Analysis
-
max time kernel
413s -
max time network
413s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
28/03/2025, 10:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download.jetbrains.com/idea/ideaIC-2024.3.5.exe
Resource
win11-20250313-en
General
-
Target
https://download.jetbrains.com/idea/ideaIC-2024.3.5.exe
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 24 5868 msedge.exe -
Executes dropped EXE 1 IoCs
pid Process 5612 ideaIC-2024.3.5.exe -
Loads dropped DLL 14 IoCs
pid Process 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe 5612 ideaIC-2024.3.5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\nsmB9E1.tmp\Desktop.ini ideaIC-2024.3.5.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\nsmB9E1.tmp\Desktop.ini ideaIC-2024.3.5.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\scss\package.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\scss\package.nls.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\jcef.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\jrunscript.exe ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\lib\lombok-compiler-plugin.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\maven\lib\maven3\lib\maven-resolver-api-1.9.22.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\properties\lib\properties.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\jdwp.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\ktab.exe ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.desktop\ADDITIONAL_LICENSE_INFO ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\lib\modules\intellij.platform.registry.cloud.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\Aqua\MergeWithAI.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\CLion\CommandGenerationInTerminal_dark.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\cmake\syntaxes\CMake.tmLanguage ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\docker\package.nls.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\fsharp\.vscodeignore ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\jdk.jdi\ASSEMBLY_EXCEPTION ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\lib\resources.pak ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\CLion\content.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\Python\MergeWithAI.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\WebStorm\ContextAwareChat_dark.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\maven\lib\maven3\conf\logging\simplelogger.properties ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\bin\idea64.exe.vmoptions ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\lib\kotlin-scripting-compiler-impl.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\cwm-plugin\lib\client\platform-ssh.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\maven\lib\maven3\README.txt ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\coffeescript\package.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\vcs-svn\lib\vcs-svn.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\include\jvmticmlr.h ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\lib\security\cacerts ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\lib\kotlinc.kotlinx-serialization-compiler-plugin.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\bat\.vscodeignore ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\lib\locales\pt-BR.pak ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\bin\inspect.bat ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\lib\kotlin-stdlib-jdk7-sources.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\platform-ide-provisioner\lib\platform-ide-provisioner.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\hcl\README.md ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\api-ms-win-crt-utility-l1-1-0.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\libEGL.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\lib\locales\mr.pak ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\lib\locales\sk.pak ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\Python\CloudCompletion_dark.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\kotlin\snippets\println.tmSnippet ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\mdx\syntaxes\mdx.tmLanguage.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\api-ms-win-core-interlocked-l1-1-0.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\lib\kotlin-daemon-client.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\maven\lib\maven.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\cpp\syntaxes\cpp.embedded.macro.tmLanguage.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\terraform\LICENSE ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\yaml\package.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.base\public_suffix.md ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.scripting\ADDITIONAL_LICENSE_INFO ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.xml\jcup.md ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\maven\lib\maven3-server.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\php\package.json ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\jdk.internal.jvmstat\LICENSE ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\bin\brokenPlugins.db ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\cwm-plugin\lib\grpc-netty-shaded.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\GoLand\LocalCompletion_dark.png ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\yaml\lib\yaml-editing.jar ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\api-ms-win-core-profile-l1-1-0.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\bin\api-ms-win-crt-conio-l1-1-0.dll ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\license\third_party\mocha-teamcity-reporter_LICENSE.txt ideaIC-2024.3.5.exe File created C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\lib\kotlinc.kotlin-jps-common.jar ideaIC-2024.3.5.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\pl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\hi\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\az\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\eu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\gu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification-shared\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-tokenized-card\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-tokenized-card\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-hub\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-tokenized-card\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\wallet\wallet-tokenization-config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\Mini-Wallet\miniwallet.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\Wallet-Checkout\app-setup.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\fr_CA\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\zh_TW\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\is\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\bnpl\bnpl.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\it\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\wallet\wallet-pre-stable.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\wallet.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_176056148\_platform_specific\win_x64\widevinecdm.dll msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\be\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\lv\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\uk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\ro\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-hub\cs\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\wallet\super_coupon.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\bg\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\kk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\gl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_719731387\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\Notification\notification.bundle.js.LICENSE.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\vendor.bundle.js.LICENSE.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_451140037\keys.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification\zh-Hans\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\wallet-webui-925.baa79171a74ad52b0a67.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\page_embed_script.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\mr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_2020374597\shopping.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\bnpl_driver.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\hu\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification-shared\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_363834550\_locales\pt_BR\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_1461454567\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-notification\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\da\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\en-GB\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_451140037\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_1297176569\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_176530732\deny_etld1_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_313213183\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_2020374597\auto_open_controller.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-mobile-hub\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1588_1297176569\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\cs\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-ec\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1799664149\json\i18n-shared-components\ko\strings.json msedge.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\ideaIC-2024.3.5.exe:Zone.Identifier msedge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ideaIC-2024.3.5.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876311919600863" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe -
Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\IntelliJ IDEA Community Edition\Icon = "C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe\shell ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe\shell\open\command ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\IntelliJ IDEA Community Edition\ = "Open Folder as IntelliJ IDEA Community Edition Project" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Directory\Background\shell\IntelliJ IDEA Community Edition\command ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\IntelliJ IDEA Community Edition\command\ = "\"C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe\" \"%V\"" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\DefaultIcon ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe\shell\open ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe\shell\open\FriendlyAppName = "IntelliJ IDEA Community Edition 2024.3.5" ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe\shell\open\command\ = "\"C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe\" \"%1\"" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\shell\open ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\idea64.exe ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\ = "IntelliJ IDEA Project File" ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\shell\ = "open" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{F4F00387-2F3F-46CF-B059-6EAAF67D9D41} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\IntelliJ IDEA Community Edition\ = "Open Folder as IntelliJ IDEA Community Edition Project" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\shell ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\shell\open\command ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\shell\open\command\ = "\"C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe\" \"%1\"" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ipr ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ipr\ = "IntelliJIdeaProjectFile" ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\IntelliJ IDEA Community Edition\Icon = "C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Directory\shell\IntelliJ IDEA Community Edition\command ideaIC-2024.3.5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelliJIdeaProjectFile\DefaultIcon\ = "C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe,0" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Directory\shell\IntelliJ IDEA Community Edition ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{1C396FEC-FA63-4841-A090-710E29CF17B0} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\IntelliJ IDEA Community Edition\command\ = "\"C:\\Program Files\\JetBrains\\IntelliJ IDEA Community Edition 2024.3.5\\bin\\idea64.exe\" \"%1\"" ideaIC-2024.3.5.exe Key created \REGISTRY\MACHINE\Software\Classes\Directory\Background\shell\IntelliJ IDEA Community Edition ideaIC-2024.3.5.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\ideaIC-2024.3.5.exe:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 420 msedge.exe 420 msedge.exe 3500 msedge.exe 3500 msedge.exe 3368 msedge.exe 3368 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe 1588 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 2232 1588 msedge.exe 79 PID 1588 wrote to memory of 2232 1588 msedge.exe 79 PID 1588 wrote to memory of 5868 1588 msedge.exe 80 PID 1588 wrote to memory of 5868 1588 msedge.exe 80 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 1196 1588 msedge.exe 82 PID 1588 wrote to memory of 3636 1588 msedge.exe 81 PID 1588 wrote to memory of 3636 1588 msedge.exe 81 PID 1588 wrote to memory of 3636 1588 msedge.exe 81 PID 1588 wrote to memory of 3636 1588 msedge.exe 81 PID 1588 wrote to memory of 3636 1588 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://download.jetbrains.com/idea/ideaIC-2024.3.5.exe1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffedd6ef208,0x7ffedd6ef214,0x7ffedd6ef2202⤵PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1812,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:112⤵
- Downloads MZ/PE file
PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2368,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:142⤵PID:5236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:142⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5416,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:142⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:5968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5648,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:142⤵PID:2524
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=11363⤵PID:248
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3420,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:142⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6420,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵PID:5464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5536,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:12⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:142⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:142⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4712,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:142⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4992,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:142⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4728,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:142⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=760,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:142⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:142⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5048,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5736,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:142⤵PID:5180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7212,i,14662245118758333028,13256677069178165608,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:142⤵PID:1536
-
-
C:\Users\Admin\Downloads\ideaIC-2024.3.5.exe"C:\Users\Admin\Downloads\ideaIC-2024.3.5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffedd6ef208,0x7ffedd6ef214,0x7ffedd6ef2203⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1608,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:113⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2416,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:23⤵PID:6124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1912,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:133⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:143⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:143⤵PID:5176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4376,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:143⤵PID:5192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4372,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:143⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4456,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:143⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4536,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:143⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:143⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:143⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:143⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4572,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:143⤵PID:488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4476,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5116,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:143⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4076,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:143⤵PID:1224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4612,i,2919881627020664367,4925807042836355234,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:143⤵PID:5412
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:5072
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:5252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start2⤵PID:5740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:5752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD51461e1d3da6ea446f5c67d2a6e482cea
SHA1e39de450608ba042fa68020a0df718d170aab2a7
SHA256a573b619abaad990c7e9f136c0da67be0c6c6d78df4e726699e342e7c1cbe760
SHA512cb0da6a629af920f25aded75fb7722fc0ff7cef2dd223278b7fe64db10f87cc27af3284d10b0d8c2940f042cf4e1c6290cecf9c2599544620e42073178ac271b
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.logging\ADDITIONAL_LICENSE_INFO
Filesize49B
MD519c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA12db86ab706d9b73feeb51a904be03b63bee92baf
SHA256ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
SHA5127ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\jbr\legal\java.logging\ASSEMBLY_EXCEPTION
Filesize44B
MD57caf4cdbb99569deb047c20f1aad47c4
SHA124e7497426d27fe3c17774242883ccbed8f54b4d
SHA256b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
SHA512a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
-
Filesize
33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\Kotlin\kotlinc\license\third_party\caffeine_LICENSE.txt
Filesize11KB
MD5175792518e4ac015ab6696d16c4f607e
SHA11128f8f91104ba9ef98d37eea6523a888dcfa5de
SHA25658d1e17ffe5109a7ae296caafcadfdbe6a7d176f0bc4ab01e12a689b0499d8bd
SHA51231cc38066678c030e8f6378dcae59add64566a977f92983c3a4c929c9b76424291915ea4283e1367ece50b9537f8d51970aa8fd5ce063037aa3a7c45f0677d25
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\GoLand\AIEnterprise.png
Filesize290KB
MD5e545e8f21e2cb9ecdde3b3c9c64ae1f1
SHA1f27516cbd79002eb89a400e2d060f13c9e2b7f8a
SHA2568dfc2b4efcdedba1423b8b123bbe8f48d5812f7826f174c67512ed0cc16dc647
SHA512961fa0b928490d3cf492b7b28768c7c543b9b1c588e4d1d7b5c19df53eb218aa767c2ec183dbede20cb47a0705cd1db19390ca78c308e430a7b086077ebb1e9d
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\fullLine\promo\Idea\content.json
Filesize607B
MD5db98f614ea1fc3e04208a1ed2ddd5452
SHA1554867c792d10140441eb540eb483717303e5554
SHA25622e58b3ce36bc4cb584894dd92c598ed173454c685e7384340f37ad5e13b0a1f
SHA512d02ec15c2c392c3839b4b57a5a304f55a2426803673d949a7ee8f66b7346e71ac23e4465d059f740957aa88a976da9983d335a47d83bf80d7a5a323edf2f562f
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\diff\.vscodeignore
Filesize25B
MD530e109396ae0255375c1715c969ac2ad
SHA1e52cfe6126f2c62c4079fd375ab8a1d889008a08
SHA256d5b4f660e6b90e43d2c31dcd830acecfdd40df3c734a41d92e0f8101ed31ae7a
SHA512b254448ab57d6171dc0ea8c4f26d900676a6b447cdf74207847fb827a2409f75e502ad981f590440a2fb2f4221547c41d6d3b1a212a56e67d027058d96af7e59
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\docker\.vscodeignore
Filesize24B
MD5afee5288848e4dab176e65648d649775
SHA1180532c987f3b3819b05006c07aa8e066e8bf27b
SHA256f1bd9df742fbeb4519d2d783297aa58b2626292f10a412c292fb52b4ad3b2e56
SHA51211b969c3927c5bee78fa10caf324e35123974a5eac344694fde7542dbd9f06aa8ad8408c8729cc9083e1df2cb30b16bc2a3b0fa32d6b60c9c5edbd75cc03f429
-
C:\Program Files\JetBrains\IntelliJ IDEA Community Edition 2024.3.5\plugins\textmate\lib\bundles\html\.vscodeignore
Filesize33B
MD5f243f68cc6382ce12e66141f8a4da165
SHA18d921e915d7789d7f008234be99c6f4e4b768ab4
SHA2563c8c93c7b0f01c697954622b456ee4ca5416a1e5f6f23976cc99de85b8158d46
SHA51242b2223a098083c5e4885b4bba5d038e745ad0e39f2b06f2d67e133bdc958ba2f64b65f22d916e113adc32da72ef08be32dbd8f19be7ea195b9eb003233f5c3d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json
Filesize3KB
MD5f9fd82b572ef4ce41a3d1075acc52d22
SHA1fdded5eef95391be440cc15f84ded0480c0141e3
SHA2565f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA51217084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339
-
Filesize
280B
MD5ade795bbc5f49f44cc6b7b4bb91c6c2c
SHA1fa99d7fc3425ce34c77c74a37e580fc4c90fbfef
SHA256937ef0952bcae8f4edc4dd9200b9aa8f122f2bb4e926e19d12d41310af88a26b
SHA5122a1e3b1ddfe8215fa818396e65b2426d3b2a6c269216780bb9de6c932cc5253f9968a02d10f60638c86a6e0835316f240b57d2b951aca9dc4d433e76d79527e3
-
Filesize
280B
MD5fd170c9cf28cd7324b15196bb3a2f998
SHA182a72539e3920b66e8c345b11366eeb5f8d15435
SHA2563778f1688bce9cac1a0b875bbe71e58657a4e12546dc4d10bccd111dfa87e1ac
SHA512c63686d95d61420a14dfb55211764b91f56fe2e7b29d8d806aaba42fe8229524cb5e9575b5b6731ef2f12d3d2365cfa220f34ffd5b28f7cb3bf2a20d33ffafd6
-
Filesize
280B
MD5b79b00811883704905ccd744b5df9e34
SHA11e2a26007765fa6fb2cc6442d1a22c639b5cb695
SHA2566d23d31e685085c875a6671295e63c8cb7b457c36f5eed89c962184901dc3141
SHA51217af536678552b25a37ff4ee05e1b62eba5bb2d4bcdc01b57db94f5eb4c6bca6bd5f7267456d9773d9adb4b1af86cd969c8db682cca3379b597daa780ffe8ba5
-
Filesize
280B
MD5e5f3655796637b7d0f4a8ed402e119ea
SHA13baaf516676664d46727759914745776a166016a
SHA25622d91a4321390a9445110f04d5600f49f03604a2d7ecadd10c663248295c88dd
SHA5122125899d678c926c9f85ad81892f8ee91aa0a74e4c533bcb6e48675ebf0eccbe0db17998f3e3ab961cf3beb8fef7f950588398c5868327aa2d33f81bde797ebe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b53b503-37f1-4290-9a7e-7afa5c860f38.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
44KB
MD5251746baac821ec0921426ffb1ea7174
SHA1657a3351f14a42cd55ddd394adff587a62e69567
SHA256a99d850fb35d91993c515ed72c069684fd8bb026b3917c1d49ce57392b5aa431
SHA512425c839dc87d0fd92037b1a6feaf9111d80163c9a42f4f8866192450a29b2dc056f0b5cb5a0737c2d39ca21c4c9489461f64f5ea46044aa7e43a93ae177221ae
-
Filesize
264KB
MD58b6598e75ae0b8ad4dc5792664be3937
SHA16a6ea365299dd5180124c3007bbd96d99ced9607
SHA256176b7f4d70b86de4f79f28318ae94f3b149f14475176388c23f9c217d1b97c5a
SHA5125a17464ea6cc4f2e5286758c8a9c523195211b2bd6bcd5eeec6c6fcba86083e9d263ffa60177e37a70c424351152de190f1c65f57bbef55e9f7461afe1b74c06
-
Filesize
1.0MB
MD5bdb25689ebda95c0a3505c585f45d362
SHA1315b731a80f3445ff9c15ffed25cd016a5f2c5c3
SHA256b015db4b6709609b6161728db5dbea472bf772f5a425f1ce43a1f2b863514e0c
SHA512a6794196109d1485f9149a3ff75ecc8ca2f69d94bfd6d2efcb50ae09bec68aa1c017571ed3176189c3f4cf92b3a76526881ff07655531b357b1ed657f4affce8
-
Filesize
4.0MB
MD55f4a33d80a829826f83f4892b78a330a
SHA160f5a502faeb291e908a0086dca8fdcb1896d7fe
SHA2564443fb0aacb0315e2920d7a87b4d93d00996a65d913da99badbf37cf365f182b
SHA512e8b7f8faee6c5f5df2367ccf5c587eccb6109455db643dd79949bd433954a770d0f9f3c072575d5ebead972cbbdcef901f7dc5d36bda38c06c4339b254ad4778
-
Filesize
19KB
MD55e5ae2374ea57ea153558afd1c2c1372
SHA1c1bef73c5b67c8866a607e3b8912ffa532d85ccc
SHA2561ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3
SHA51246059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf
-
Filesize
264KB
MD5090beae92b00bde5de1ec27e40435c95
SHA101d5594cb24e77b760640a16e69f14065f72dfcf
SHA25644dbddc25848511de0a0486dc9a8bf710a8aec5ab80d57c3376e3b8a62da7874
SHA51296cc66c4218666ecb8c5427925a581bcdabcbab73b41546b29fa09d1e624ac5477b728e45959e2ef5ab7024e95c6e9d0cb70f6d662fe1d483678ae9253f6a47d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
192KB
MD5bc8b91794cac39681a7d7af28ec86e0b
SHA1a846156025b84ce8e69a9cc50a4b569bb82be1d1
SHA256c4cb5fcf135fa35d4610254e412f264099f9d7fcd7ca45505b6620087c1e8862
SHA512371ea59d83260254c3d2315259efdf237c91ca8fe1672540d482c4fcfcedc81bbf3f429c2583a405d9835ce3d44e4e8fb92f1bb48489a8281e7f2bd8f266b884
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
Filesize
2KB
MD5f2f81af7488d15ee0fc2de132a72e568
SHA12e30b1f563ed4e5d5a56f635888dad13921a527a
SHA256436fd64d87849c82ec0664e69b1da344ad04aa3393e8e9e4769b50b9af39111b
SHA512903cf16b93ae60aefddee6dadeba21dc1a794a3497eabe6300b49a771e344eba890f89a7e8ddf27958526641bad0a2ca8f1b057a90aa083e26408a218fdf477d
-
Filesize
2KB
MD5d4ad97134caf0dd786dcb17f2e4df950
SHA1eb900348b2d9ff01816792104038bf4835aa53e7
SHA256415125861df66d3b797e00d606939c07cb68b202c1c59754acbce45209029cdc
SHA51226415b5be017ca1a58fa23ac3b9264a1dc26d8badfc0d5c14cdfade5750f0027440c2839dbbdd4df2cf67961ee12d753e8e4d77d1ee4c8b28d1c0ef9cd093efc
-
Filesize
2KB
MD5f1aec3454c6ac88f027d62d702c687d3
SHA10741734c4fb47a5e0418234ff349339d2094f2bc
SHA256bddc17db2e079d10d75851bc275ba73a68c7dd632f0381ba6fd7f23f11f257d8
SHA51258dac7204864211e1642244b0d7c4cd8d0741bda40645b4fb9e603649e2b0ec35f6a8db9df1097ff729325797959d2c06cc94b9e4d6388281905987f31177afd
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
188B
MD5844ee9493e572b2bdec8b0f1c71577c4
SHA1865a15817fa48849bd0a75d7af643e6f78e01ec5
SHA256869ae96413ba15806db432f99f6444f1026c87f1d755892415901b9fae31c86b
SHA512a0482e6289d5fc939127fb40a71b6e5b361472ff2b5baa294701d9342482dbca173aca3059098207d0debf4e5381e0afa520bb8ae26ae6d7b11e96fcdfb544da
-
Filesize
16KB
MD54e888592965a55a76d56d9f1fe9767fe
SHA1c6026170e738c186665d064212a0685bdbe54649
SHA256bdd09562afe7518ae5deb8b8e1246cab1ea66507fe644c4342b3146975ce6826
SHA512ae29e128a08be33462f2bcd74a3ce6b8377ad4acfb9257f91352425144458600f33d6cbb79fee8b3d3200722e1473c5abb97ee796ce983f19b26a72d6c03d328
-
Filesize
16KB
MD5772593f1efce8ffa7372c6f83e62a27a
SHA1a49720ad7a60ed5a646cf4b9f1e570838b2c8f4f
SHA25603e97ab66cfd41258f5ee6c3c7c34a0ca4e3d9d93b83cce24796ace58c23f490
SHA5124d93471f3190dae25326080e117174339c5435547336272c3965f4741f879c474c4e8a62130dd75e4aef983a368f436a2d1d1f7fb560d417f2420a56eb5b9e60
-
Filesize
15KB
MD542cd383e867c00e8357fdcd4bbed27e9
SHA1158570b392305bf9ac33ba7cc71488e51950d91a
SHA256231053a53d27ab6edc6c21fc3e20615bde0212bff86fa9bcb8edae5a13b19981
SHA512581edb0128be0271acc94f9b9320bae6667a527718049bac5f254013508453afc3305484f4150d1be2c2109a24d0834b29dbe77ad5d2a4160573f4ba78f40a0b
-
Filesize
15KB
MD5e130bc5118b7bbca06260f65c2b4048e
SHA17ff0372ccc1307f907d55e540afcc6fab6f75759
SHA2567ffcb49ad7c291a9e1542dcbeac928fe549e14c565c3730f52ec373d959fa53e
SHA5120165845771f4edb5764709a2f9004deadbce8e4624b5835113a7188903c0d170a7fe738c0c056875038016689d9a8dde8645cff17efa18444f492a9a5583ac6a
-
Filesize
37KB
MD5af543b9058225b6979cb85311607b962
SHA16205ee824ca6cd3bdeb6e6694a1de0ff10ac1c1e
SHA25619f0cacc3422a6b9b0bca32b31f93c4542ca656b41aa3ffcac56455728429d02
SHA512b654d185b5bd096e62257d375b89bf9807ad676612d411832b02a95ba7eb2139354de1e7e62a94c1581ebee70055f66b784cecf65d4b68733c4d8fcee97f8ce5
-
Filesize
338B
MD51b3482f229bcf3c599ad726adfdebd9f
SHA1dd04cb5e5b690727a57d4c06b89ffe09cd611cb0
SHA2560168f04327a70fd0afa241c96aca08b76c4e6355c03d1a50a63d76b050b671f9
SHA5121e47c31839f355aca1a297d590ec275510063edb2503cbc4b63b696dfc77c9a05d797684135fbb130f9b73a9fa7ab645c650fd71c0d4c17b651afbe8f9235943
-
Filesize
350B
MD54a8c6255420e4144301a2b5c880edebd
SHA1eeadd369cf037cb6971dea07417443f99ff72a2f
SHA256364da60f20f53b2919c95e4c909dd4f4c180807dd588d41f1c1b9e7c0ecc1531
SHA512d7a9e1cd9b18c09a4c69a756f3430bed6db9170b1cf3438339b81f54cc294fe4488463837c7cff882e4b7d20a689cd332a6c689c7673e015635076a38b9a0d42
-
Filesize
323B
MD5661779d7da3abc6029396989c1c2f1e2
SHA19b763207a2d7e93dff6ab5fd2a0b0e3c1f2a46b6
SHA25608233a7feeee5e8ee0aac73b62d6a9d40e3a6734d972bf4cbe136ff3b18833fd
SHA5125ecc0d7b78719f2945841c5454aed7c45dfc705374bf385a10b493847e640e3b9f4e8f936f92cebcf9935ce0be3df3e31ae68548720a3fa9c5e6b9813606a89e
-
Filesize
23KB
MD59b77db4e30f4018b37da09ce80321527
SHA169d6c1c1632fb41ec9444110229c9a696b2eb85e
SHA256392f597ee794f105e3ac7818c945374df946e37cee9a543b3234b4fa7d0179ce
SHA5120104449c4ca481dd672a6b2f1e4ed42b3e30f1f62d3c2e9e76c42a09a837b0bc6052ff1a6bc28ab0117c4d969398ca8001cc8c83291729f4a73e85ddc02fc58a
-
Filesize
113KB
MD560beb7140ed66301648ef420cbaad02d
SHA17fac669b6758bb7b8e96e92a53569cf4360ab1aa
SHA25695276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985
SHA5126dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\manifest.fingerprint
Filesize66B
MD5dd1a95bb670d66d80e751de3fcfe20ca
SHA1556f54c5d2b48f84a7ca7fe3ff0604d6a6118d70
SHA2567a941a2a3019ba1b069c105d6fcf66dc07f9b13fa739cf3d98653fda96dcb5a4
SHA512ed49e7b7d607f4b8ddf3e620f8df332989fc1af441ed17fe9ed3c50b797bc4f376e8f864d9488a85191e3561e324866109b8387c1599fdf67dbd704611141ac5
-
Filesize
23KB
MD5b4684c91a1fdfc3daf3161864a466daa
SHA192169b504b1296a5becb695d445adf41b99ec843
SHA256a1cbbfd4ffe8bfd2a548973e2213f02a28b70cd2bb30819b946dab8966309200
SHA512ea18ad56d5b141376e0d813e3b7fb703f4ced2a23411dcfeed629f0c84efc83494fb98204805957a1110cec965e217354f447094daa668bde304d3e26f894957
-
Filesize
904B
MD5aba477a4f645c316149f3e577c6d6727
SHA19b0e2ea452ca88fb504b839890c481984d52f98f
SHA256fc28a4687c680a44d08f66718d70bba8aa59ae7f71e7f77231d0f8819582d5f7
SHA51243808ab3cd96fbb114ae3a2621d061355c4ea1bf27f55881e09afcac64b887355aab57b1e777e505466110851e74ef948757db805fb121552ee8e26fb9f9b1c4
-
Filesize
464B
MD55d62777c57d69bff31a56321be4472c4
SHA183a6254c9f13141714176fe2096ffb1650f80bba
SHA2567095a91665bdd6c407aa93c86acea2e602f2a91df52d3a67b00a32ba090a1dd4
SHA5124d41b4bc837ae06bdb928b72d478e32884bae496742ac8e4b6c3158c7f0b1287b85fcccf6f070b94d5597841621632a8457fe632db75d34aae952b85f5bfd716
-
Filesize
469B
MD5503aa9468b0ab258df9d67d0af81991d
SHA147ee19422896b3992a74de8a2ae7c68098c6835a
SHA256815cb3a25cc2e942176baed6fc54664272dcd9d64f3c804b7ab027dbcbd09457
SHA512c3dad98763532712c0ecf61440249e4caff6062849007f61beeede7ac03708826cfb35d303ef3f2ca2afa07c74b56c317c5f9bfe2b718b5cf9c07343174501a8
-
Filesize
19KB
MD541c1930548d8b99ff1dbb64ba7fecb3d
SHA1d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA25616cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
SHA512a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.31.0\edge_checkout_page_validator.js
Filesize1.1MB
MD50e3ea2aa2bc4484c8aebb7e348d8e680
SHA155f802e1a00a6988236882ae02f455648ab54114
SHA25625ffb085e470aa7214bf40777794de05bf2bb53254244a4c3a3025f40ce4cef7
SHA51245b31d42be032766f5c275568723a170bb6bbf522f123a5fdc47e0c6f76933d2d3e14487668e772488847096c5e6a1f33920f1ee97bc586319a9005bacd65428
-
Filesize
13B
MD53e45022839c8def44fd96e24f29a9f4b
SHA1c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA25601a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
SHA5122888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
-
Filesize
56KB
MD513b109d8075b7b9203bd46ea98c19fdb
SHA14101abc11fdc0bad3b91546ee0c733851c181e22
SHA2560c8c7de547ebc59124a59f2e7132ef9c0349ec7c0227fed07fbbd84017ab4adc
SHA5121410448b95ac80c96e7101826be88809987a2aaf629d62254b8226583d6d79f4d6c9b5a26b40388ba2fa9ca918bf1925b92502d8bd946af51a13b32064c61873
-
Filesize
56KB
MD5b9524816e34de37fd96df6860850e180
SHA11bc74514b70fde2c6a3ab1499fd4c958a654098d
SHA256a2f1a3b9daa66608ccade7f140ca7f7f1159f614b577e0ed063076edd3d5a6d0
SHA512667bcff5569524018d502c79b9d5dfdb169ad8b327a3ace2f4334df30761ea102cbf1ba3b9c2b131276126e1a512a440728b3008acd62df220701740ef270651
-
Filesize
50KB
MD5432234807ed5fc7f76a82b6e60d7e804
SHA1f2f8c8af3d77ca3593e89789d9572685b099746b
SHA256508f6b450a1f1cd8c2e79cc4ab16d9b63d12f23af7c66f001738521cd277285b
SHA512a53ed74852e1e57b5f20d743eab6a8af22f186e903308e292a10625fcdeca2aec00189b548a79fb9f150bf63fedc684e275dcfbd6924730b10e423db0161a55e
-
Filesize
50KB
MD5cc5e630e2881e8e7f048816c51caf7cd
SHA1b3ccbfe11ae747a86d7c3f6cdadb2daa111939e2
SHA2562a1e9c9d2265e22b3f88a03037081c04f92c4cb429b7845304824a10d64c28a3
SHA5123f71f592e0f332f5928a7c2bf29389b79fb36ca1dd60bdd71581cec3829d98acd5b8f6c5834bcbb83efe0a72719fd8f6848f001914cd7f3b0117a729f116350c
-
Filesize
50KB
MD543142ba6f01b61ef1b6786fc0eb052a7
SHA1b83a0b1413f5509f222e69baa2c8cccb875484b5
SHA256ba60b81bfa1b9e98ea8cc28444c76fc5ff59c4f991fc5220a696195d1fa1e44e
SHA512848bc73131bedefb17f6242ec65f1f745bccce772c14b9251322a34f2ece351ac1b214e2c72ac3bd48f257123cf9192fa57fb925043b18a2f69d8b736c2a0c50
-
Filesize
41KB
MD5d56c1308da10ae3b9a094a9251301ec5
SHA146b2ada6c7c24cfc0349206999aa9c47bb3393d1
SHA256c98aafcdb071c4c3aa4a4c7597a988e2940bdb88cca57392036f98686983aee7
SHA512fb1d0d7ed571b652e16d104cc31525c37a6a2b49e4a01e6b34c603efd87734776fb3106073751603a0b383af72060f94728068a15fdf9cfa5d89f9d1836e32fb
-
Filesize
41KB
MD56d4052189773faeddad9ba8d6cbe6042
SHA1f81d3728ba18f8b919a434593e5d5862cc7ae566
SHA25600631373aa2ec180cdb4f9ba707fa969e25f9cc00bcf3e760618303072027cdb
SHA5129c92088688e1eb082ada462b41a4bec7ccee783bc94a40fd4a4212596b24f1f4e96dbc72892381cc8452f91e1129fa3f065b867e054b60e7e79c3230b7a725c2
-
Filesize
50KB
MD58383386c285b0ebb76c2bdacca974890
SHA1407ccc81986048e7bcfeb059e711f7f688f9b36a
SHA256e3da0254a9fc2e0bbf610543ddb570ee6fec36a0cb22dbb7f907c0a37806fc3b
SHA512ee4e0b8e4639c689cdd75caa650baa510ecfe5b087006a4b2d4df82af636661afad47d7bbec2420680a487acea524bfcd0ce9db70052414ce97b2501f028773f
-
Filesize
264KB
MD59622dc43582b0abb8eb56213659ab3fd
SHA11bdacfdd5d4ad312560cc69fde734fc712c59ff2
SHA256c2dcff49319a8569aa996b3da94199165a10fda235d0c305cf27d98262fadcb5
SHA51244895843291ecf350a9fe22e5707d1d8d28051707ba74b47170aedcd8c7f126d2944bace2bbc30a2348bd887f08f96a07beacf97659acfd03325d1aa1b2697f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Filesize6KB
MD5bef4f9f856321c6dccb47a61f605e823
SHA18e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA256fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
SHA512bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\manifest.fingerprint
Filesize66B
MD55ddbc1878fe757e9fb5be515f8f95864
SHA1fa7d42b5adf36a370a95a0abaa20c6094b2b47f8
SHA256a0b13e5ecb7638ffd1e054301fef148b47ea17bc528779c56d77d4e7a6152983
SHA512ae2a76a48c46a90085a46cf03eca6576ccfdff6d76c64f095c2d657641c73054581b3e8c8738d751f2f8465fe6a2298e01188f807175fd7f4d1995078c7bc1a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.28.1\typosquatting_list.pb
Filesize628KB
MD5bd5eeb9c4b00955e5a0f6a332d78cdef
SHA1cf9e85ae41cf1ef2385a73ef36ebeb3c3378ea3a
SHA256dbbea874b4b73aeb3ad17355c90f692767a947516481f158b7319f7c43f0e657
SHA5122cfa521120dd1ab9c2cc90b74cd8d3f6f8991a086bd2dc1b9d225b08aeca8420f565e047f551ddf6d2149cfb02e4ce69b641e328a774dde7017ad374fd58eb96
-
Filesize
86B
MD5961e3604f228b0d10541ebf921500c86
SHA16e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.21\manifest.json
Filesize176B
MD56607494855f7b5c0348eecd49ef7ce46
SHA12c844dd9ea648efec08776757bc376b5a6f9eb71
SHA25637c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
SHA5128cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
Filesize152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
Filesize
15KB
MD5f894e7068ee5f5b4489d7acdde7112c9
SHA179ec857791ad4ac76673b05e6fc44e55315424ef
SHA2563948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab
SHA512e85b2bdc27b9721425bb03393e8aad897647053c77d7862ea541e03dc896173af6eaaf182514d46464d560d15c6b9d4652690885426ac1c68e2b9dd8d632e816
-
Filesize
2KB
MD5273bbb1677826addeb9ba0fa2d0ae8e1
SHA160739eb4da696f8c501311a9cb2674909487c587
SHA256615ccaf3600e9bf5abe46827cd1aacdca126ffa87f5cf9560874b215d0c59241
SHA51297cf6d9611ab252d449664f6e2c766dbe909825daf559507025829762c31f944affa23b03ee2cc8626f3ada9775a44b05789350222cb54bf9b02cc3b3ee3be5e
-
Filesize
1KB
MD5c8eaec621303f13347a4deadbe6785e5
SHA1f0422d6c3861194b3fef027aeba60eb9fbb84fd1
SHA256c0f98e29b3abd984eedf985a594ce4449019ac15dfe7c1466ba4f18615fecfe5
SHA512248c31359d0dd1341a80f6ff1b91992db51c40f87b5a6005ab5287dc62ce0663c3cf92749e52cecf21d3d5a803fb7b1055eab642ed0847eb68ff99d669d3d9f9
-
Filesize
2KB
MD59d7f8950285b6b1f23b0f8b69fe50d31
SHA12ac52fe877d9f77fa97c80013d4e054bfa7ab19e
SHA256c77e53ba8323355bae83ab40d6ac1b31a412df4cdc670152cdc1c7127b82b349
SHA512e4fd349fafdb46b6a7c969852862914f7dc1e044d0c42af36bbdfc92649fafbfd7375ae41e15b5cbce82602f32452e41a62dd5e56f3c60d4f65d74eb2e9d6d0b
-
Filesize
2KB
MD50e21ddb2ab0b5115d4e7720a10ec9408
SHA1a78fbe02d33b835fd28afe91c6c1005c9b5ba715
SHA2569b49ebbbe507beb6daacf3c0db16b10b7881751091e4c50efe478c5663dc17a7
SHA5124de5d523ebfb4049644319b897716484eff2f6e19921541ef44c55a7fe4386300dd3513d54514dea3bada371aa9e42fef59deb5d428e925b04fa51049d05da0e
-
Filesize
2KB
MD5b59b7269823d6aed78a933c2cff6953f
SHA116f8ed7e2f524eec81618366fedaf6a9144eae22
SHA256eb7f688c06ba6a4d6da25e19b45d7bf2d6af326f924403721f3423cd270af123
SHA512dee54eba23584ff74f64b441ecc01843d177434c58a1e7f87b89bb6a87d84db876351550b18ecc3102348cdce6e97aef606ea5debfbd70dbef88d30e1a43a76f
-
Filesize
2KB
MD585e9379f7b3c2c856ac3480248c18baa
SHA1eaabeca55ef9561aeb2c44fab00d2ca03957e106
SHA256ae3842704573c5a836ce84ba1ed73626a465a26988eb82fdce4ac9db8c44a7b2
SHA512b9182fc01316ba81a2087f4e599bcdea5e8727c377b91891f2bf6fec78ab9ab5c8501f1a6c82f831c79128f353257391e61e77fa2eda4ec9f8c82a7c8a583d01
-
Filesize
15KB
MD50a9fb96a7579b685ec36b17fc354e6a3
SHA1355754104dd47d5fcf8918dee0dc2e2ee53390a6
SHA256b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7
SHA51267870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b
-
Filesize
4KB
MD5d62d3e349689811f838dd10fb216eba1
SHA1edcafd517860cb6b4bd299e20b17ad74a6fa2a5d
SHA2565d103419245e2a5f124a96cace25d6836b2398edc0aa3919829b0fd6ad8b5d6a
SHA512fc7d5826cb9f85068ea702f007920bf7ae63758d13c48761e83cc9e8ac06b231f40e17a9f3340d60d874ad2cf6e0991eb98a52cf893ab785489e0cdbbf294f88
-
Filesize
7KB
MD56b7073967487c24d08e88c208a1626fa
SHA1f75f9dd095558b3c03b1647fe23c0869634bd9cc
SHA256c91c61861cf22d1e9cd14dbba163573b2bd3d03dc72fcb1512879e4f3ab3b276
SHA51231e1962b761bb0304905287f8ef33bf244b05ce1490723b98134dff0cc55956295d979086c350457fa5f6618868e431f1fc2d34afb4437ada15839ae4836f6f7
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
-
Filesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
Filesize
1KB
MD50b6571897c933a842202b07d7da59e5d
SHA12905378596ec0e65c93bd8f22526778505547090
SHA256530a6a3f0204242c0876de650b9463d7acfe14ab78d11e29f10a3fb5c5644860
SHA512c13641fef996738d6964e4801b87fc57c0f9055385dc7a6ed57385e0deadbd47566fe2f5421a59d46a680b5c3343b653f0d184c869f013884cc800f82255140d
-
Filesize
150KB
MD5b0d4c173b4261b9ab2252eb01fefa221
SHA119d9da5dcfbf4c94b0a9f58563a9e810d85a4620
SHA2561b0cf9d0be4b0a130fb40f1676c99313ed86443e1054b87b290451f750923ed5
SHA51214c0bb483f8673684a4089ccc5377cd4487f976c616d4475b9d4ec9e8542b8be828dff68f27d122b46139d1fdb069c964d111746a8c23018f98974293dc8fa2e
-
Filesize
9KB
MD548f3e7860e1de2b4e63ec744a5e9582a
SHA1420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA2566bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
SHA51228716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
53B
MD522b68a088a69906d96dc6d47246880d2
SHA106491f3fd9c4903ac64980f8d655b79082545f82
SHA25694be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88
SHA5128c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff
-
Filesize
85B
MD5c3419069a1c30140b77045aba38f12cf
SHA111920f0c1e55cadc7d2893d1eebb268b3459762a
SHA256db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
SHA512c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
-
Filesize
1KB
MD5ee002cb9e51bb8dfa89640a406a1090a
SHA149ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA2563dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
-
Filesize
79B
MD57f4b594a35d631af0e37fea02df71e72
SHA1f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA256530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
SHA512bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
-
Filesize
66B
MD5496b05677135db1c74d82f948538c21c
SHA1e736e675ca5195b5fc16e59fb7de582437fb9f9a
SHA256df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7
SHA5128bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c
-
Filesize
134B
MD5049c307f30407da557545d34db8ced16
SHA1f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA51214f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1632378695\_metadata\verified_contents.json
Filesize1KB
MD568e6b5733e04ab7bf19699a84d8abbc2
SHA11c11f06ca1ad3ed8116d356ab9164fd1d52b5cf0
SHA256f095f969d6711f53f97747371c83d5d634eaef21c54cb1a6a1cc5b816d633709
SHA5129dc5d824a55c969820d5d1fbb0ca7773361f044ae0c255e7c48d994e16ce169fceac3de180a3a544ebef32337ea535683115584d592370e5fe7d85c68b86c891
-
Filesize
66B
MD58294c363a7eb84b4fc2faa7f8608d584
SHA100df15e2d5167f81c86bca8930d749ebe2716f55
SHA256c6602cb5c85369350d8351675f006fc58aea20b8abf922a2c64700070daaa694
SHA51222ed0211822f6f60fe46184fb6e5e7fcb2b3a9d2e19f25fb6e84e1ca3a5d645183959309549cdb07c999b345cfdd9a1351f3474e03fb8d451b0f093d44844d7c
-
Filesize
9KB
MD5eea4913a6625beb838b3e4e79999b627
SHA11b4966850f1b117041407413b70bfa925fd83703
SHA25620ef4de871ece3c5f14867c4ae8465999c7a2cc1633525e752320e61f78a373c
SHA51231b1429a5facd6787f6bb45216a4ab1c724c79438c18ebfa8c19ced83149c17783fd492a03197110a75aaf38486a9f58828ca30b58d41e0fe89dfe8bdfc8a004
-
Filesize
1003B
MD5578c9dbc62724b9d481ec9484a347b37
SHA1a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d
SHA256005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0
SHA5122060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640
-
Filesize
12B
MD5085a334bdb7c8e27b7d925a596bfc19a
SHA11e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA256f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
SHA512c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
-
Filesize
6KB
MD593c7fc76f7223d043593c999de1c0bea
SHA1dd7c906c629466fe53a29d3945e31801065b5b1a
SHA2560db8861eb771d2662ecabd8c7125c5453d6f3d976c14401ecb252e1f85b018d6
SHA51255c752b20ebf883adaf0bf696fbe7c3f94b06d5bff907b39e9f43358ee7a58336024145b77ba315393609853c54a701ec25592ffc32b9ed3e2ce4857a4186c8e
-
Filesize
9KB
MD5a3b6c4249c181157cf292b749209fb49
SHA1f3704c2d69b8f1c7738104f2d9fadf5ae644702b
SHA2562edfd6823e18cb7a1e9e6abf571ef33c5be863cb5ea891ffa3df9a06fd0bfe98
SHA512113df193b92ac3312b4e983434d0fb61fde5f3675ea00687ab6f9c53f17635bc5dba2970a5af6dc176618d962f982ab514b82d9ffbf894e315a31797887d35f0
-
Filesize
66B
MD5a287310073c3b178dc97cb38269847da
SHA1ab283f53827794fffcfbf8603d33a3d9f6a5bbf2
SHA2563af99da8ebc689d4324a15e3f059e379c9be7e523b5b26efb9261cb507a6f6d3
SHA512bdd9f96341fc74032c9ae8677e6a06badae1ab60f4ae48ced84853a0a57a16e16c68d636bb821f10fbd06779462ed3fca5d4eb903e5235f519dfdd46b1d7e95c
-
Filesize
145B
MD5465cc76a28cc5543a0d845a8e8dd58fa
SHA1adbe272f254fd8b218fcc7c8da716072ea29d8ba
SHA256e75fb1fa1692e9720166872afe6d015e4f99d4e8725463e950889a55c4c35bb9
SHA512a00286cd50d908883a48f675d6291881ad8809dcae5aca55d5d581e6d93a66058e1fe9e626852bf16e5bb0c693a088a69d9876ccac288181b1f74254bf1da1a2
-
Filesize
118B
MD53e4993f878e658507d78f52011519527
SHA12fce50683531c5c985967a71f90d62ab141707df
SHA256a2fb35b03e24f5ba14cbe0e3c3d8cb43588e93f048878b066fd1d640ef8e59cb
SHA5129d24ef876ac989e50e9d4d06732a4c4f61e12df366b3d4e5ff93d6a60badac36c3e55e7f13c2539ecb525017490a887fc56580ef8e83483019041ad9b13358d5