hxxps://www[.]mediafire[.]com/file/v04wcs9dlfq5ke0/VanishRaider-main[.]rar/file

Resubmissions

20/03/2025, 16:04

250320-tjdtlsyps7 8

20/03/2025, 15:59

250320-tfcr5syny5 10

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
20/03/2025, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/v04wcs9dlfq5ke0/VanishRaider-main.rar/file

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
597	5900	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
2432	7z2409-x64.exe
4536	7zG.exe
5352	7zG.exe
3652	7zG.exe
5896	7zG.exe
5252	7zG.exe
3124	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-RU	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_76428245\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_638838247\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_638838247\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-DE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_76428245\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Filtering Rules-CA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_76428245\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_638838247\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\Filtering Rules	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133869603091008218"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1678082226-3994841222-899489560-1000\{B954671F-525C-42E0-B583-98514A213991}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Applications\7zG.exe	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Applications\7zG.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zG.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c003100000000006e5acb7c110050524f4752417e310000740009000400efbec5525961745ab5802e0000003f0000000000010000000000000000004a0000000000ada7b500500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VanishRaider-main.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4876	OpenWith.exe
5224	OpenWith.exe
5972	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4536	7zG.exe
Token: 35	4536	7zG.exe
Token: SeRestorePrivilege	5352	7zG.exe
Token: 35	5352	7zG.exe
Token: SeRestorePrivilege	3652	7zG.exe
Token: 35	3652	7zG.exe
Token: SeRestorePrivilege	5896	7zG.exe
Token: 35	5896	7zG.exe
Token: SeRestorePrivilege	5252	7zG.exe
Token: 35	5252	7zG.exe
Token: SeRestorePrivilege	3124	7zG.exe
Token: 35	3124	7zG.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2432	7z2409-x64.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
4876	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe
5224	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2812	1976	msedge.exe	78
PID 1976 wrote to memory of 2812	1976	msedge.exe	78
PID 1976 wrote to memory of 5900	1976	msedge.exe	79
PID 1976 wrote to memory of 5900	1976	msedge.exe	79
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 5280	1976	msedge.exe	80
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81
PID 1976 wrote to memory of 1416	1976	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.mediafire.com/file/v04wcs9dlfq5ke0/VanishRaider-main.rar/file
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffd9d59f208,0x7ffd9d59f214,0x7ffd9d59f220
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2276,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2312,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3344,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3412,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4888,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4728,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4144,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5556,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5580,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5872,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6596,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6772,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6820,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6828,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6936,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=7196,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7656,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:14
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7672,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=8016,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5076,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6868,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=1784,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=8440,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=8168,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=6760,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7948,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8716,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:14
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=8656,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=8772,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=8796,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8784,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7308,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=5984,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8536,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6164,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8228,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2016,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,16522466547738742296,16870439037748991317,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:14
  2⤵
  PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2176

C:\Users\Admin\Downloads\7z2409-x64.exe
"C:\Users\Admin\Downloads\7z2409-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4876
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4536

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5224
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:5972
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5252

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\Downloads\VanishRaider-main\VanishRaider-main.rar"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
551KB

MD5
b6d5860f368b28caa9dd14a51666a5cd

SHA1
db96d4b476005a684f4a10480c722b3d89dde8a5

SHA256
e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de

SHA512
d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
e03115ee7530777231a0051667ab23d3

SHA1
5ded32077cda52b5527f75017552a598b0523db7

SHA256
cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a

SHA512
053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ec22f50770391322f5bb30cd9641a566

SHA1
1834325d4edcf15cf1897c5e9beb0da1a937d05e

SHA256
5c836bd284ec9a5759e33d68b6d183c4f1fb6a1a9c37b20f4bc05d54d0eeccaf

SHA512
820e6e5816c3e002bb64190257bb97b381bb11f74171e248b50c968c1fc2c7704a4662501dd5c4d1cacdbfbd32e81c38746f500e91335c16f5da368e130182ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0

Filesize
29KB

MD5
94692fd6108e230174b9ed3f95f6bf49

SHA1
b037a193f3cf4423d89dd13e624032dc3e1b488b

SHA256
e47f4e4639a95988266ee2152b9e08f585639b5bab00684c19f70896fe3e53d6

SHA512
304d40f466954410a11aee0ffb8bab5f86e912c10630a503e5b4aeb2af5e89503f925593627ea3cb9ce2a4436020d5bae3e20f09137e33ce2847d6dc3458d7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
8bdf9705bc3182383b9c5c03a57f8f92

SHA1
a7f339cda10a0bea556a7bcd98e6b11422b32adb

SHA256
74de23d4b51447331a6e5937cf881cb8eec722a9a145719064490a8ac7f06ed6

SHA512
2572ea087e4850e652bf15d3356e7a005a01287bafef0152e727600d782cd59bfa3b3005055bc043a60217f307aee71fb2a10557123fa7c1924a71086dcaefb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
1c24733e36bb228d47c20cd167e966a2

SHA1
c5abe35b9873b65574ee2f185e0c0115c52707bf

SHA256
5515db78fb0640dd4f34687d971a1e867be35dab82f26b21db9318be92eb98de

SHA512
500f9785a9ca3761d12dd3c997f43b71be21302152f3488e44118eb512995c518da4cb49c90e1c50d55c3a45949d60a246ac5bdfd36bd9831f91a708e9a864e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582bbe.TMP

Filesize
3KB

MD5
31cc2d828fe130e8c413922d6f056c91

SHA1
5bf02684f9d5abe7aceac0064cdcb1acd8dc6ab2

SHA256
17558baa8bca4e2518070d02834f0aa83ef3a6ba59a11ff2d6a21faeb16ffa83

SHA512
53e7d1d38c9ba8047c344418adb352e3d3ce9f42f082959ea6763972521f7dd68ab3d2dc049a9ffaa150cf79cb75113f0ec488710b0c3a978c32268a21b2ac29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log

Filesize
32KB

MD5
856d95c03d7dd51f5644c3b295cc4aa8

SHA1
2092b5f0384a0a0be714c40659ae1d0cc7b8d70d

SHA256
235961532b6eb390575c4775155a6c4bc9cb7f4d34d0a8f14400b61fd1a75716

SHA512
cdab6a1c6791590207f291818eefa8177fb4ca5aa47a79f41979c50a3651854d9a14be61137309e898e9db2418734b1de95a1d248a908f120937b46d817e67cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old

Filesize
343B

MD5
03593ed08d02476f19d2bd7835c58185

SHA1
f501f2c344073ce5f8e89b523265ab773c5cbba6

SHA256
a261a050185c70810e5587914bd02663b29a400fb77d01aa1dcb630623c41bcb

SHA512
4315c252c13529c8075ed9f2017a4af0bdd9a62fb3f8ad7f7e7a31c5418f588f226721d2e054250ef0b9b30872f27ce80443d54a8ee6e6a41033effb74267248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
24KB

MD5
f7a16c8f28ab96d73c3a194a1d45580e

SHA1
f5e6de946df37af66f51a56ca222d7782ac2be46

SHA256
800ef70837b3e848dcd0e5072c49f71a57e4d63cf001e064e3a7f988a74a99d0

SHA512
ae1bdf6cb2a1776f3ec02ea2ad6ca2629382a0437171004ab276d1e78214a842f30e6b56f2b80b99699efd1fd4fe30d9c0e675a4d8a25942de4054a267298c82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
e84bba0b9a415e155828720706f63d23

SHA1
2bc895eff8ea5040c60edcf9dcb6bf5591b0ff95

SHA256
9a0c74330bb488f579ecc2c72aea11b7be9f12a7ff696d083f72f4e3664b40a0

SHA512
ece0ac1d08fb9357922341d33bda71592532d03c9088fe430216092b677a21299899686e6072af83d32905fec2c159bbf19a7eb9be7bc1839cfe4e61e03f9f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
24KB

MD5
122481978632e33718096620a3122e4a

SHA1
60750eec5c40e53199fd1aa60838f43455b6226a

SHA256
2928ff8d8cb9ca37ee2aa6b70f765bc243361b135ae0213fbb71f54f230b5a9d

SHA512
7a13ff680994a1505b5f1f38ee33c27edef9a9f8a5a04d6003608de0f5ca6f39b1e1464489e690e70714377bca76b0e1c93cf28770879d3fd796566814d8bfa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
23KB

MD5
bab104bb46f64356d8ee3821e4ffcb08

SHA1
39bd10405d9585641393fb602cf0d3fe0c6fd34b

SHA256
973cbe782a9caf617487c5e175858629e375bd0b0d60721971c8a8eb1a8c2dd7

SHA512
cab59a129c78f102d73e739d1b82dedc9a042578d7c6bc3180ff770016e538a950b30df98aec2b61646557ef6f348dea94917a7ad34e369190c565f9688eed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
25KB

MD5
543c5c50987b77abfad871ea3408d876

SHA1
1586f267860a49f699aeffc58cd857c503cf8513

SHA256
c230c95ebab359fdd15cf8e4592fe71b8ab48d06b669378489dc285040f6229c

SHA512
d866a4954ec055ae9c3d1469eb06628219ce88ce749abe7fce28e848b054671d6cc4a1bb275adbe2100851863d607fa9e62d18202dccc663219a928137d349b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
4eea8b95631b3160ee9aa1f315338b2a

SHA1
2a638f31ebb97216f6add168529e9dbafbbb3de6

SHA256
b28f9c757ff49c7a2571fd282d64a25e172724087df46a57582d0cbd43619890

SHA512
23924d637737924cb5734205be233f11c3c8af271d9371fbc28be170b5940e620ef82e14ac51a2568c4e0a166345ccadfad83f59df5cd4c55846a7b848a00a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
fcd2783a9b5845c67115913d2615700c

SHA1
da285da7325b93e06c7f2ee0c7148ce4fb3c00b0

SHA256
c0e5e65b4a23b85a9b4d8421fb5b47ecb1bb650af7f45b1c40dea5df6a96e5f2

SHA512
1d2fda36b1a74e3a018eda50c26789cbe1f51d2172f53814395e8fc4803c8cb65908d6c03f7147885ac5fcdaa752209baf9e1c5f7d8a0de211360cba6172748b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\170ce29fd1bcbf73_0

Filesize
57KB

MD5
752100bdad0c8a5fd0c14edf284640cc

SHA1
db9b8d4b532d30746ce18e5f27c070a3036378f5

SHA256
c7fc10b5bc40d065b94d50b2b1c8935aa7c5bfd7890082adc002b8d5fb6ea98f

SHA512
9b080a079a230dc26c7927c95d7db2881324ee04cdaf24ee6a5bb2b77aa3ec63cdf0dd13ef45a1d3944f141567f3ecd186b8296ae2cf59f902bcdb2d943845a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\index-dir\temp-index

Filesize
72B

MD5
2511ca2f68503d71642cd007a9c91852

SHA1
bbfca2bcde8959febcc129a4ff348ff0f08845d5

SHA256
2d819409f449d3220ea236fb63facd7e04aa2386722202e9e2f178160dd6d8ab

SHA512
184fba20e6b000867346bc554c1d124f28a110b40dd646da3e2abfe29ec204ce669af4527a94829f964bd5ffa01ea3ce7f2d835fdc47379a91e54b2a7ef1155a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\13bf7cd5-3f0a-4967-869d-004c84656018\index-dir\the-real-index

Filesize
72B

MD5
4bb0c9159ca4eec224057a713872e9ed

SHA1
169acb92e34b9c9c9e662a2899962ef703395e20

SHA256
5a04caa138b09eb78ae108c5fd4d8c0674817555f41622b0c7f2cb4fbb22ac42

SHA512
4cd91d1971be9e70782835e946f2abf7569098e33cd2c8f2b59824f4d98272cedf09da81e8833f1ed4698a87923ef02f61f285e8b7882170818b47128879daca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\18f11421-2b28-48b3-a7c4-b1eb1a8fe171\index-dir\the-real-index

Filesize
96B

MD5
9a14ec5454540b304a4461c251a48471

SHA1
c9adca970fd328a0ad02557ee4531ce216dd7cee

SHA256
1f6dc75bfbe2a5be532f9085202a173864879807b78719b409b6cbd2299e760e

SHA512
10f61af2057585b9fc70a43ec45b703d556090117e2edcede9d44776eca17c57922bb10c5d25ebd2949ef89cc1aec7cf235864126ebbf794a44bfe9cff4073d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\18f11421-2b28-48b3-a7c4-b1eb1a8fe171\index-dir\the-real-index

Filesize
72B

MD5
d926e4be01e03d7624c1af1548b39498

SHA1
6a8c02548135b4dc0148bed6757167e2104499b3

SHA256
72cd2b8f4703fc38410bc07e110dfc8fbc23e90a15ce283bb8f2324e2e832267

SHA512
21d13bde7f585bfda926206e3554d71089808be5819537e3b9122da9e9fd76f0ab6936eb1a44f1199769e1b972044de59c2c5f2cd1307df60ef1874bd005f41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\18f11421-2b28-48b3-a7c4-b1eb1a8fe171\index-dir\the-real-index~RFe57f08a.TMP

Filesize
48B

MD5
523fdc2028e9caa3ff4ee42ccdd52c50

SHA1
ef661a30bd19285f11d45b8793ce90a9d76b0f03

SHA256
87b59949c3f8c40d7180ed1cc0577b0da01a83966a08e5c03a088d7837fe6466

SHA512
f17b4a7ed304e85d4e14cedf009f9d28f44358fd5661b9d16425d1b5fd49e7b50354ba75907286e96b43a631005003fb636f78dd3302877a3df89bf8da3b6131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index

Filesize
2KB

MD5
db1ff9ac1970782a3c2e924cc4e0bf9f

SHA1
d9462e49c22335095b596d8c0472974f752bb71d

SHA256
d36c19fc2b1ea676927d5e49434920398c698cd4c3bb757dd1bf4d2044bebdde

SHA512
844988c55fcb9009b3e129bcc4aa5f5864c99639b89fcccdf41c1a1653b40ad29c587482e82beef49c1b2d6b7fb3877a9c6b57f958dcc0c078aa843e56f3cdf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6de81848-5b24-4103-b044-7a04b1ce3981\index-dir\the-real-index~RFe5803d3.TMP

Filesize
2KB

MD5
0b8aa8e295ff1f0d7da5456906e9ee1f

SHA1
1ad6fb3221eeb70cf2cb9c2cc75a44287a4321c7

SHA256
c8e50801626b69101f8b3a880cedbd1e8a815b3d43e6508877e06264ed2da3e8

SHA512
b885f75d0e777f897ba3b835dbfb475383edd7c5d98b63762e25bc3244bdc208f78e763058897d4771d1bb23b1f612ab1b00fd120d4edf231217827a81958c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index

Filesize
72B

MD5
f21d0a421211841bbc7b76f00189643c

SHA1
34779752e02ba9bd7dacc2ce72acbec09805cd66

SHA256
c540d56a8dd1212fcbafb20f11fb8814f7c64fecdea473017f1665759ae06a7f

SHA512
ebb70d25646f7baf06ea28181d2219113fbca2cedb1772f983786e691a19fafdb78f745c0145039273492b3dfe1a151afe9eb34b70e51660bb2f3d42a97d70eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc7ad1e6-2a51-4dc0-9579-f8bf6674ff51\index-dir\the-real-index~RFe57f117.TMP

Filesize
72B

MD5
ae29160f15b7f2fd1dbc246f96c4940d

SHA1
8b4b1b9188e74240a2c7138196624c5499043a99

SHA256
49134f4b5810df62371da51286f315c9a446c838ef8ac177d453355f19561c0f

SHA512
cbbffc718d9eaed09961971f6c14da136781418fcef18de586b9f216f53bd4ca16a99caaba333a4b89e9f97f1710ffd5e36a267f2b87090c64f98300332d3b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
8ab3c9c3477fb9b3e8a982904bb637f2

SHA1
18b1ea0548483586cabd5bf714bd7d1995aeaa39

SHA256
c58cd5d0c888fab8c0f3ba4edbd926351f12344bd6b9fa1350fdfad8344d16b0

SHA512
0f8d4b16d034de303c6351512d090c10500829c82bc9feb5ad1e92206b06b68f60c8e50c01cec6674253fa496d54e7270e712e8e6e723845a24b0d124779949c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
1eb553661e93da4be832a020cb9f31a8

SHA1
83a1b633dd77d7e9bd7fc2eb6559c239e2f771fc

SHA256
c23ca8dcc635c1c72b6171d07372f75b231d9c1f91f2595d33c2aa58af7fa210

SHA512
0cf4e36bd3166ec2dcb2c9e25e8472525f87b15ff00e6bfe4bfae0016a5bca5140136626d4744f0c487d378f1e26b30e1485ac929ab41825ba082a9b47e5a664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
50e4a77aeda56ea8f8700eae3c81d73c

SHA1
149be02d537bf3bc1bcdcf2ea29db938b7489c67

SHA256
9c4adc438d00921e4f5a8abeb483d11c15d83a9a553f575ae9d40e982bad9926

SHA512
7258c2719ed1dfed487d5ee81204e34a76d5d5531a2a3465d2e152d8046a08390d8edc8b4a26a743b9a02639826a6086fd8a764329bc776ab42107e11bc777bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

Filesize
115KB

MD5
6bee4110985c208a3eb195cb67b4f6a5

SHA1
99e860f052893135ff1d2064a9915eccc5dc9744

SHA256
e5efb2c8ed89f151ad8473799e1abf9ffa127398fab812ac98f626943dcfea01

SHA512
d7c67cc69d3be7c0cde014f7cdfbc6ae6909b24f3b8989f601dc73f58efb8699b075936a6572370b806c2eb8bee6bcbc454e99b5833dea7e848606b6e0541c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
835326ca997fa2842ffc8d0b8ebfc747

SHA1
9380ec509ee40f9b8f317d4d4508067b92ac97be

SHA256
4a8c9aca508d40309151601638a24c0c5f6e07eed56e736ab666a3562fa3e295

SHA512
047452f0eb8e4fcbfeb6f2a45fe312c5287f33a2da23e8406451229975cecbf8a070adaf61311d9c6c6b59a8d08208b0021fe6a8ab7d6b76314f85e05f50e470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ffbd.TMP

Filesize
72B

MD5
1d129f177ed37f3a3c2fcb9493ab6532

SHA1
801fa8b2d3e76514540a45c899a3df1fa54c57f2

SHA256
49184463c5defcc4d63e355d44c5c0d181b24d103bf7631be9fd1b3cee3a9e03

SHA512
7d11a3e9e6dbd9023bdcfe5324b93096bf68d5c86dfd57896448caf87a9c03f6d104ea91c34c371a718f350a8b709ec27ecc75bc49270e0391088f91ed8fbcb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c69e7ab824657b3c490ee38075399b9e

SHA1
a18f360b361cb03ea44ecbbd4e7ea8633aa94f2f

SHA256
edfc26b961ba1c5be338d4062695f2ec14515a44c715d2fc6d407072a261abcc

SHA512
fa3490c2391e55ec6f76b5c66c43450e871aa1879b23c6592d80303de951f07e9ae3f116c4de781a22e33dc49568165f4207b22a18ec6d64e8c41a83ca60220f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
22KB

MD5
3de1dc3b8b44015e094fa588202f1a36

SHA1
d47a001582a8b7ee459b83c6d566c51424bb1f16

SHA256
38667312bf141ad2d0ee386a0ff7012e760e2a034d1dedcd1a5fa3d098d8339c

SHA512
67e2f5309e4f9656ce889a7cf41b7634f1a2f341431b14adceaffc3323331c8b2845ff2299c5e5e99cc923df1c23b5631469ef3e66fa889fa4076810b5882eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
8550d6c0920857da7cbf19bfee49cb04

SHA1
860a102c244ed98cefa528d6bad613d85a5e6793

SHA256
d0a00eaeffad0120550df9dc78ee27a1b01029b9bf14be6966e566cc7d36408b

SHA512
c0314f3d8cce568cd262837ce4ffb37a409a0cd10e4b1cd798d342b6f5230053b316e2de127143462c8c6ae1995109bc54af64f7c868a677700c6c01109a8e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
d891154b9bb90518d45030d7a54fe252

SHA1
9ca178f9ba0b8fda7cb59d93b38bf4d2925e472c

SHA256
12849ba02411bc8221a637471e4f0ea939bf202f51ee2a79acbcd84ee76c2cd3

SHA512
a1507d30ab0dc0592706c5616e26f4bc82ef39a02033229a9eb2d959d2f92bc6a9534224b6b8aa47a4877919d12fac915ff67e6a8d69e17cfe2b8314d82694c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
88219bdbaa6d4e7f73c3a34985387ee7

SHA1
e34eb11f811fae1046e8b96baaf529bad549bb46

SHA256
c687504a1326c43279dc4b083f734c40b6908b1a35f27cb0327a9d194cb72647

SHA512
fbdeabc7e64c40aa837d1a62c69c832608a137f3a8d5807425466a9be2568df757738b40bb380d1962a77bf740c1fb79ecd7ec7d816355073d66eff4ef9d87c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
cd5cd6fa90b8a6434267b994617c62d1

SHA1
75041d73f3d8c32bf326b2783953f5a14e169b58

SHA256
069880edd8e89f317b38a350e7a99ae584a78a80ff5ebe6ca1516ddcec813085

SHA512
57b634488490178d98f69e34462194c9953296f610f87fc2364541161729c4a76782f9f28b524dc8ab845278a0f5e88318027b4dfc4eea846f62c04a685654ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
9bba2fe6eb469c877f640a2a0202c9e4

SHA1
0ab4fa72195d7bd5fd2d7d46c58df348125e45f8

SHA256
5edc76f6f40f199c46284e3400496ce0dd179aa860adadacd32bb6f9e0743dd1

SHA512
df1fd197862de8b067080b2bf3ab8b1a07c2bd3c7259670fd982b8126d4969d401e26c57f719f3d34cd6278691a560d18079c0b7e09211e70aff73f841fa5a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
a8dd79ad25d1eb3d4146df7e9f26c59c

SHA1
737908dd6a1ddbc092498a19bab8dce0cc12f841

SHA256
9a71b36593d03c2f825458f738233b186a72f817722001059133f987fde45507

SHA512
3316074dcd3318aa859393cb0eaec5bf29c3e1188a2fbd4185139d913cb82d5aa27abe3ec4526f4f2d99021a37596774bf5e4c7ad070a1c006bfc747b30093de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
4eabd93e5f1a819aee707b8c2f6c08fc

SHA1
8f7cfd4cdca87b1db0b171621dce2c861a483a2e

SHA256
906b1b64019d0beef916133a5ff2b5209baf5cc75d70591c2a6cc892d6703e83

SHA512
5e6878adaf653dca2535ee82512c915d38f62fc7e6be1a300c67acc036a94250ba88a8e6574feac6e3e91b1513207bef9ab0cb2c983ff673a671b88a11da1baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
aa17059d6fbbbc695adaebb05300b30f

SHA1
f67f38548740ec4599b3b1e1ad1883eadad88889

SHA256
8af2917a613eb17243eb3ab1419edeabb3fd97ce905412d26b23cef2889213d2

SHA512
4e74fd7da3a3926718fe3c1f7438d82b66b65846f89fa04916b86aa0c01f9a8bb66b40856b0c2a094c4532fa4aa9a79525d75a1443a700c680c5e9aab29a34d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
f627af53cbc9de147eafcf530fed44ed

SHA1
74d9ee17bd4067a8a30d8c92bfe3ffb3f41989dc

SHA256
cff09ed41e01a120542d00bd57a9a6bd1e35adc5974ad9beb91d1657eeeb36f8

SHA512
55c7c8bc42115a1de4b66ba08391e71b69f95869258dd32f4bc690954755863eade82cb126a4703cc521f4c12561ffa669da9e4832fbe8fa1e0c7b4a6180232c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57afe7.TMP

Filesize
392B

MD5
4913b7efe194838ccb945bcb0012c896

SHA1
087f562b7e6b6365114dfde9d42ba0927d8d5455

SHA256
e198732976eddbdc0f4e20b5d65c888603a2dac1fb880db618a2245078b26b79

SHA512
2e500808e5e83c20b0afb7c924a766904b82af283598885020e3255d1becfd0be2bb7b2c13728e5b2f4c7d0fa2e644056c3d74efe92383ce6373fe747eb07541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

Filesize
1.8MB

MD5
d7c9c6d2e1d9ae242d68a8316f41198c

SHA1
8d2ddccc88a10468e5bffad1bd377be82d053357

SHA256
f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547

SHA512
7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

Filesize
24KB

MD5
aad9405766b20014ab3beb08b99536de

SHA1
486a379bdfeecdc99ed3f4617f35ae65babe9d47

SHA256
ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

SHA512
bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\VanishRaider-main.rar

Filesize
61KB

MD5
3d15d9b5d05223d0b812f1f51eb05ecb

SHA1
7f0f19e7128f546193685be6efe39a2ec61d8175

SHA256
c39552926a046eca64dab7cafbc9002ae22d592cba749fa03b6416b4a299431d

SHA512
7c65b4fddf10687c119718d136e45c570c4a5f9bb2ddbb23731813b5975d79a91ec062d7722909ede8ced4ac5a6fdb654ca9f1780546f50400f5de095f088ef1

Download Submit
C:\Users\Admin\Downloads\VanishRaider-main.rar:Zone.Identifier

Filesize
324B

MD5
6c2c63626d332ed49b09b695c1782a18

SHA1
3d103c5dce31cba6ab56593aa24d2dd6eb7c8223

SHA256
6815ab824c53cbea56d836fea011ff3a52e10abb4b939c66c4bff8adc6630052

SHA512
2e905ae582bbe9a67b02562476afbc79307b80d703bc89f83ec38f84cbe5e5a1de236ef78795cd1fa8e8a6462e455d7f394d750451059d69863e9928335fac60

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_3659211\manifest.json

Filesize
116B

MD5
2188c7ec4e86e29013803d6b85b0d5bb

SHA1
5a9b4a91c63e0013f661dfc472edb01385d0e3ce

SHA256
ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62

SHA512
37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_652348156\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1976_76428245\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit