xenorat | hxxps://www[.]youtube[.]com/redirect?event=comments&redir_token=QUFFLUhqa0lEYncyOVhWS2IwMlc0NTZBTXFOT3JQV2d6QXxBQ3Jtc0trY2xVUHplN1J1bGR6MGhxRjF2YkZLNTBpVm9ienB0R3BpbDk0ekhGSWFnUHBrNi12ZWtyc3Qyc1NwUEZBTDNuMGhEUVdxM01qZjVyeEk4X2pDc1g3d1JjOXZDc2hTN0JqMGV2REIzUVRlZXZpeG5QSQ&q=https%3A%2F%2Fmega[.]nz%2Ffile%2FLoQQyJpZ%23M6Ru-TDqtJHNTbBrX29Z4GLdHxWcPGlEQcDv0vLbhVM

Resubmissions

02/04/2025, 08:50

250402-krm8kstybx10

02/04/2025, 08:40

250402-kldf7atxd110

Analysis

max time kernel
220s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa0lEYncyOVhWS2IwMlc0NTZBTXFOT3JQV2d6QXxBQ3Jtc0trY2xVUHplN1J1bGR6MGhxRjF2YkZLNTBpVm9ienB0R3BpbDk0ekhGSWFnUHBrNi12ZWtyc3Qyc1NwUEZBTDNuMGhEUVdxM01qZjVyeEk4X2pDc1g3d1JjOXZDc2hTN0JqMGV2REIzUVRlZXZpeG5QSQ&q=https%3A%2F%2Fmega.nz%2Ffile%2FLoQQyJpZ%23M6Ru-TDqtJHNTbBrX29Z4GLdHxWcPGlEQcDv0vLbhVM
Sample250402-krm8kstybx

Score

10^/10

xenorat defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Family

xenorat

quite-cam.gl.at.ply.gg

Mutex

MSNetServiceMutex

Attributes

delay
5000
install_path
nothingset
port
16226
startup_name
nothingset

Signatures

Detect XenoRat Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1512-996-0x0000000000100000-0x0000000000112000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5256	powershell.exe
5848	powershell.exe
6028	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
688	nitrogen.exe
1212	nitrogen.exe
1512	Windows Dependencies.exe

Loads dropped DLL 17 IoCs

pid	Process
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe
1212	nitrogen.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6112	icacls.exe
5260	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Dependencies\\Windows Dependencies.exe"	nitrogen.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
192	raw.githubusercontent.com
193	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
183	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4116	cmd.exe
5624	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2260_1377979056\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1458944427\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1920802451\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_768676584\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_71958619\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1920802451\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_768676584\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_71958619\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1654581002\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1654581002\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1920802451\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_768676584\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_205970774\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1458944427\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1481527662\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1481527662\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_71958619\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2260_906502430\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1481527662\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1920802451\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Dependencies.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4784	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880574255072381"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{A513651C-E7F5-4DD8-B7DA-2E74189F5386}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{A8A73345-90F4-4960-B12D-01C2B302E6D8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5256	powershell.exe
5256	powershell.exe
5256	powershell.exe
5848	powershell.exe
5848	powershell.exe
5848	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1432	msedge.exe
1432	msedge.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2984	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2984	AUDIODG.EXE
Token: SeRestorePrivilege	4592	7zG.exe
Token: 35	4592	7zG.exe
Token: SeSecurityPrivilege	4592	7zG.exe
Token: SeSecurityPrivilege	4592	7zG.exe
Token: SeIncreaseQuotaPrivilege	4712	WMIC.exe
Token: SeSecurityPrivilege	4712	WMIC.exe
Token: SeTakeOwnershipPrivilege	4712	WMIC.exe
Token: SeLoadDriverPrivilege	4712	WMIC.exe
Token: SeSystemProfilePrivilege	4712	WMIC.exe
Token: SeSystemtimePrivilege	4712	WMIC.exe
Token: SeProfSingleProcessPrivilege	4712	WMIC.exe
Token: SeIncBasePriorityPrivilege	4712	WMIC.exe
Token: SeCreatePagefilePrivilege	4712	WMIC.exe
Token: SeBackupPrivilege	4712	WMIC.exe
Token: SeRestorePrivilege	4712	WMIC.exe
Token: SeShutdownPrivilege	4712	WMIC.exe
Token: SeDebugPrivilege	4712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4712	WMIC.exe
Token: SeRemoteShutdownPrivilege	4712	WMIC.exe
Token: SeUndockPrivilege	4712	WMIC.exe
Token: SeManageVolumePrivilege	4712	WMIC.exe
Token: 33	4712	WMIC.exe
Token: 34	4712	WMIC.exe
Token: 35	4712	WMIC.exe
Token: 36	4712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4712	WMIC.exe
Token: SeSecurityPrivilege	4712	WMIC.exe
Token: SeTakeOwnershipPrivilege	4712	WMIC.exe
Token: SeLoadDriverPrivilege	4712	WMIC.exe
Token: SeSystemProfilePrivilege	4712	WMIC.exe
Token: SeSystemtimePrivilege	4712	WMIC.exe
Token: SeProfSingleProcessPrivilege	4712	WMIC.exe
Token: SeIncBasePriorityPrivilege	4712	WMIC.exe
Token: SeCreatePagefilePrivilege	4712	WMIC.exe
Token: SeBackupPrivilege	4712	WMIC.exe
Token: SeRestorePrivilege	4712	WMIC.exe
Token: SeShutdownPrivilege	4712	WMIC.exe
Token: SeDebugPrivilege	4712	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4712	WMIC.exe
Token: SeRemoteShutdownPrivilege	4712	WMIC.exe
Token: SeUndockPrivilege	4712	WMIC.exe
Token: SeManageVolumePrivilege	4712	WMIC.exe
Token: 33	4712	WMIC.exe
Token: 34	4712	WMIC.exe
Token: 35	4712	WMIC.exe
Token: 36	4712	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4784	WMIC.exe
Token: SeSecurityPrivilege	4784	WMIC.exe
Token: SeTakeOwnershipPrivilege	4784	WMIC.exe
Token: SeLoadDriverPrivilege	4784	WMIC.exe
Token: SeSystemProfilePrivilege	4784	WMIC.exe
Token: SeSystemtimePrivilege	4784	WMIC.exe
Token: SeProfSingleProcessPrivilege	4784	WMIC.exe
Token: SeIncBasePriorityPrivilege	4784	WMIC.exe
Token: SeCreatePagefilePrivilege	4784	WMIC.exe
Token: SeBackupPrivilege	4784	WMIC.exe
Token: SeRestorePrivilege	4784	WMIC.exe
Token: SeShutdownPrivilege	4784	WMIC.exe
Token: SeDebugPrivilege	4784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4784	WMIC.exe
Token: SeRemoteShutdownPrivilege	4784	WMIC.exe
Token: SeUndockPrivilege	4784	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
4592	7zG.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe
1280	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
688	nitrogen.exe
1212	nitrogen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1688	2260	msedge.exe	86
PID 2260 wrote to memory of 1688	2260	msedge.exe	86
PID 2260 wrote to memory of 2616	2260	msedge.exe	88
PID 2260 wrote to memory of 2616	2260	msedge.exe	88
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 5524	2260	msedge.exe	91
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 5524	2260	msedge.exe	91
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 3984	2260	msedge.exe	89
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 4068	2260	msedge.exe	90
PID 2260 wrote to memory of 4068	2260	msedge.exe	90

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5532	attrib.exe
5548	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqa0lEYncyOVhWS2IwMlc0NTZBTXFOT3JQV2d6QXxBQ3Jtc0trY2xVUHplN1J1bGR6MGhxRjF2YkZLNTBpVm9ienB0R3BpbDk0ekhGSWFnUHBrNi12ZWtyc3Qyc1NwUEZBTDNuMGhEUVdxM01qZjVyeEk4X2pDc1g3d1JjOXZDc2hTN0JqMGV2REIzUVRlZXZpeG5QSQ&q=https%3A%2F%2Fmega.nz%2Ffile%2FLoQQyJpZ%23M6Ru-TDqtJHNTbBrX29Z4GLdHxWcPGlEQcDv0vLbhVM
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffefd46f208,0x7ffefd46f214,0x7ffefd46f220
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:3
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3768,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2372,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3092,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3100,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5708,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5748,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4240,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4660,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6264,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6296,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6300,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6824,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7080,i,16581814033021961742,4521390485390801939,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffefd46f208,0x7ffefd46f214,0x7ffefd46f220
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2152,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2432,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4200,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4468,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4200,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4692,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3780,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4676,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4640,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5028,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4840,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=772,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4680,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=768,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4420,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4512,i,220928860193338127,2762816070341350091,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:3744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4780

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap8743:78:7zEvent22265
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4592

C:\Users\Admin\Downloads\nitrogen.exe
"C:\Users\Admin\Downloads\nitrogen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
- C:\Users\Admin\Downloads\nitrogen.exe
  "C:\Users\Admin\Downloads\nitrogen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic cpu get caption"
    3⤵
    PID:5400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies' -ExclusionProcess 'Windows Dependencies.exe'""
    3⤵
    PID:4896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies' -ExclusionProcess 'Windows Dependencies.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe' -ExclusionProcess 'Windows Dependencies.exe'""
    3⤵
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe' -ExclusionProcess 'Windows Dependencies.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe""
    3⤵
    PID:444
  - - C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe
      "C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe' -ExclusionProcess 'Windows Dependencies.exe'""
    3⤵
    PID:4104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe' -ExclusionProcess 'Windows Dependencies.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows Dependencies"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4116
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows Dependencies"
      4⤵
      Views/modifies file attributes
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5624
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe"
      4⤵
      Views/modifies file attributes
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Roaming\Windows Dependencies" /deny Admin:F"
    3⤵
    PID:912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\AppData\Roaming\Windows Dependencies" /deny Admin:F
      4⤵
      Modifies file permissions
      PID:6112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe" /deny Admin:F"
    3⤵
    PID:3572
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe" /deny Admin:F
      4⤵
      Modifies file permissions
      PID:5260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Windows Dependencies\Windows Dependencies.exe
1⤵
PID:3840

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1481527662\manifest.json
Size 79B
SHA256 530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
MD5 7f4b594a35d631af0e37fea02df71e72
SHA1 f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA512 bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1654581002\manifest.json
Size 53B
SHA256 94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88
MD5 22b68a088a69906d96dc6d47246880d2
SHA1 06491f3fd9c4903ac64980f8d655b79082545f82
SHA512 8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_1920802451\manifest.json
Size 176B
SHA256 37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
MD5 6607494855f7b5c0348eecd49ef7ce46
SHA1 2c844dd9ea648efec08776757bc376b5a6f9eb71
SHA512 8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_205970774\manifest.json
Size 117B
SHA256 9c671790b4edf287831f07d73111b00bd91fb649e96eaa53d3748b386ba84a99
MD5 cb6893b981072ced9b0993748531ddcf
SHA1 f658fc18d3a47a6b5dee5c1941c8e1737444f102
SHA512 7a979fc72d56d6468867e3f64df6b56e9aba5af83c81775146eac788c4d8deed457aa8c8a4efed926d4a36c754e052d4ef2070f91f7b247ca7ea35525031e2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_71958619\manifest.json
Size 119B
SHA256 82dff3cc4e595de91dc73802ac803c5d5e7ab33024bdc118f00a4431dd529713
MD5 cb10c4ca2266e0cce5fefdcb2f0c1998
SHA1 8f5528079c05f4173978db7b596cc16f6b7592af
SHA512 7c690c8d36227bb27183bacaf80a161b4084e5ad61759b559b19c2cdfb9c0814ad0030d42736285ee8e6132164d69f5becdcf83ac142a42879aa54a60c6d201b
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_768676584\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1432_768676584\manifest.json
Size 85B
SHA256 db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
MD5 c3419069a1c30140b77045aba38f12cf
SHA1 11920f0c1e55cadc7d2893d1eebb268b3459762a
SHA512 c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
MD5 SHA1 SHA512

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\autofill_bypass_cache_forms.json
Size 175B
SHA256 b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92
MD5 8060c129d08468ed3f3f3d09f13540ce
SHA1 f979419a76d5abfc89007d91f35412420aeae611
SHA512 99d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\edge_autofill_global_block_list.json
Size 4KB
SHA256 a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742
MD5 afb6f8315b244d03b262d28e1c5f6fae
SHA1 a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e
SHA512 d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0
SSDEEP 96:MYL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6ln:MYL7O9FnLk25+tF4B8K5b+QiGoztWuD0
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.15\v1FieldTypes.json
Size 509KB
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVI:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee
MD5 01cc3a42395638ce669dd0d7aba1f929
SHA1 89aa0871fa8e25b55823dd0db9a028ef46dfbdd8
SHA512 d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f9f8121131eec8ee878beed5ff74370d0f2cafc973f3f18f93faeaaf9d21f809
MD5 2cc0fb195da3d01a4eda7ae527158cfe
SHA1 36d1a99e7e99cccbfd7528e5b0a7f6f71d8ea1c7
SHA512 334d7eb50106cbc8b517236fa27cb9a86c92217921c7525ddb815b0ab305c3fb404bc774fdaf4be4d283c3ec483dbc12e68f18e3a40b109cc1ece1b7ed9ae8bb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a0d22b382f40eb69ddc4f16060239da500b702d2b71baf2cbed25b76105cc28
MD5 0425ade58a0043eaf5afdb538b47f632
SHA1 f88afbe32212ab12233f5702d902a3aac9ef548a
SHA512 b9681ff0805baf27520f22621b470ab81239a822d2d098ce2387462daa8220b66d6ef2c4a71397e63e5d5a2834105935fc5af553636177c4c86986e6bf8f3b58
MD5 SHA1 SHA512

Submit Download

584c5d7f-83ee-4ae7-8383-8c8e8a5a6363.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\584c5d7f-83ee-4ae7-8383-8c8e8a5a6363.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6939dcb7977b0a51c30c28a86df9affeb111749f029fbb88d478f6666e628ecb
MD5 1b3c35fc6ffaed3bd141488f97c24916
SHA1 07d0d05dac825f49f9c10d92e2e652668a83488a
SHA512 06d2bde322cd12659b84225bd1a641104940fd46227469123a00f4ccd2355e39536ab625c0e994f793b841315b52a28626f9de20e98cf430a160b0fd0e02bdc5
SSDEEP 384:VKKi8VUIKa/1X+I+uOHRXtuisrFi8/hkceKeKKD9vRgJaWVJ0bG76qM:VJX/1X+I+uauHFi8TeKeBD96JRSS6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c67cfb64d96885679a9ba75d7d6651c8e0ed755a89ea3da298769da08510615d
MD5 4689f18381e778a69ffa82fa6d14e260
SHA1 a1007e9bb9dcf85b9f7e3666bb2e6ec5cf95a535
SHA512 d67767c5b84a99dce53665e543fe979a3afcc773739f10ff3ecb10f6e51c8979ef9da31bfb582e56f5813966812270f9eae14c2df3d51da7c1bf24374f159c7c
SSDEEP 1536:gkbX1Z2+9xvNR3pIC2vTWryMW+kp47vPQ05RMR0eSXrTGsR3mhU+J:bvYb/0by+TGUWG
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e305b1f643005e3bd5a507eed71fe25664e220fb401a351db3977f30355c35be
MD5 fbfae75c66a50c62256faa205f4d6900
SHA1 109e7dd87908347d571e5743c4eafefb1445f469
SHA512 04b520d09f66aaba4c6a5ab5009036b62b1c1ffb034b15946a65658307f2bc10898c26f52513600d6d9990ab9d9fe2da4e0c594671e843cb4fa546305035617a
SSDEEP 6144:WI59CtrK8ZkdeFyAv6dzlU85hPewWZrCSwHs:WI50tFC/ASdb5hPe9ZrCS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 a260c8f25017d25693dee37bc1e5cac5ac2a1846424db330b18f9137da4944ef
MD5 cd41cfd66ef5485a8a32b4901e994024
SHA1 faef9cb1c501b5fce5ac0a2b84caf3f5ce2fa270
SHA512 6688512c7795a2c69f6af2af9e87c5698535d6b7e1766ca19f716898124d200803f0cb88f4d1dde1b6bd77836b01f833f18c1d244ba86d04719f47a4f29346f1
SSDEEP 24576:RVsTdlZjKFPCCHmbqj2nIG61LWx7W+X7PdiJGiXV4wV/yAgtsGw6Sz8nAcJuClul:rWP42Oj2ncE7W+Xj/WlY9spYDu0S
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 19KB
SHA256 1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3
MD5 5e5ae2374ea57ea153558afd1c2c1372
SHA1 c1bef73c5b67c8866a607e3b8912ffa532d85ccc
SHA512 46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf
SSDEEP 192:tSTGDXMDPSYAxmemxb5XS/7eh8qMFfWQE4+rmqt5QJq0+Rij3Qaf/KduesiSnP:tu3SXs/J5CXw4+rmqdRiLNKduesic
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 191KB
SHA256 9478515162e79256323883a5092b39e0045dc8213d7dcf7be5dcc1ec5b70e9e4
MD5 eaebb390ddb3b1c0e07904f935d29bd9
SHA1 dca8da5b24b1b18b3c8dbc2523f5d145fd4dae13
SHA512 e2dae28c4661b3bb65b3811803a9396e1c9b16eb187b60f2d4d1a8cc65e2ad6ce0931a48e942b5d920bdc263ea939b9164b649edc3752e83daabef9366a186e8
SSDEEP 3072:fD2eayekRYEPREb06mok3L+tvwE7bGxM2iuuZ9aENUW/PPMOeR4+cb5qxO/SNZ:fmyeinPRc7m5+p13hnLfNUwUtpy2Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 93KB
SHA256 1361696afb2eff8146cfdc3fa9da8325a30cdce61ae33e7defc7fd2b7175d366
MD5 f5c4338074f077046b82d789cb732220
SHA1 252d2e8211fb2f7801b88e8d29b891299b679947
SHA512 64f751224a4967ef7427e6a1b8c5d4148ef10b14e562988b7d9fa3e9a3646033ba506e8fd569860bc806215200ea2a13c9aa2263a21faecba41e0dd738cb1a1b
SSDEEP 1536:ePeejgb6qGpunEUh77LZ2GJlFWydtoTdNMzolrTrlpPr+bdI0VTg+aPcD/pYlCK0:6eeUb6L7UhzZ2wgydOzhRv+bdvWzPG/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 112KB
SHA256 04fabb767f8189b73c778f03970ef440655ea4e000af392e64769c0221626f74
MD5 b5213e99bd617eb20e135eaf894cefdf
SHA1 711aae35a063cc65a8ce16c97d8c766b5e5cbf2b
SHA512 77f3868ce8157643a3ee0914fd6c4e0c509bf49f744dbb5137882b02450f7511940efba7042378bbbd01aacd0e0bb2a759d8bcfb731dfeb98eabcaaec0e245f7
SSDEEP 3072:64VB9KYmQObZG/ZrKVu48GHqxrzCQdTZEXeJLY:VBtcZGnPrFNPM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 104KB
SHA256 fe910bc51a7ed25e0e216d0dcbc159badbb7217239230928d17d87c4310c31b4
MD5 3822954de1ec9a48c0db87780dbb1166
SHA1 a8e382a2840f7a0c99d02f2b05b851b30b2d7587
SHA512 0183cdc3eb75567153736a2e9ae5687825fab8a050535f655ed3202843b4e859f8d761070e1c7a66bd6576ba72357697fe185842d38b58aef7e4ac85f0adddfe
SSDEEP 3072:63c50scgsiJX8sxhOO/8NggiiY1RQuNIWt4B2k1jZ:63n0Ms+zfuQuNB27
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 82KB
SHA256 7dc57b2df871c944e79816c289f9b0ffa7999418724089a81f28a11eb3f549f1
MD5 44a9c002fe071591c9b4f5e12d6d03f0
SHA1 11ebb90ba83dfea4138bf3e900441d8c3412e5bb
SHA512 5a2475d8aaa36e1b14e267c83bba1322a91747d543c38e18aaed25eae3b95710e8b2a0dec6f68d6ad0f00646f9f158a83c7ce315bc3a331dd6119d787f1aecc8
SSDEEP 1536:ddVOraHdT23mb+U3LqBbvrygu83pgNKk8NKVelW3fsP/MVWY:ddErdmyCLqBb9uQu58w70/Mn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 91KB
SHA256 b296112252b3877dc5b6123717faf4bc3577ac6cef0e599f544b78e308729b1b
MD5 4e4ac22bf060098c6f7f3649430f7132
SHA1 c53e12f8a61351836a5b2eb5f4f15bc82410bea9
SHA512 9a461e95b4b28bb429adef3d31032f03c7c89a0d3ee424a9db6e2220cfa131c26491b0db6e27a7908683d7ab64e60f7f11b4313a376ec7b3e479a77378bf9e3c
SSDEEP 1536:bAqJyD27YDYq3ByglbI3J1D6Hl3UwKA8a/rlRaLbUW0SDE2VhKlwwaooqfZ5t:ssyD27XqEgl0POl3UrA8a/rlRYUXOhVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 113KB
SHA256 884d9d0be9ae2c0a81d6899c7b0e84d84337f2a047283a87a7a58d7791d413e7
MD5 ed0413447156a48b0e6e0e45d28af1d7
SHA1 d9bc5fb0651525fe3b8be3de328e354e63676b61
SHA512 1300ab8a5cf04ccef1fbb3b4e7b5ecaf1e104f846c2ba31543d15a21ba48b90e165e86e8f6ba044c60e858629cdeaa7beac78a18e766b6aa2dafd5f991b26174
SSDEEP 3072:IZtj/p/EnQj3lWpv8+DMg+fZyzKY4b7rRZKE7moF:oNcQj3AV8gQZQErRYE7nF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 106KB
SHA256 7f568c13910623a153749f691f385992d93275022e49ddb5c5d54e9bc2cd295e
MD5 99ad492a4ec9b9c30c832f342dc3cc3f
SHA1 630dc5365e9ba4c55d634817c4c9f87bc9328241
SHA512 1a5da8ddb5401baa103c3999f6d0c33914b270cee752acaa2ea401eb159945ef61b7184552713ae37ca6974a05bd1d5793ed99d676f3b7253c569372267b8aaf
SSDEEP 3072:DxtCN1nGiA03F8aXfQk8fIqzR9AiNYnVYAUHUf:7uM0+WtLYRyiNYVGUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 109KB
SHA256 2bfc579444e71f8c4320eba53d0d7bacf8a2332cba7983ecdc847487b80d876b
MD5 e99181a1a6986b54b1d41267efaf76f1
SHA1 0a5d9a8e9d26347e973f848d9a86762ba1ba8587
SHA512 1a1bef46bb4583e741d323a08fa774edda60092d98ba8974dbe16c0f029c73645deb42369a5301d0ab1391f2b6bd71129cdbd73968fabfd5cc6af9ba7ec57f4d
SSDEEP 3072:/nWtgbejcBo305NeL27Ugii381E/MxmgO:/nWtuScK0K27Ugis62C0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 80KB
SHA256 919a415598f8e6de9a44b895c3b017f674f3651ff99ec63e2a75687d3dc69ef6
MD5 5be0a8d3bd87e57f6dd553fbd9043b76
SHA1 078e15e3e1f12f0f6707ae8992e6b53eea05c546
SHA512 22c895e497eae54cd37ee424ea3574f29976f2079d8d81c9584119ef3ed5a22c19da1ca9a69e73485483732a67205105b403bdce8ffd81b9858461770a0b049f
SSDEEP 1536:lkndiLpJq2ccRvGt1hz7qEdrydFqHqcQiyKpfbheXd2YaaDLSo0Rp9l0d:BLpJucRQhz7vry/qbb/bEnQRx0d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 102KB
SHA256 f6f8f06d00628ab0b54610ba90d8f2e09d70dd5b080d4a351326cf6466be7c0e
MD5 560784d74d250c807cd826e00f36fe48
SHA1 337b7c6c8c4aef2a537468a5d99ea2ddab4adaa9
SHA512 7139ef550574d804e0ae5fb04a860c6d23b9f061697cb2fc1658d5818808d67a49fb167d13055f2256a90be33c52a520f11b7bfca618e6d9842a6a464fd55824
SSDEEP 3072:2lv0FPswZrBj5kJJsPBTePyQmqonKq/cLcOETn+3:2N0FPswPjl5TtIkeET+3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 32KB
SHA256 6e375844cb9fec4cba5580005e89014698555b74756c994952cab40e5bea3c53
MD5 cd3ed9974c93d293cc7c430f5ccc158b
SHA1 3b26e9f3abf731640f383e699b53c66b738b48c6
SHA512 d46e471cbca4d1336486e374ba4850e7f37a28945fb3d203f9d8474139f201efec54362f612006278c57b9c054ae1aae4ae038f7cd52cbc52cab23d02ff1ec12
SSDEEP 768:B9LGoRF4fZqWxm2nVV4ZtJOScIHUmRuy0LJ8uhQOy+B:B9LG04fH0dcI+n8KQOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 97KB
SHA256 efc4f6aee704b914e1ca20783452455e61cea1cedf009ec0f9f74ff9dd09fffe
MD5 263b5557334eb275c6b0e9864b173d01
SHA1 aa92ef0051f7bb0738b960d05a74bf86eda78909
SHA512 fcf83333931d222b2d9fb09a13bf959ad16a1b56103d8be08a9f945ea32c156a68a560f367f8cb5febfacef0712095101907e1cab6cd84a586b82ab7d7ea935b
SSDEEP 1536:FpObFiK4XfPmPJ1OeiXvIkZWdlGO+3pt5mOG/dNs7jn6plo8+yl0wOQTm3ACINCh:Fp0iKWPmPrTd4XF3GVNs76lgyufw/ibx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 116KB
SHA256 6f948232c163cc2b8d3c858b0a411c41a55f912b72e74f0b87433c4b3243b4dd
MD5 9aa0d7967e407805d89e6b5b7fe2eae9
SHA1 a9f19de064bb51a0c3523e17755d705d645ec008
SHA512 a338099c0ef989814f057796520644859d6f32c16930bb4afd98394bf7901281b893fe737c11842d02f87394a549492933fa5b601d487ee6f701611f7709eda1
SSDEEP 3072:EI2VSxSgNwRXaFiz8EB8yVUdvVMEVtc71tpVTaVMxjKFHsbYj:EIeKSCyXafyvVivVHncxVTaCAFsUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 32KB
SHA256 9fb7aafeda5886a20287bb35afff9ae51bd5dabcc07b8da555e1a6ca58fddc04
MD5 ab28b125527f320b4d0932fcea0e86b4
SHA1 dc14a9b1f4b1104fad932c967f2123d005263328
SHA512 36677671415e3c5eff64c3a81ae11714c32095c1141db69a36949cab7df7bb91687aa912446028008f05687d0bf45b33127dd9dff72d59f231fcf2c47faea931
SSDEEP 768:oLLlZhoYz8VlQMiiyCrB+t6Zf4MgtsFhGgZGcnUwhMYbsRgg7PH2:oLoYz8V3QIZgjtsZ2whMYb2f7PH2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 103KB
SHA256 bb040b520308a664d00cdfbae65c63db33cad8800429fc6bcacbebbcf4e11d30
MD5 038875ff91e37ed43aa64a08ca0bc16c
SHA1 173c7259de50c80323211082221f501305c3094a
SHA512 43d2a4097f576c2e319ecbb93e6bad5b5af9d9fbead785f6146d9bcaaeb07e9dabe2b82153da01432ff2e067d30407738b10e38b605f535e2a889704b06a7dd1
SSDEEP 1536:s22RZA/AqtTpOJeF1tePD50thwUDmp7jyyaWBSrtrSRb5ujqCV5x9ulh6mKqMDs0:hwGtQmey9Deb6hmjSuumKdDsGyrh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 94KB
SHA256 62ec4c2c400a9270b1fa2e4c216e60bcf45e177c6d5fb572a58b5f16008bc8aa
MD5 2c2b8d4ce6bd0af1317f6718ac0b6860
SHA1 a66f595399490d1157589ff17723301d8a2d0f23
SHA512 d053462c05b6dd44253f1f08e64b4264df396475688292c598e997724c304a3fd10c42a6ebadadab3fd3b5488014cef7c889424e8632b26e38bbfbc0d74419db
SSDEEP 1536:d4LEo9PrmzD53LUvLSp1QigapGg1yQMSihBOSK8Uylwc//1xpQAsyTSqj1VGPBxZ:iLTCP57UjoQCGg1yQhiKSKLye2/1xpQ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 24KB
SHA256 3aa1dcdaa93d0bbeb556a51d7acead71e2ad9dd1528eb9618ae85be8264f0cee
MD5 f9d97bbf8529ef80d828b8bf73632c8c
SHA1 41667e3ab143a12cd15c333813b193224b888df4
SHA512 686228d114b6ceb4beabdac4a7e2dc663be034cd032ff5a352c1f68b7f1ba7aaa9e3048e8efafddaf423e0268805cdbd28b7aa616a139a6fb8292b07fa254423
SSDEEP 768:8FMj+GNVXMzQDC5tf/4VwwS63KFDFIaMH0S:8FU+GbXMzQ9ztkhIaMHn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 112KB
SHA256 0622ae7bf7b18b80bd89f9e86f4df3d56ce35cb48253ecbdcb25e1e3f0507b9b
MD5 24b261e83927c15caebddadc11764772
SHA1 c914b7e7b4d434a935067c4b2027caa147791e49
SHA512 cec91d7bd9195e1a09d1a4c87f0ba6220f0d5bcdd5078896b87f14ee4bf51ac99179e248b099441f6ab18cff707fb1d01b584735cb820348ec572a157517dc18
SSDEEP 3072:bYX0fLqBfwdU6H7AjAlobD+X/UoruKiuSNqAbJ24:UX0fRbov+X8tZGv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 97KB
SHA256 7e681ebe04a6f5fc6d28e08b5ed6a0c8784e44e3d40834daf839090fb5182ce6
MD5 af53f6286ac2c1dc0f538f36e7fb59f1
SHA1 5e8a2a0482d2273f52e4be1c7df83f954734fb1b
SHA512 22a6cec04ef8fb587debbfb9f492d855cdd89ed8f56c726687f27ddb250581eb735aa3d2288d336a16b380bfca2b98fe9092c72ed497ec13f5826859a98312a9
SSDEEP 1536:G47YuxBOxusMfWUZS4Afk5ilb5XWLEf5XsD/mYwf+y9EO4VwH487Ro56tv:nrBeB/tX6EhCqEO9HxW56tv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 100KB
SHA256 37afcff4234282351bd40bdb17002ad3c6993060a518f9787e4545bed6db8c26
MD5 0745300dfc57c14ce5c83a6b29bde4a9
SHA1 9225460653d84ab2f7524c268c8e6a950af3b252
SHA512 909d0ab73d341057f17a8f916fc5451ff8a00629a58fdd44f54ab9ea590a530e4f962898e426f89c53cff6ac8c1fa5239ccd02471bb296ccb3449ebe874b6789
SSDEEP 1536:gNCO5ktH+jIiHHA6M5t0rhH98xhyCf+NoHL7muj7aAbBIzdpbCpUgh:gF5qH+j3HHA6IGhH9SYCfDmhqyxpmagh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 90KB
SHA256 b54102efd459c5e86e3a655d49054f72a0ae37d2c0f49a61823cd8fcb9f2694a
MD5 22056b7aec8137db7e8256c5174f2012
SHA1 bcc8554fa68f08aead55f7ff859567690da8a78f
SHA512 80580bb541d2604367b93bb1499604923df7e69fd64ed94974b7bb6f90f7395e3e69006e25bba45907e6d8d96af046aab3e0472549b008767f2980055fa65b7e
SSDEEP 1536:n5v7EveoiZFpedwQUXCVBR+jA9gFeyENvLtfFHHqvzcdIG/alCNPk1ddfpo:nBAnihYwQ2CVB8jA9geltfFHTIG/alDg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 45KB
SHA256 9f181f1b68b5fa438b52bfe20ce1c545d0555d0193514540e50bfe4197b10cba
MD5 f1e0fb4f23154a994c449d31c40f3509
SHA1 5fc2bad1bdf494aaf3721b62ada79c10b6301a3e
SHA512 be02fcbc7156549574455ef1ca5cc6dfd3f19648e98ba573cabdf54e3d740a52ce8585ae3b3eb5119696c8017ece822a400a57fa06b513112f5b3682fc47c1cd
SSDEEP 768:WSh6OchEKXbkWikq3Wh1mjKnLcWnMcLvfqt/oTqhPVHr2bTyRRVss1fAiuX4v0Jc:WA6O2nrTiWhUWo+McnMwTEHss1fAiuoL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 88KB
SHA256 0b86f3bde3c5376b9ca70d667f3ff0793e6277aedb3af8b54f64c634bec311d5
MD5 04aa3a4bb657c56c19ff316c1022732a
SHA1 53c3c94ef1a53f2524cd01eda966656852f5a221
SHA512 3b72ff11f0063a77075a9dcb73c4b1b927adca35d046ccbecc39fb6da7548d5c885ac023164ada4cb654688ce72304248376dcd7de811c5495ebd51e6900bdf9
SSDEEP 1536:1aLqv2K90cioCTxIQDmtNBmNvPRntGAdmn39j2PnY3Jesb4KCXcWsV:10KLioCTxIQSev6AdE96wUsb4KCXfsV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 89KB
SHA256 69cea3a2a478220ba8347f4e42363722341f7a2288ad6889a7af48d2c0cd12f6
MD5 f33f9ae792ec7b4656947fe4eb83c566
SHA1 01b8c8c05e42ee5552a3bed6ac29491108903225
SHA512 ad51d78166d873a1bda11e9f2701df8023ea8698fe981e61e9363270c690cc0b6005adffe7320728f873f2411dc487e285cee9f5765f928448739b93dba7d6c4
SSDEEP 1536:dKex4uR+b82TPkBDkI+yF+m6B7/fDzWNlNQBX/n35kkTvkESfNrdh4FAdZugYmlH:dZxpRS82TPIk7m6B7HDCNluBX/n3ykw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 48KB
SHA256 68ba830fa316b7ce8607353f984173baa766bb07e763be275228a6e9dc423e8e
MD5 aa82fc7241f57a1e3327d2381b748758
SHA1 02fb458b23e893bde880597c70e39984f8a340ff
SHA512 0742582d55edaf13320276ad0374ce0a925073e7c70749a49f5e4f5feb35c1678ead6da0355cc0cbe81774f18cec5edc8fda1daa8105b763b0e7087481b9d886
SSDEEP 1536:gek50EpnFXoDq2dMsdBlyp7WzAGgpDzq0xPN//8N/M:ge80EQq0lydXG9yR85M
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 87KB
SHA256 571b4ac1212e81c7fbaebb13ebb8b12ce366a9b8728803a0167a7d5ad080c747
MD5 a0be78e86424c26106ea2fa5c3264393
SHA1 32d0550421d434a4b61d8ae1e5ea2383ec403ce3
SHA512 a61e046bc07f45d392faf2e1a2e2a2e5014054cb76a2bda0560458e8a50f8fa3a75f75993f62874910f4c0157bf6f6e96eb58ab7b6a3e6f6860cadf97acaee63
SSDEEP 1536:1apsl/gPRqTkgdTU1GvCO2DeEJxefg7vtz0Llm63XnMByI1VBVbmV9kgOCqN:1as/gJqAMU1l7nLql33cBLVBVbm63
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 21KB
SHA256 e88a17f670e58895c31d671ebd7e4a4a6ab7cca461abd84705b20b0e60781b24
MD5 4126f90ba8665732e65c8377eae8c1bb
SHA1 f065e5652179be75ade12e8294b274cfd35ef1ed
SHA512 db061a8b5669ad1060922fbc5c8c16ae0244615549811428a4f22a6ee46998bdab4598d809e38be4c629e00aab4a18307c15195f75a5bf52eaef004a9d95527a
SSDEEP 384:lSApKafrOgyAM+AfVYoYUWGtpR5ZtppX5B9zrU+2MyjmeTo+HIfREGbBkPE0izr:NKarOg6/YoYU7v3z9nR2My9T1H1GWE0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 29KB
SHA256 1692f9c36f3aaa9d3e251a92fd2615b55d6f8e8e0bb286fa87184ecb4e20525c
MD5 c53c4b781f53b21562990926425abfd3
SHA1 fff91c4acd5d0c187ad634b79b2619dae9af58ad
SHA512 85041e7dd1eff82db0355a471ed64114d214bbf5d9b6b54f5f741e7a83b56f38dd591c854dc16c748db806ffedf896076c8a31af7664429c373497f68323c7b6
SSDEEP 768:rphWmS5OEJDbSP4BvdZ0SKVCGg8lVBv8IYSqMd3rv:rTWmS7DbPfZ0XCGgqkdSqU37
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 20KB
SHA256 aff82b4fceb3dbf328b92d4f31fcb545c5ac9e8fe4bc47082a88550ed9a01ab1
MD5 c75010d4d5c13ead3a962ba2c1f53bb9
SHA1 dab95a4b027ef70e36e139c92fc440f19343071b
SHA512 393a8456beeefceb226d54cdcb2638640360e8248a6c02a02982356cbd1c17ff8b8fda02ded6a2f4df5e7c73d923a72921a8b323dfda0ac0d83ad5cb4e0467bf
SSDEEP 384:8c7c5xP/k1I9gCunXLDYfGT1fBBHsgfrmwi223WHc4nQ0W:8c7aSbW61ZBHdli223ANzW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 68KB
SHA256 e8bedfbc203b2d09457d44a4ddfaadfb770d637e332f41487438fa9a7f5352f5
MD5 d74c0efac1a9c59152b0325932d399f1
SHA1 a472eadb5b431a4ef40e78ed79eaed9bb8fc8135
SHA512 8b54060e0a7fa219fb96ada3c4beae832727540d8872a231f71c2a0cddc3abaf061eb2687595be3f4fbfd996bbe0488f44e1e042b28c2aaa45d51f03d0b4e689
SSDEEP 1536:Y0BMBs8Wls4KmHpLfrBUGu5nel1iTIv12Tz8SpwfiQI97lW7:Y0BMulHHLfFUGynePV1YcMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 79KB
SHA256 edb146b39f296a38b41604a65ff243b72b94deac1f5280365298fac12a753410
MD5 d2b6330b07c55034ba208d7cdc49098e
SHA1 0514f7f246ec5342f9b1509ca765ad355ea3e303
SHA512 dc8376f6238b382ab727ce2b8938379961fe7768d45f96aaf7f421d2b142c62a96d5f9fcd80614bebfe448324386b69e1e51d24967d64fa890ddfdf158e17a6e
SSDEEP 1536:sa6juSrVEVK0T4aHDP2+9nmUYlk6k3ybh8oUYnyu1GZuaj:s6kvxaj99nmRS3ybh8o5nbjaj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 95KB
SHA256 06d474b0c4fac2ec974d85fbee63f1f0dd25b7b9f07730c02f86f5c7795ccb3a
MD5 9208ff4ec6bc5d7185669e270150b827
SHA1 30a13a9095e47f37da4820e55c59a0535768a1ca
SHA512 53557fc78fc9df2a871c8f4741946d9c78c11582ba31063fcfeb17a7ba7ae02ee163e12062d6a2a1ed3b7221251229200c4ab830fc7b62fed996cd56e85930ba
SSDEEP 1536:V1BKBB/EPtQ6U5NsmyHUS8TThRvBCOLAZ0GcaRPfJMregBnz+rb7Lm6o4YwGuARo:Vm2fMNsNtGTrJN0ZvdfJ/gBz+rbFo49l
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e4924f86bfcf648df73976d8a095e34b9c067c33381fbae0023e9315c428b02
MD5 e37f466fe7e047995466936c423399e4
SHA1 573e7ab84ab26db3b37c2869939742a5f22f1d28
SHA512 e4158815345d7951adea24d6cfc4765af8c648f638e1cd01f8ce348162e4b336a129fa5ed70a6865308e7561612ceb874664fc64a5899cafa7ab11425f829928
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe579114.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579114.TMP
Size 3KB
SHA256 cccbaa05b830680440c10b0e9f259ff5ddc914cc624fdae7075bc8dc8b7877a0
MD5 72d508ec8fb202e96b5049394313696e
SHA1 e8bae7d6460bb7ca9c7be6200c82b144b7db53cd
SHA512 c999639ddfafa5b0058d8d0efb4e865d7410c660152f16f5db858e00f9bb01ec03d49ed0233bc348bb423c077e4425dded6bdf7e42734838d53ec91bc6a49c7d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954
MD5 2b66d93c82a06797cdfd9df96a09e74a
SHA1 5f7eb526ee8a0c519b5d86c845fea8afd15b0c28
SHA512 95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5
SSDEEP 1536:IRWH74eshBGZqW3iPPDuVvpBI/S8tZsA62UYPq:vHjdRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c046a2a387344ee4b4a541844960d19e51505f47841d295020fc1cfadc0561f0
MD5 99da0ef1b4fd6957d9fc998840e488b5
SHA1 36bf93b2136c628ef086ccb49c2bbb0f8f2f6f59
SHA512 1dee3ef6cdf2000fee19881cbff5325de7f09f83ccfdb106b9b6504f703874f6ade689d146fa1a43d08783221b752785f1b33cad4d669cb35b36afd5ae4025ba
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 76bdf2b0e7b1af45e49b888483189bc709afdb8f4b127feed171d1e692a4d9d3
MD5 97e21698b3e90a9a04bf74e6df1f38e0
SHA1 8dd95e576c2e8a7604f09261da7a3fb0c59f6537
SHA512 48502a20e76d99d65c642b7fcafac0f3b3bf8d0e3ab215cb1346c4d868905e2ea215b09953063c29ac6face8c17e1944815d23b5591b870bdb7ba74cc17b9a31
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 47d91dfcca98e7d20f2b941337ef00bee86b070d4d64ad4bee0a130031fd4592
MD5 eaaf994b062a784cfbbed8dfc9487342
SHA1 e30af017aeb08676a82d4d61af82fccd388299ed
SHA512 a062d0f00fc3ac3e23909b40eae3da0428a01b848b2f6d4bacf6c4913b4a7576ea3c8d1e2807a28b740c3c81a806bf54900822a456e3cc795c6c96c945963d0b
SSDEEP 384:sVblL0XsBWcmIZrsxb0B1xHSbwwDMefQsAMn:sFCqzmIZr5HSblDMeF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2ad45f5cea7e184e6f96c748865906af5fd2d2ff97948e74aaa8f5b6aaf62dcd
MD5 4fbf9395ccc718e7c79c64f931825e71
SHA1 2798ef416248fa1152c1698db4d82a9dec99daca
SHA512 48e6841dd14daea82ed520dc6393c9766521635f4b0d636a5af6e6a0b0538e8c6da2d55cbeabe3d8202dfcfa92bca5e717a2b5fe010ce0f1b6ccfa4b42b5cbf9
SSDEEP 192:sVbRKyMqv/Ky0Ml8M7Xs/McwDwIr4Txb5asGzoZ8pB1xHY+WNx0MwYKLErfefQc9:sVblLjXstIZrsxb0B1xHSjw1MefQlArn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 29ed5e48b9e9de71298f3b37090b0b8a952f42ba95e0f427b9a6a1e141ecf06d
MD5 3e5bb295b679d3507ae94a59930618e0
SHA1 7488fc9199e5432fe240d74439b8904d0ff2b173
SHA512 f66bfe84686586b552d34fded80ff22803ea1144f9ac1f2b992f70e1039a4ff3df6a44c84190c7833b753ba5e46a98a2567dd9ce7a7d54ba1d25e320507398f6
SSDEEP 768:uDdEGNo7pLYLpMHWFThjN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVj+ZU2LlCc7OBrn:uDdEGNUmpMHWFThjNu1jaY2U2LESO6SR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 68040d753e8d9dd5a0a30d83f09813677f86600e9dfedfd4df7793b5655f0601
MD5 8ea87dbf872ab3565ddee91692c4bd96
SHA1 f7a4fde88776a5e27b736519a52ba7cd41a4dadf
SHA512 def15ab776a6112a0f8b6dacd51212c66aae1f77d23202721ca40ce50be72070deb9284c7a1de7fb1e28fd7664c4bf38ad6e255369e7e6ac6ababdd643715b1b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5790f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5790f5.TMP
Size 72B
SHA256 663d82b351a01a88a627f3c2729102c66ba7dcc9c6c6047b594c173fd4981d50
MD5 066d65244ebe868212595bd320bcc5e0
SHA1 cbc23a45057e6ff0c2a6c8623f2b232fff9543cf
SHA512 79e5eab01e83d54224a5ff77610ea603cc0452ed8187ab88b5788ff98f44be0bdabec78cce228759f23bafe2c5808f43b41480ac1b03faa7745cecfb735c168b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 6401650c744411645364bd2eb771ce988a7ee6491f24e731ae0ba2ea831de5fe
MD5 a0406d7d67b4cf3caea6516bd6b7d7ec
SHA1 de271bb4856c13c570a44ba17d4ded94d0c061b9
SHA512 1544a3161b011cc8e77e69c0eff722d7b0c4b0f32e2c977515e055a2123341a2f10b5af9608e25fd483a16ebe270008575a009b73a7bfaae5d63f1d620952fbf
SSDEEP 192:1wLakOfUspeisuOVCjeqQyMcLqhXHwtjp:J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 59886566fb4e0c763c273b03bda67f1ac5a082a1e845fa4be4233608a507731c
MD5 905746447e43699d40ddbeca60b9b5c9
SHA1 c1aa97975f5ba9d839972aa4d3b86ce250c2a70e
SHA512 8a7c5fcde61d9b86726f3afd36d9d2419bd9b84d296e01261e7e7f3c3a14d1f00ce5bcf47034f4a06a34d7e6e1600e1d75e0ffb0c9f173de58c3bc725f9663d8
SSDEEP 3:ImtVfn/p1XlldO68/Pb:IiVv/pFz8Xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt
Size 113KB
SHA256 95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985
MD5 60beb7140ed66301648ef420cbaad02d
SHA1 7fac669b6758bb7b8e96e92a53569cf4360ab1aa
SHA512 6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5
SSDEEP 3072:WOmkTNO7NHrMziBxfPURO+/bAipYbzV08unFZUUnaR5K:W7kMRIziBxfPe/sipYbRJkHXaRI
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 465B
SHA256 2d42ad84350881300b389a3832cc7807462acc75eae70a3f7bab6b79055602fb
MD5 a21e4f2cbeebd13fb368dd4b1af76afd
SHA1 fa0c67a9e4032fc04aaf5f13f0d78aef6be1426c
SHA512 c0f28d615faf15c382ab29d722e1569434120463c50f2a0996853cf09e34d166dbad0ae38bf922a8713fce0971398930b0359af386233be5937855a00bb7272a
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 23KB
SHA256 e618a8d91921427388d0b9fb3d581213d09864c26085aa4511dc37372ec199ea
MD5 f9e45389cde63f71fcb302c6eb6bfbf2
SHA1 055e02a4bb9e9431dcf71bcec66bec477465f3e4
SHA512 41250945d6394adffabaa9725dec8cc5d3719dcedb79d230899ae84bf12d052908b0564621283564d4e30165bfa2bcfdc40cccba7bb91b8064c070fa9da907ef
SSDEEP 384:kXJOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6PQpGMgSVlkFIum1z4tfLTvq/uq:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 896B
SHA256 3c1d8d530f3f9504aab3f843b7c9b65bbee017a6f3c0be512f0f25894a74fd79
MD5 a689eb220fd205fde06d8ae47ab226a9
SHA1 db1447a4d65b0e64832f16da069ff8cf2086c5c1
SHA512 2a8300e1fdb3de2bf1209a20a12015ecc4a1184ba59ab7b1df77b666d129dc9cf4e62697f37b4911b197340ae948efe7e1dcebdb6c4502e7e5818d4993f107a6
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 19KB
SHA256 16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502
MD5 41c1930548d8b99ff1dbb64ba7fecb3d
SHA1 d8acfeaf7c74e2b289be37687f886f50c01d4f2f
SHA512 a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+eW6PQpGMgSVlkFIum1z4tfLTvq/uIvqV:WJOk/FY7/2lagbCtCkQ7wDlH/h+eW6PH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 54KB
SHA256 71d100e9a4a0a8c77f12a001f3b3a206b3313bbf17d541beaa4eadb83940d882
MD5 699edbe5bdc9e40d51974332f90791f1
SHA1 57ff2595c8901787906ebbdd9a137ec37eca8cb7
SHA512 b37896c882c5a9c1ac9e531fc3803154393a99ecc27c41e1fdf21f64e042bd39e2a08aeafd8bdaf2bda96e6de67ee628d2a7f39a14a14976ce8ccf2f121c4844
SSDEEP 768:2gnE6esE8lDldUGfPugSUIo+Y7bKFfXLTfDzFbiwHMmg6qGCecVb5rTfx:9eB85dna5fFbFvg6qG3ctrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 24a9acca35ed425d8d99b61032c1a17bde57d7af1fb8cdee0a137e3b8551c5c6
MD5 0591517cc89b544b23fb8f5ccd50fcb5
SHA1 fb2ebc40165ff108a7112e8035f4fa2871be1ec2
SHA512 d3d71483079d6084994af8119adc9cdea2df195ae7894e5dfb25ad82ad49fe64c37ea6edb1c94a96bf7ab2e6ffbb6274d243b6f0a3f5c235bbaea49adfdb0713
SSDEEP 768:AlnE6esE8lDldUGfPbgjB7bKDfXBTfDzFbiwHMmg6qGCecVb5rTfx:0eB85dnB1fFbFvg6qG3ctrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 161db4946f2e1030e1588a57fdb445ed26ebec881c229cdc486d99a6b029cdc0
MD5 8f49bcfdc36b2dcd0ce901771860abd8
SHA1 8f3c76e6680c60b5c570ee6108639cd1edb236c9
SHA512 cfb1d95039c8bfdfc5272c969160116f976b2f8bee529eb10b88372ed6a3c388ce57915993bc113d6ce6ac52a2c4fa4d2ce9ac7f51a904754c06f308b882bc28
SSDEEP 768:/liE6esE8lDldUGz3EbgEn3bKDfXRwNKozn8lzCecVb5rT4EH6tU:OeB85d73H92nYz3ctr9H6tU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9d0a2e9ac0274fc829a0dec4712b4ba2799db1029e1f023223f8afac69e0ad5e
MD5 f36cf4dfb7d624f727bcb1db23cb0ded
SHA1 90c2fe17fbb1859bde920ab7840694c99016ca9b
SHA512 ab83ef7754ec51a1d7ddb16aba1adf7524c32888d5b267f7e78cb9f8bf0e30237ab5aeefdb1f5cef460ded481fe1f54d6b010ff9e23746c521a1f9dceeb17b02
SSDEEP 768:CliE6esE8lDldUGs3Pbgj87bKDfXn8pu6hIvCecVb5rT4EH6xdU:HeB85dE3k4pH2v3ctr9H6LU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 030976cb93f5dcb5adcc281582f9886c74d889e791e9ca973512a1809750faad
MD5 8eadae812ed18676016141d6e803044c
SHA1 4afb39bb545aa4a08a0d25c6ad1810ee56797655
SHA512 491a07b8d0b4dbdda7436d52df31418cf51401c7cfe261207e8c11172ca5e1465f180081b9adcddfa1cbc60f78588c3e9f715e7a936137ed1cfb1866677ede4a
SSDEEP 768:ClnE6esE8lDldUGl3PbgjX7bKDfXn8pu6514f6xwzFbiwHQEH6lGCecVb5rTfH:+eB85dt3n4pHra6xKbFpH6lG3ctrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 56KB
SHA256 ccff7c4b843e45b2a8242ab09e3752414227164de9d47fc25b6c5c660cd13008
MD5 bbb0452d5caf5dd0c65b445ef6e9c70d
SHA1 5ee12e0e993a38ef9d6fec6fa7c53423f90bf3f5
SHA512 6bc8dba7b59b09a30a220b223687726beb558b0eb4a2d461a41fc63ab12c59a485e46d5e05f60f9f77c6eb77584373850f88ecd040b36d10fea21565eaae7e86
SSDEEP 768:ClnE6esE8lDldUGfPbgjW7bKDfXn8pu6514f6xwzFbiwHQEH6lGCecVb5rTfH:+eB85dnc4pHra6xKbFpH6lG3ctrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 363c9d6a6e4bd4b9b542e1a87742bb421e68b767adca83f97c770401017b16b9
MD5 783e991b169ee413e9bac780d6e6f677
SHA1 05b37f8cee7a9646c4ea72cc803176f64930311f
SHA512 4516dffc0577829786af4b464bb19c7c332a560b341b03db3899ad917e3efd0505386851b6089788e6b8c4cd1445ec6fb0d39bf3f9d88368506261bf236241e8
SSDEEP 3:MsEllllkEthXllkl2zEflJ/:/M/xT02z4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Size 6KB
SHA256 fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
MD5 bef4f9f856321c6dccb47a61f605e823
SHA1 8e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA512 bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
SSDEEP 96:UXq6pG2GE+Vy2+m0plhYvPuW+wkpTm+ozdswsDm4+uTagSfC3AQj+y:uNtGbVKm4lOvMwkoR9PuGs3gy
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.4.2.1\typosquatting_list.pb
Size 631KB
SHA256 44a2b1d78c10fcd9d4053f3ff3cbb949e1e7ee1714107a7dec2276106c32c461
MD5 3cee7624fcfba5c43ce581a3ddce6b32
SHA1 2421f8893d984b7295c1cbc63e6bf374f3e38888
SHA512 7afd78ab63736347b2c091841a81ee9734c2591d985458a255df5dfaad8f9e63c29ea2b5c8ab75519d4c6d317b444be79e2e8f66d89fbd6410330e7d12db81de
SSDEEP 6144:RJmh4rjISa5wVno5gGEZUKtF3h9C6BTAOxU3M:RgarjIPwo5g5Z3FUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
Size 152KB
SHA256 fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
MD5 dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1 d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA512 65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
SSDEEP 3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a8c2856d46e5f79b4383eb9566efe0176d5dc505c10af790b1aec4b624ed3075
MD5 0d81bc13a4e0a51f7511a9462bfc8c49
SHA1 31cfeb3056d6af54ab5cbd0bb8103e62af3d6bc6
SHA512 ee1d8730156ef28859127ff800612452e3f723d1d4bf260884ad363896ac6587c719530ded9300251f663e735022b39a03bac021c15a266eb89e87cd8e1e4bcc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_43up3xxs.pph.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_43up3xxs.pph.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1280-999-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1000-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1007-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1008-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1006-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1004-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-998-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1010-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1009-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1280-1005-0x000001EE60B60000-0x000001EE60B61000-memory.dmp

Download

memory/1512-996-0x0000000000100000-0x0000000000112000-memory.dmp

Download

memory/5256-961-0x000001EBA8C40000-0x000001EBA8C62000-memory.dmp

Download