akira | hxxps://pixeldrain[.]com/u/TcV2BREC

Analysis

max time kernel
223s
max time network
233s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
27/03/2025, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/TcV2BREC

Score

10^/10

akira discovery execution ransomware ransowmware spyware stealer

Malware Config

Extracted

Path

C:\PerfLogs\akira_readme.txt

Family

akira

Ransom Note

Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/0628191501-BDPUC 3. Use this code - 0420-QN-PBZC-TZDI - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.

URLs

https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion

https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/0628191501-BDPUC

Signatures

Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
ransomware akira
Akira family
akira

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	3184	powershell.exe	123

Renames multiple (10015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell command to delete shadowcopy.

execution ransowmware

PowerShell

T1059.001

pid	Process
4624	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Executes dropped EXE 1 IoCs

pid	Process
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 30 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\ui-strings.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-140_8wekyb3d8bbwe\Images\PowerAutomateSquare70x70Logo.scale-140.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-200.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\ui-strings.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\storelogo.scale-200.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\it-IT\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsBadgeLogo.scale-100_contrast-black.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-64_altform-unplated.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-400.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-48.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\msapp-error.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\customizations\mergeSettings.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\IComponentAs.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-unplated_contrast-black.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\ProfileIcons\pwsh-preview.scale-125.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\initializeDir.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-256_altform-unplated.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateAppIcon.altform-lightunplated_targetsize-48.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-32.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-200_contrast-black.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-400.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Thumbnail_Dark.jpg	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSplashScreen.scale-100.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\zh-TW.pak	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-256_altform-lightunplated_contrast-white.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\cardflipped.dat	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-20_altform-unplated.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\6a9cf9e066bc4c0d99a76bf63ab54ffd.arika	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\TXP_TicketedEvent.png	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.winmd	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\IAnimationStyles.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
File created	C:\Program Files (x86)\Microsoft\akira_readme.txt	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_915479289\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_915479289\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_915479289\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_915479289\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_915479289\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875548245604316"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{7D3D9256-EB07-46BD-94A8-CCBD6DBB14A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
2636	ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	1532	7zG.exe
Token: 35	1532	7zG.exe
Token: SeSecurityPrivilege	1532	7zG.exe
Token: SeSecurityPrivilege	1532	7zG.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeBackupPrivilege	5444	vssvc.exe
Token: SeRestorePrivilege	5444	vssvc.exe
Token: SeAuditPrivilege	5444	vssvc.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
1532	7zG.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 5212	3904	msedge.exe	78
PID 3904 wrote to memory of 5212	3904	msedge.exe	78
PID 3904 wrote to memory of 3836	3904	msedge.exe	79
PID 3904 wrote to memory of 3836	3904	msedge.exe	79
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 5160	3904	msedge.exe	80
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81
PID 3904 wrote to memory of 2160	3904	msedge.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pixeldrain.com/u/TcV2BREC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffed50df208,0x7ffed50df214,0x7ffed50df220
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1856,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2140,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:2
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2492,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3468,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3452,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4664,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5544,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5844,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6220,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6188,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6316,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6308,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6076,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7000,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=6956,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7248,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3508,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7092,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=2272,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7584,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14
  2⤵
  - NTFS ADS
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5856,i,14044842651560623563,1174177000002052657,262144 --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3440

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16470:190:7zEvent6373
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1532

C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe
"C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\akira_readme.txt

Filesize
2KB

MD5
8d5c0c4b3f8ba6154f269d41fb4ae0bf

SHA1
f54c99106823a57fd6ef31d5c43767f4ce580d4f

SHA256
92bfe213fc85dea5d8248570b32dc4c82fc934ed6a03b842643171465de20bbd

SHA512
ee76730461711aba1427b3e2ce884a916582379a345b31a59e2ba6a952f4863489ad08256f42aec3b2ab3c3df5ffc3a90ad735de732d77f47c2c42af07264961

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
596B

MD5
35bcea8498c345f2d244c86b67dd7854

SHA1
7b8d17f3a48748d35503e505113f47e1a4d7f6a6

SHA256
05185a418f911b36a7487f04e7a4d5089b33370df2eb4ad7bc749a0bbee6f359

SHA512
b6238b755a22edbb8f1ec85b44317526fee0b42ad12732962185e35d08b50552de4457f4eb0f8355ddccfd4a718309062f5ec6516ab0caada85c085df34634ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
2517ce17f36d05eb644066acdfcdcb87

SHA1
b15bd946aff0b5a686d6041cf8fa6d4e98e5af33

SHA256
e88763c8e20ec0ffc0b5c48dfdddce88ed0d935bd41c208f9e0304e4b9f94616

SHA512
2a06048c96b7c52c3b1110c0b60daf40ab511d5e671e0f3a2f2c0002adab678ccb39bc1394baf89e7a6044186f1b0d12b1f1b0ce5a7c4b2e12d517b0d0688a2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
1.0MB

MD5
70eb795e1ed8716c68098249174504ab

SHA1
45772b6e887ee1a0c057dc88f2a61d62ce2d1157

SHA256
5e9aa39f7191638e23d54b9d77fe1ed81cd1667c44fe0745c6a6057cdf8e6429

SHA512
2d6550cc4b7f46ef12f4567c207656392eb63d0646117118210965a79ec01cb6783ce6952e595120cc873cf5b26f3b1d8a1dd1ac98a992153ea92225f3fbf37c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
872B

MD5
658a987fe8d4b7ee34e599e489453246

SHA1
7048003ef7a0737a843a2dee0420e178fb1300c1

SHA256
bff1ddd01f3e2065f0b8c60ee3838ae3d712206a5cc46c790ffa3f49c2d4abb4

SHA512
3ce59f034d35ad97b618ff1632413b591c9213ca0007dbe94c96cb4dd3aa70161ecbcaf0845197eaac6ee94b40b4acc096ebd96b586bcfe31ad039ec4d0d3d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e5f3655796637b7d0f4a8ed402e119ea

SHA1
3baaf516676664d46727759914745776a166016a

SHA256
22d91a4321390a9445110f04d5600f49f03604a2d7ecadd10c663248295c88dd

SHA512
2125899d678c926c9f85ad81892f8ee91aa0a74e4c533bcb6e48675ebf0eccbe0db17998f3e3ab961cf3beb8fef7f950588398c5868327aa2d33f81bde797ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Filesize
625B

MD5
08cf13ad0d0ec2253ca5c38e6e7cdccc

SHA1
dc34374ada6e3eff717fb91e4b71b5e22a657285

SHA256
a38912bf5e9e78cf2d77203546f219a7aef37b0579bb0cd90d46c46582447d2e

SHA512
362b34e632adf7a1b89697407ecc89a70aa310be0a1908f619b61286dedbc741e2c1d2fa138e5663fce1a9f1a4bf3e3ce44f9153321cc578d40cf2d31fa46bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT

Filesize
608B

MD5
35b9f072e0aa5fa22ec110fbcc1a7150

SHA1
15bd13f3b5a95d99406d438ffe7f3c944f44f7a2

SHA256
936024b42ffcc22db2faf2f78c7b58ece02777b171553e1de69f2bf6904970cc

SHA512
c9606b67f195681a3ed31ede3596401e919f33c2c9a2f641e5d5216e71313729a538416834da32db3cb84285444ce0a3e2bf5cf1065b423ac3e0afcf70215b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Filesize
899B

MD5
22bf98a4acb0be410eeaaf8294906794

SHA1
f4913d53d714c3bc287e735f3435922575827cdb

SHA256
46cf3622a41e44af228a48f51f0ac916ea9b8cfc108c71d2bd308a2403ad2a6f

SHA512
d514811cf8163f53c91a48c3e3ff5ec2944344703cbcbc7d87cebeb4ebeaf6d519ee9472b83d6e4242b96430f2885875ce2c2c06cba1154975be0384f61e8bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Filesize
633B

MD5
ce50eaaad8bec888f3da7e1b7dbe8f79

SHA1
e994ff06f11ad26f401e95b033e3ce2e978ee4d7

SHA256
7b93c0ff7c8e771892b7d2cb3ae2d0d1601943cfe93df0db9770dcb7e0ad4626

SHA512
77f70b1d1e0df9ec8ab22c5fbebeae7c5d8c2ab027f021b5b1514b916e412f1b86da8fd9218de7afff989b3fcb48c40d0dc6e19ffba2b78635ecffdd1f4c1aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
9c48d1f22e2ea29841b564562f0199b2

SHA1
5a2cd2ab880e865d8448885df92d0978a2e6b119

SHA256
7d1e738d02c7cf946f52a80d27d3f0268c203938c2564b08be91c9b208a6ccb5

SHA512
d528cacfd41bf2d2a3dbdf2936da1b05713f88c47524ce9f34b30bc9cbd96353131d0de2c28aeb4efecdbde4a95111d0c75ae9b4ed3976567cb33f1f436bf7b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Filesize
923B

MD5
504ecd07e5480e98c23bf34241b1b181

SHA1
4538a9c61cce64b9f2ed10db7f26cc0a5868a2bd

SHA256
e6a62024851276164eca3d5998dea72b000009a7b5836a3f0c28a827540009a3

SHA512
1e360acaf8cd2a9cfd0cc4ac1846d4d7554c35c332b2b8809fa66ea476cff69c520298f455eebf8b22d5a3739a171467f58293b02386b5a1dc0007c8c4cd5a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
832d2cde594c7fcbd67ee2ac1ebc9153

SHA1
48fdb2d80684d1abcb0cfadfcf25ce1b587d2699

SHA256
5dff04c1729c552e3e965fa02e57e35209f1b078665e544064ed7a4f02690f31

SHA512
49480b79ac92aa3a9ef847918d96beab976decae7ec6e1822726b3895b92489c1095a8b41b01745b6a8dd34f45cd05cad060b029c9280bcd5018b0bcc534d180

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
520KB

MD5
d0d3c2af5bff3afe95e2ffc717f0ce3b

SHA1
f7437acce1c89ca48b9cd5aaec4cab2e550f83fa

SHA256
83cf91915c1f1671be945bc8df1ea90219660ae4675e8393fdd11feaa85e7d0b

SHA512
3fc5a1718ae5e1d7d4cecc3abb65618a81be169b1c5e3a4e8df510252539a234745c2739de9c2639655ccb4d8192018dc67a2318f1d28ef61025e57c1f8d125b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
476b2ba2868b03149f39b50ee4ed322b

SHA1
bb99c3628092daa5a953fe7dca1e782a4df8f398

SHA256
9ab003272b3d210ba443e5407c631b5a614d782eb093a2b59af648ee81cb75d7

SHA512
34cd11f06e1777c0aac76b352e0e0e26f4d2835c4b69c41937e3d6260de2a35909f5f5561b1af215ad697e322ea8260c5d6e2c6ed737809f0e4359c4494a9740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
c7137258eeef1a07bd8394e4bf5c367a

SHA1
02502c164f6a36a6b8147c4ecd01e3604c63a41c

SHA256
6138da4003a92a69453d25404238f17b571a6aba08bba16771d773bd4f8eb554

SHA512
60ef3b9afb46f8b5303ba704f6831372acabd2e3cbfd2bdabae80d427bf081f8eedbc8dc5daddef6423302cbdb5bedfebddce99ea5848bec87a11ea1b19b5e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058

Filesize
445KB

MD5
2bd9553707853c4d5804de6786faf4f0

SHA1
7e8afb46da596821a6718de548457cd373c6c064

SHA256
0ef512e575a735a403a2f7380d2d0ca89d293f2abe6ffa8790fdc1920f0ae3a9

SHA512
399df9dc2abf6057384f0b110bfe6186c39d79357c45cf1c9f75452cfbc84e5eab715771827345b4ec57b482eb0c57246d5fd640540e03b7f6f93a6c7d2efff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059

Filesize
125KB

MD5
66588639179cca2c1a24675686d5c2df

SHA1
44f5d59834eda43c2bb1ad4d3ddf5ff57585363a

SHA256
4f66cc4d7a671df5be54a3061777e8e490923d258b547dc86ffa2b5782ad9889

SHA512
910752a17d4cb85da48c93638e8333afa48ae8735db3f328a20eda12ee9e7fec9431fef47b9e5d99128ac3b3064ec74907e97b17f71b1829ccc2ba136a74bf29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a

Filesize
296KB

MD5
05e4c9c9e944d67657af95d553e7b391

SHA1
301504f73a527c3b6ae60cadd687de485dbd06ba

SHA256
158ccdf514c3164a4812e8d8cb7083e2f553f23d2b3b4dc7ff71587572b0d2e4

SHA512
fd5a0d457bb735a3503c13e3a36cbc284418fdd62500d1b47d4497341ea92b40acc70175d26209b45e56dc5b43a0fd772d762cf481bbb2200db2b76ab3f43881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
20KB

MD5
60c2a25dd0f3b79959de879498a8c14c

SHA1
098e0f8ab90dbf5fd9b4b145174759742f53de78

SHA256
0828d0fe4cd8de9cf57b373e91cd044bcc201c8d1af68f91ec6ce259f47c3058

SHA512
92a0032914ba6c0acf79f25a936dbb3a999745548cd5b9b2231a67ecba1fc89d4e5c0a42eed63d50385944f117cd3bca52acfd062dc32c3e4bbabe58be29e3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c

Filesize
123KB

MD5
fe11f229c696fa2e52c4da5b6764ad1d

SHA1
24c7cf438c7f4dcccc08acf67a76aac90caa8727

SHA256
580856828817dc430c9f518f3505ee8fd899ca65c71cb91af0c70866a76a9e26

SHA512
c208648f5b2614ef01378fa8a202945511a31fc09dc2a72398fe2ed9c589799409d611a8a61be82a637ccc3f0815dd5f1f40a6d7ffa8f2a2c8a65e9761cb81f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d

Filesize
49KB

MD5
4c9b8c92f45815c3d1e4e90db10f3eff

SHA1
05388d6f02f01ac380145e88b05f5fa8fea284e2

SHA256
40031927abc9f35830d3128f7d05aee29af2253fc71ceccc30557b043c6c94e7

SHA512
c00e45841d769e57a5e296c406b0a4578f9ccf83072b9461e5f89dd2fee147522c6af47319cb2a19d2cffa1255077e07b5e759793dcafe66712b4ec03d8b8404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e

Filesize
366KB

MD5
342c16e2933512c6ef8cf5fb25e53611

SHA1
4902f79b6ab9757f46a6dbd2d861ca37b4a2d672

SHA256
1567e3fef3e45856d1e38d7dca51fb784c5efc4bc72e2d1a570a38af24bc71d6

SHA512
76b25775569d461b84681e80ee7c413cb5d063e113e80df4ace01cb15a67147328e0074ce46795f0c3b286982987d50e626e969b72df52b4a329bc2cc33fb371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f

Filesize
70KB

MD5
863d90d9f83c503819a286bafafdba2d

SHA1
fab898e048ba456b873a2994e62acc86fecabe48

SHA256
afa827bac30a25125ee7d930218fc957d260ecbe7a4657fa6e627297ed5af352

SHA512
ed81894140e19620c4f936bcce68ccc5ff3ffa60a4c60e157e093dbe286a4fb71cd756aa40cea694a29a2e9d2c1f48c31d91ef47bbc2b0403fb3fb2f42bb1b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060

Filesize
20KB

MD5
d814e94d0fae6795875a050f3ccdd656

SHA1
4860db83923fd9e5df5b820a69e72db5089f8a96

SHA256
a29f3c05b7141c7a4ec76d6c3d06e8243d6139553d38d4bbe3bc7972f1332ab1

SHA512
e946aba4256391a34e84e57d8cf1b9c6fc879c71d286cbf41c9f9228695b7da4912e7df6e7f0a9a4c04d420dcaf1d95e56284199b9f91e61e3c7f757eb46b9e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061

Filesize
64KB

MD5
77bf4c8889a4707a96abb3189d90e642

SHA1
4f3bddffcfd06cbdc6586e52bf5a57d721da29b9

SHA256
e1f71ff05c6abc7f25ca769695be9d703aa2c0666deb7e3a8308dcd386060b87

SHA512
6f4b6bca6fe30186123bf0effd4c90b589e13bc05abe6a0968bf290cfd4c0d58eaf18ba36e7a6a05ef1f2bc8c0b9f4d5d6cb9733fc5564c81546047869de74c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062

Filesize
27KB

MD5
955411945277f5a28bb30b74749ca7e0

SHA1
2d610d046b21473ae3ff22af145c6f7f10d74506

SHA256
2a5ca729515514f352e070224583dc20be29912d6bd1659609fe650386527017

SHA512
a4cce275885360e965e90169c43b47e524070b37513c1cdfa2ba754a253fffef60737400767affc3b8078c8a58393ffc70120044c8d3aa2d3b413c6fa046654d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063

Filesize
23KB

MD5
02f17e25abd9ad5ea55a4fbaee156d29

SHA1
7ab142dbb3d2fb2db90c5004f0fcbbde14baba6c

SHA256
adf5f9363e19e25fe657728d016ed36c7823c73155f5c0da7b2473c5036265c3

SHA512
eeacf95cec9a161b11105b3f672863aafba8b7399f61032aee0b3d88ce8e002571e20f354dc71f42bcfda7220e78c7c040bb4fb812f8a93eb95ea8ff14bdfb68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064

Filesize
30KB

MD5
68a44e5d34e8227684393d9ebee62ec4

SHA1
3ee575a2a9fb2dfba0846f44e72aa751d0f8972b

SHA256
13546dcfca99036a810fc06cb8544a952972a860a122e10eee86dbb031a6cd05

SHA512
b0b8d300923ead2a961fd6235fb6f6b15dd38b529374898dfc0a7f5b0e52295ead84ea7023a30d952f621ec9eae2258c71a8836499b941e7c8e6056a97a7097c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065

Filesize
78KB

MD5
7a1f536872fd6a607200e2c98184e815

SHA1
704c5995ee57f6c5062ce8143ee12b1e253b478b

SHA256
11bc49b7bd8b8fcdc61a6f115fdb639692a54224a9f6a04818b2f28547195acd

SHA512
d18ed697ecd932eff874c6e665927b47a23df271dca88d559f8057cecf02a1f15b98a848c71cdd447bba4bd68ebaebb007dfcc557498deb3c2ff21800587084e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066

Filesize
116KB

MD5
f9b1ee6531118c580b580861d6912df2

SHA1
f071623b5b703e31dce9159adff7265062ba27a1

SHA256
048e5b079eaaea902e5fe2877c207e6778e70a2af0ce7bcff344227ab022e57d

SHA512
de4f9d606e672e86309b78a8796c47905877c0ffb71617e65c9af851fc719121e726fdfe699134df01012a42897e8f4f8d3c47c6aa6ae229189f05a94fb268df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067

Filesize
62KB

MD5
dbcc76c5df2dc82df1dad045f9d6b668

SHA1
f4b97dccd68413e46ed429ece02f9df88997ef3b

SHA256
ea15651fc17675b5106d79431eb80e3e642c5985d7dd780d478bc32c886a12b4

SHA512
57b1e13b6be9c2e062cbd47b7fa2b09cd7299b5b26c63eac037ac2da5f4e93d4b6f455907753820c3ee1976e49f250c497a65e0a70d662113b17e3d2170f5b11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c53e03208e436090a4bdf95d334b4543

SHA1
a30582d99989c56fac14f169e3d6cacb96ab9bf9

SHA256
b63875481ce72c0cd36d3d5973305b3eb7332c1969932833e615274a017d507e

SHA512
ec788465a092cf57d27b4f91e3a598bb06c5a09ff209a5e6ac6449235f18fdb5ba2d6254dc4012ac4db8b4829eefcc66a24002093efb1d7b864ebda31a15e49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58651e.TMP

Filesize
3KB

MD5
d3d481eeaef3de21296ad77d34133c07

SHA1
150253a6b154cf3e59a10ea73e14485439605042

SHA256
c86600564e91a7afd4f6ebf72cb020b15abff055b7cbd4a28cad3657be2cf7f8

SHA512
9d8d083998de54abb8583511e7dda39920d15610355b6b8a540f7dde5668b2b0b888fc2b44cb2e11239ef5bcf89a305f574c6871794cd0e69a93b7d11e74da30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
78fdad1316f5d2b1be8b1c5924622250

SHA1
60f7cdb66d08d18dd7041e0799abc210467c5fc3

SHA256
a1244f6dce6d2d5dec330219c689a7976d93c4f62ae43b66c2b60e0435ac61a4

SHA512
edb9c3a79baf33342b3fad829825c7ed25300d8eacc16e3bf0f5022a2741268ecb59a80d65cc469fba5a3c00d21a9d9b6ae6cad2d03770be6e61659f7198a23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
c91f583d7e435ace3ffb64e3c240cf90

SHA1
71371474f7fb587dd52162cb47f75073e8191333

SHA256
ce5988fed9edef25256428c42487cb984e9363b2e5be50457b0c3f89d3d1531d

SHA512
8b2d6d429209ab8b58a8f71dc9cc9de4ff97f6ede71b2de62d60fd29dbf0e7696ebeb4036ded6bc64bab14b6478131ff2d4bcf9af5a1852d9d7bf3a692a525ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
211B

MD5
0f713fb49d9339f67ad8a7cd01b3a008

SHA1
219534d08188124d7fb8446d2af5a5a2c32a40fe

SHA256
ececd9b19db96f06a86ac2ea83a6d09438dbb2fc5b7eb07808ca7485d04529d5

SHA512
86328293977975c7a38c52bd26bebd6013387cc37769f027c6b07459e3f95f8c3b25081f5bf69b66ceffb2c9e29f8b323ba4110c367b04119d1391a0af9dd7d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
ae677edd1358bc9a22f4c0969d200fee

SHA1
d2b0ad338275038a2295539631fdaa403bc9af6a

SHA256
fc8b9fd170c66b7d69e9844ab12caccec1582cf64b039deeacace8e7e3042f08

SHA512
507f1b83642a044c7ba289ef0fb3d061b3d72305d9768249f1f3e3468d36c813f72af02265bf28ddd06dab7cff2569e8740159633f527ba7912b873b33fa82c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
413KB

MD5
f889e13b4bde009a01006c3ae48eba46

SHA1
3d58dd38c970403761e556b57a910f63a452d8f6

SHA256
095d298c45030c009078eb2be62d0560b13a7697c6dea777e4f2380874f15033

SHA512
e7113fa1e39dee225a942960cfda33eeccd9a3640d3024e35ff70f1f48a37857a6288ab01c321cea76dd4a01f96e8db3702f0d47a6db97a2cd862e269e41aa14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
411KB

MD5
6342f32f3c5228e769f2da5a4214c094

SHA1
1eb89ff60970c27a410380867ef634bf582bef6b

SHA256
8715b6a4fe6edb34b4133933f17292163e8ca0cf1ed9aa7b0547d8c79c521790

SHA512
7bcd3222d36d446a3f7e295bdd257b3bc612e38e25e38c26c1daca920f071b93f307304c69148bdd70538417da79a8bb0b60ede582f6ce286a95aa6ab43890e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
cd9b4fc498fd4aec83fbb6256e6c7ccf

SHA1
f3ec92829b901ea5f2707e1603470f33c57d1681

SHA256
f6d69da6d2c1183df115555c834aa0f6574af3832e9688c817f446bbd6f7359a

SHA512
360253ebf0267eefcd4b119de4214e7b45476cfaf95c421470289e70f1d40f4082f99722d8389bd32d1c786d4d96092330235f731bf29a9953e54c0c1b42380f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
03911cc2e6cc49f18abb3c575ca24683

SHA1
9cf58ea773b87fe25731ff515f56581f514eb227

SHA256
f3f27bfc0cb96266fa550d348ee53fd1da22f8f6e053b0c7c4df8537b8d72ece

SHA512
e340a56f60821cfed8bf44ddaebbd46e290b09135d8ffe3205a4319c9d8376bfe4bd828c3d701d0bcd2465ef07b538d8dbe63764b391e25e357c2c7a37b3726a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Filesize
19KB

MD5
0d5270061f52e8bdbf962fce06c483cf

SHA1
2325b64e2a1ace3408907312733b41221a3ae056

SHA256
6929968295a7afaf5c48d2c9a03cb3cc41ef653a8e14fea12d94ca8828a0716f

SHA512
2822ec464d0751afd683e87c185fe103ac109eb9b20f8de8595f8b66b99b36038973af8afcd00e62889821a24cb3b8e1e3a0297baf33f0b739851fa12cdc9c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4223c658-e341-45dd-b367-bc24dc00bf8b.tmp

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
9fda619388fcddc701d7cf8a679786e5

SHA1
b85622be5952978eea5e53007ff5a0a10018fa92

SHA256
99aa6f1f4e225d27c30dba84f5e4445331e5034da039f3636e7c9d5dd1e0d24b

SHA512
e1b4347d104e0851037e33978032d51a28ed89564e6a58e4376657067172c7f36c142d8a73fb54303cfbe516d6728bb96f7f7853ae46a35900416c3343773bef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
9a049fb9dac1a0fd3a8761dc21d07fb7

SHA1
6044376b9413c01344e985cd0235c026d2137040

SHA256
c6dba2cb4bf0be6fd11fa74b56843bed2e73731b4647ec7d855c60a235d467aa

SHA512
aec4e2aa9ff10c661cea5c98ab164c9d68461eefa8a32131f7833acad2155a76151d7f4552e5ef8ad1bcd471873bb601943af53d216d40a17b7e281f51a1cd87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
2a424a0f343ff6ba39c9fd76bc1b3d71

SHA1
5772adbd3437ad2c815e629205565a77efb7fd79

SHA256
1c43c48134749a492daed37b02534f6dad4390418e66744ab3b4015a2c3c6cf5

SHA512
83b9092cc64b64a906ef30912ea9684d61299b0b3103a5663c091cd73fb6a11cfb4fe035c740845d69f70cd2b707731bf2edc9d8e5a869fd4118cb62dcc9618e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
da0eabb57146495687ee03ca2381cf3e

SHA1
018fd344e8652c5d16c079207fdad5064ec7148b

SHA256
8100b9ac9ba0900ebcd3b837e1c3ce31ec60497e534485978b765708ef749e55

SHA512
30850c339260bc7c683de10fe7c5448f5cffa3c9a91bd0ed91e2ec8217cdba74e84d9cbbbe3464adc1e9e7bf38638a335e10395c164f2118ae9de85e365d8b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
0c2529d91c8de22ca79ed80c8277e7d6

SHA1
c63500b07a309eec4afb40102d99b0af0012ff1b

SHA256
75fef3fa89fedc43e97719c7a770b27c779b85589589cc3463001798b863c52f

SHA512
8b818d59235f3f4f1115e2e0761127a6b473c20f50586dd38b6d4630d222a7972a293d1a99d727907fa242b95b4cd871729b2f397b9ded16a4d357cb0c848f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
58e85b3f76817511a8c88e0c05f78555

SHA1
85710afdb58875aca599d342a2641816fd20db37

SHA256
be5920b79617a993a4fa3ff059940a878a77caf6df6d439869f6cac3260110cc

SHA512
30aba3c5a625dd365205d2b828a3ef5ce79980b51189eb39c6a7fd83f3030466b5c8f043a329ad59f9fd45a4e938126542e99aab9a4d12c4fa62673ac18a7914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
39226881db9617948e7bd6f427206080

SHA1
10d9571b8423c02698d75a0f18a0a58360158eb9

SHA256
af38fdb5bcdd1af91e449c1642c65ee02bd8efb9900172939ac8447acea99955

SHA512
790f6a669f305d9e43aa24fe199fee58955d2442850b5ff14b603b59f5077e5a738c6e7c418f24f3cbc69b8ec9ac196aa92d8e7dfd0b3392065a8147fd94852e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
56c33e7a33acef497401ab6b9ca4ac76

SHA1
02ed64584aba0235da00ba285ed7e6614cb63ef6

SHA256
3386f0e1c6a55c1b3e22ede6b0583c26f956b39d0302cf17bb3812aba718d6e2

SHA512
351b2c906ec0373ab7d8b10042a0c6dde9fd90403647f95bd648e3f6a883d47905c05c372edb6ec50b16d61e481af92ebed74065c336b3ca76f31a4e2a5aaaa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
d0cf5861b5268b9d733d828491d51854

SHA1
6fdc68e1f266827a98f94f4588460091d7261cfb

SHA256
c863f567a6e3930d38a3abbade2424bc3d93ae57903e323f2d592a2a2243054f

SHA512
31a97b88cd33dacc37f7c82f706f67b5bc32485eb360c20cacfb37e068c00a4cb69c0db40e20d15300326464a602badfefd89fe572f1d83e55f017bccbfe1e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
e51fbf0e9e0fc6b8aa73fd8b3507859b

SHA1
b937660b20fb241b458a7236ce97e7e2a4917497

SHA256
c300545fd21a643db6ea5b949ba0bab7d75ea3f1ec55f08ddf01e4512dc93b4b

SHA512
cb023888a4d3df2730730e053b85f36277e826607695aa2c8e5ea2fc5645a23e29369a706e4f74d0c55e56ae8b35e46a77e05c604f35a542f81bf951475bb655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
3f15e781fc812ac5ded8c8a54f688e35

SHA1
8a19644315910204d9280a9f2d257d876230452a

SHA256
aebb136db553935db02f750c74964a1e53b2de8f6a97e92094d32390984fb0a6

SHA512
4b7865a9efcec32e55a8956f0962505c8b9fbc997fd746d5d210e90c17d723b422f735cf929e86cb37af1c7fddb44113cd9b68ea4bb58e4e61b08765e466a13b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe582a38.TMP

Filesize
392B

MD5
75729d5d5563dfad514a9d813ce6672f

SHA1
bbcbb874d3713c04f13cfd889fe89a01e5a8d641

SHA256
134ab3d1a4ebcdd82f89377088a885b7cebc160f476f81aaf4d1893980c030da

SHA512
5328b35409d6b2570137545155e67b06ae70f2e5f12516cd1a59d4d48214f2607cc085f3bb34194d8ffb257479442d14058c3f21f1723044acce3b8360131455

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xjdfyo2g.kjv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.exe

Filesize
1.0MB

MD5
205589629ead5d3c1d9e914b49c08589

SHA1
3c1d57a054f3bee458754c24de73af6450ffdfb4

SHA256
ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3

SHA512
8b81546112a6f0b4c1390c0da318d3f7431e34e750ce8718e95c3c9da69e497aec617102e17244bce0439b11bc7addd64f89463c9f1ee9346f50717363ab193e

Download Submit
C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.zip

Filesize
415KB

MD5
2b697b81ac77cc72cd5973d2cee09d53

SHA1
1f9b7f8419c0aa70ccb81e6a65063146fb7335b0

SHA256
6ac1231e2689d0ae1d726354ca43c6ce9ce84c75c4e89575d3ce05a2b5244977

SHA512
84be019d5decde3295ec3bdea757c64b7592fc580367a25c16c44f87b549ad3d0ec862ca6cdc13de19938d6c401e6bcc174d4a261b10b72e329b9fc4b6e612a6

Download Submit
C:\Users\Admin\Downloads\ae455890e2123a9d011e47065828b0a03c08fd66570fab9d0340d2f5d5eb40c3.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_1994089265\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3904_256099118\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
memory/4624-715-0x000001DC94240000-0x000001DC94262000-memory.dmp

Filesize
136KB

Download