hxxps://stoic-ai[.]digital/

Analysis

max time kernel
256s
max time network
257s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
26/03/2025, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://stoic-ai.digital/

Score

10^/10

defense_evasion discovery motw phishing

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 26 IoCs

description	pid	Process	procid_target
PID 396 created 2292	396	Stoic_AI.exe	49
PID 3068 created 2292	3068	Stoic_AI.exe	49
PID 3336 created 2292	3336	Stoic_AI.exe	49
PID 4156 created 2292	4156	Stoic_AI.exe	49
PID 3084 created 2292	3084	Stoic_AI.exe	49
PID 4796 created 2292	4796	Stoic_AI.exe	49
PID 1936 created 2292	1936	Stoic_AI.exe	49
PID 752 created 2292	752	Stoic_AI.exe	49
PID 1576 created 2292	1576	Stoic_AI.exe	49
PID 1436 created 2292	1436	Stoic_AI.exe	49
PID 2300 created 2292	2300	Stoic_AI.exe	49
PID 5580 created 2292	5580	Stoic_AI.exe	49
PID 5456 created 2292	5456	Stoic_AI.exe	49
PID 4964 created 2292	4964	Stoic_AI.exe	49
PID 5552 created 2292	5552	Stoic_AI.exe	49
PID 5052 created 2292	5052	Stoic_AI.exe	49
PID 2036 created 2292	2036	Stoic_AI.exe	49
PID 3912 created 2292	3912	Stoic_AI.exe	49
PID 716 created 2292	716	Stoic_AI.exe	49
PID 2968 created 2292	2968	Stoic_AI.exe	49
PID 5412 created 2292	5412	Stoic_AI.exe	49
PID 2384 created 2292	2384	Stoic_AI.exe	49
PID 1576 created 2292	1576	Stoic_AI.exe	49
PID 6008 created 2292	6008	Stoic_AI.exe	49
PID 2300 created 2292	2300	Stoic_AI.exe	49
PID 5044 created 2292	5044	Stoic_AI.exe	49

Downloads MZ/PE file 1 IoCs

flow	pid	Process
52	3348	msedge.exe

Executes dropped EXE 27 IoCs

pid	Process
396	Stoic_AI.exe
3068	Stoic_AI.exe
3336	Stoic_AI.exe
4156	Stoic_AI.exe
3084	Stoic_AI.exe
4796	Stoic_AI.exe
2724	Stoic_AI.exe
1936	Stoic_AI.exe
752	Stoic_AI.exe
1576	Stoic_AI.exe
1436	Stoic_AI.exe
2300	Stoic_AI.exe
5580	Stoic_AI.exe
5456	Stoic_AI.exe
4964	Stoic_AI.exe
5552	Stoic_AI.exe
5052	Stoic_AI.exe
2036	Stoic_AI.exe
3912	Stoic_AI.exe
716	Stoic_AI.exe
2968	Stoic_AI.exe
5412	Stoic_AI.exe
2384	Stoic_AI.exe
1576	Stoic_AI.exe
6008	Stoic_AI.exe
2300	Stoic_AI.exe
5044	Stoic_AI.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
12	https://stolc-ai.digital/	3348	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\manifest.fingerprint	msedge.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Stoic_AI.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2724	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stoic_AI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875062297403903"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{EF8CD71B-DD4C-44D9-8999-35439B57AF43}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3920535620-1286624088-2946613906-1000\{BA74CB40-39D8-4F49-9BBC-D8CEBEA0C45E}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Stoic_AI.exe:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5848	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5536	msedge.exe
5536	msedge.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
396	Stoic_AI.exe
5292	svchost.exe
5292	svchost.exe
5292	svchost.exe
5292	svchost.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
3068	Stoic_AI.exe
5812	svchost.exe
5812	svchost.exe
5812	svchost.exe
5812	svchost.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
3084	Stoic_AI.exe
3084	Stoic_AI.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
3336	Stoic_AI.exe
3084	Stoic_AI.exe
3084	Stoic_AI.exe
4796	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
4156	Stoic_AI.exe
4796	Stoic_AI.exe
4796	Stoic_AI.exe
4796	Stoic_AI.exe
2724	Stoic_AI.exe
2724	Stoic_AI.exe
2724	Stoic_AI.exe
2724	Stoic_AI.exe
2828	openwith.exe
2828	openwith.exe
2828	openwith.exe
2828	openwith.exe
1936	Stoic_AI.exe
1936	Stoic_AI.exe
1936	Stoic_AI.exe
1936	Stoic_AI.exe
3084	Stoic_AI.exe
3084	Stoic_AI.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5848	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5848	vlc.exe
5848	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5848	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 2656	5632	msedge.exe	78
PID 5632 wrote to memory of 2656	5632	msedge.exe	78
PID 5632 wrote to memory of 3348	5632	msedge.exe	79
PID 5632 wrote to memory of 3348	5632	msedge.exe	79
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3376	5632	msedge.exe	80
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81
PID 5632 wrote to memory of 3880	5632	msedge.exe	81

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2292
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5292
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5812
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5224
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1448
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:540
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5788
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1616
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5192
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3992
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6072
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5520
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:660
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:800
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:340
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4052
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://stoic-ai.digital/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffc75f4f208,0x7ffc75f4f214,0x7ffc75f4f220
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2200,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3444,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3452,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4664,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4676,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5780,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5260,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5316,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3648,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3620,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6028,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6812,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3496,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6128,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6096,i,289786483391603843,16194475608422301484,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x360,0x7ffc75f4f208,0x7ffc75f4f214,0x7ffc75f4f220
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2064,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2316,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:13
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4336,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4336,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4628,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4460,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4384,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4440,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4660,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:14
    3⤵
    PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4644,i,4938461258346804554,8725533920111060508,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6096

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:396

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\CopyFormat.m1v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5848

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 668
  2⤵
  - Program crash
  PID:2116

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2724 -ip 2724
1⤵
PID:3064

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5580

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5456

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5552

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:716

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5412

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6008

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300

C:\Users\Admin\Downloads\Stoic_AI.exe
"C:\Users\Admin\Downloads\Stoic_AI.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7989c10b6321cfb3006eb49624c2209d

SHA1
d4649708e7b71b3205cdfa9d8ede6ffea9764ace

SHA256
2a14af44710132b12a806b3a3716dbe99bc85dc3d1f6f24e5fbed370ddd3c120

SHA512
c752f0f48e88352b41b0be469c6a8959bb2a379de75dc441e3929e38b07355daa96c88876f723da0ec4b71ea7b97f123039af160c3f3374fd9cbb53e9aaa372e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
af6f8a8c149cb2457b42987c105f7eb3

SHA1
55d7bd0004d34d31c6275189c7157bb61fe122fc

SHA256
905d2f4eed9ce99823f3f639f0b36c8ff15550ae7c2d82cbb87b683cc2b5068a

SHA512
5c5a8aa85188e449d25f3f8c4331b082a616603f24bd62373456f41a6aac6501ab558adc21b598c4bf105d69c8cfa6763c059f68e4ae74a2b937081e59f44a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
94032bb7715029bc1e29e690003baac7

SHA1
0a8d28fc88904ac567315cec0c08e15f1fddd28d

SHA256
5136a012559eaf3207e153c8bf45f94e784831e6f50e34e86aafea61d8ab6653

SHA512
92ce6adec2f8c5892fbd92ee2fbec7d8b15775e420d6ba8567dc43e30400b7b3f7609b152cb0ac31a72125d7a2000772aec07b3863eafe5d6844b49506492a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
1c8abd80faee80bdd4e41fe491969887

SHA1
85d0fe28ab6427fe0abd13c0b1800bd588724e81

SHA256
b6dca352e0e8f3301baf752bc86542f8f3403a95bb9d3fd66e793158004fa96d

SHA512
bd81dc1d662d130afa61fae1c37b5953e4f373b868cd32b90e2f5a853cdc0aa15cbe79417c32652e8bfee2d391667aba651b228ab37d315c6567d94559b4317c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
64bf34279454d446b4ad5a95bc196e58

SHA1
ba89d1b1740aaa54cb626e713ccf5a5ba0598bcc

SHA256
7f39edf87cefe5dcf24b173a45b4a802365ac671c35a0737b5c9acee81927f90

SHA512
0db51e31049c376e83d107b27db5e4b85829e59f04c694d297e86506d2ab5f317a95395e61b10c6a5d747ef583a2a19e73f66075f33a21580f0003b085370b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
01e72a0004d889c0e2372c72a9ab190b

SHA1
15a05b713497422f021cf3c3727ce94c38cd374d

SHA256
726255969a0b0864c8e78971a240d78ebcafeb895adfc97440f8bb2f7e4f918e

SHA512
d933ea8c6a9cbc8fa63ff4629f547cbebc359ab7556574bfc1002f784db8be4f36ec5857cd8b5966f62050a228af3eb115615f5fee9dc1ffd47d9ccaef8cdf83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
29KB

MD5
4f67bddea4a4b56fa44f7cfe3d8e17f6

SHA1
438d0068eea5ebebe51681e9a99f4ea32cfe15e3

SHA256
b12c446b6906a8955e13fba049813b7367342208f2f605e636bae8cbb7c2a847

SHA512
341ad30b36804ec19a0299e99e95ca576474ea85eb853f986f0e8199481e5e5f6826d71ed660f408b0dd7bce3e2d28e873e64799a24c5803247b7ab356a276be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
73KB

MD5
d358b01d8c37e03b2156ca1a6472ac8d

SHA1
33696d1b667396ad44e7f9effc22d4ae5d30d234

SHA256
c54e34f0b6a5cfdef3cc592b30765c4fd625fca47238e182e42b292e7b344df9

SHA512
ed441b8d7bf6958e6cfa7b9687c092cc47f5c08b6645810326ef9ec9c8479cd161996144cef5b21d45549b231beba1bf419aa84dce337151c023855906787cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f1d3495c28c379a66182414e22cfaff3

SHA1
7a610107dab572bd7079dfd37b74f596364f8ee3

SHA256
b274caf21630158234fdffc64379252b95265f43c56c9d6efe3081b604386d86

SHA512
44c6a2f9fd9333b7b7ac0bc0c76b2ead99fab96203fc95ce43e29edb3763d4c341210206c4e57d7a7c4b68dfc9d459e492c247cae269f1a86a62750e5be9d3b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57eadd.TMP

Filesize
3KB

MD5
b502baa6133d541a9885ea02069337a2

SHA1
6b32d0f58df7a37eca08cd0211b3fb00768ada09

SHA256
7df83304de0693a19b66f85daacbb2b716009b14f755ac8755b50f4d7aafae01

SHA512
7b02b3b9eb7c152b95d75d76a626952bfed0b2b7288fa1d35d2aa64947c7e8ed0567a41c299ea48edaf919f5d35358e0dda70da441425e7ad3bcc0cc6a51cff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
2d350a616e78f747915c71151c567ede

SHA1
bf3bd688ca32f8f5a94202ca81422458d915ad18

SHA256
5bf65f8f4393d19824e782a0b267b23cdbcec8ef11841c21a12dc1681892039d

SHA512
2ce8690d418b9109f37fc16b8ad12520158aba859fe9f8512f0065fe0b771e6c6e97fa558c563c65bca5a4308371efda5c8e28c9d476c00ada0503b8a01908ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
c2b61dafff2341970785e8c1152bfb80

SHA1
7c342dbaf0dd56115b62a921ac0918ecb2b35880

SHA256
37091a92c3511e427346d2fe96ca35636ef2f2e71e7a5645bf7cff21229d9f0c

SHA512
327a457012351066064cad260b582229afea14323c45a07369f4947a4af08a02f0bf7cdac5c042dcbe8d8f264d26a2b64799c58c0f839cc8531a1a83ed1ab7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
24c41d968851266446b68134075a882f

SHA1
8723c2519ffa3c3350cc63174d7fc0d653d62e48

SHA256
acc5f378455a11c2916ce17ff41ba17ff969de74b223f6a2f216cfda7c56c592

SHA512
f33dc6fd9086e2a35d16c06a268abfe8f60e845eef57835ca767d8656b137ae748e63a55fc8024d66d38e691f74b256078d2f03b42c28f9d9b81e11b09b250e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
49bea86fd6c5611e183e5216560706eb

SHA1
8e3dd9dbeea37041689a4fc55b9e6b279e37ed16

SHA256
b0162b6d5462fd4e09da12ea221d5370fa32ef3e1286260da68c1e4248e6344e

SHA512
ee74cba41756ad3a9b8352dfcbbcb23af82a2c1d05a765595a8c334628baa3a87aa14cec60e08e6e3745f1586a5f9232fdf3f90fe01601c7930c6f100ac9dcce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Filesize
20KB

MD5
4173a2982abbf158834cfec5fb996c04

SHA1
fdb66792c296be54ef75f2ed3509c0ea90830d17

SHA256
826c2ccd678ef8c4af75aace3a13f7b1faeb26d063348c8543a6153539d0cdbb

SHA512
c8e115b67dc7391c8da1342c2589c0d0ef67255f98980f0f91a69fc4a272704abd789e5be491644ac01f0176fa82d8732c68f4b57e297ef1b35fd0bb808c7495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7241b084d94a6c92ab91e67bf464aa91

SHA1
b618b28c1b0c63710caedf10519156268f19fabd

SHA256
0074c07285fc1faf53b6195a042e5b92bc5d38c32e270bc210fa3399a395ee8e

SHA512
31e7766c540d6f24220c8d15ac1b0331ec71a88e9eba0eec262121f8553a031ab529b6e12d4f4071c9133ceaaf409f46384f5257a05f4093e10215d88bea1234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2e861709500b417a5d4e18175d44261d

SHA1
b35b1eaba358903d2e60115822026693cb226d5e

SHA256
2fa1b2e5e18bad2a6effb202dea0b2276f8c2c0942a7562bba43dc46150d1dcb

SHA512
7e26547cadd6f246f55d5a68101baceff31f403f4cba2bae5e92578729d1e285f8005cd819cd76b149c7fdc1fccf0242080544baa95a7d36eeef669b2013aa2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
aa4a72236b29b5d8069a5d5b386f068d

SHA1
aa6df4b34f9d7c676034d8f8dd259948ce8a7832

SHA256
22a47b96218609586619efaa3d6fb4ca60a3f0f8fa4c21a2cde266adf2977512

SHA512
d54e55c21b6e88db8e5f43a8e07f34a2e4eb08aec1f19af8483a8b2c1eefedcfa6148984a31d7dee502a7d685fa6bd72629aafda0d6e8185693cd255f2acc40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
87336050487b6cd290c6308ccf16b7d8

SHA1
6d17c2512e66cff8129b3713bb394e405575a611

SHA256
ed5471a12280cc4e3ad290b28cbf5708a4bca6dc7db63d70e3b830d73cf98ee3

SHA512
01f414f2c7884e9fa54e44510a222f4f1976df71b608e9aa1feae9b6b93c5ba2d27e8c2f2743245079fef89c9c406632afa91b57d2786408c142ff3fb518417c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
7c5fd007fb054c0cdfbba0a909869a01

SHA1
5bbeb646b2afc42573c9a89bc58e8ae92d5ffa25

SHA256
08007cb853cea260e268be1682c9ad0b6fb70a309064df466860de130f4d40de

SHA512
3e83a16165a1c7502bd51ca2af044e2e6a7738d4265dacd3cb61e6bb78b3549e0465db4f912eb99da85daa5fdbd7e8ec41d8eea05737d2f44c4bbab38fee6cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
188B

MD5
dfbbbaf44f27e0e79eff78aefd953d0e

SHA1
1e9bdaab9613186defc84741e42e7cb320e041cc

SHA256
04f798ca04a29a8fb7d2279c4efbb5f63d120581ad5e0946145897d7f92c44dc

SHA512
bce563c34c2133a532698ca021dc64b3017fda65e1e0746f31328e89d56ba8bdd9dd558bdf7d89d6448560c7339823e9df153a281b8cfefe7f2118911469de2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5594dd35a473424d3b3f8dcc434e56a6

SHA1
0e47fa74d9aff26f30aa70c346fd162aa2e27edb

SHA256
0e7f88ba5e01eb345035b7c5d56128454874ee03273ea6c093e3cbcd9b123f1d

SHA512
7a979c4ab1907ce9d6f180eb40b2828a4c21292527cf97aaffea3d44c64e169700eeadbe1d3231b17eedb4d21690bcfa5a8928489f9e9da125ec3ef91c4c353f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
47070762e6a7e754557425a36b620176

SHA1
fedcca6da80f03acc35238619235ba852b2ccfbd

SHA256
4efaf9cd9d21589fc12a55e0edd167e086f5e3ff31740e0709196726de894ba8

SHA512
82c01f148c3ad0df9882decd8e7154c2e97559801469f350c3a85be49e7790ad6542c59e529d925dd4098b93ede8652821357d8d3ee8957f1c798ad229cfcb58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
0f7e1f449d84be6c04b84a99e21f953c

SHA1
1a225ed07015a75708a1d5e483b2169388e6acac

SHA256
94f75d51f1b7321f47b99287527db8dcda857cdfff3bba377938fce0979d0862

SHA512
909b5aefd31caeff79415d56317e950e49eb31baff89690663f4d43e3b91728029e238945ab3c747f477bf64ea5fbd296b12ae86e1f073725fca9136044f49f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4d014554f765ef45a4bf4bf122b06e8d

SHA1
34ebe7faf55006b545f2d12d39a848f07d6e1fbc

SHA256
1bf675866214b69885eb0e2b0d9f508528436563366d5f168f941212b53d567c

SHA512
7fc9f712b343dc1075cc3c6f8e43cb0c5ac5ace80cc4dd1faafcff2ba72491dd3ec13b28569ad7160bb12ddbc9fcd8ce1a0fd98edef03aca6d71f0c651ca409a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
5a8acd903f1cabdc58fd48bd41c5d457

SHA1
acaeb8035051d81e9ae40d3725d9accda975ce93

SHA256
eca8601e8bfbae0e1e774354f45cd9c07339e8f5248a633617720b657929d1c5

SHA512
38575ce84ab9aa2a0520aa5a3f7c6bfd77b7e0a6e077e8da0807d7382e6697ec51df072da837ea80399cfd76acec87197d40220cf62dccc3cb4cf340b095fd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
869ddaa88904c938f52bce41a3509a2f

SHA1
a55fa515fd043e1194474d630dd35750db98d6a9

SHA256
734f658a36968cd1f52cca6f1019cd1821af5e6c13baadf7f4923f01e7424c15

SHA512
6fb4482d203e928c06c8e0d22b29cd72fc365ca98366d344346656f5bf3e295dc427a2f89c4d44183002055d4061ce2b8702c1a2bb9fccaf34ce59cd7d4cf887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
fd2be2897ee3c36a642193ce54df1a87

SHA1
6cdb19de80b47df600f64e14a00d6540b361e2d7

SHA256
702e90b15e943f6d5e3083e6a8cfe4248d280414143e3ffe0558a8beb43a2a31

SHA512
7ad966f913746fe000c7ccf5240ceadf5bd51ada9dddc176ff5e92b00a4e5cb7a45f4760ea6b9b92ed9e74ba787c2ba16ab6274103781ec593a3c5104be0938d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
4df51448f02c206b323b5b14f9a9c96c

SHA1
7aa9140329c50869d542f225df569c6a5139780a

SHA256
481e644f5257f42835041cc77fc4a6b88223f2fa1b4f90cf1e63d202ead80fd8

SHA512
c925f2307cb78e0e6d99a78516294ad4266ffb18a6ad0e75c8783e4e41d6cc1fa0a04829cff1bded671589b89a2b8cb9d2fa093b6dc9605cdb9bfd9adf0c960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
00a58a2ee1721408aa903b62dc605dd4

SHA1
0023feefbd0ff2f256c5660af5ec7e9913892334

SHA256
e984e5ddc65a08b3c458ebf4ea845c648da5ead4cc0f38842011e26ce92aa2c1

SHA512
98dea56bccab262e91d1cdfbba96cc5c8442fb33d9014a5df7e1574d20bff2a46653f0dab927190ec60c55b3a4a0bcfb8de250d74a359f0d268ad9bbc1fb0ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
8873e873334985e752cd3bd30cf5cac5

SHA1
8c407e1ea6623452d8a31fcddc5527613742e369

SHA256
9c22ba8ee6517d1899d9a8877b205a3a4d5178bd3bd68c851a04b602d3aa2be5

SHA512
461f378c6eecc159112e87f2aeb8373c8f1bb90ac444e62b8f9cb8579528010eb80da2cc34738e170d00c4fcee3110427aeb2da7944b560b4c2ccc7f1bb6c71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
dea2103a744bce9cb3047adc9141efbb

SHA1
c199584ae4e7a645e4c4ba28c10e7edef4cb55a2

SHA256
fd70da38cfc01c76df722bcb8584f368520da36cdf421bf96980b9c9cc67f1b0

SHA512
a0bd5b643c1f02115f5fc118eb8fb7d5dc97ef8327fce392fbef904c3c0ed372cb8310a8a64dd7d812e735d73425dd29cc3cf383292c6fcd83c21db956576d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8d8ef44-3d51-4299-974a-d7ac61f73760.tmp

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
20KB

MD5
ba76c89e3d621fea68c427cfb9e306d9

SHA1
b2ab9260ebe7069136075a8ca9737ebdfcd26fd5

SHA256
26ff9f467da71c544a865b7e6c50eec3b9ffcf2236c0b2f8c1f0afb74b6468cc

SHA512
846e9104ce86c7254ace6239bb29779489ee3096f13e3858619a97a575248f589b359753a357d1295d39b062fe5a752bea5f3815cef1306429153cd237d83d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
82c9165f682bb4f3e37144d8acd38f28

SHA1
f9e46c5224ffa0144b851926481ac4afdf47efc6

SHA256
0b23d1d78c7a287bbc4850a7c8ad7102f2e7ebd6082c7a7ad3f3c6eeffb8f0ec

SHA512
ce83909c6d63cd8f3b4e414c5a5d4f261031325df047c81d2a1c3bc8c908a672c8c146c8f6d72133138c766f42ea96adba3f810874df1a929f12a8f633b5e768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
5e5b9de31a09458e074aa50824d52084

SHA1
41d9ff6daad8210674d969eb396e89ee92ecc79c

SHA256
3358323b40f0b72e17715e19c4a1673d0de397d5e2c840c28a2130aa351c8c7d

SHA512
6b4fd113b6abb735d774895cf49b12783cc84fc02e3b5ee995f62beccfa99aab0eeb77ce359b13cde29e577c7cabdc43842ec8441bc58792f7be654a8d77999a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
b5d27f4a86a42a43307972218a8ea14d

SHA1
d32f20759b5b7971ceb6b495c0e9f0105c9a22de

SHA256
484e86ad1535e87301c5ccddf68c28cc2d0cc6704acb37c25d01923f0d27a990

SHA512
c1ba077efc5c9818a178a1e03e24a75e629d08ff29558283bc92859f8eb3a02211ebdbaa68374958c821bbace29120aa1fabe44a5b71ca1b56e4b6ba45334d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
900B

MD5
cc6596eab20fe6cd16492e83bc571d62

SHA1
c19e4fa0d569351f2dd58cc785d4e41261544db4

SHA256
aa932b6376d21e33fb0e0d0b3097048c7676fde0e9d19a1a5d05146b9f07350a

SHA512
33b7545b60d15ce22a919eb7455777ad0ff61b04899cfba224ea54dca1321568b4315064076191239649d46b4c7980fd5cd3430b6f94239fa339effa397d8489

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
b9e0b7b177b4ce965caf2e02710d56a4

SHA1
73967b399436fdd120aa0709d24918c13205429e

SHA256
86fe3cb6e7950023ee686a636343fadc8ab2cc4228e87caa125eab41dbc61c0f

SHA512
b81f7e50e401db2d0d1a46cd408687f66ab3e0dcdd069fe9068b684365ce2e5f53d9ca0b67d0c8c438fc6e17e7adf4d1dd8521664ce225a770fce766792fc41d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
467B

MD5
1ae3eb56e876b68f5100134ce807fbc7

SHA1
6879a448dc9e4b0332fb2f6223d205042962bc7c

SHA256
4d26c75fe3dea0d6ac4b5bee8fa5a28921e7ba1f2ad75760ff3dff7d03aff9b2

SHA512
f771327278b7224905416256345b2d792e61bf6b21a9dfb761f0682528c3a5e1676cbf79582777d059ed1461950c7301b9c2d56bd487830a7a45b662d20bb8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
acacd9f93d48e4b6c44ce496d78850e4

SHA1
e213eee836b3a3459642ac342c2eec1c45933e39

SHA256
08e3d2a055eb3e817942c3be6531957121177429d4753c9886cd135020392e42

SHA512
7eacb14d860ef1929a76be15f82ce39cec880323698af40e4ec62ddc65d636cacc5430e7d8c79c497b0a0c5e50600cd3bf8b87251c888a1305a4903a37e5804d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
8d767cc4f1b7692eea3d7eea8b7663f2

SHA1
86168839404cebbebced4e5aef65fa99ab667afb

SHA256
c0892dc920375615fce3fda9b50e0551ee428adfcea7db4ac312b523d13833e5

SHA512
1c68579d2f7a78eae605b4896ad7ca3ca12a073ddce0ec272a5e6f229e1954cd3ab53a208abd034781d0c8e209e590a00aff9262666673fec3b118ed6b975bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
9fc99b080aac2b12e85f15dd6e989441

SHA1
9d62117bb4f698fb4eb309799a5ecb551d05724d

SHA256
0ad628214859c6073786bb4a250b1dff9f9d68bc223e53ac52144fc203533cb1

SHA512
7562e90fc635b45fa9a889cd92b9e79f8fb9ee9031bdec0087ed64b56e44528f763537a36bfceb95219a115667e17482dddc5afd95c16ea2efe695bfb8cf8d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\f_000011

Filesize
22KB

MD5
fd9ad2902a327fb105d3c07fb26712fd

SHA1
600727291f9c76e91159af798706f2fee61173e9

SHA256
4c663d1bd773ebd55cb6926698477500e466e63e56b498dec521ccae87d4f138

SHA512
5cb8dff14f289f56a31ceac11e714fc8e83f666c9e5b567df8e87597ab4b7820cf046c79c5bf72213438656ffb30db6ce376762666aa785acfd400a8d8ef3f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
4bca94065304f12e189cb82ab7881318

SHA1
f5afd9f50cd8452608152202e62cfecaa46d28ba

SHA256
db675f57d7a671ef631c1e0cddb92b181714393c800efcc5ee2f2dcfcf88438d

SHA512
84a3fb0d995af75d68908ebd2717d9cafd23fb9cdd37d20bf5d506b66409124579f0e66321ac36676c67082a34f11cb4d3c1064fb3fd4d228ee1500f34e96157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
deaa62e053df43b3f06a0a737774de14

SHA1
3cfe8ea70fcc2f888321b133b0c11e34c6b9ba70

SHA256
9d719373c90e28c11fda55a7ccb782e445b01e8e43fc9bb68148c28462d9ae74

SHA512
947a29d38fcd437e6d8e786e30be9d5aff10fe1cd30ca2e4003b572c26c376238d828ea1601c052370d50cb37ab18bdfc6cfc613f55c9ddeb4ad54c3c75ca436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
47a6fbf2321b9ef4680932d63bf58079

SHA1
43b6c420938587917aeac6eec1b701c1350b9013

SHA256
c1352b8653a536bb0b2e41abb51c739bb3facc34ed27dc00661acfbd89a71c17

SHA512
de34edf6ddab17c669c7dc02458aafa64a438d0e1c7f173c6212d068e119754b7f3d2bc9a6ac68ef271f9e44ac1217a5c4d01234f7ef0c1b56558de16a0c6562

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8353ac0fe81339d9e2f806214ce5fce5

SHA1
62bfc3d93498a774af4bc140ff966a03660b2584

SHA256
268ed07e9e30c9eb04eb3fae9913c7efa963da743198eed0c77e85611067b68e

SHA512
16e362f08b8b2720186e48c0a388431e06448a558250502ceca4a5157b569496e1a3a2fef8ca50e62ff040d111324fab53da8a7cb34ec5f47882f541199817e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
abde2cc494d3435b1964cdb134eb6f84

SHA1
e1227a88529539f3daad0a4e458ff98b41ae80ba

SHA256
0762261fc69871f9b428e79a8662e0c2088191338b8bee53eb44fbb96f10054c

SHA512
5ac0cce9a2ffcf2be926755344ab58daa1669eef82200554b43b2be5a244ea4b58b04443282a1a265a05a57b7cd8252883f1d86618a4525baa7adfaa19642b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
8ce1b2e3c246828614e26997bf115c9c

SHA1
face03ead2b36a6021ae150fe878b1e16c0a6ff9

SHA256
efd450dc25c90d7142c19f3835a143305fae8a8cc6c0e8cba01309ee5a578e25

SHA512
c5e75379f7cd7dd47afea37f0bc0116399e213c6f5748de6db28f1073abdac7c26a50100d234b318bcebd7591d1820df8784bd74699828d67588d658e70aea96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
3204d5694d3c7247f4df33fbd2d22a2e

SHA1
c8d9a6041ae192ddccf6e1f456e9dd3227c9a4c0

SHA256
3fb14c855663248ac6afef5bccdba29e0672a201bb461166b859bea3c09e189f

SHA512
96c6f59d0d838e5092df1c62fa03f57e0727440b384bd1214e4f256562aae98e7aaa081b2799f88d586475ca26b1685eeb42a577d49f395acbcb093fc15c1078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
e593bba7646f22d839821035ca803a69

SHA1
e5ef2b780fe3171e6b4e0a77a885d07a00227e23

SHA256
7733d754f545f9de55f48a47dba826f2a900995fd4573fa27ba9cb0cf72acb7b

SHA512
6cf96229af3cc1b5b18b651b30813e5c850bb7f8afe01b4eac2a307fcf4d67f5c0464f42e323441d85ec29966f57cb450b95a9851b36508cdc28e7199b6ddde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
61KB

MD5
e562d6959a55963761f6a3ffb570359c

SHA1
120993d6fa225fdf273900e6901747cf143d4b1a

SHA256
8cf727014f4eb72273c9d438965c8b5ae4bd5e8e3c3b6ff533d0a129af4025ad

SHA512
ac1af0f41b8663d8087dd71788d3ca007e1f102b3a7a700b75735241b6b4c97f415bda5eeb011e1067ba7fb300e6fec7db7ad1c872ee3153c306d70fc8cb05fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
93f8149bba28843fdf471ac43487f82f

SHA1
588cba85b13734866376bfd31b892dc005109c57

SHA256
5b9131fdd337b9b75beca7d10c54c48e5d0b170c473555e3f00f14b5d4d76d3a

SHA512
9fd68d1eaceec243e24fb96d798dc94ac3098878251c437cd40cd594a776128b957353f9cba0ac53da0a7f39818559e94a87269adb9a4e6017aa6bbca1289689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\Downloads\Stoic_AI.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_200092861\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2756_447096845\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
memory/396-664-0x0000000003520000-0x000000000359F000-memory.dmp

Filesize
508KB

Download
memory/396-670-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/396-661-0x00000000030F0000-0x000000000315E000-memory.dmp

Filesize
440KB

Download
memory/396-663-0x0000000003510000-0x0000000003513000-memory.dmp

Filesize
12KB

Download
memory/396-672-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/396-669-0x00000000067A0000-0x0000000006BA0000-memory.dmp

Filesize
4.0MB

Download
memory/396-668-0x00000000067A0000-0x0000000006BA0000-memory.dmp

Filesize
4.0MB

Download
memory/3068-712-0x0000000006150000-0x0000000006550000-memory.dmp

Filesize
4.0MB

Download
memory/3068-715-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/3068-706-0x0000000002E60000-0x0000000002E63000-memory.dmp

Filesize
12KB

Download
memory/3068-707-0x0000000002FA0000-0x000000000301F000-memory.dmp

Filesize
508KB

Download
memory/3068-713-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/3084-783-0x0000000004910000-0x000000000498F000-memory.dmp

Filesize
508KB

Download
memory/3084-782-0x00000000036E0000-0x00000000036E3000-memory.dmp

Filesize
12KB

Download
memory/3336-755-0x0000000002470000-0x0000000002473000-memory.dmp

Filesize
12KB

Download
memory/3336-754-0x0000000002200000-0x000000000226E000-memory.dmp

Filesize
440KB

Download
memory/3336-768-0x0000000003ED0000-0x00000000042D0000-memory.dmp

Filesize
4.0MB

Download
memory/3336-771-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/3336-773-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/3336-756-0x00000000025F0000-0x000000000266F000-memory.dmp

Filesize
508KB

Download
memory/4156-763-0x0000000002730000-0x00000000027AF000-memory.dmp

Filesize
508KB

Download
memory/4156-777-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/4156-775-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/4156-770-0x0000000005830000-0x0000000005C30000-memory.dmp

Filesize
4.0MB

Download
memory/4156-762-0x0000000000790000-0x0000000000793000-memory.dmp

Filesize
12KB

Download
memory/5292-675-0x00000000010D0000-0x00000000014D0000-memory.dmp

Filesize
4.0MB

Download
memory/5292-673-0x0000000000850000-0x000000000085A000-memory.dmp

Filesize
40KB

Download
memory/5292-678-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/5292-676-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/5812-721-0x0000000076040000-0x0000000076292000-memory.dmp

Filesize
2.3MB

Download
memory/5812-719-0x00007FFC85000000-0x00007FFC85209000-memory.dmp

Filesize
2.0MB

Download
memory/5812-718-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/5812-716-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download