
SHA256 0b3665a08706216ef3b6181fe1ab0f3714a1c543e9c27025af416a7e4b141a98
MD5 f72bfd92f8001886a1a405ea4dbac4ea
SHA1 afd422e50a9c3a52444e43f8f41dcc4417811afd
SHA512 c2df26ec8ca79c59f53ec020c685f8a201c531b94b072fa00119d411bfa8f65d983354d02ad299c2c201ad35aa0056730caa51c6dfb907e817610ca0e274f2b6
SSDEEP 768:7iA8zQttv+ZoPNeeKvzlKHoBKIOaKMm3KAeyKycqK6Ic:7xOaVepJMzy/Xc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 e99f3b95c3babe3e74fa9afe76628ba1cf986c357cae5dca6893ee5e2f5de9d8
MD5 72044294d178870fdbe74e7f254477e8
SHA1 8ebaf0c5c643bf8cf29e20ea87eaf65db296438c
SHA512 0923b84a6ab8ca626c733acfd7767644169e4de59b294aaaced6c0814e366d0d9827947cb2ebc2b65159e7faf7a0f8993a35dc13f9b515198b231d88c9a53da9
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 59cdbac83ada53efc44186c013a4fbf4794a65a188b5b2dc69c737fd9306b86e
MD5 5d928f7b52dfc079cf03d9d31a60403d
SHA1 664309580a656bbd8e40de8fb1674c2cb6213468
SHA512 38cfbbe5ea4135d00a7c5027a8ff53dc41bf70914419aed016debedf90ac467c78086f458e33b4ca2a76bd1fe3948c5b83950b882270b8f3660eb36268a3cb2e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 f84dc44ff590dcb348741649474781d8782c32e8a637cd4197559d95f5054ed7
MD5 e379caa41e39d02781e3a7503b248959
SHA1 497651c71272308ae17c23bfb173ace9b961b10c
SHA512 a2c960e62877ce536678e57a9e39795c5f24ba3bb8fd4293ad5ff844eadc26ad1d221519d7f27b6fbfba458845774de63dbefcaad5e79ac243229be0d0070575
SSDEEP 24:dMtIEO2GgMC+Sl/Cw9FdcPIv5vQkETn6EJrbrJ:I7bzcqYkc3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 82b61988b530e6a39db5f38e32539de46cad5700fb49b7a0d4fff9a11536bb3d
MD5 f4655cedc19710ba77a07b83b84bc154
SHA1 0ed4d29f72a15560bc0998459cb67ca5f016a651
SHA512 ad94690dc011884a84da08ee6101f530c051c99e5d23c48fd6c432c59259f478ee950b6b37e726aca7db021306c1f10845216c5bf13c2c23def928c8dcb61fd5
SSDEEP 96:OOS0rOSc8OSGOSVllOSTOSwOS/OSWOSS2OS5ROSaOSTOStOSGFOS9gOSa4OS:O6rrkTllBCdYQ25Qhvy0g4
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 3f4e8ce10efdca886602fecb7a369cd2c93ee9e12bbb3e24a9d52156f01b5cfa
MD5 3c4b2246926ecfbaf4624dba18352ec9
SHA1 aa4eaae3c361c5a1010439dff3ac676bab082b85
SHA512 30def150db3fd77d0c9fd04323fc642983064cf4c916381c45d111ef4290ee164ed0451526eb152eb179db64fec5e57093171c2c3a8fb0bc6f466b1a234fc734
SSDEEP 1536:E88vgusNrZokv5V0XvZoZqtblsleJnnmlFJse4FpliJ7F/UZA/AM1QFeDrLm8:EJXkv0Lbl59kSnFO73v
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
Size 20KB
SHA256 82f03e141e82546b261c1a24cd9ae3cfd4b19a7b4f343a296428deeda88cf856
MD5 7e86d5c1bf2ff36b15bfbd8fcf748b16
SHA1 59a1515ddff8caec85c4f27ffb17b69a42ec6226
SHA512 943fdf966d2ca4bfb35e01431e7bae1611e86d4bbf9c27524ba4502a9a93b8c0bb39e7760a8ee76993c4099da1ff49febe0b48468f134d4121f22a0ffb41bf2f
SSDEEP 192:Nb0VWBObjI2jOJfUXWXF14yEQ0OEJfmnpNgZ89B:hyIYWCmEJfmnpSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002
Size 20KB
SHA256 fe6e92a5b020858bbdd8089533c6f22703bc5927e22f689c384164096705b11b
MD5 2a029687e73114ebcb4fad10c0114e8a
SHA1 f09cbbed46b9f8c731568bdcee13024e89bda397
SHA512 211dc45e2bb5739bcf863c44ca8132f92e895b3c95d074929aa4338698d53c6ccb3a8e2f23180260d9226073f4f5cd21a200010a7a224de7c8ac2e1cc853730d
SSDEEP 192:Nb0VWBObjI2jOJfUXWXF14yEQ0O4JfmnpNgZG95:hyIYWCm4JfmnpSG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4
MD5 b29bcf9cd0e55f93000b4bb265a9810b
SHA1 e662b8c98bd5eced29495dbe2a8f1930e3f714b8
SHA512 e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2d1f87e0b333a324c83342f1dcb743eec190dab009e6039b490fadebb5158b23
MD5 2fcd7a98d48cef636b77dda735ddb171
SHA1 783aaafa8d7890c7de29467564052f07aa983742
SHA512 125c440dce95a39f52464d66446e28a9cb94abd2a20d6a6805a5caa9a5b633a9e7e27a4e19b70a2ff35551cbfb40c58fbe541aebb8939da2e8cd3508f3f9a75a
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3BTlSjse2RU70R9DD/8m2TacHS:/9iIxuERzA83h09RZxA3B8Wke/J0VGzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2d12c65de3fa7b00a90932faed986edd42904a2f6eebdfd8f29379d8b78fbaaf
MD5 bcba365e8d190b73310d2690f53a41b6
SHA1 dbd4670d1a370d554ab44d75ab1d9a1450afe50f
SHA512 0e0ddcffe13aee83f45dcafbce671579d5f7bf6bc21135b507bdf1e1668749c83338d07d34c4872c9d4a2204a3f1b6f8e83b39dafb317ee68b823096f3bab474
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGWlSjse2RUokR9DD7sX0TacHT:M9iIxuERzA83h09RZxASGWQW9u7sXiVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 434501a12a2a5bd864faca4c87c7ecd6215ff381917b3bd8bf66bb9061e212c4
MD5 af0e13d6556f50249414144370d188b1
SHA1 7e0a2ef06175daad45067e4f587e67e3fe04262a
SHA512 54a82332de1202040e986eacd86c160912688b33ab2afb8a9a927fcc77bb420f03b6d9cf1ad2668494e1ea2cba9d5465c8800505a066b8e8edb701111dcdf9a3
SSDEEP 192:GoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGWlSjBe2RU79V9DDKKX0TacHT:C9iIxuERzA83h09RZxASGWQZkpKKXiVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 8bc75bc32f55eac233c7f3f34f33d9bd62053376195e45355e2ee3987ca18c24
MD5 279c8ba7b6d103cd1209e18e3917fe55
SHA1 1f9068fc505d8ce975a3b3354134efaa6d16c751
SHA512 e337efe432a63b242a8bec1cca0c101d8cf64535b2c897941c0c305abda7bd2a41cb9b1ec872c0bf09b032d0e04d54d5c6bacadb469827507de9965bf31b9b22
SSDEEP 3:MsEllllkEthXllkl2zE/lKEealll:/M/xT02z3G
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

edge_shutdown_ms.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
Size 4B
SHA256 2ce96a83ae20e147940c1a6b2d105e07c6241fdcfc0ffa8bef141aabac94bd5a
MD5 14cb576040e984c700c9922ae3a22e07
SHA1 84594234cc7c01b0dc42116ac6c665ce4ad9b12e
SHA512 ad1a7619deda5099a21ccd999a461a9fbc2ff020834b396c979b2faec651a26d6b5ca7b0f751d157f75cb3e7d2493462c00a19bff97db5910cc27a47c867f4e8
MD5 SHA1 SHA512

Submit Download

memory/3112-6-0x00007FFCE2230000-0x00007FFCE2CF2000-memory.dmp

Download

memory/3112-221-0x00007FFCE2233000-0x00007FFCE2235000-memory.dmp

Download

memory/3112-4-0x00007FFCE2230000-0x00007FFCE2CF2000-memory.dmp

Download

memory/3112-3-0x000002BE66390000-0x000002BE66D00000-memory.dmp

Download

memory/3112-2-0x00007FFCE2230000-0x00007FFCE2CF2000-memory.dmp

Download

memory/3112-362-0x00007FFCE2230000-0x00007FFCE2CF2000-memory.dmp

Download

memory/3112-1-0x000002BE4B450000-0x000002BE4BC6C000-memory.dmp

Download

memory/3112-0-0x00007FFCE2233000-0x00007FFCE2235000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads