arkei | dac651edd381388ce17e6c5a7c5f41c66a42530e6ce82e58745adbd3c2570b14

Analysis

max time kernel
445s
max time network
440s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2025, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mars Stealer Builder.7z
Size 2.8MB
Sample251024-cabjfswnds
SHA256 dac651edd381388ce17e6c5a7c5f41c66a42530e6ce82e58745adbd3c2570b14
MD5 9adaa92c49ce7b760fe9804148502b1d
SHA1 9c7ff83f124817589dc9e45f9e55c6fbfb6e1166
SHA512 00151d77df0cee260dadb95dd53e08ca0e7aef9e6f6668ddc439f5a138f263a957aed80431407448442eacf9b9cb4f02b98c9c4a4420e012496b2023861adc1f
SSDEEP 49152:7ZgKH7FFOKPETXqzZIwhMMJeBsWG9gnxFYMtZaw+mYokRTcUe6mH:7ZfH7nEUGke+WGynTX+73RAUeF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery arkei ransomware spyware stealer

Malware Config

Signatures

Arkei
Arkei is an infostealer written in C++.
stealer arkei
Arkei family
arkei

Executes dropped EXE 12 IoCs

pid	Process
1632	Mars_Stealer_cracked_by_LLCPPC.exe
748	MarsStealer_Menu.exe
4780	MarsStealer_Menu.exe
2672	MarsStealer_Menu.exe
940	Mars_Stealer_cracked_by_LLCPPC.exe
5484	MarsStealer_Menu.exe
5512	Mars_Stealer_cracked_by_LLCPPC.exe
6024	MarsStealer_Menu.exe
6060	Mars_Stealer_cracked_by_LLCPPC.exe
4408	Mars_Stealer_cracked_by_LLCPPC.exe
2224	MarsStealer_Menu.exe
1108	Mars_Stealer_cracked_by_LLCPPC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_2004489049\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1455961637\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1187209124\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_565357926\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1169560871\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1187209124\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_565357926\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1461200045\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1461200045\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1455961637\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1169560871\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_2004489049\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_212400868\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1187209124\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_2004489049\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_448350493\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_448350493\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_448350493\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1187209124\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1169560871\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_212400868\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_212400868\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1455961637\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1285753627\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1455961637\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\CompatExceptions	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Sigma\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping552_1285753627\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1169560871\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_565357926\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\automation.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1604	1632	WerFault.exe	93
5708	940	WerFault.exe	152
5948	5512	WerFault.exe	158
5512	6060	WerFault.exe	167
1872	4408	WerFault.exe	189
5220	1108	WerFault.exe	206

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsStealer_Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsStealer_Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mars_Stealer_cracked_by_LLCPPC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsStealer_Menu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarsStealer_Menu.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134057443840709558"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2860684728-3699940733-4015428997-1000\{2C007B48-AAE2-4AED-A21C-0507672C0EBA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2860684728-3699940733-4015428997-1000\{4E9032B7-8961-45AE-A755-56EDF3C6F9B8}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2860684728-3699940733-4015428997-1000\{29E23E64-B563-4AD8-905E-AB9999E9A6CD}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2860684728-3699940733-4015428997-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
5852	NOTEPAD.EXE
4192	NOTEPAD.EXE
5596	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
2284	msedge.exe
2284	msedge.exe
5240	msedge.exe
5240	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3676	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3676	7zFM.exe
Token: 35	3676	7zFM.exe
Token: SeSecurityPrivilege	3676	7zFM.exe
Token: SeRestorePrivilege	880	7zG.exe
Token: 35	880	7zG.exe
Token: SeSecurityPrivilege	880	7zG.exe
Token: SeSecurityPrivilege	880	7zG.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3676	7zFM.exe
3676	7zFM.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
880	7zG.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1252	2672	MarsStealer_Menu.exe	104
PID 2672 wrote to memory of 1252	2672	MarsStealer_Menu.exe	104
PID 1252 wrote to memory of 3344	1252	msedge.exe	105
PID 1252 wrote to memory of 3344	1252	msedge.exe	105
PID 2672 wrote to memory of 1092	2672	MarsStealer_Menu.exe	106
PID 2672 wrote to memory of 1092	2672	MarsStealer_Menu.exe	106
PID 1252 wrote to memory of 4360	1252	msedge.exe	107
PID 1252 wrote to memory of 4360	1252	msedge.exe	107
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 4340	1252	msedge.exe	108
PID 1252 wrote to memory of 3200	1252	msedge.exe	109
PID 1252 wrote to memory of 3200	1252	msedge.exe	109
PID 1252 wrote to memory of 3200	1252	msedge.exe	109
PID 1252 wrote to memory of 3200	1252	msedge.exe	109
PID 1252 wrote to memory of 3200	1252	msedge.exe	109

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mars Stealer Builder.7z"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4628

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1168
  2⤵
  - Program crash
  PID:1604

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1632 -ip 1632
1⤵
PID:5024

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://encode-decode.com/rc4-encrypt-online/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2ec,0x7ff83319f208,0x7ff83319f214,0x7ff83319f220
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2340,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2584,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3616,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4160,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4180,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4344,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4848,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3604,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5756,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,4114724777580311514,12182166715621713009,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff83319f208,0x7ff83319f214,0x7ff83319f220
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2152,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1976,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3220,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4364,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4548,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4208,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4280,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4768,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5072,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5576,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4484,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4940,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4580,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4628,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5252,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4732,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4832,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3744,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4440,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5312,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5496,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,106556908258148003,2740216460318699627,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x214,0x264,0x7ff83319f208,0x7ff83319f214,0x7ff83319f220
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        
        PID:5656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2228,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        
        PID:5664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2528,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
        5⤵
        
        PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4180,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4180,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4644,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4652,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
        5⤵
        
        PID:3996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4660,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        5⤵
        
        PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4124,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
        5⤵
        
        PID:2636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4700,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
        5⤵
        
        PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4380,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
        5⤵
        
        PID:2504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3724,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=784,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        5⤵
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3264,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
        5⤵
        
        PID:1500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4044,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4944,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
        5⤵
        
        PID:2376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4708,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,4823370613894022708,13933462733110572304,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        
        PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://encode-decode.com/rc4-encrypt-online/
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://encode-decode.com/rc4-encrypt-online/
  2⤵
  PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1332

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 1344
  2⤵
  - Program crash
  PID:5708

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\" -an -ai#7zMap13673:156:7zEvent31613
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:880

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
PID:5484

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
PID:5512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 1308
  2⤵
  - Program crash
  PID:5948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\grab_manual.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 940 -ip 940
1⤵
PID:5676

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\plugins_manual.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5512 -ip 5512
1⤵
PID:5928

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6024

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
PID:6060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 1308
  2⤵
  - Program crash
  PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\mars\panel\assets\images\small\binance.svg
1⤵
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\mars\panel\assets\images\small\binance.svg
  2⤵
  PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6060 -ip 6060
1⤵
PID:5524

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1296
  2⤵
  - Program crash
  PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4408 -ip 4408
1⤵
PID:3508

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224

C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
"C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe"
1⤵
- Executes dropped EXE
PID:1108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 1332
  2⤵
  - Program crash
  PID:5220

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\instruction.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 1108
1⤵
PID:916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1169560871\manifest.json
Size 79B
SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
MD5 0726a393d6366788cb47da5897d1af64
SHA1 022ebd4d118261b871d50479868d502b797e6d14
SHA512 adaaf0c40793c606d44fd7112b42040f01dd483a7c4c678e811f824e2fbad722ee3faf50984615731d71425eb3a1e4a9090962249e673fe8e7290713c8f75d9f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1187209124\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1320321891\manifest.json
Size 119B
SHA256 0d74ea99bb8016a42338e4385e3cb52b65f99adc4965f8bb623e563522ee5327
MD5 8d9ed39958a16a5926bef1d0df3ff779
SHA1 30805668626f5f12a5afea2eb4e6ad32635afa31
SHA512 7584a72e968cdd197027cddcd8a934dda68924b404595a51eed5191e1120160a1e4c94cb4a97154c69f9935129a29ba971303009b775322615b37fbd7f3167cf
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_1766965512\manifest.json
Size 132B
SHA256 4d5896135d6894a9bb306bc01c529269e3a425ecdb80e40abddacd16a4b36076
MD5 64d12fcdf9771237e6ee19f77b31e0cd
SHA1 00256ef42bbf7e9b3c5660ea32586f2b12597e07
SHA512 fc68f5ad4789bab6ebe6742f49fac3397b0b860c3847d4a68db3dd4f822546a7057c334033dc78949c28de4345349ed2b8006edd978ebeca6ca1d93acab776cd
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_232264858\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_565357926\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_565357926\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5240_580257126\manifest.json
Size 176B
SHA256 cd3bfb95cabb4cce04ae822443c4e7ef5c16ef8364804b3907bf37775f821eac
MD5 f99766abe08dd2f4607288031ffcb71d
SHA1 40f82d7a810175043004f10366a763180f4cbe13
SHA512 a6cde975e71a816377c2837d0941b0c7e68d730dec93d157b4171839e6a0314fb599053111b2e1951b0b90b23ae5cd06e23e7b7cbd01d6f9a6928cad82bf5e17
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_1285753627\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_1455961637\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_2004489049\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping552_448350493\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4c0ef31a72bd5d02360216b0c5f9ae62422c17e378ca466e09077bd4b885bb78
MD5 482ccb45b7248384e423f53f8539e192
SHA1 4ee5daf8b9be44f7327aa6c2e4fd0ae3158e5c5a
SHA512 feeac04df4b0f4bf8bcb84286a6764943cfaa9a1013e10082c9768b9f2fc51d9ed82a070878947551825c572f5f9e18a646dc06c3282e027df4093b64d31d5b9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7v:fwUQC5VwBIiElEd2K57P7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.30\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
MD5 SHA1 SHA512

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.30\edge_autofill_global_block_list.json
Size 5KB
SHA256 088e07dae9ed4c79c840f517eb3a4d494ee87296ad463d350759cced742425a7
MD5 901caafb70b591f1da2293af10f97ccc
SHA1 e511451f4732e9266b71cb11f23dfce801a3421f
SHA512 1e302fd46619ca3ef5093612e30d863c8ce03b61664eeb9c6158efdf7145701248e20ffe9d4716556460f547fa8c7440e201ab381a9d8c4ef88e6315720b824f
SSDEEP 96:mstL77CC6fQinLk252b/lF4NXtKK5b+QiG2ZwOSZqWqxtxpttx6lFuftdMsSRa4K:mstL7O9FnLk25+tF4B8K5b+QiGoztWuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.30\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6c8ed05b03a4530c385c326a2c3a12ecb29dc5a4cbf3d465e61353f569d9463a
MD5 68ebff45bdff601025bdcaaa9aa44f35
SHA1 0bddecebb57219c0bab949811d100d7026cce1db
SHA512 3cb2392b7ee46f5b1fef3247f50506f5300162f405006c910724f406667174305c8286d607c7ede5193a3e44fc2610815f01aec52d2a0cc9a91ee8e1cffe7b88
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 841a81dc820cd1f7642d1dc2e0544dff07302344c9f2f8e8dd4e3bcc31326242
MD5 ac2f626dc7e324587c36ffd1b57e8398
SHA1 0c3f42584e91baf59b7fa7951020d0cbee78392e
SHA512 6f88eccc165e38b9d544fbf7476f85d61f9a39bf9107f219aa3ca9a97d1bd106b6f854b51c926e350a4096b717a99c1bd12132c74e8a1f3b5261fc8bf8a871a3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 147cee27fd1c8c85cea84f38168427146178c38d712a31310154d516eb28fd3c
MD5 8429437ec67f6de7afae45713b5aa462
SHA1 e7ae135087a48083f4e0bbca354b1ed6bc049d75
SHA512 7ad770470c768452e6f28240c45753459065f1115af3985b5a58a6118049aaa49b73b018864fd10cea27b5c2aecddb2ead0f2baf951746a54512464ae4be7407
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5347cc604fbf9e6d036aeee63a204a38efbd41a64d4783c8b7ab5ece16ae0e6
MD5 bf7bb465fe892d888222e417e736e66f
SHA1 9cbf14e29dc322025f4dd441e2edb2bdafa796cf
SHA512 a0e37050592089cb695291df38b580542cb1964fb67563db1f8398dfa9a5ad402f6dd1b56c5f72f040a3f7f4c91010e745871f0aa5c1b01b08cb76aa4b64231c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2f7055db977df3f1f0b0cf2fbd2e12242d961cdfb255290d07fd86b633f47c60
MD5 944e2c3b9ccca05234fb58795e374b92
SHA1 698ad5eddbdcf85ddc7c9d16e35d2aaaa5f23d5d
SHA512 8cb641ccdc9e082d94fcf609dc56a2214e9e00f1506f8ed7109212981a6bcd720b3245bf4dcb22a6217701159f89d514b1b92da473478f35d9d741fd7297980f
SSDEEP 768:pkuFd77hmiNDTpDhOo4O7ByjywZ1R6L9:pkuFd77hmiNDTpwNwwl6L9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 80b12be3be0d4c09ba4f7f490adda844b543517334b60bf80491e0d3803ba511
MD5 a197495ed29ef8221d2ac2464e59a713
SHA1 e49daac525fbf472db922cab0c89e17dd356dd85
SHA512 9208ee37e80c41fe7bdacb4f0ea3d0c205fadf33753f26e901f49d393ff6ec13bf5d0b903a345cd8532adc824a7ea3fcd3b8028bab8ec409531425741dd7baa9
SSDEEP 1536:qkKqPHkKj/TQe3qwSgLMw6MFTQcshlZgHzgz1pF8FP9BPFLXUdTHfoBmz82/Tc2N:koqwzB6MFTMJF8FFIdcBmz82/zJuFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6d36c7338d0822b44fb9dc45b62e77f90cd00c93e5b9e0004c851ce61b1121e7
MD5 ea44bfa84e750c435d772ef2563d16cf
SHA1 e64c282b7d75c8b0fc4e5a66586d3e74701e1bb2
SHA512 073152c10036f6c2dcf8a9579993f16065238b8431bd2023db05e354f603f6fd16a2404c3d4e7f7a47624181436fd40aa725a5a66572749716d07288c443e91f
SSDEEP 3072:5u5mOVCGdYH67TgSPC0+u/WmNkhavwBMVsKXDkWbmviFOoHleWz9yrZAVqBW:s5HVCowSPC0+u/lguzzpzvleQUZAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 7f39785b00e8a0d0555edeb1898a5383b8fd8bb542709ce12fd7980df855ef08
MD5 64a892f1420ab9dfacb0b621956fd1c8
SHA1 e7b861799ab3100664deb6b3825db49d29e5cd8f
SHA512 158b0b3478658d60d81be19e40c6425fcbac22057b7625393bf73e6c31a572a4b12b5551fe4ed33301c127d773f08658d508f0f928f81df59363311b2b9f7931
SSDEEP 24576:DEaxcBUjGeXeLDqQhIU68m26U/n9sgjRQSuqTNOls85Tkl48GTp5GhzdiA43j+9x:DEQGd5IU68m2fnXVdOX5PmMTk1T42Y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 67KB
SHA256 fcd18cc22e9c63c727654b9f66a8851f7651b5aed5f6e99f3132d49e311de3ed
MD5 91a3b6d72347bb7dce78b5eb64ba3a1d
SHA1 929ee5e8b4a679c19438f2bb1cfbb66c5ac8bd70
SHA512 3acef410bc0e1c39f72453d090495a888404e37fd4812f281b8e773049de9c952ddfc6ded2dce6516ec4c497a2e8c521872783c8bfb1229389bfe747cff0322c
SSDEEP 1536:n8lA6KYcYSEneDRcq72u/pHSkPlIRt/b4D2CHnO:B9QeDR76u/xbNg/MDPnO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 146KB
SHA256 547a8b1997a79da1d2584982313b7aeec9c85fcea0e9b4dc2e92d77bce250119
MD5 49742b121e02088b11a34c565a481af5
SHA1 be93a9448280c6591872af45c30abf342db9694b
SHA512 6491415b551036e8f6fa2c9aad16458673b34a699dffd8543e279b7238c94a77a7ac585ce6995b6bb547965dc671490648e757c5016fd330e0fff80b704ce069
SSDEEP 3072:GxHPTa0VhWV+iyXMGDRqqmXJGEG7GQYuJiUrBpsPLy3cRr74+O:GxHrdDLMM0dXUEQYNM4ocW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 51KB
SHA256 ac62cb0ce0a9c1e5b2bc19a34fa7f4a7c727067749533c85fe83721e90cf76df
MD5 95e497ab9b851cb1ec230cc052b609a3
SHA1 661f4cc1fdfda605ab7a711533b595ab3b76249f
SHA512 be9ff75b7eaf98ae506c2360f1b38351571ab18c2981daa7dd9bfee74f4bba64daa0c7dec97d875bad74953cf7a3995091c1b7ec1d63dbb78943c94dce6bd09c
SSDEEP 768:BjZCKJTuBYyaB2MtZicNxBda8/D2lwW8y9WvHOJX3nnUfVqXO:BZCKJHyaB2WdxL//DGWvHMHUfVUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 84KB
SHA256 c8da2baa7b6677e30deb1a24e14c9cce4eb4751ecb534836ca3682cb7d148c80
MD5 1793926aa936c06014a1f523dda4904e
SHA1 3ab3cbc0a143ed64254f65cae666d51eb8c63079
SHA512 ca36a2b7618cac3a692d2d0dfc106de6cdc0e15b3a7d7366725ca52779acfcfdcce4f56385ef13bc367c5072178741af88d27dd90eda720783bffbb33e472642
SSDEEP 1536:iN0ekyhRuRLxL//DGWvHMHftT9wERgwtqp5b83yH0ejDohQ8:iN0ekyh03zDGVH1TTRgjL6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 18KB
SHA256 e247f551bd0b4d9cbfcbb448a0dd9aca7f339e1466661c3b8a83e064c9dbb98f
MD5 d04bec07c9b1fac999d7888ed9636e6e
SHA1 8d6a2fe54e5be9f416c0a233be5df4eda009f76f
SHA512 f4ba1b29ec672891696864344c66884ce86834db5cd61b30803e272ce2cae278e1c9a9da5be91ececceffb5bf3afa2b2a656ec57468297654c97159510f68792
SSDEEP 384:qZINDg4fFE4y3kTnamOfV1URgNh4UjoD6UEmXf+dtDPRoMyWroBO:qZIq4fzrTaffVORgb48hpSYtzR1yTQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1739ce44aeb5b609124d12deda40e59f46b2f6eb2682e95e24ee420ad612ae26
MD5 8b035ab62f049b2468b7d3727b4a6af4
SHA1 ad91e8c9a7140638d1e7a554f482c2fe49b11fac
SHA512 74e932a2e4cb05ff59cdd4e3cb99ddbf17c458941ca24ba09c541a2eb75a25578b99f17dc36fdedf4a88524182f75a065b10dee47c42eea2ed077d0e41e10dbd
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe586bc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586bc5.TMP
Size 3KB
SHA256 bb6f0f9ff63593509f5aa375c2e38c596cf94a528d7dcc9d059b383f38a82a91
MD5 16b822e1dcb7a952590706d6a1cfd64b
SHA1 5a84fef07b6f5dd2739b74bdfe62811579b10d4f
SHA512 13074c006d69a67443b61024325fc22fc68c6e292c1de71208db37101beef7b5c9e4d5d620fec785f176bae1cd6699f4334a07bb57214a9a26a41a1b9bc94dcc
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 684B
SHA256 ebf65d839a9c2a53ab503763d44c3a0363d3387faf4f947b5959463833c3b75a
MD5 f93b6a29284b7e38dfd05af480d25ab7
SHA1 cde3c88c5dd5d4e617e8f8157c03d66d730953f1
SHA512 e2148554c1b5c2b97175e5ade1fe82b5a08311ce9d736907ac299f99c3580a99458d7fefc894f4badba5921dfda84f61117e1ae3e57b0063f127aaca6563e099
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 3ef2b13bcbefe5484d4dddf92a356f243bbe9a948070e00f8114c58f40d06b75
MD5 cb1f208acd5e54b8f93fb1b44be1de4b
SHA1 7cb84d9261644a67ebe9da83dbe103dfb3fb6312
SHA512 8a8e5a7ce60ff2b6fa068cf547c03a3173683740bed159102fed7f7c2db5847e59e4799fc700538e4e63e0d1cb6d571196fe8061ed96bab46edd7ebf9628e28a
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 d8c3ece5258dda25d479ca65c614255f85ca66fe85fae6030d3c5fbe69ceddb5
MD5 1a6af7439c3f39d52edf2c877d7bb4f6
SHA1 da59fd963c74a5a9337e71d6598433701da8cbb8
SHA512 a1121f4f65e734d4032032ac7834c903a7329fe645cf45c6feaae58d6411a21a713effe973ec83a8c0b5d1f3885895c741ef9267826fd773829f767499221a27
SSDEEP 192:cUHa5+GmBE3upbIXJlPtwVjHHrDo/A8j:nHGmBE3u1kJFtgrDo/A8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 04d235aaf3521016a70d7c7549e1ce78b292e7d2391927560dbcfb5fe4c6eb0b
MD5 8fdd933dfa7afd2635df9dfc82d74a0e
SHA1 603cb6a3ba4b40de826d88053b13776da1b5b320
SHA512 9528a282509a4693b4878a36d81dd0c2bcb39824f7ff4017ffe76f8706f32c764e3227a34f117378f1beafcceab2aa60fb6b3509a8207d9e1823cc9ca9acf5ae
MD5 SHA1 SHA512

Submit Download

533a5a09-3c07-4b6c-a781-262b9cb7031f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\533a5a09-3c07-4b6c-a781-262b9cb7031f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 aa0d608e259cb72dbd4129a3a23901f5877ed0899768dd3e3724f3733bc1e1be
MD5 c2e15824678378d4512577f42a3dfc07
SHA1 02da9aa78c091f342457f2302eca83c64edfac2c
SHA512 24a85ddd68c16e8a00418f9278113495f4660634613d21b6bcafc010f39ab0e900d58ddd01e40626b021895e4e070e0ef18cb563b3199e6bdde3f3e191b625af
SSDEEP 48:T9LopFMatSaw/auUOt8BY5xSRtMVS4Gt7mpppbVm/:NeMatUaAKYrPVS4G74ppbVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d21e5613fb6fcaa087f3f1617333f2ae846be48ce0947a700db186260d51a705
MD5 8f4a153e8240ec5b9ca25a2521093fb3
SHA1 a42166663f93e2685bdcfd8bc04425e54fd4d773
SHA512 78ef8ed05cfdd5ecc39e96896c44f24b45752361d9ca4ae537f19b757a7828946636c9a2591cecee00df7e007f25c9bacd312091edc4eda21a162c91482e327c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ecd42533660faba9ae740f605222a2eed7d49dc2acfd60fadc3b72ecf1f8b776
MD5 49efbbb9719756f2b16877ab952d44ce
SHA1 94d379a41120db44b1a06926a1c48c75b1c0e5c6
SHA512 155dc7dda3fa411a915d966598a7b1ac10796e965d51533cd4f52e470ca93128bd40c8275b87bc9275f3032d637901259a9ad13c7b28f56767dd6d09136e83d4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ee5035546faad57239bd3b0927eb68148aaf89cc56ba6cd93a4d25099f25b046
MD5 d4c6d35f6606fd8609e39adaf3a5cea9
SHA1 0a2bf5edcacb26d2cd098c81357e7db0a4e8678c
SHA512 176f2717419ad1450c81d017f3a762143684180d2747cc8e86aff8d38f779d879eba99a0bb2feabe204cb4751cec3f5a86306ee4cff7be2adcd58047436e7955
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1ee1e0a22721400e140d9125f91a2eba1fb92f5a79079823418444c9c414e7cb
MD5 57197cc67dd6c6e0102fbae32c29bea8
SHA1 764fdb00028f20463fbed94f93b800faa41d77dc
SHA512 c49b444fa8ee6053725a18555b05e1743dd1d334b33ecb06615e5eaa07f9acefc859e2e6a502247537d821fe105a772e4fa575dbd627826dbf00d2ce3302ea1b
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 169787663935c903e8b40e620170993695fb8abf8c0d9af682b32900d104a957
MD5 e9d41be84bcdc25a006ac10692556043
SHA1 a3ea6a5c845231d1b850282d66e27cfc6dab7002
SHA512 694544061303d6e873d97377f7ad17fc011ec429d243b66ba9f55d19c842f1041410f56bbdb3e9b32d0ca29440e3772d45ba99adea7847e1f59b41ae49e0ba96
SSDEEP 96:OIEumQv8m1ccnvS67UETjOtYEaqUyqUhyyrYIXhyyUEEAUHixZ/3j40:OIEumQv8m1ccnvS67h44xTDyayUuD5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 0b4a759c2fa47a7f7bcfd671d64641791b346c8257aa5b81843503863a118928
MD5 87af8d19b2949ea612b3f17028405085
SHA1 0ff51ce02a2b22b84431319a0fd200f5b954a668
SHA512 b8220341c8076d19e8eb3b8be653b384070836b4f486cd27d08fe6c7c47d11c03cea32e04b859fc5c4f681f81a8da8d00614c7a6bed259e11bed9ae752739e2f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 951c146cac2e590458b83dc272e7ae10fb803e2d2135603deac41b157537569e
MD5 1bb311d92fe0c252b0c2a0ddb19062e3
SHA1 d173fb6165d8292c30e34f6f68422354514b8c57
SHA512 145cadd673b36567251029d827b68a937d1c24d1dc6759582846c35ed930a394922f407feeb802aabdb97af7cfbc364ff7ac2b3a5b33d4ac5fada3314900ba40
SSDEEP 192:sVPRmyMh/K1Ml87g+sFWcvfxixlEZ8pJUHY+WN4sr4QXgCPLksnrcIg5J:sVPmx+sFWcXIx5mHSeQ5Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 772c4b67d87f52b2ac0c40107a9cd5d59c59f56ffe4fa1cb08cf83e7766834e0
MD5 6751d2a2480773bc0dddf7b0e430bd8b
SHA1 1ef62961ed2abb97a20f2715155d67ca22640279
SHA512 228130b132908d68715cbb50a34d1e73f008b8ce88895f3e655cbfc506560990b12cbc11f011f19efb515e613e9bf3746e198b7613bc5ede548c0e9f369af782
SSDEEP 192:sVXRmyMh/K1hl8kg+syWclfxiTg68ZN7vlzkZ8pXnUHY+WN4sr4QXgCPmksbjrcf:sVXXW+syWcVIk6sN7vxEHSeQqAf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 93708aa3162b373ff0586753da382c56677114c3c1a57e73204f306b1a7a9824
MD5 abc58fa23f4a14967c0c2894b92571db
SHA1 4e5d153a4c8bbe891b58b382189dc7196847ee4c
SHA512 1b685362472195995bbc13de0752376d944fb7c30b3f7f8e50b7bc4cf437d1e267af3cdf6b7239c9bf5282cf5ede142bfc2eb26d2ef8fb278a09b4c827d70245
SSDEEP 768:+Oti8BNWFh7xr8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZALlBT5CJrorelJ0sI3:+Oti8BNWFh7xru1jaCALz1Cikmn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 e5fff5ba67e98b15f7bffbbb634ce759bec6044a05162763db04fd253251a5b6
MD5 fad7a9082ddbf322059a38d85b6d8fb7
SHA1 7e935919dc27133df239912c4ab107d246b8e7dc
SHA512 80933165837ca4c5112bb39a8a79bc624ff3fbcdd3ff617e59c51fe5b72b8019fe0b0dcf2846c6a0a1a6f128c2609f7ef82f156a9aec360252adc4872dc4e58c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 328dfd342c5e6b7f5c659f634e9494cc897e463c65752bdf12f6323a575e63b5
MD5 72d4eb9ceb5db1ebd812bfa55c424654
SHA1 7091d352d67657c477aac509a9b87a7a135ef441
SHA512 4b810952c48fe472b0d34b0bd9593deba8c5a8f4c2f11a797f26d57a0027d78531fe971cbaa0a260d4ae4509039eaec3ccc427ff4ff94ce90f7aa188fdf66756
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 15dbeab762c483cdac5621056d7a67a808b089cec349c89779f9f50f6220c21c
MD5 96244624212a28d5f9e68f5eec8186a1
SHA1 4ed48f04abf358ff72a3a55c41c2a3c06343837c
SHA512 eab01e240685716cb79f78705161208fed7411eb4c4ab216c5896818a52a678cf10f79729a39ff20171edd36b7e02b5fe4d5368e636b0f1582d4b00b7f0168cf
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 23209512836b65e2750a4c791ff1ea6659f0825d68da7db37190c1fc3e8f65d1
MD5 26af0bbbafd062f4a9947a64d5dd85f1
SHA1 77b747500128935d9fe8e90c5f087f855c8d08b4
SHA512 cee85dca41cacae2d629e678fc69758c45ae69fe9b4246609fc27f950ddd0a23a54f164d34386f56cc23fb74aacc81f3bed46c7a45b3d69a2ac4cc1cbefd1f6b
SSDEEP 192:QFSznVX72zQnftf5FYj2rEXABEwyui3GzEocu6oDafgHI95HNdMpmNxTJ33+Bg9W:t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 83db3516c56524761abc0c169c1f1758c1b4cf9f95f8338c5761bbc02ec43494
MD5 ce06bfb7a7a8b294bb42811cd86de5f8
SHA1 4a0803c2b2f684cd7780ab548d177c03f3d9463e
SHA512 f5ca737ce108fb290c4c5b857c1eca58e043d0e645f284996e9f31dcfc25861e80919cfd290461c01a04d66a7a4cc7ba34dc83241675153bf69951fbc7b87f12
SSDEEP 3:ImtVuAPYll/l/zfll:IiVuAA//Fll
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 228KB
SHA256 ada549012950f332b22feef521957f2fd206a3344edd359818996fdef5f22c53
MD5 408cba8488d7bf6c087186bd92d10b0a
SHA1 7fa6da5ce96020b7a461599ca915775a0124a1a8
SHA512 f7913f251316f00edeb62a2e6eecb7142413862782308d15d488cb559706df5601a45073c8dabaa352df65094cd1d872698b7d43b7b64bb8a059787d074d5840
SSDEEP 192:51moNMfT8a0QQnGzaW6qt8K+dJIhPJyiqzX1i+VpdssMV7due8FPu:b7GfQrQQnyn6qt8K+dJIhPJyvzl5cYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 6cbe03587afb82ebece635ebee5776a6d4fc3cf166915869e44e0108506c71ca
MD5 51c5a66b8c6e6843f072d2251d451d1e
SHA1 b73f3f082a73d7aa734796fb8e9aecb4d387d1c7
SHA512 fadb2fdd75f624876764c912b0e33f0abc488d131e035e5170a5320542b563d6cf650e75b0934ff86095ec5811cdabe64527858d4d66b823f34ec4aaae12bd5e
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 402397d220d1334a2f81039b4d7bb7cf562912ec43c6c0862603fe9c052af1c2
MD5 0670970d9a986488d1d27a1f295ad034
SHA1 40d07db4cd58dc693e4fef244758c49a9e743271
SHA512 b8ed4f6ac395c047c1f85e2559e2e71e033b88c65c6c2554d6bd86540ebb108017e2b62dcc23db6322f1708d858c6b9de5f63770313cec2a344a8c999bcb701f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 aedd437bf5b5bbc53a596c9f8053a755b6c03f330562dd086da53a22764c4520
MD5 496f8023a9f8942a26f5960e492e2cd8
SHA1 648a13eb3497668632d915f8c096084820df15c7
SHA512 9727f8f631e55bc11f8821072b8f1545f896154de82292c05a7cf6f76a09ffbc31d9c23b965ff5c7b947b08857897f6b75e3e0840514692f664da316e2f30792
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 876B
SHA256 2e993a650301eabd04a4b622e4b4e342b882cbe808ad77369e45ae2f87ad54af
MD5 c77a4ac0cd4986f4d11a8e44fa57069f
SHA1 b0cec9807054c994695717de16e54b0f9bcba1f9
SHA512 1b7e6daa17ba2c9661a2b3dbbfcf286d9ebdcf25c60ad3f93b7890e23c23835e5bb1da686af05014da15a968bdcc0d258baaeb04c2cb604021647b06421ba682
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 9b9400282bc113727c8f84ed21c204875b08a31aa4858861d51d7677260b1c4b
MD5 9afa7c0b27cfcc9836e3b069e11e3524
SHA1 4c0f5bda0f824f881a02ae66148b6cbc7644bfd2
SHA512 b9f342e77591203afcda0ef3eb77fa9d69e11ef24e28257036266f67c12d40ecc1ec864214385e981d471a319aa4b7b7bbdd64fe712c8454241fa9bd3fa4c998
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 24KB
SHA256 5f9a6e2a46fd4d842adc54d6fa6efe0a2029407a3c86c7b44f5c5d9ff3fdd7b9
MD5 0ab7e7754ef8e042681d2ed62412241b
SHA1 aeb79a84bfa4a7754f91fb81bb50f2f1e07213e5
SHA512 d74c1d70714e4cd6f5959ae74cb72e45f42a71ac9d5b63b0f22fc7889e6472fc5832eea7668dde287509697c9108782555bf3ee48e427e11d8ff52eeca81334f
SSDEEP 768:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbA6BQpGMgSVlkium1z4tfLTvq/uIvqpgRvU:OJOk/iSlagbCtCkQ8DlH/jmbA6BQpGMw
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog~RFe5959ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe5959ce.TMP
Size 467B
SHA256 ce608533fc46e4856ab00d584052652d140b7ef887f16bd944bc4d4104e75887
MD5 0d4c632a05a2f9094371e1e9c1229158
SHA1 38d75127f77ecff9995f51047eed276351864e1a
SHA512 99155888226933b9e71eeb9a7bb41985fa87ff91f5603ffaacfedace4708ef887f6938a519eabf34a821953e4db5871e45304ae69a9a7f82b2a453c7a115ff1a
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig~RFe595a8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595a8a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
MD5 SHA1 SHA512

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0
Size 44KB
SHA256 ad55e8c211ac0f4355403ae114fd1137762b8ab4d22a7b4c905e43cb40aa1e09
MD5 800d6358a91fb7e6642f041eb84c4061
SHA1 08eff5ef3a335f3c4b55d12648fbbb56f4cf8f64
SHA512 5e5ee57b677af345ca03025d103691691072681481c7013d5ced317b895b84022657e8269db0a578049b77aa0307169461cc6ce847100d722bcd002cc17049e8
SSDEEP 24:dSJ1ETIP1NYbh2LrCrVFQztoZc/t9MGjAnVC/NENjK/UsPJ:9SNi2WS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 d4162533e881717ca0695f6aae7711b51257ba721e085e695363ca6379f1be38
MD5 df662c52c02cac7561753a4fbe645be6
SHA1 201e11c99bc5802e1d74e4490e1b9b1e3733a3a9
SHA512 4aec28c11431692bc7a5db398c2b5aee75c09d934acfda4042ae8a5b1f222c6d8e5ad7089090a0e0d329ddd40959000c3fbb77a23e8d3c4477129bc097afbd9d
SSDEEP 96:LSsqS4SMS5SXEkSWzVSuS0J8SeSRvSFJSspScS1wST3SPPUSPzS7SqtrDFSKnSKN:YeVPg1vN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3
Size 4.0MB
SHA256 78bf502b12ed56dbd40ac140f1e170745f61986bbb5019452aae2c607c946ab6
MD5 6b8954e79d0cda755afc39c7e9b11df9
SHA1 846607ad562b5c402a5ef7bbd7647a6643b62a6e
SHA512 8338793f04bd9cfb5f09fdc91943b16e096cbf20ca7e1fe203444845aa14247df8278149136d7626e1e2551ea59d6593e9469c0bf0199ff15d7cb585bdaa1a9a
SSDEEP 1536:xNQFqViLb/63SCI3qJU46arkClTafx6JoJKJcJdwr0wyvu9rjcE/BxtZpETKopyg:xriLbu44pTaIuAqED9rj7tn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\f_000001
Size 19KB
SHA256 f638cc954b724d299ce5514ba51b49a4bbd2d670a7704750570b48c9d4a93eb6
MD5 c7431b2d1df70484ea75ecdbc1018573
SHA1 64a206c8304ec32b3bcfa9d5962ecef953bf7eda
SHA512 5072f65e9d2586b20c5bd28a525dbb8336496acc5adca3798f933f7cef2d2414dc814f435dff50e3e8cd1f809e0d3fd8e9e29e9a88df70e31718bf3a113c6b2a
SSDEEP 192:vnorT8mWFa+xE+AlZSlHCOmHbrDYZyoYY1zf68rI31/DeWKJ891rLXI6Iic8SUDa:vdUzZsRrIph1TIEPHf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\f_000002
Size 16KB
SHA256 d1de5a57947933a02c07d2eb29dd8734f560522726a7ec9c1053c8c1b64de23d
MD5 48812fcbe704391f131b6af306f0871c
SHA1 5d834a814129132667d2e1ac9a348ee5c874f8eb
SHA512 6a19e4123bb394f1edfbcdfc6bc9e8e250488a7b8b6cbc62e0238879be0772498e6cfb56c6c2b28f096793aecb7e5417426bbbf586ae277af862ea7810f695bc
SSDEEP 192:y2KpcTwVVL++xEdZhIgu/TN/jo0oM2W6fHq3XF1ZJ8UEE0CyNJ1MF5H/pI6nw/+y:aEhITnw+yNJ1MxDe/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 36d8a02284759ac8ea30a281157fe967e6aba6f8de39b6d3ce8ecd8fbae7e4f0
MD5 4a6fb325894fe814cd6b15f2873021b0
SHA1 e01d1570a0ca651a8a34f47bef85d6555eaea9b9
SHA512 dc84072947e4903ae5b08bada3cf31075db4c47723c253985e1050944b4cd601a989a8a017945fa35769295016537db978cb70427ed11d3b49d527b16b879432
SSDEEP 384:zjXsNbwqtsFPDLGZM92C4XX+pHFEbYdYjgz7jGkytW5KX:nXeknj92HH+5yE5z7jaM5KX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 30901b0cc85743180c201091b7d01277aab59061b3c717e467bbcbcd0aa6c43a
MD5 b9d6587283a15da8b9fb47e143e4e482
SHA1 9559305d8f10162e2c458b0a45756bce6478856d
SHA512 f25476f5459ced18eb09f0cb4ebe9a75667d5543452268a4228975841f1258f77eedff53b3cb29a33a7839b1f7d5d3355354feab464c3b196a41037f227bcc0a
SSDEEP 768:RBLv7I5wCPFdV6ZiBXClxa92HBSf0toKRx:RJUV6Z2XV2I0toc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ca9f962ce5c5d9cffc21417286d19066337257321c8e6825d7d48bfe19c5be8
MD5 c2d592eb3749c174556adb7577ad6e1c
SHA1 886473893ecd948bf0279d8bba48ad0057197bbb
SHA512 bf7e4beab0030435f60f170f8da750a300658d8e0c5ef6769769c92df5099cec18746c3cd64edb820e41c81332559e0347d29801ec5d9baa8a38ceb0aecc9f68
SSDEEP 384:zjXsNbwqtsFaDLGZM92C4XX+pHFEbYdYjgz7jGkytW5KX:nXelnj92HH+5yE5z7jaM5KX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 db8fb887fd6330bd029efcc4236a619e5a563c7cd6a1aa365e105133b164e21d
MD5 ef0e1a6971a9e7cbf8a047a1ad3984d1
SHA1 d4a56608a6028b09769e205794ffdf1696d9a5ab
SHA512 de26e2b3cc1041ccc39aa4f7cb854957927301df8dbb7d6f7c0fc5d9301818abd0ad5ed76d6a4b0dffecef6b205f2adb33cfbe7a38b7152316893dfb5ae96143
SSDEEP 384:nnB1J0w7I5gRzuYgFL2I/V6ZiBXsNb7qtsFaFL7ZM92C4XX+p0P5KnwB+5x:nBLv7I5wCPFdV6ZiBXDlxa92HH+yP5KL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 97bc951d0fd84c54a9319c53a352dcfe3776060fe29c4c769785df89ae3f60ff
MD5 8f34fbe436e36f4871b0fb8466a5f98a
SHA1 3e6a062b5b7dd58bb4e8568cf856e87c45a67ead
SHA512 e77da9454f9a55aa3ab6ad90ffef7603135c011913562a9bc98581f18dd92bea56eb79e65e12e088b7dc63026ea39f01627594aa4c59d8e133ee2072404088be
SSDEEP 192:FONbyB1BCWiRUyb2kbE1SM92C4XbzbuVgpBgUZ:FONby3kN2eE1SM92C4XSKBgUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2d4c2e9df998de38ab5ce85cfda172fd281bed8cff1beabe06743ad8a58d1c69
MD5 eef4d5222d53709ca32e1bb9d837e943
SHA1 5c66e5b6a5f8487d18a95b14d0c33fdd94ba78dd
SHA512 9a1857ed4541d31c208e4925898e908da9ff4c2f2425b6814db00d2e84c3d405b02bc34fd57df90cae403084ac6a2bcf2bbcc3227770446f2456324bd8541d2a
SSDEEP 768:2FvBLv7I5wCPFdV6ZiX3jCgliaRYlQ2UNSgXngLcW0tMKRx:CJUV6Zm3MYTwp0tMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0a2195fef3c43ba22dd36f7a0e7d672af22350ed4a9f031de0b9be3618a61c33
MD5 8b581ae672c2a44b761925e8947c6892
SHA1 91df00c7d6f3eca29e553d90b1ffe287b7f09435
SHA512 c48115b9b116873e022e3cd76750b4583a2c4af6d0481478ec0a8d267bf46b2ccd14c0334ff550a4aefcb8905f9fbd699b76c7bc70de365e05f17fcc3aa200cf
SSDEEP 768:7FvBLv7I5wCPFdV6ZiX3jCgliKRYHQ2UNSgXnZO9rGMqKRx:dJUV6Zm3yYTOGMqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 7d4256a60aeefbbcdc77ee6b88988e0e8e09cd94f71b4a1dd4bb81a8d7f5c3cd
MD5 bf21b68ca9ca49d7b0c6631d3af659b6
SHA1 42dee297b9655e9442a3ad6421c0074712f50237
SHA512 ce398d6f00a107bfdf9ec1c904261d23848cc5746e60095d10f559c3f3ddee4f33d1b8e05180f4d3b5c6a95ca760a376c08df36efb1c3502fb4324329dfa0154
SSDEEP 768:7FPBLv7I5wCPFdV6ZiBXoCglqxCYl5UUXIOFXcfTeEdBJPAvYLPp15ewSf0tnKRx:9JUV6Z2XxLcekLP2Kfex0tnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6d1cb9dc53a85f92d0aacc545d2ee5bfa9ca7653374d152c1e9fcaaafe751ade
MD5 9f61d4c8f2885b4e0d987d6219b8c160
SHA1 416094f05d01520ac581bc781424b02827ecff8f
SHA512 0fcfc7b4af8fd590656c549a8a9466887f10ee0d7bc143a5b3cba9e5737bac2bf486a289acf746aca7812f8d20b57344cee90153b04f9ee14d14ee7811129613
SSDEEP 192:z6ONbyB1ByWiRU1bBUEb4Q8UZM92C4XbL+pK3kVpQgUW:z6ONby3s2Bl4QHZM92C4XX+pHtUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16f4b9cbfba7300b3ea42b86e2a13a2367c3a77675f4e35ea7baf117a9ac4884
MD5 19d91c17bb58398fe82e7c3dc0e52b01
SHA1 3ce599991bd2dfa14be75326a42b6fd8b667f796
SHA512 4325ecc7ae6535d79a1617078e6fab21f720a3cbe1569551bde684e5acc78e3e31d8cf02c85d8aa026edc415094bd93aad309f44f1c12ed0c9fb3a4d4473a688
SSDEEP 192:FONbyB1BkWiRUyb71bENSM92C4XbL+pK31VpQgUZ:FONby3ON75ENSM92C4XX+pGtUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2ee601a2eeca390c456eb22b2713e8811b635b4f43b1ae1b3765123302294cfd
MD5 c3d7b3777907f27a7b63a1da225c3561
SHA1 5325fe80b53f45e2af3eea4c91abdcdc6048b779
SHA512 0b192e79376e561d507eccb5be6952b196e6925b066e2a5f9ecceee808e17405470b9a296fb1cd9cc728816f7b10e29ed57b3fbb3dc768dfe887383d3193927a
SSDEEP 192:z6ONbyB1ByWiRU1bBUb4gZZM92C4XbL+pK3kVpQgUW:z6ONby3s2BO46ZM92C4XX+pHtUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

safety_tips.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
Size 163KB
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
Size 3KB
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Advertising
Size 20KB
SHA256 53787b4f0995cf23dd6844051ca7e0a74ef8e006e85aeec78f9be13a261429bd
MD5 3865a8445d02ab84a1c3436a68e0d508
SHA1 403f4580003b0bd494b020ec07d67b4e4a9c6f8b
SHA512 06de74b96c339e69e35cb7cb80648a3b742f929dd7a1535440daa15106f874800c413351a61cc1fdf8c2114b03c629ab11d9b088c562f439f9da790c0a1aef9e
SSDEEP 384:cd2Z5LKTxyeE2o45a0tw8rnuepd6LvXWVlSQljffW8Nmrgi3VaTxwU7INB:3Lxso45a03ruepd6LGVlTljffzWAw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Analytics
Size 4KB
SHA256 3699d85c333761cb342d47ace15e4979b9ccdd5ac17b88253780f7a334c002a8
MD5 3d96f1c58c779111c45a1bc5d1c00b0f
SHA1 7ba15dad2be1218a410818b20742b3c016cd539e
SHA512 c3c05dd3c363ced3dd73d56e9a7b277dac1dc84bd394ee324dd486bce80d2cfbbdc3409376b0e67c23845510a3cbd5d82c703966b863dae7ff640a0a5349395a
SSDEEP 96:CeQeE8e80b4He1LJEmjwsi4RjJzGPeKkF7y5W4jNU/oyw:CME8eJ0Zd4eZkVkW4jNoo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Content
Size 1KB
SHA256 895265899e9bec79c0919eb0e637119c91b2edc957d42e3426698d8701963292
MD5 9b2136f4634fdfe669fa39c290816dd5
SHA1 90b09979b461da3cd7edef91bf7fa975e7b75ca7
SHA512 1e668e5984663b4f5104da53c7549008a8c50ce44ccfc767db584039c0fefc0729935d7bc13d16b583dd3ecbe5106388f3fcd1255e9db37b92163e8188a02afa
MD5 SHA1 SHA512

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Entities
Size 68KB
SHA256 e91f285f9a6ebf6d7f719511ccc2bafc013e78e013f2e5292f1dfb5f319e38be
MD5 962d5ead34b6e908df09c2e4ca58adb9
SHA1 855cbff7a53f14b1bb24f10b2fa84497743b6788
SHA512 e85312db7a45fc93fede09089f3e54b69b6ed66a2bfb1d844682eb4db7766122f462787975954e7cdd0b00856802e7c4758682a134a684f9a6f6ac4c7ef6c288
SSDEEP 1536:JzG1p1W8Y2VMwe6NvUT+5Z9jt1ZvPsj/jin:xGr1Wr2tUKnjOK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
MD5 SHA1 SHA512 SSDEEP

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\Social
Size 35B
SHA256 decde67630f29fc003cb1f2ccbd7371a05079985a9cce93ec93c4fadd8dc5541
MD5 976b1cf7e3442f88cd8ba26d3f0965bb
SHA1 b75438dc71de4ac761d94a215ddbffadcd1225b0
SHA512 d0472fed72e1eb0a7747a693a0e654fbe92dd028db3cc42377810d90474dd4099ac981cca333eb52c18e75ed04a1f1f79f3bf5957fe8b16086f1252b3454b8d5
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Advertising
Size 34KB
SHA256 7f38f6317cad0e146ce1c738d42859d5a05f363694efa73566f30500a0c30cb6
MD5 08e4cf6a5f748598e307cc4902641947
SHA1 76fd8746e074e4d3cf61caacd557e9f91fd62241
SHA512 88301aea28677227a59363f819bcb2e0e0fef3fee90446e7059eb5894d8ad3d6bd73e4ca7e78b2f8734f8e3f620dd06768ad4447bafcfd69a01e0fff5a87a2ec
SSDEEP 768:khqsnQkzHQmLwSKFVFAK71UZzxQl8cj7VFIDua1QB9AIL:khdbzRL9Kbr7mV/cj7sDpC9AQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Analytics
Size 2KB
SHA256 99368fa54c7ef3001d65b4d97e27a936af3fb51680afd4aeb3c0f81ba54694c4
MD5 e0a604421dfd8b86c5819f57286adbe2
SHA1 8f341cf6c171fa72e529c223f1d2107c43340b7b
SHA512 9647c9b0bbe38d4bef466748a44103327058de3a0377ba5762dba726fb0a1a4a2f370c6e9c2dc142980f6ad23632b0e1e2d73c2e3a4d566bf3be3437482a0fa1
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Content
Size 333B
SHA256 0d0259d74caf490948f4e56f1ea642eba2c92c69d0857042e0380cdf1031bea6
MD5 64d6841059e14a44c990b600b5e6ab22
SHA1 b79037e068652b291dfe26ae4471624456dfca4d
SHA512 c16ae58d41bfe79ee8463e0fe6c6b5aed1b9bd6c0ed66a174f8362868bc23687908869486e6e4e1c1708944bf26ec319a3c71633a08ab7bed7153baa1c5f8baf
MD5 SHA1 SHA512

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Entities
Size 77KB
SHA256 496457021b5c664d5fa5467db91faa217d9fd9d2766d315a9556dff789bd0b0a
MD5 ad8c9ed74c385a83305ee65e6de325f4
SHA1 ef5d6b9a1a896364de714f9a50dfd528bcedcbf0
SHA512 3ad390247905a33f6821ff23d1d3b2784834e4faabced316572ed0f354baba0677b822376a87100c7bdf5497c292ea9392087b32aaff5e60559233f585671420
SSDEEP 768:f/B5hYS0XVXqIIKK4R0+BCBEDDglGmgEUwa77mQiHq7nYNO0PXai1sPkgmBPiaUg:nr6IKfhYOYG977YiivPUwE21r44Ayj1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Fingerprinting
Size 629B
SHA256 e8515d60ed34bc9af7163ca37e56592e0d55c4836d18655bc6b1af4d1563f846
MD5 ac6de6213f3998cf682f5da3aa89141b
SHA1 44df48991113f95f1465f5a8b5f3c9c48626e5d8
SHA512 db156599dcb182802c12d7ee8b3c4d6cf71eb6071b1baf11720b21cc41dc955d3b7daf6662bead44c1a1f181053c67225f47d15c0bfc76840487c94f105dfdac
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Other
Size 178B
SHA256 018019380bfa269c9518207321c6ee0f1060bd003576746689f0b98c184c465f
MD5 d48e676110e2ac48791cbdac0c219bee
SHA1 625e1ea8c98427fb62e13e98ba8202bbbaf018f1
SHA512 db180e5bcfc35b1fd47595c84145a171c10c8dfc26cdda99f969b8cc161f80376b48c0d2e676b1bbdfd6ea341849ead1903010589441fa320ec9b8f1a1b356d2
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Social
Size 3KB
SHA256 2a249b02231fa3f6eb88fbaf1559181a8ad1a10d05294df9a8bf76315c96f709
MD5 8ed8f168d6e3e9624b3d8c341b4d72c8
SHA1 76beeb165dd9c05ec3201b80a582823ab91c3006
SHA512 9f641c9a79c24c07bea06f42a20069cafb7cd415dbafbec7611cf5591ea4f08ad0ccfa772d1a400f26551f82be6e34ace94e97303df63f4108d12dd61319c52b
MD5 SHA1 SHA512

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\Sigma\Staging
Size 12KB
SHA256 5e009ff550b17b61f4e7482898a85e32e65986d29f99d10d70e7cfa56435b2ce
MD5 b939a3ed264d0cb7d0cf8dac1b491d76
SHA1 e846c33095eca6e77fe2c8a8256f33726b09c512
SHA512 4e7846a722fed03690b7de63355426f53e5a6210b5cd1f0e0bf4aa2b94ef0c0e25c93c6833431c7dc4706f0ef7447212a08890633b694b2f40436a6068453e91
SSDEEP 192:7iRh7cFJvMpmXVSayrdrHQlFLSk80x2f0kZUzBJXXAMUc4Ze:7+h7cvMAVgV03M7ZUV9XxMe
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.31\manifest.fingerprint
Size 66B
SHA256 fbb910dde8d642f200a0072ee6e41469b30a60c3626cd7f9e7bda923765d5d3d
MD5 fc5f70b06c29e57443b88040ee46487a
SHA1 6aa7c04b0a9dbb19869c8079a6b07e677d5c2739
SHA512 1b9414fb3d6035c75ad7d24d8940c57ee27a47d70842b389252016dfadb08c537f9673891c76d33817ae9da16f9152eed536967a4dce9cfd09958a96d05e592e
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
Size 8KB
SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
MD5 80068ae175438916aff814972b76e6f6
SHA1 39336911d02ae3c5b038aa31c73c4757dcfadab6
SHA512 7cd55dc8c37fbaf9675d08fd2346ee45721338e1e70cf6aa351e54b45630ada5ada1243d738742cbda258c830e25ee8e09f57fc3cf21948e62c3c552ba9cd18d
SSDEEP 192:uNtGbRmmhGfHPJyR9Pm4lOvMwkoR9PuGMXcy:Ohm+0KjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3187d1de0399068acb613f3481eee314ee42a60fd4a1cf8dcbc5061e1a096e55
MD5 a6d4c11485c8967a186a10d34847d38b
SHA1 a50f36e5c0f7cacc2aeea277a7ab5dc4f9aee049
SHA512 6ead75e11502788bbc8eef8d23726c1f7214a53d5feab3ab4f2f7918343faeef32b379c6cd6c5455957a5e47b7b05f41f9049a37dddb739f2a0e8e12bacb5cc9
MD5 SHA1 SHA512

Submit Download

ae7d7cdc-707c-4fb4-96f9-e4f1fe6c7032.tmp

Path C:\Users\Admin\AppData\Local\Temp\ae7d7cdc-707c-4fb4-96f9-e4f1fe6c7032.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

ddf85418-d289-43be-b329-9e898fe4f290.tmp

Path C:\Users\Admin\AppData\Local\Temp\ddf85418-d289-43be-b329-9e898fe4f290.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fb2d699f-3d66-4652-8fee-5af622db6275.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir552_727324316\fb2d699f-3d66-4652-8fee-5af622db6275.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

MarsStealer_Menu.exe

Path C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\MarsStealer_Menu.exe
Size 3KB
SHA256 e506ea953b9f457490a0db0cccf16a6b9c1f159da5769853a6eb20e2d3d542d7
MD5 8abb41f6e7010d70c90f65fd9a740faa
SHA1 dd71a776e790e437eb8da082c663eb824db34651
SHA512 c62977defea808e10bd7923acbf595e14526f09ffbacc20c9042f11a0762acea25c19e32f4d10d6e0124c59d67b4ff274f9310fbf4669d30ef2a90707557659e
MD5 SHA1 SHA512

Submit Download

Mars_Stealer_cracked_by_LLCPPC.exe

Path C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\Mars_Stealer_cracked_by_LLCPPC.exe
Size 93KB
SHA256 9ee5f68ca23f797de0d152e7b782832414f43ce8ea9e1578c870680aeac8930d
MD5 4d7949f6f4aa10120eae24df5323ec94
SHA1 9fd5489c207ffd9698348e73200ad87bcd99475f
SHA512 afabfcc3c8ee774b1d35078d2ef1b7624232be9af068fe3ae5ad7036769eacbab4aeb32f0a54393a0842f190f5e5187fe5d68f9aefb4e6ff94ed98129b2eff29
SSDEEP 1536:gWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUn3jy0:gWTHVn8TXvc4O3CFvlaSED1PCj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZU3EUA1V

Path C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\ZU3EUA1V
Size 160KB
SHA256 ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a
MD5 9b85a4b842b758be395bc19aba64799c
SHA1 c32922b745c9cf827e080b09f410b4378560acb3
SHA512 fad80745bb64406d8f2947c1e69817cff57cc504d5a8cdca9e22da50402d27d005988f6759eaa91f1f7616d250772c9f5e4ec2f98ce7264501dd4f436d1665f0
SSDEEP 96:IkBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:IkBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

re.png

Path C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\mars\panel\assets\images\flags\re.png
Size 545B
SHA256 79a39793efbf8217efbbc840e1b2041fe995363a5f12f0c01dd4d1462e5eb842
MD5 c1cf1874c3305e5663547a48f6ad2d8c
SHA1 0f67f12d76a0543772a3259a3b38935381349e01
SHA512 c00e202e083f703e39cafbb86f3e3f6b330359906e3a6c7a6a78364d6adeb489f8b8ab1b2d6a1b8d9ef1a17702cfc8fc17219cf1aae3e5a7c18833f028037843
MD5 SHA1 SHA512

Submit Download

sj.png

Path C:\Users\Admin\Desktop\Win32.MarsStealer\Mars-Stealer-main\mars\panel\assets\images\flags\sj.png
Size 512B
SHA256 f8dc302371c809ebda3e9183c606264601f8dd851d2b1878fd25f0f6abe2988c
MD5 559ce5baaee373db8da150a5066c1062
SHA1 ee80e5f63c986d04f46bff10f639113c88107ced
SHA512 c0ca7595cdd2dcef0385ccb1c0d15bb74accaea63b9531233bddf14c1791ffc9712dff660292706cfa269a975d29d7a189885cd09046ac6d8ed39a57ec9557ca
MD5 SHA1 SHA512

Submit Download

memory/748-13-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/748-11-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2224-2032-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2224-2043-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2672-121-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/6024-1516-0x0000000000400000-0x0000000000403000-memory.dmp

Download