hxxps://github[.]com/ytisf/thezoo

Resubmissions

26/03/2026, 18:52

260326-xjjawagv4t6

26/03/2026, 18:49

26/03/2026, 18:44

26/03/2026, 18:36

26/03/2026, 18:30

26/03/2026, 18:27

Analysis

user interaction
yes
max time kernel
237s
max time network
239s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/03/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ytisf/thezoo
Sample260326-xdvrqagt5v

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
139	raw.githubusercontent.com
62	camo.githubusercontent.com
63	camo.githubusercontent.com
64	camo.githubusercontent.com
65	camo.githubusercontent.com
73	raw.githubusercontent.com
74	raw.githubusercontent.com

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1578709585\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_814371506\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1986630938\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1363280231\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_814371506\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_614048155\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1986630938\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1986630938\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1363280231\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_614048155\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1363280231\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1363280231\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134190243062129876"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{BDA49C33-5493-4422-9493-A0864B06C184}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5360	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5188	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	2792	7zG.exe
Token: 35	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeRestorePrivilege	5324	7zG.exe
Token: 35	5324	7zG.exe
Token: SeSecurityPrivilege	5324	7zG.exe
Token: SeSecurityPrivilege	5324	7zG.exe
Token: SeRestorePrivilege	6088	7zG.exe
Token: 35	6088	7zG.exe
Token: SeSecurityPrivilege	6088	7zG.exe
Token: SeSecurityPrivilege	6088	7zG.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
2792	7zG.exe
5324	7zG.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
6088	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe
5188	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1332	3140	msedge.exe	87
PID 3140 wrote to memory of 2988	3140	msedge.exe	88
PID 3140 wrote to memory of 4824	3140	msedge.exe	89
PID 3140 wrote to memory of 4824	3140	msedge.exe	89
PID 3140 wrote to memory of 4824	3140	msedge.exe	89
PID 3140 wrote to memory of 3860	3140	msedge.exe	90
PID 3140 wrote to memory of 3860	3140	msedge.exe	90
PID 3140 wrote to memory of 4532	3140	msedge.exe	92
PID 3140 wrote to memory of 4532	3140	msedge.exe	92
PID 3140 wrote to memory of 4532	3140	msedge.exe	92
PID 3140 wrote to memory of 552	3140	msedge.exe	93
PID 3140 wrote to memory of 552	3140	msedge.exe	93
PID 3140 wrote to memory of 552	3140	msedge.exe	93
PID 3140 wrote to memory of 1156	3140	msedge.exe	94
PID 3140 wrote to memory of 1156	3140	msedge.exe	94
PID 3140 wrote to memory of 1156	3140	msedge.exe	94
PID 3140 wrote to memory of 4324	3140	msedge.exe	95
PID 3140 wrote to memory of 4324	3140	msedge.exe	95
PID 3140 wrote to memory of 4324	3140	msedge.exe	95
PID 3140 wrote to memory of 2884	3140	msedge.exe	98
PID 3140 wrote to memory of 2884	3140	msedge.exe	98
PID 3140 wrote to memory of 3156	3140	msedge.exe	100
PID 3140 wrote to memory of 3156	3140	msedge.exe	100
PID 3140 wrote to memory of 544	3140	msedge.exe	101
PID 3140 wrote to memory of 8	3140	msedge.exe	102
PID 3140 wrote to memory of 544	3140	msedge.exe	101
PID 3140 wrote to memory of 8	3140	msedge.exe	102
PID 3140 wrote to memory of 1704	3140	msedge.exe	104
PID 3140 wrote to memory of 4464	3140	msedge.exe	105
PID 3140 wrote to memory of 4464	3140	msedge.exe	105
PID 3140 wrote to memory of 3040	3140	msedge.exe	106
PID 3140 wrote to memory of 3040	3140	msedge.exe	106
PID 3140 wrote to memory of 4248	3140	msedge.exe	107
PID 3140 wrote to memory of 4248	3140	msedge.exe	107
PID 3140 wrote to memory of 856	3140	msedge.exe	108
PID 3140 wrote to memory of 856	3140	msedge.exe	108
PID 3140 wrote to memory of 328	3140	msedge.exe	109
PID 3140 wrote to memory of 328	3140	msedge.exe	109
PID 3140 wrote to memory of 5836	3140	msedge.exe	125
PID 3140 wrote to memory of 5844	3140	msedge.exe	126
PID 3140 wrote to memory of 5852	3140	msedge.exe	127
PID 3140 wrote to memory of 6140	3140	msedge.exe	129
PID 3140 wrote to memory of 6140	3140	msedge.exe	129
PID 3140 wrote to memory of 1768	3140	msedge.exe	130
PID 3140 wrote to memory of 1768	3140	msedge.exe	130
PID 3140 wrote to memory of 1768	3140	msedge.exe	130
PID 3140 wrote to memory of 2884	3140	msedge.exe	131
PID 3140 wrote to memory of 5420	3140	msedge.exe	135
PID 3140 wrote to memory of 5420	3140	msedge.exe	135
PID 3140 wrote to memory of 5816	3140	msedge.exe	141
PID 3140 wrote to memory of 5816	3140	msedge.exe	141
PID 3140 wrote to memory of 5972	3140	msedge.exe	142
PID 3140 wrote to memory of 5972	3140	msedge.exe	142
PID 3140 wrote to memory of 5972	3140	msedge.exe	142
PID 3140 wrote to memory of 5852	3140	msedge.exe	143
PID 3140 wrote to memory of 6100	3140	msedge.exe	145
PID 3140 wrote to memory of 6100	3140	msedge.exe	145
PID 5188 wrote to memory of 5360	5188	OpenWith.exe	147
PID 3140 wrote to memory of 4748	3140	msedge.exe	148
PID 3140 wrote to memory of 4748	3140	msedge.exe	148
PID 3140 wrote to memory of 4748	3140	msedge.exe	148
PID 3140 wrote to memory of 5664	3140	msedge.exe	149
PID 3140 wrote to memory of 5664	3140	msedge.exe	149
PID 3140 wrote to memory of 4188	3140	msedge.exe	150

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/thezoo
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffedee2c188,0x7ffedee2c194,0x7ffedee2c1a0
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,4096420217539937966,17331870740797276131,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4572640442797252274,18015116041041578598,262144 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,8016364008714853317,10105620387245584450,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17498579935915690255,17102707907514531170,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,9212020895633051578,1005576581915085782,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,11028774459103344715,2261665477027154884,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,15672920512604220292,9275555708071102450,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17556108514727132432,742509607706686611,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,3747316009011252505,932176792247250256,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,12243920216631711501,9570070395245686922,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,7605655580072144987,10597709080746664813,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,925791434655819125,15682653504674513840,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,925791434655819125,15682653504674513840,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10579126984591673811,17592791254453313200,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11965899508925348351,4907284842354213045,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14269024278821358596,9434516493412794550,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1780048833396020487,4488413753174959387,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7824553181845624913,13494465878204381223,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,18174207895958243660,4329737321201568636,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3225067958370013556,10145314997406917647,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,9704978259859847376,14217621227991964079,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,1120488215657030770,11844528383947986429,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5164,i,4211563657223587735,13429544031440676583,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,4252318405966848417,8091064917032578523,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,18187782956463285932,2885628684926605108,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,6776659396654443217,7218029332398457701,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5720,i,7944255599787871059,17861724591192506487,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13883485043244496227,17509492753251530841,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,12345060814829880239,15226984260489723338,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5936,i,9234837661511176518,12491906003967760056,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,15057268333005675958,1248258041621455584,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=4364,i,13105820381405778173,18120719595995524198,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6264,i,11862957846310212622,3974408730563623343,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6616,i,17894514211769621753,149352813948399007,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7324,i,5050357499406384400,17487560441717487296,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7160,i,7199756912343738293,11956029630585211764,262144 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,2747881034221259581,13405131150766016863,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,2189930994413889854,10062685963341108950,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,2102254379982705405,15604508155919664314,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8449147007645993009,10138306902051233347,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,7785155619297274150,12496141284927035258,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,1911566446005693134,1855985941978016293,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7204,i,15154107711814018408,14525519851999359038,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7540,i,16574520265626859733,14227285254774602211,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7656,i,7866094136858337862,499288134319539127,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6564,i,17644394086554436738,6000608674845771248,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7832,i,10195733806276560359,13555960988313326034,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8124,i,10588021578417650716,18079698306283208500,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8256,i,5083119756710409524,2420068747102758468,2097152 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,17709892209522421559,5352932606679099037,524288 --field-trial-handle=2396,i,724799898060526579,16947524597669218794,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:8
  2⤵
  PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1780

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Trojan.Ransom.Petya\" -spe -an -ai#7zMap29146:100:7zEvent19999
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Trojan.Ransom.Petya\" -an -ai#7zMap31431:222:7zEvent17265
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5324

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Petya\" -spe -an -ai#7zMap30072:94:7zEvent10422
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Ransomware.Petya\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5360

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1363280231\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1508754025\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1578709585\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_1986630938\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_293879067\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_614048155\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3140_814371506\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1da12a90f1238cd16c8a19ab9caf4f7a7d72ce5475628f16ba1a651cb0737842
MD5 6b9f6da3db6c132cd3254de14bbbd7f5
SHA1 81571888b2f8040a496e2dfd03faebd67cebe234
SHA512 4395aa4c37c404e97b2917f68da50d0feae134c5ee185b0fdd08f4b347f0e7ab7f9fdae407cd9cac78805c020d76133aac459ed6434e1377a99e0fc25b7e5639
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7k:fwUQC5VwBIiElEd2K57P7k
TLSH
T1FDB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2118f3debea8e2640977d8aaf949f09ebd1208d30ba20757560f958087279634
MD5 8d9c606cac641db39043b73620b9af30
SHA1 5641a30c54a84af71f1a3aab03ca11b81a4d3457
SHA512 e3db3c84d1a85989aeb2ab3f1c4235705e72fc3ef797e27988b927948b985b91f9a11ed453d521868095f672866c1590fad569dfc486201d39a6df77306d4a6d
TLSH
T13ED0C04810711C30D09D90734C4977873408C9538C4357321073386C0C030601685187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5cc77a69e2933d0235ac8a539206200c479816f5bda04a32fda5a396eed16f10
MD5 1c0c83b8e90dc2addc52496554af3ff3
SHA1 d51d2e4f19bae4673952b8a9a969fbf594f3b774
SHA512 8953275d791ff6c9f0be1af08ed082a774a4afed8467fd458e4c175381ed8191baebfe40ebe8844eaf7a7054a60441da2d5759499d2bd067a8d0315d8593071f
TLSH
T1F3D0C04810B11C30D49D90734C4877873408C9538C4397331073386C0C030A01685187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 66KB
SHA256 7dd065d75dc51fab7ff1b6bb0ed2c1759274472a900edddba7b9554d5931b08f
MD5 3cb0fa2bde091187e777e6ee14f6f2e3
SHA1 6c7ea6198e5f9f6a02a958e236c4a915025a1a7b
SHA512 9303ef6497a401c07180fe366dd79a775d4b977c31bdedf7799694b755e9bd90749ca3d12d49c6759c2649b5d219c115d247ab70917ffa9159fba4314f353989
SSDEEP 1536:VXjWmU173cC8thnUX/ykMgmf3Wq/0iuXopbWmEJnrH9dkE:VRgTl2hnM/gg4Wq/0iXImEJj9dX
TLSH
T11A6302A6F04FF5B7D10023EE5243C862A9E7D7E8E6260979D7B00755871674FCC12BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 403KB
SHA256 f8661998515e7fab7c398e5a3f1146c34e6cd55bf046de3338f6c9eb8c53a6b3
MD5 79be7ac403ce649b9e003015f4c57c90
SHA1 3cc535c36af52322b636aa6e59b5dd72514bafdf
SHA512 5cea8c92a7417e15edb1c7d928198408882f51f394837b3f04b516f7c9061963237cd62fdf63739bf18c01d5b4f14a911528fd0c5e8e3b7702f1675c4d64b2bb
SSDEEP 12288:sW8oHjhJcFc0+OiXqwIih60VvU565eO/ddI:sWTjhJYF+PXqwI+VXv/w
TLSH
T1DC9423E5921CB232C40A581C76273EF35972799F62D173A935A59FA844F854B2C3FC02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 16KB
SHA256 d6f39907d582d32a6feb49321985c452ca295524bb1cbeeecbcf41654211fe83
MD5 527787e4b92ea1eecf3d875755f003b1
SHA1 8c17ed0f1b0ab961c2e12dea1d290b538b393f16
SHA512 d70cca76a087fd5a8288126f1b23320fc033339fd9e5872cef522ec393191639039182cf4d8226b3e47a476ca5b2a884860c27310c012e2e7c78e673e1baf3eb
SSDEEP 384:A0Bp8CPSkw6ughnWc1BEKYVbzfDsBrzDwXmie3VQ1X6e/L4:AWpD5ughnRBwBzf7XZ6UqeT4
TLSH
T1C272C0958ED0070D4CC07C2EA43A9D8880696039F695F5562F28E55EEE76205CF7EF86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 77KB
SHA256 9b5f18ea57919ca27a021dd5fd6f7c77febdc4ff3077579e2f685a5f111fd397
MD5 69bca165562949447b4e73f5a5a40cd3
SHA1 1b7a9f96173b37c11884e7ea60818537f0bcbb20
SHA512 c93fbf676dc24f427461976ef8474174de4c72fb2593903f919fa02dd6dce448de78af35631b148311c669443b01d907cf75059889b56987bb531b3bdc460cd1
SSDEEP 1536:frvWlk6q/Kfht5/nNI2a8Pbm3biXYKlaiSthfDha1pxZ2XJ6Oyw2DQtOj:frvpz6hPNrA0TGbfDMpHIJ6OiQt2
TLSH
T1EA7302658C8999F1BCC16B12A307E2A1E5634E6D0D7DC524A3A83FA67EF3151CD4C21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 78KB
SHA256 87f0d4a53dc62a7f19ce9ad3525738bbec696263f64449899dd8b63d4c315621
MD5 2a813eed090eb1a21a62a841ed91c4aa
SHA1 39cefb1a083dd4413c7d944b34bf59708987298f
SHA512 e804cd9e8557c4d25a80b7c73105d36cabafe670f71bf74599d06496b3f9dc6932ab87388a31a432508c0418861216a6e9c4574078d55b7a9306b8a83696d598
SSDEEP 1536:MvxvqW6SMmN0C8w0X/qUgO3ra14vueEsPLXgr5OqZBl0MIMnk5xA3D+b:ql2CkXcSrA4vHE2LXgr5OqZB+M0IDo
TLSH
T14773124A41BFD161AEA8FD887BDD30A96A27394C8FE2C447AC9D134D4EC5E3D16C3189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 20KB
SHA256 f812e04bc135c778560dff8344d15bf4d3ffe6fcd69ebfc7445f179747ee2ba7
MD5 30c47bda8aee7ca861482e06fe6fe702
SHA1 1fc8c6ad8a1c8c38bc5c287fe2904465a14c0cdb
SHA512 06ccf6708d6ec21c3534bbe9f5d73a1d220597cde312da5c2d52b4d8ce132344f3f36540eda9d2ca27b271716ad70f5f3d9f753926c9f7d76f083f9401f7c0dd
SSDEEP 384:ZPOTklaqhgOhqM8vVUdl6HhipyaCkzWrf3VETbSY6laVLL7QjPJ+exm3:ZWT3whz6Wdl6ECkzWr/VETbSlsp3WJ+N
TLSH
T17FA2E0699ACE979B686244021F72D6F13A7F675048CCB3D4A1E0B1AE6645301DCF2F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 18KB
SHA256 f7f97b8bac398b9fd626a3190cc2a83b9b8ce4c178eb76cdeb71fa3062dffd34
MD5 8a81d6af207e0b59d353401108936122
SHA1 f45d893d4bb07e44d0d9ce5a5ad094b46903d5a3
SHA512 ff601f1e50e283d2b483416e48bc29bc46cb98dc2f8b1b09cc22a84b1bdfd7e71c48077b6f800ac4449420a06c3b224c24ed694534028bce15c444ccb00e6e6f
SSDEEP 384:6HoLfTl0C9dBGqKYxbBlmCUkkFzs2zq8qKDb1oMVPLUpJhpiDPm9IDNCg02:6HoH6CrBCYntYsqq8rxoiLmJhpizQgD
TLSH
T10782D051863E4746F20849631651436BBA79EADF836329A428CAC3190D0BDB9582FF8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 55KB
SHA256 d7c4f4f448a5886c864d529f40e419816cf467ffce3a27bb8da6cc4a5586c127
MD5 fd70889ac424c093111488790713d2b3
SHA1 c51855bfa1d9d6862fdfd9e3f7a1f3a9e9ebbecb
SHA512 a57e696a6aa02467651aaf6d1cb45747c2bdeea3a90c2447e4bbf09886e5150c11cbe08052a09b09318967fd7f019593307215de418e93333552caded7c50a14
SSDEEP 1536:GbH40pGzH/ItEXmIX9OHM6+gJWTzXyTRH:88/XXmI6QziRH
TLSH
T11043029243F98775155DC35897A0729FBFF18DE8E2013EB5A5283EAAE10E714108EB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 71KB
SHA256 f871c977e6863c557e5bc906041359cdeb45b457d6168bc16f19135e19d7adba
MD5 4914df7765b4a449c7711f0cddb3023c
SHA1 a821d00416f0ffe6755a2a8b1d2146da90100d8a
SHA512 4639a40a9235e0a74061bf4220e7fbfc32aa33f4cee625492758729d033bda5e1fa61ff5319fded63124359bf443b798bdccbc4127cda36b4a359ae93ef923d9
SSDEEP 1536:ZXpTMYEQvh8cHnwHSrOkT5R4KsAYa9niox9v5UKL+L:ZXpT/Hvh8cQyrOm5R4KsAYIig9v5Lg
TLSH
T14163125B09805A813E274FE2F7F713BC735764622EEA57EA381AB604176C117D727C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 20KB
SHA256 d6f3283f9be9fbc1a8a7cd65cbb69527e8bf1f0c37407341ae01f912298c2dec
MD5 94c0300d1398ed6065504b90c650f9dd
SHA1 ea4ede31f4df7ab890803fce00ce7d5c7ec316f2
SHA512 821f1c7d0a7011c4e323143152a0b5ff9cee8502dc02585aa685036afb70805fe4f8f2839e1af7366a81db179cc39360ae68870c96dab9af67dacf408db6ab05
SSDEEP 384:kgvXvQfMJ9yXZIOvUevTfQkzT8+aFNq51Z8M1+oaOmn4f/MSdisLoPcb2lL3Px3h:kIoy9yXZZvLhP6NaEm+oaHn4nMSdW2yD
TLSH
T18892E0016FD92213D2C71DF3D1ECAB809C4ED16AF15242776FC905ABA9EF212967E112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 68KB
SHA256 0ede23ec4c87abf61c5dffe073f0f6103fcbf5b0b19c1050b578c8099e63277d
MD5 4c3f40c28f637e2161de88ee2052258d
SHA1 a31d4ccd08fe0e77491f9f057f87edb061c8aa67
SHA512 545404558b00c9f3408b6983c7a37eb955a9c3edcdb64abf6f0500fe34775c69046aec7d2e484fea8003be535bbf85bf7486a04b3b051cb3d08a16258b9bf2db
SSDEEP 1536:GZxK/Uf76Z+AGYguWv0Kxwhne2y4Y1RL3h68zPGEHa:6U/X9GjuW8Kxwhnez4Y1Fcs+E6
TLSH
T1AB630211D69BD7593F905876FE4CB271CCC52891C1072F992E7B969D0F5242398D83CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 38KB
SHA256 249c769ce48082cf09ccff08c29d4f34315aa2100dc1cda624aebdcc1eff7cf4
MD5 65905191d17aba7e52d1e7adf0224727
SHA1 7d985b867ea7956d983343df51743e3501245fd3
SHA512 75f2f0db3edf107046102e3c87f263b1ab9550e4eaa869fcfeb74e48b30c3be0d903970514976868787999d12e0ec5ca253db453cac125e030d3f76f5b488def
SSDEEP 768:IBU1R3UwnRkV0VBY3eMErqFmU4We2v86w8f5Hsst2sK/wpptw:IB0Rj60b2e24be8b8BHsstlFp0
TLSH
T10503F15BFF5B7BD0F340591D333A8F4A622511A14A764B103CBCEED9C653E31EA99029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f6
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 5c6b59de38e90f1412b8cdc14c5a3b5cdb54bb352d4aae3966976e67994abbfd
MD5 3c808afc75b39733822e0853587f656b
SHA1 c68e63fee647987b5fb460026bafb8d23eb04780
SHA512 f972d64ba3611ac013e1e57be3a09e96bb990d1fbfe12d35710d6faa5f0adae8cc5a9a423aa9f7bb6782603a77933cce69555d09c521e149ba778894219a6984
SSDEEP 192:++ipqTXNq25wdkYMsaX93R4cCi2NsGzqOIwUnHU55IJ9HydA2uvSTIM6CL7HxRUw:++ipqTXNq25wdkYMsaN3R4cCi2NsGzh7
TLSH
T176F1625897526018EBE10AB4A2E36C317E7AA824634F3E9D71FC04BC0919FCE2970B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 7eeeb150e845fcb52444c1da04af5cb64d1df07cb1e2446b63978f9e4157dfdd
MD5 9e4a888a89a56f1807d73e3a4457daed
SHA1 84285b180473b21359aed874bdd2cc79cf8c0312
SHA512 01f1b7b1a7ddc0eb8b413b8b69f8201e808ceb4d1805583845a5e82b267f6463fe1cc01b94d4b7b2e0cc0edd4354ac8dfd890082c4238ac3b744391bb4285c72
SSDEEP 192:JCzipddZ/ZL57EpYFhUogs2yzQTIMtNBWjH2GroXLeS2MjT75qqXC+c4NY2cwVnV:JCzipddZ/ZL5sYFhUogs2y0TIMtNBWj0
TLSH
T1EB32D848A6419018DBE50AB061E36D313E76B8245B4B7F8976FF10FCD50EECE2932B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588e22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588e22.TMP
Size 3KB
SHA256 b27b0f054bba3fcabbea4e0d422924abbb8e65de7a9b3b1c1d18c02a81e64d81
MD5 8c7a4f2bd7f64f001a4d8523efeb60d9
SHA1 965bd2f907b8d635efcc1beb6626d3e7d73891ad
SHA512 76880c7748ed56f7f380592f6582b09b02535efe1e72396c48d45b3e26f82c449cf63f5f95d2d5c22253804cba843637e16ef6ffe2284c98d8d07aa16d119e8a
TLSH
T1BE61075CE3A2801CEFE583F0A5E7145573B9C93873430F25B6DD657C1A16BD24A80B07
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 462e4e3fd6052f0335a890a6dd65c175caf617332510572603e797a080b0ddb4
MD5 ea35ac43959c64ca9ae8c56072c73a96
SHA1 60f9d7d22fa53bec737ae86b5a656c5ea463a260
SHA512 c21c70f68514667fb99484930ae15222d7a7a37ba85fc3066f54f77e23bfe5abbae48aaf4a7eb32a16b5f9921089902a7ef941f5d1665db0bb3c3351b68886b5
TLSH
T198617BF783E5856E9A1255F0AA18AE2BCE2C0510831C3C6A89E4AE5BD3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 69e4a130bc6f9fa85690d1f31a6e5fd0fb856e7320344f0c69fc8a58d93f3d4e
MD5 3e3a16cbe9d78f5560d93d5f16ee0853
SHA1 b7e1aba20bccf185f8bddcd6b898aca99d0aacca
SHA512 ac437f2a044ebbde618eaf579a4c36d357be14662ad2c553e2c9fdbfed6c8af157f6e8fd17e899567aa278bb0cc718166a0b83435e518cb1fb6caa2095037a7e
TLSH
T1B1618CF783E5856E9B1255F0BA18AE2BCE2C0510831C3C6A89E4BE5BD3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 44501f02b3ef2538738e6eace5a96942d712609be112f35e0a17a8906993e620
MD5 03fbc63bebab5ff6aaff7807202bc9c5
SHA1 7c58ffe4e611b034657a3683708a7eb365500658
SHA512 79d95bf28924291f98cc03663d313e51ee940b1bf3c73e4cf10f3a7328d44256bed839d9a76c749190036cea6adb4d0688fc32347bcdacde38e1d98b691d185e
SSDEEP 192:DxbPm4ANbgNCt2sam9kj6VimrmymDmtmDmgjOxjc7g57mzxm0tyTGXVovgx:DxTm4ANbgNCt2sam9kGVimrmymDmtmD/
TLSH
T12EE1BEF783F5862DDA1195F0AA18AF1FCE2C0551436C3D5A85E46E0BA3F2871E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 926cbc7c6fc98a0c74bad35b5175c8d6e49aa57d609026e9db9805b053d01b96
MD5 720be4ac82001a066d4e7d70d5311280
SHA1 73fe892f6ce713e6cf81c420423769a83725941d
SHA512 6a2280211df8e7d983bb667cf955613ceced6f50b8b4a243b185f57e5a163906966dc131c71b5a804cdab88cc814b8643e1bd3bfdc91c4c349ac3de3fe93408f
SSDEEP 384:DxTm4ANbgNCE8Nk2JaeTnR9aoKr2samdimrmymDmtmDmgjOxjc7g57mzxm0tyTGW:APw1qji8i8Bok7lo
TLSH
T10462AFFBC3E4862DD91251F1AA18BF1BCE2D0555436C3C1A89E4AF4BA3F1871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 afa175dca062388c26b6a9b40a2900d782bd6d58a9772411242aeef283b41942
MD5 7f2caaf366587243c7e08467a5ae9b9d
SHA1 9d533b96fc7990173aac57673a751c3964ad48e2
SHA512 0771a0d774b98d79564a4141d26cf8ab1c97d5c555f5f43bc2db29e2899e214e02972f920494178ccd4b675f5f66672966b9f7d7d04741f025757c6d3fd89e4b
TLSH
T19AD022A33348B1F4A56CAED682AEFD8EC33640280883F9D612E0B8AC093247D2707340
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a0011.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a0011.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d7668d94e4cd4364362a7c744ed4fa26b851dfadd507462652edd5c2e6936a3
MD5 d7cf0101dbedfbfc3a85884779ff3d63
SHA1 7490c56403822ddbab04f93551f56a9738866b22
SHA512 8b12b55968fb155381106e14902884df5daf130a591320289156f5485eb1b572338a735b74577091dd790109bc98c1a6f496fb40eb6e126e24c20e65029c7bcc
SSDEEP 192:sxZ2kRFyM//K1Ml8Mki/f0sA8o27TE+65Idp976HW6+WNYUI//YBk8ZCZBIg4J:sxZLdMi/f0sVo256S4Hb4/Fc
TLSH
T18952F9166A386977CCCBD209BA45BF53D7F51462D1811E58AEFC8A0C04E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 08aa1a10e04dc2699c19c2e25ad10570d8d9fe47a04155a47b09b5a475e6ac42
MD5 36d458849732bb49f70bc9b9af803122
SHA1 18cdc58e9975db6aa54e1d21ea43b16f69198151
SHA512 b0f83c517a0369aff34f2aee1747d6d7c4577ba26782ae6b88f105a1b7cc9ca0e78fccb5dd9b248d2a51763a914c3e8080c2d08a20fd844d535b30722e5f432a
SSDEEP 384:sxZLfsm4i/f0s7oz465b2fHb7Lt/oAPW7Di07oO:sz0m4i/fDozv5GHbZ3Mi07oO
TLSH
T17D92F85669249977CCCBC509B925BF53E7F40026CD910E9CAAFCCD0C04EA6FE620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51d54627c1de0da1d55ebf7f90b89dfa7418e62b2932b4a2670fcc86c81f60c4
MD5 d7fb48e45f29e6a7533cc1b0d1a87778
SHA1 b8b052dd6872b910f50ac712036cd18979ffae91
SHA512 feaa9170f46afcad1cdc2cc8beb7131b3b0bdf4111777e2bb7abf530633a738da6888e5d3837235d54f9f38df7a526d6ffc8f2a97700f7b53524a148643f3989
SSDEEP 192:sxZ2kRFyM//K1Ml8Mki/f0sO8o27TE+65Idp976HW6+WNYUI//YBk8Z4ZBIg5fJ:sxZLfMi/f0s7o256S4Hb4/xX
TLSH
T12662F9166A386977CCCFD209BA45BF53D7F51462D1811E58AEFC8A0C04E6BED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 0ff9ca5df6ead62a81f36e9b636ed5a107dac9e785e60af6cb311b46990d4804
MD5 379c330002167e466fd3385c39b2d85d
SHA1 4da11b216088beeae28c331f3d4a26b188bc0d85
SHA512 1d785cee6cf6b2024664b78effafb1966b8d3e80030762b86f30e4cb3f0bc54f7ad7e4d68c93e88b5b34904e052963659460bb9fd8face6726bb4266cfb8f78e
SSDEEP 384:sxZLfqMm4i/f0s7oz465b2fHb7LtXoAPV7Di07oO:sziMm4i/fDozv5GHbR3Ji07oO
TLSH
T18892F95665249977CCCBC509B925BF53E7F40426CD910E9CAAFCCD0C04E66FE620382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7b3778a49a3e6ee09ab81feaecb85f4ee5d5cda7439918d6c44d823beca9061c
MD5 671716d3e87c43be664845b529aaf31d
SHA1 40eee81784f123e93cf5f5ebcec88aabd3a1e316
SHA512 d25e70d562064f9cf650ac3f0e5b2cda4717aaeac8d095e68ff98cd519acdfb69d2406a34286dcea91d47b61ed8a07959a049f649be5248704eedc71e0f96cd3
SSDEEP 192:sxZ2kRFyM//K1Ml8M9i/f0sO8oz7TE+65Idp976HW6+WNYC5ZYfZk4KZBIg5MJ:sxZLf1i/f0s7oz56S4HbvZbu
TLSH
T1C662F9166A38697BCDDBD209BA45BF53E7F51426D1811E489EFC8A0C00E6BED630381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7c0a7412cf0640d8d5d0d5659b394e43f789ccc1e646150297fc0e4b0c853785
MD5 213850dae618339f82138a35a0e1ffea
SHA1 5f728181c24ac3a32b651cba69813a567900b113
SHA512 49f91e25518312b3a1058e670eee639fac10f7925f8e843a89347c2954f8db48d3219c0496db19c4bd5c7c67f16cae9c16a954b6e99f6a796405fcf28e1bbef4
SSDEEP 768:ZFU2JPH7pLuLv7nWvB3u/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYDjsLl4CpROroo:ZFU2JPBEv7nWvB3u/u1jaRDjsLiaRFh2
TLSH
T1E1F20B7B2C4CCB7E4F804E9CEC2ABE9E6DE8018B9698895447F9844C03C66EF55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\38efcfc5-d8cd-4852-9a2f-8087fe5febd5\index-dir\the-real-index
Size 2KB
SHA256 5e13b06c56d2862a8a02e54882a4053233f193d1d4fbe3a25a047ae92e07ff4b
MD5 828f7518e7f1fd35e1d8ca8c94d5d6f8
SHA1 6d31b5b8ec7f5607310625dbe7227a76b376158d
SHA512 0e7e457c2f2081d3334b3d64f72f5f8e23f6dc3d5be7402a17ef63f28c2941262ad1e3735ce3e589a2e38007bf20fe722393f16045faa90d29c737c5956ef1e9
TLSH
T12451C60E9D426323E96C51F208FA048933352DEE13544B136CAC6638A84F2195EA7356
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\38efcfc5-d8cd-4852-9a2f-8087fe5febd5\index-dir\the-real-index
Size 2KB
SHA256 3c0c4ce0330b9cc861be8aa492c4ad38285075a12e52895e45ea841da57bb9b6
MD5 f080759c21f4c871d2dbd4a038be4ce3
SHA1 e275ea868a66f4fc0946f6872f619a316e0d2e87
SHA512 51ec6b4cb74849b8428ab062fd23b4828b14e7827e163367779542d56852f604e7976bacf5cb274c2077e83364bcc68bd5e1d8b8dbc89fc7514ce5a3e3ff5794
TLSH
T1B951E98C9C965A17EDAD42F218F6145833381CEE0B585703BCFC26389C8B2991DAB314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b089.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\38efcfc5-d8cd-4852-9a2f-8087fe5febd5\index-dir\the-real-index~RFe59b089.TMP
Size 2KB
SHA256 8c2ae652eb2f75e0c005b7a9ab9260bcd8e6308df2e515a8b7d1c5b6c8d31ab2
MD5 a939bda3d67075224ca1314881bca8f9
SHA1 b7697d5e70acdba13be7d4c4f2a8e8025be07f2d
SHA512 2da003e867d0f3974c5e669c9deb4ac495760c1b95d6c8d2a3ce2507a5a2fe48c40dd8b885b7c2baf32113863622a06073489c4a23b59366fec1e821af187c38
TLSH
T11351B65E9C824A22CD6040B349CA2468333D78944948AF0734FC8A33ECC77AD3D57345
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 72f34c09da003cf47bf67395024ef9958f45b05432847052c2161e6dcb490243
MD5 1f0baf5961b72a15d7aa4cea033e1ac3
SHA1 63a6cea2799c3977dd399d7ac619c80c061e466d
SHA512 228d7583889f8791112ab9f8833d8a6f9d71ad2e4246a6b6421c66a356c4aff86aa9a7df379625f829303a8ec11de1eaf402d5481c799b08e4c6224b81578a5a
TLSH
T138E0D8BA7FF71C159C6FDBE9283291E4821279248944DC6F246A928714B23553455C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b12ab494424561e285a1e50b9a9efc51adce9f09cda906228df4056d6d2e8482
MD5 bfd57b20662f6c9d28a8ab56342db184
SHA1 5d89910a197f3cc5a02d36c42fb4d2c3e8b32eb9
SHA512 2f50f376f2904c6515e1b96358f129289212f511bd95a21f83d183f8e709356e0663a45d650c3653fe9ed7c39279f6ba990a8aef01469645602782e87021603f
TLSH
T1C9A0021181D6914BC0000674D0C1519832A58E945A053B1940FD0058E854790C56F005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a07b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a07b2.TMP
Size 48B
SHA256 714c34a3d6882be26aa664433e32a8ec6dcafde53b652d145bdb307f699671ba
MD5 1f8a83714b0a9a6bcb22aa5dfbe7d29c
SHA1 a4a10460b989004e5903bc7c6f9ab5ae0c4e9390
SHA512 13bc54e3861bd504a5b48c94e377f644eee5c804cb91dadb1ec0fee9c173a6cb112cde79426b0a6b281ac02f39ef528411de2e9ffd8578c3e2f0b0446b53576d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1ceecf0a7bec45a65f229e69cdd62b5ad4bf2ee706bd269aed4c01f9d27d7dd6
MD5 2ec65675978dd58f3744451d300323aa
SHA1 c33a4572d72ce83dfd17789c59c4ea776e34737a
SHA512 f814229eabb456d0062c22c8beffa4c9d8c6e304fe67a9f777ae06d2d59509101c6f4fc60167a1ce37239a0befd1a7693a36db2c387d5caa80b3eceabdd59f7c
SSDEEP 96:K88gKFGNCAwKh2Wy20KP6oCoK7ayLXqJ1vRhFANU4etFKG0e/Fi3PMND:KMDnf0vLXqJ1vRhuNUBtj0e/c3PMND
TLSH
T1E3E11851717F03803ABE65AE95A5F81F16C231A73068A83B377810A61F67E10EEFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59098b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59098b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 175da2d32c2e7c68dd95d1bebfe3d6759d5e70c0e5ec1a9c71bc6a0fb7855309
MD5 5ee14d2eb8cc9b1e24ddca6d89a18d72
SHA1 edad75a46e304318fb660aafeb83417b3d96db3a
SHA512 1bd65034528178f1974c7feb6c47241cf12b56a51d955cd1d5b111f1effae88051abcfef98c3ab5aca60d6d3dd15637d6e9e7d77808fe8b608ecea7be9d31ced
SSDEEP 384:nTjccCs+Bt0S3vsNW0j+YjRvFh/j2sWusJTuXpHsBl2TFbiqi8:/ccQPI+Yt7/M1JTWpHsBQ
TLSH
T1FD826B3528786C77EAB6AA49F24673139FF4107B6AD12F28D9D99F1C01CB2981307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 120f3f8f33b8834ffb27447a2b6aff472da5fa15db8ef592e0672961297a742f
MD5 5bdeb936a30ae958b74e7e0f8026af99
SHA1 56b4f08e5920562b567405b326b9f20bcb2fbf7b
SHA512 cf9f282aaa382b29fd7c49dd8b3da2be78039502b4b1e9c1388153c0f7d443af3c88a788bcf9b57d8859222b2a5385587736045f573285784a9cfd2d36f6de15
SSDEEP 384:nNiFajccCs+Bt0S37QsNW8TUNTUlIlBj+YjfrFBDfYt/j2sWusJTutpHsBl2TFbj:EFUccQkLwgn+Yvst/M1JTepHsBQ
TLSH
T15FD292F598E79936E9AE4B87A33E6E029EBCC05775841994FBC85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f61905662c73e72fe083df97512245ed23bae042a30b703df677b7f4a937e280
MD5 0ada734f9aedfc625aabb8d962f53943
SHA1 59e0ff39c2c42ccd11c4e4eb6bf255b954d85a8c
SHA512 0b310cf38ed61c2df5dce2136546e5f541bf56650fe67f9ada66e5458bc26f487ec7b5f362be313c22314bc316443bb6169df82084d0851686be8e64fccb2976
SSDEEP 384:nNiFejccCs+Bt0S37QsNW8TUNTUlIlBj+YjfrFBDfpt/j2sWusJTuppHsBl2TFbj:EFIccQkLwgn+Y3Vt/M1JT8pHsBQ
TLSH
T1FDD292F598E79936E9AE4B87A33E6E029EBCC05775841994FBC85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 e424b930b4dcd2e7799074effad0c6105e9dd35191aa3260a7de4c0a64a9925a
MD5 741105eceafaa1888f954798063725e8
SHA1 059ad5e89b0431bc7fb56e961923ce1290148734
SHA512 7329296bdcab659def78585951197c80064a805739bc96137bdf402abb18e057fdf3b49a4d61d4f1abf2cc22b1ecca73a11ecf031c9dfeb708b7947daad72a7b
SSDEEP 384:nNiFsjccCs+Bt0S374sNm8TUNTUlIRBTs+YjDbu2BxfXt/j2sWusJTucpHsBl2Th:EFqccQsrwgA+Yru2t/M1JTtpHsBQ
TLSH
T170D2A2F598D79936E9AE4B87A33E6E029EBCC15775841994FBC84D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 28da4685477c2c87d97979a67514e5676688adf209bede976fc08d1792292ece
MD5 3329b3825ecea8b2b671768f247a61a3
SHA1 659449e5a074af5661d99d892caa4161945e3815
SHA512 817e3f368fe5c172362d8a4016e6bfffc5ebe66824900fc06debe5286805e23c3aaff6fad252a1118255af0807474cd8f9354540bb5ae479dabd3d2d0a9b3e6d
SSDEEP 384:nNiF3jccCs+Bt0S375sNt8TUNTUlIlBTH+Yjtbu2Bxfct/j2sWusJTuTpHsBl2Th:EFzccQluwg/+Y9u1t/M1JTipHsBQ
TLSH
T174D292F598E79936E9AE4B87A33E6E029EBCC05775841994FBC85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6ef2a1a8fa93826e0363594fdcd82c56b309e50729d854aee8f7edb6e607ceef
MD5 f2cfd74f66d75bb0136666bb98049b48
SHA1 8dde13aaa7f8dfa6e2f99521ec40cc1334b77fa7
SHA512 aaecb79031d79853a6aab3b44ee845e2b94c7b9b5719d3bdf1ae80d5bfd428da18620b472a492ad5fe0eed4c54cc6258696f62fbe5fa2b6d0e7aa795476681b8
SSDEEP 384:npjccCs+Bt0S3EsNWBj+YjfvFh/j2sWusJTuXpHsBl2TFbiqi8:pccQkT+YD7/M1JTWpHsBQ
TLSH
T10F826C3528786C77EAB6AA49F14673139FF0106B6AD12F68D9ED9F1C01CB6981307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 677ab2ddea5b9777f9f847c19a4bdcf54a6da5f42395c50f4162b9577a0574f2
MD5 fa296bd1527d719e2db93bf9f8edf09e
SHA1 ea748f2bed59b76031bc35529770071fc1c8cb31
SHA512 e9ea99e6814acb5ca5d5f5c6aacc7d7c42d7ab5fdbb742a11093a282ef317244f32c906bb288dc9035cae893b581a0e994d141b97b1eae2a52425b0645fbe407
SSDEEP 384:nEjccCs+Bt0S3vsNW9j+YjRvFh/j2sWusJTuXpHsBl2TFbiqi8:SccQPD+Yt7/M1JTWpHsBQ
TLSH
T145826B3528786C77EAB6AA49F24673139FF4107B6AD12F28D9D99F1C00CB6981307C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7824422e264ebf59ad8956738000e23d2fd18d1da0d202384801c1e7cc225164
MD5 a8d0174cd6008d0aeeba2bfd0a467c8a
SHA1 5dff3c69d214694f6d59aab0fd0400cb376c5475
SHA512 0e6173cc3251b5f6c60912c7d5ad60a7aae4047104be4e69b617c85047bbe944b1e8b405f2b678882848c036136d1a1aea9ed771e2eabbd6f74ed755811f5b54
SSDEEP 192:tONS6xIQmiUyW5M8R/j2wz7Sus6elPWHkqU6:tONS6arMW/j2sWusJIjU6
TLSH
T1AF02F838686C7C6BDEB3AE45F68677239F94203BA9552F48DAD85E1D00D759C2303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 faa582ca3133c12409ef0c4e77a566b5dea2f4bf79c61b1f10de9ea98e01c20f
MD5 0cd2fe9c47c1832fff103aa45f8412c7
SHA1 a932afda0c39aeeddbdc440ea65b0da7be4863ce
SHA512 b3c1775d72b4bcc2c5dd408b4f6b78c7916cde50702ca1e174f2ae8cbdf112be42f2abfa0fe17fa25338e8ea5dd2c2a345538c72502777315273bce603e80f60
SSDEEP 192:wONf6xEQmiUy0538R/j2wz7Sus6eloSuOtA6scqzU6:wONf6q/3W/j2sWusJTuZpU6
TLSH
T10312F835682C7CA7AEA2AE45F58772239FE4212FA9853F44D9D81E1C00CB59C2717C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0e837a4acf0a0e6097049d886ffdc142884baca77dde86ffe74f0253cbf03cfd
MD5 c6a82315e3ae982b923abc4ea9b9e455
SHA1 0fb13ab30c0939e14d518c726d47d03b95786302
SHA512 7bccf8ab2aa8b9b6260c219be6fb05eb12bce57f6b21c4bb0c61733b808b32e15c4378d32e3ac7d374716c60c8c0d979d8bc4de52e106d1c5203cb9c00378a13
TLSH
T1A8E00957631219AEC579077502C36F781FE6D16052B6174A9B70016D6CB33207F35BC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 220840ef48399957735035b0aec7a206ca58f8a72b3d7d17dfaa4e2403d4b977
MD5 5fc59bdc1fef8d0dbaddfe98084332f8
SHA1 b5fac220c42870b039d824310df3febd23340f95
SHA512 211bf00fb52c06a18bdea779d3bf69e4120aa45468a6ab0c4fbfe483bbfe106e3cf5b39033fc234f0ef0fd29c2774889ebafcff7a775aa4a5a9322fab71e14a0
TLSH
T1F7E002135311059DC135013101832F741F67D0601145070B5F70015D5C713003F164C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fd699c6de2867fc7bc5003cdc6f515b71a6555d43eedc039ad2b72ce0b2535ea
MD5 09f9e12e4f675c71810b88fb08d7ee88
SHA1 27c4647edac4ba10abc2b40c4cde1aaabf2f07af
SHA512 6b6243ff01e3e13298fae7e4cc39cf26d88988043705ccaceb8fb2bf44c4f7dd0d98ca0ff215cbff08283558199e2753f48189e8ee416acc29f3b513aed0ee22
TLSH
T19FE00913631119AEC139033102C3AF741EE7D07012B6064A9F70016D6C733203F35BC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a323c9b4cce7f0bbe2324d03dc7e9ea1ccabe0a817ef140d246940a4b3936a7e
MD5 08af197ebb7b31bcfa65e145c21d8482
SHA1 9fcf594048cdc21aed96a3734918eda4fd180dd8
SHA512 1e782ca4086d232e018a620e89be1ff622191a1914f1defa8050cdc97f36a2c39d5bd76e35749d911593d8cf058452981843f34ca3170146076803093c20922d
TLSH
T1CDE00913631105AEC139033102836F742EA7D07012A6060A9F70016D5C723003F25AC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ca7d3af1137c4ee36e688f6207d0c710cbec0392178daf88bd133073cbed3c60
MD5 4a64b02e480d0b422826ebed25fb1950
SHA1 8f43cc213f6e1fb1f6b288ca0d9453d90cf08bb5
SHA512 8650aa53ef568689eb1e12689d9436c6872b86942570ba88f208afa0785bb8f02409c5418b1032d576b21656aeea87b62e14f9275058338cb632daa9f3e7adec
TLSH
T15AE004115301051CC135013001C33F341F70D0401145030F5770015D5C7130037154C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bd31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bd31.TMP
Size 392B
SHA256 b26ba100c9b3e063cef2e2fa6bb4a8c43e85e219327a6edcbe535e803b0d098b
MD5 c697e3632cc7c5a4f0ac64d8a7b09f01
SHA1 6864ede64260f4907382d9e442dc9752ae01fe29
SHA512 e248cc9ed8287d553f0feba9093d41376ae18ee66af9d138ad7981f2872c9941352100fcf2e63991504410563b61319abf65f20f44c22d9f8047f9b9b072bd4b
TLSH
T1D6E0041111010514C115013001C33F141D70D0401145030D5770015D4C711003515440
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

bd79374e-cbb0-4405-81f4-b16ef7cbc158.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd79374e-cbb0-4405-81f4-b16ef7cbc158.tmp
Size 29KB
SHA256 d2ccb10181efc5dcd2ed4ee750c752ba3ad413db964adc7acbd2c9dc3ec18d61
MD5 b39af1842f1b05edb5a9d81ea3ac408c
SHA1 3716e71fb35a2f284dbcc905fa8ac5614f81426b
SHA512 e8254c09c179a63d8ec74e8a5c20a00466c1f9ad909f2d3d1a3d11f9f13faa9c10b21661cd04aa1639e227156656dd6e82bda917aa8054cae698b8b74dd3bee0
SSDEEP 384:nNiFnjccCs+Bt0S374sNt8TUNTUlIlBj+YjwrFBifpt/j2sWusJTuppHsBl2TFbj:EFjccQMuwgn+Y2At/M1JT8pHsBQ
TLSH
T1B2D292F598E79936E9AE4B87A33E6E029EBCC05775841994FBC85D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2b4ae45-f6d9-4a6f-9bc4-9920ac5b4d32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e2b4ae45-f6d9-4a6f-9bc4-9920ac5b4d32.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

46af91e2-0677-4267-9762-0583ef84195d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46af91e2-0677-4267-9762-0583ef84195d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9981b0f62c0ef2ee24720d55baebfd4ea6ac4605d14316f275ff800ead7d0181
MD5 bd6d80fed49b662c01fc2283a11cecb2
SHA1 9dc937a5ab04706f0062693168b7144cdff7497e
SHA512 5bb780ede59cf6ccbd8fc7921fa0f3c36fcd27836883fb29810e63659487db38cbdb9cb24172b0d063b2c0e82b95a9af792b7c28e76f6a136d8bcb1833dee710
TLSH
T1AF412B5CAAFA1544B3B76E4A6FF7686D447A7D772E06D45E00110E4F0A22A40C9A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

991eedbf-8c09-4c8d-8fb8-a48e263db8e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\991eedbf-8c09-4c8d-8fb8-a48e263db8e0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

db9233d5-f7ee-487d-b512-d737b65bf899.tmp

Path C:\Users\Admin\AppData\Local\Temp\db9233d5-f7ee-487d-b512-d737b65bf899.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6c5e3d1-b6ae-4eeb-80a8-0e4dc03f5ec3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3140_1286155772\c6c5e3d1-b6ae-4eeb-80a8-0e4dc03f5ec3.tmp
Size 146KB
SHA256 ec68b308c1b5444ed4d179df510a843fe2d464fefb631f11fd4b9310fda986bd
MD5 fa032a5db34ff20ecbcb6654b02cd7c7
SHA1 3a0c7141dc03421536419c33cb5f9ebd5a4e0289
SHA512 3a3d99e5b9794db882760f754b9b58bebf77e88ce8d0bef61f3ae82c4d3c9631e524a98389f74f7f9215674d60a6d06c10b9e5d0760c908dc19412955ea8522e
SSDEEP 3072:Hl6RntNhz5AkVuPmNptLSZPunVlkDS6it9TyZpd21+PIpGE8aK5KyTmBpw:HM3z5A41L+gXkDS624Xwp1XKgyKzw
TLSH
T170E3E16C6EEAC81AD10F60BA795DB08FC8068F16C107645FB2558418CA64B8D57E2FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3140_1724251000\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ransomware.Petya.zip

Path C:\Users\Admin\Downloads\Ransomware.Petya.zip
Size 538KB
SHA256 33ca487a65d38bad82dccfa0d076bad071466e4183562d0b1ad1a2e954667fe9
MD5 e8fb95ebb7e0db4c68a32947a74b5ff9
SHA1 6f93f85342aa3ea7dcbe69cfb55d48e5027b296c
SHA512 a2dea77b0283f4ed987c4de8860a9822bfd030be9c3096cda54f6159a89d461099e58efbc767bb8c04ae21ddd4289da578f8d938d78f30d40f9bca6567087320
SSDEEP 12288:h62An+lYWejkM9KIIoyoAWPPpxS8yrST5UvF50VHCJvD3DpNu7NwRUDxuJnU:hJA+BncEoyojpxS8yrSV0nvHpNu7eQxH
TLSH
T1F3C423620775E85C3CAE4B6EBE5FF6D7E728450D43BA4284267F038079ED6A168190F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin

Path C:\Users\Admin\Downloads\Ransomware.Petya\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin
Size 225KB
SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
MD5 af2379cc4d607a45ac44d62135fb7015
SHA1 39b6d40906c7f7f080e6befa93324dddadcbd9fa
SHA512 69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99
SSDEEP 6144:DCyjXhd1mialK+qoNr8PxtZE6x5v+k6f:rjXhd8ZlKOrMZE6x5b6f
TLSH
T1FF349C2276E0847DFAB306378CFD36759ABDF9714931890B33C50A0E79605E1A63A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trojan.Ransom.Petya.zip

Path C:\Users\Admin\Downloads\Trojan.Ransom.Petya.zip
Size 182KB
SHA256 01ee80fae9882c4905390a2927895e6bdcf74b1a5662c7577ab185b3c826b64b
MD5 089dcd9480fa127da76645e445c3e909
SHA1 404fa8d1eb068452b0ee18a22cea2716d156bd10
SHA512 16850e2a2972ba31830661f19edfbea9e72ae7081d27b517e3e707ba0b2ae80e4128c0e99b41c3104f1ac3d4904d8b1fd78f184b56eaf368b8a5b050e88d554c
SSDEEP 3072:9Or8kHWEtPc8h8tMQ97IVlQHWNmQf9X+P7uWYimpGUDky4BwratiparfdsEXhb:9W93e2IYf9k7pYim4UZ4BEGHV
TLSH
T1620423EA536CD4548DADB010F913A93AAF3BC5E87F46AD8A94F0B90D0B3281547FDD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506

Path C:\Users\Admin\Downloads\Trojan.Ransom.Petya\eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506
Size 328KB
SHA256 eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506
MD5 8ed9a60127aee45336102bf12059a850
SHA1 b649b9bc9436d373fd09a89ed71840aa7ac5ec54
SHA512 95a0d62f02b29a48b1988cba6610b6410327f52ef918fd83fe2565d3767ab202d2a9aef6bcf47234c7c7200c49b71b80cd0430a7b6e55885f7a4b54a69e0dc2e
SSDEEP 6144:wDeUVJuo0tl4VJLofrFD68Y7LE8DO11bEVUNNa:IuFl4VJ4D68YUQO1tEV
TLSH
T1C0648E213795F83DDA6204348FE78B6E52FEF1A5E43A1D87E3C40A1B5E76C41812EB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-987-0x000001501DA00000-0x000001501DACD000-memory.dmp

Download

memory/1780-1042-0x000002E437070000-0x000002E43713D000-memory.dmp

Download

memory/2792-1047-0x000001A2CF000000-0x000001A2CF0CD000-memory.dmp

Download

memory/5188-1195-0x000001A276EA0000-0x000001A276F6D000-memory.dmp

Download

memory/5324-1080-0x0000020232CF0000-0x0000020232DBD000-memory.dmp

Download

memory/5360-1204-0x000002A204DB0000-0x000002A204E7D000-memory.dmp

Download

memory/6088-1177-0x000001EF41B80000-0x000001EF41C4D000-memory.dmp

Download