e98668df11978ed3d5aae5ba3ace52423809d426eb1a6a12017f877baadad858

Analysis

user interaction
yes
max time kernel
366s
max time network
364s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fnwXWS5C.html
Size 2KB
Sample260418-mphanady5w
SHA256 e98668df11978ed3d5aae5ba3ace52423809d426eb1a6a12017f877baadad858
MD5 3598098cc3b86003e5bfbcfa8ab917d9
SHA1 d40bf467432fb3d46008bbf25f30cf1c28d4b374
SHA512 1e7e9c02d82a5c621a7b0707c8c0fbd09832cb88ba23628205d9ab520622834847c7e35956ce34272d9919bbcad17b615d82db4fb2052f673edbede563db4073
TLSH
T1DA416123D50480158661E285F1F9B75C8063978FDB324C51A7F8B1EBA0D7FE1C2B62E9
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3252	valorant_unlocker.exe
1360	valorant_unlocker.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Notification\notification.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\wallet-webui-101.079f5d74a18127cd9d6a.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1543392193\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-ec\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-mobile-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1543392193\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_670039558\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1154241471\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_865295243\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_670039558\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_781711780\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1543392193\Part-IT	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-notification\zh-Hant\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2480	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209823151074433"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{F2787094-4AC8-4F7B-8913-041289DA1F35}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\valorant_unlocker.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\valorant_unlocker (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
3252	valorant_unlocker.exe
3252	valorant_unlocker.exe
3252	valorant_unlocker.exe
3252	valorant_unlocker.exe
1360	valorant_unlocker.exe
1360	valorant_unlocker.exe
1360	valorant_unlocker.exe
1360	valorant_unlocker.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2592	7zG.exe
3592	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	4744	7zG.exe
Token: 35	4744	7zG.exe
Token: SeSecurityPrivilege	4744	7zG.exe
Token: SeSecurityPrivilege	4744	7zG.exe
Token: SeRestorePrivilege	2592	7zG.exe
Token: 35	2592	7zG.exe
Token: SeSecurityPrivilege	2592	7zG.exe
Token: SeSecurityPrivilege	2592	7zG.exe
Token: SeRestorePrivilege	3592	7zG.exe
Token: 35	3592	7zG.exe
Token: SeSecurityPrivilege	3592	7zG.exe
Token: SeSecurityPrivilege	3592	7zG.exe
Token: SeRestorePrivilege	6084	7zG.exe
Token: 35	6084	7zG.exe
Token: SeSecurityPrivilege	6084	7zG.exe
Token: SeSecurityPrivilege	6084	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2532	1300	msedge.exe	79
PID 1300 wrote to memory of 2480	1300	msedge.exe	80
PID 1300 wrote to memory of 692	1300	msedge.exe	81
PID 1300 wrote to memory of 692	1300	msedge.exe	81
PID 1300 wrote to memory of 692	1300	msedge.exe	81
PID 1300 wrote to memory of 5036	1300	msedge.exe	82
PID 1300 wrote to memory of 5036	1300	msedge.exe	82
PID 1300 wrote to memory of 5664	1300	msedge.exe	84
PID 1300 wrote to memory of 5664	1300	msedge.exe	84
PID 1300 wrote to memory of 5664	1300	msedge.exe	84
PID 1300 wrote to memory of 2188	1300	msedge.exe	85
PID 1300 wrote to memory of 2188	1300	msedge.exe	85
PID 1300 wrote to memory of 2188	1300	msedge.exe	85
PID 1300 wrote to memory of 5924	1300	msedge.exe	87
PID 1300 wrote to memory of 5344	1300	msedge.exe	88
PID 1300 wrote to memory of 5924	1300	msedge.exe	87
PID 1300 wrote to memory of 5344	1300	msedge.exe	88
PID 1300 wrote to memory of 3100	1300	msedge.exe	89
PID 3100 wrote to memory of 5640	3100	msedge.exe	90
PID 1300 wrote to memory of 616	1300	msedge.exe	92
PID 1300 wrote to memory of 4380	1300	msedge.exe	95
PID 1300 wrote to memory of 1240	1300	msedge.exe	96
PID 1300 wrote to memory of 4752	1300	msedge.exe	97
PID 1300 wrote to memory of 3648	1300	msedge.exe	98
PID 1300 wrote to memory of 3648	1300	msedge.exe	98
PID 1300 wrote to memory of 3148	1300	msedge.exe	99
PID 1300 wrote to memory of 3148	1300	msedge.exe	99
PID 1300 wrote to memory of 484	1300	msedge.exe	100
PID 1300 wrote to memory of 484	1300	msedge.exe	100
PID 1300 wrote to memory of 4852	1300	msedge.exe	101
PID 1300 wrote to memory of 4852	1300	msedge.exe	101
PID 1300 wrote to memory of 4852	1300	msedge.exe	101
PID 1300 wrote to memory of 5392	1300	msedge.exe	102
PID 1300 wrote to memory of 5392	1300	msedge.exe	102
PID 1300 wrote to memory of 5392	1300	msedge.exe	102
PID 1300 wrote to memory of 3728	1300	msedge.exe	103
PID 1300 wrote to memory of 3728	1300	msedge.exe	103
PID 1300 wrote to memory of 616	1300	msedge.exe	104
PID 1300 wrote to memory of 616	1300	msedge.exe	104
PID 1300 wrote to memory of 5968	1300	msedge.exe	105
PID 1300 wrote to memory of 5968	1300	msedge.exe	105
PID 1300 wrote to memory of 4552	1300	msedge.exe	108
PID 1300 wrote to memory of 1124	1300	msedge.exe	109
PID 1300 wrote to memory of 4552	1300	msedge.exe	108
PID 1300 wrote to memory of 4552	1300	msedge.exe	108
PID 1300 wrote to memory of 1124	1300	msedge.exe	109
PID 1300 wrote to memory of 3544	1300	msedge.exe	110
PID 1300 wrote to memory of 5848	1300	msedge.exe	114
PID 1300 wrote to memory of 5848	1300	msedge.exe	114
PID 1300 wrote to memory of 2732	1300	msedge.exe	117
PID 1300 wrote to memory of 2732	1300	msedge.exe	117
PID 1300 wrote to memory of 2252	1300	msedge.exe	119
PID 1300 wrote to memory of 5032	1300	msedge.exe	120
PID 1300 wrote to memory of 2252	1300	msedge.exe	119
PID 1300 wrote to memory of 2252	1300	msedge.exe	119
PID 1300 wrote to memory of 6048	1300	msedge.exe	121
PID 1300 wrote to memory of 6048	1300	msedge.exe	121
PID 1300 wrote to memory of 4644	1300	msedge.exe	123
PID 1300 wrote to memory of 3664	1300	msedge.exe	128
PID 1300 wrote to memory of 3664	1300	msedge.exe	128
PID 1300 wrote to memory of 3256	1300	msedge.exe	135
PID 1300 wrote to memory of 3256	1300	msedge.exe	135
PID 1300 wrote to memory of 5544	1300	msedge.exe	137
PID 1300 wrote to memory of 5544	1300	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fnwXWS5C.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b0,0x7ff80f04c188,0x7ff80f04c194,0x7ff80f04c1a0
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,11540960890672522021,6935672419567332964,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,12979659197503029222,15224483924673442031,262144 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,15307537326317319446,12452499268137493375,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8390638983171531427,17089814649708026057,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13163100685225669862,5921734736822013674,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,252774022891988127,9729080946741811649,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,4212094310900749965,15398327456468711715,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,14783936197703410930,12699368328673937732,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,16264686496705306171,76191767900983505,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,16264686496705306171,76191767900983505,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,15565336726600739917,14005433183131871249,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,9357982255169798008,7306927496329298816,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,15970917282721841961,13180786315872329350,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,14391356961602420124,1595167910923938918,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1583078066018595727,9074331225817729660,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,7325379169720279835,16870491196807997011,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6428,i,8241520148326324960,1738037271306427217,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4160,i,4717752068691411039,8725995774370235789,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,8180950293504997549,12802148405219707230,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=1504 /prefetch:14
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,14660779572772073234,13129135614218994692,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:12
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,9856501140027465559,2490293257899945685,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7144,i,3842824731196798376,11200164596237648634,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,15397731972875562186,7387039909631644380,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,9381759056199443291,10707625791362005911,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,13491065367343464972,17917077659515550318,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,9465279970568056312,13406387819837699748,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6172,i,11420461888324680795,16779623378017487797,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,11854536913644230891,13697080096201585298,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,17720445106790968995,4465372205228536350,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2676,i,8052704044494331147,3439639566594165538,262144 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5059863224406323945,17006976722315829947,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,8231220319250820210,4238325496267191790,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3367625796980469894,989854130991338419,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,9678347155549394877,7915058890986972126,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,16518913901829899702,9437146539557105299,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,16450092049457028487,10862149347704124540,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,3936077041392862102,12400375967660530931,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:14
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5572,i,6451919719903991487,8814313202498793940,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7156,i,7574131849976413500,8343380796919317556,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5832,i,192566519667982818,11388477380660298725,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7344,i,1312012456435476202,11605780217313022723,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8028,i,14750550005825643722,9795039571321762228,524288 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5572,i,6576587473323174297,3982440850513728831,2097152 --field-trial-handle=2224,i,941776222671565050,5357431023556910389,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
  2⤵
  PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4768

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\valorant_unlocker (1)\" -ad -an -ai#7zMap26399:104:7zEvent15926
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\valorant_unlocker (1)\" -ad -an -ai#7zMap878:104:7zEvent17605
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\valorant_unlocker (1)\" -ad -an -ai#7zMap31819:104:7zEvent23857
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\valorant_unlocker (1)\" -ad -an -ai#7zMap28738:104:7zEvent6766
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\valorant_unlocker.exe
"C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\valorant_unlocker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3252

C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\valorant_unlocker.exe
"C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\valorant_unlocker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c764b104b5875e4857c8a3fa4afe91bfcd648c7f089d8e411bad01a2b5c33932
MD5 38155e7d41182360dd585d4b408cc8fc
SHA1 3e15809e6f487ae0360127dfecdc11affd102e31
SHA512 555f38329d5ee52afc88932c0242f7d683b3ec5d5ee0bdcc8d728ec8452488347d45b07a79a6bd89e244141d1c43d660569b067834dee7570b6173d23a78dfc1
TLSH
T1DDE0DF14BBC9C5F94182B74BE06EB6148180B987A3BCFAB933456C8B3446B00922B0E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 44a89735c9dde66cbac31ff932d0698cc421eedf8f4bfc723cb165c348ca2302
MD5 11f7e53555c7ea87c25accd96ae52c66
SHA1 d609d48c7534e6bac1e7f93634755dec89340fd1
SHA512 5edfb7ccdb43ea7dbd47d33308ca95fd1540ed9ffbed6e740f20cbbc478917a303acccbaf8e877fe060f3d791df5e5acd08350885a65222e49d124caabab87f0
TLSH
T1CDE02BAAC821986708FD172954504A0AEA20531B2B50964F3F3C820D8FF0A37499585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 29KB
SHA256 c9530bd11b57e093fbc4bc2939cf5ed17be9da3638f0d6a1c74e1fe314a4dbf7
MD5 a4e4dbeebe115cd3ec69fbeda0bee032
SHA1 782410914edeee647b47e4baa756983fcc274ec4
SHA512 dd53a6443843dfadc363fd50d4cab8a780f9a35a7fe75a7ac25560996701db1463c6c675655391ffd770374dfe999b60ac0f3182fe5e5fe077acf94bfea7505c
SSDEEP 384:/KkjfqpcDlrmFdOdLMTtoMOlPHey5kdhc6cmGW7wp1zVccbMlbpnDQrKOow1pavh:/njfqYlc6MhOZHeQkK2w6SqDVOhDmb6W
TLSH
T101D2E1D6B49F2B0475DF25D63372F69293EB8FAD3274A077807952A085070A50ADD1C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e7
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f1682ccebd0a847b77f8aa67991ede30383f050b47a9ff986f248fea955483f0
MD5 1129bad30280248ab11c9c6ef2aec336
SHA1 59358f6f7dfa0c88e167d1ce5999b3aaeda02a71
SHA512 f49964eb2fd64dae2675531152b61daf349ab0191c9e5e7a183c75d66d0df730343089347f51bfe78fd64724b0cb54ab3dfdaaa48bbede417ba176b9aed0c5e2
SSDEEP 96:4ywK/PgBGX/uzQb8k6hsjgH8UZLFGfg+2H3bUcNYCO6igmok4dOeah:xwwWkHgFZLAoYUYCOLok4dQ
TLSH
T16DE1417150B2E116EBD6C4B1E8E8CAE771734072D923CF1644E162BCA54E7B78B810C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 03d5c2d07738af34ae0566be929896fedf181a6fb504ca3fe6aca0539651b939
MD5 daa73f14383686a0e302ac316ceff1e0
SHA1 d3ea4a568f0bf8d63205001b640be4067dc42dbe
SHA512 ad67c00c59256b19cab85cc6c9e8848437e00b77a50a502737111188c7880e37a036baa582a3657f722d3643c092d8a4a710c79bef26a3d23c3531aedca4dddd
TLSH
T18071E44501B2B46BE7EAD5B2CEEDD0D036738174DE2ACE2502A213FD6A1DB3343C4019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594d99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594d99.TMP
Size 3KB
SHA256 f1df8d85ee4b0d79805a975582f18a8a14a26dab42b74d56949cd36fcf27f4fc
MD5 a9dc0eb6f596555b3d4c2fedcf09ec15
SHA1 f6ba4714efc355c17b35e93deedd389b6c7e7d4f
SHA512 ad2dbbbea9342fad465dc1b56658ec6b665960751299b7c31662066c0073a7d994fe83f6455b24a30f12802d6425f021bcbaafc45f70cc3f0f57240ea6aba02f
TLSH
T16B71D44541B2B46BE7EAD5B2CEEDD0D436738174CE26DE2902A213FD6A0DB3383C0019
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fbf0ac38b77d7d17346e70c41bc3bd28c5f63bf26d086ac54438ecef84dca8c1
MD5 170b9d73eb678819d3d7f9856d00d10e
SHA1 9f4bce54ff49829c8d9713a2df934c3cf083a9c4
SHA512 91fc7b0a3a7f5d249c189eb84892a139e074e45145bbdfa7f083ec5231e25d4e34985d1bb5978f4d45ac5759153a676a8c9a8aa19c42dd2bdffb8a4c01ac2895
TLSH
T13E71FEF783F4856DCA1291F0AA187E2BCE5D0514436C3D5A89E4EF0BA3F2471E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a768e7a9-1a54-448c-a1e0-dc8b50f13b65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a768e7a9-1a54-448c-a1e0-dc8b50f13b65.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 d75f4ed6dc2cced3b1b0c3bd52cfe48534912f72e4cdf1ac538f5b5cb4d07379
MD5 816816d0b911f41ef6782eefb5871c0c
SHA1 d1d6f7c4479522a206a9b7e9153af59ee9c7e94f
SHA512 4ee6cdcf6513e7690f3e15415d0cc1f8a9a4893964a3ef845be1f6bb7e6f857786501222933d496d3ae920edf51d05501847280673dcf6490a563edf65c93cfc
SSDEEP 384:sxZinleiqUf0/fxsXQufJjtLxowg3/bOAdu/ew26Y:skletUf0/fuQOJ5NoD/b7+ewe
TLSH
T175A209176934497B8DE7D226F956BB53D6F90123D6808E84AAFCDE0C04E67ED6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 454ba1be2b391232f0e65e692a70eb5d3fbedc60d0894b664a122f1acc53eb8c
MD5 cc6702130f6e7eb006e465ab04408dfa
SHA1 2fefd515e4eb309c3bcbe9b28139e51f10093779
SHA512 e822e5086fa40bbf843729b9fa9a4c4ffef8adb978c1f572b3045eb6fdf07783cf10281bad7dc5f061b109fd0e886e487603b456916863185b3095e8b280e27e
SSDEEP 384:sxZ/eiqUf0/fxsXQufJjtLMxI/bDZ5wt6v:snetUf0/fuQOJ5wy/bF5wM
TLSH
T13A72E806AA3859778CEBD219F955BF53D6F9416392804E44AAFCDA0C04D77DD6103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ac930f0c1a25f75f033422d74e4c5bd000bd058a354b7b390a29a5a9c820ffcd
MD5 2ce0cf07483a3bae4e6669af8fc3443d
SHA1 95a7de2c8fc789fbca02b380f5146f9f4dd0b4a4
SHA512 088922cc76b578b7b58df39b68a7c1c8164a17bc26bca8fd3ef63fafe53d651035b310680f6917a779fcf9a0f14298ed886270a2a5885150de1a1f74b2f7e47a
SSDEEP 192:sxZ/RA7yMqZ/K1Ml8MFf0/fxs7wAdfJjIIDPN+KzodpE0/W6+WNGY0EThjfM26Iw:sxZ/eidf0/fxs7wufJjtLMxR/bG5wEj3
TLSH
T17362F8066A389977CCDBD209FA45BF53D6F9557391804E48AAFCDA0C04E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f810ae55694211b5fe34734ea899d6c6415d836a8d6ee470b1041a1e814f87c8
MD5 4d008540dfb12ebcf1b7c91703b94924
SHA1 ab35e0ca07092392c44583f8e432c52b15b606d2
SHA512 ccefbccda2e0eea74539fdfd13c7ddbd61448c936d119b42f2f58024ac75036ef7f9026ffceb54249f0fa70cc9e7b8b1efceb77fe3661b737d3541ca4a04c502
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3yDwvLlY:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKyDwq
TLSH
T17E030B3B680CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index
Size 2KB
SHA256 715b6b210dada6f583eb516996ac56ab4f1030b62f8c22f75ba3a242d7ccb722
MD5 7d843afff7cdc40ac5288b0e1e0b88ab
SHA1 1fbeb4beeb51897f750807d55ff2827109472591
SHA512 1dd9c958236f91125fa1c59b8d3fdb0254e1c8c89c3626cebc8eb7248895a3fd3ca94df4061a0272b2f08893c7caee2f698cea7706f2fd3773b3749525b6250a
TLSH
T1C751C61CAC0E9BA1CD7915B649F61816337898CE7EF44F0BD89C59B5641322E1F4A82A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index
Size 2KB
SHA256 f8c0ec5dda5126b3f8c1b378f62e1ac8af67edfba25b9d4fc547024016e2a41b
MD5 c894c35a11bf871ecc816eb49cf9d305
SHA1 8ab293621a7a05d138f010d7943137662a392d94
SHA512 c613c907ee4cfc4441f8c686d447cccb04a18a34ae929e1ce648999cde4035710b979014f8415fdb1adfbed76b23e8890ada677654c3747e2efae46106d13f0b
TLSH
T1FF5108CD9C8E5B07C97D92B1A9F6002633784CEE2A545B0B68FC5679AC8316F2993108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cce25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0fb5ef40-558d-48c2-a3a3-30db6f2b1f3e\index-dir\the-real-index~RFe5cce25.TMP
Size 2KB
SHA256 27b5501e8b7c40a63947aea6c4e0360fa744c4704eed62e1e0b654d9c909eb10
MD5 0a51ef37aedbc03c6b9166cdd94b9d97
SHA1 94d4663c5d21b34a8fb1cc3d6295166669f479ce
SHA512 931a05a3eca350206d6dd82bf129ddd5dae7daa725ae2ac55322395c22b2dde32b817bf83129bf30e798ed5875cd9c5518d469faf19089d221e27340b5dfbfed
TLSH
T1E551C95E9C430A31CDA091B359CA5469333D68959945AF0B35FCCA33BCC77AD3D66384
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index
Size 72B
SHA256 bdeb221d4d5de62a6ba471274605904a82d4cc30d6434bf4c4a18e060293f470
MD5 237b3603a1fe9e91505251c8789d2f55
SHA1 a7320593eb3e66618053e56691cbbe001146363a
SHA512 00bcca240ab8ff976fe86cb33adc8e97b8066307d4e12a4968a83f2ba5c88503260d1d8f2585661bb51868f659afe8053e8d4cdd23edd61eb6365182b9f6c92d
TLSH
T1B8A0026403804001C01752B17EDA07623715C9614381134746D001A8CC505554E5605D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a367834-68d9-4a2f-8d23-8a5bf77e73ac\index-dir\the-real-index
Size 72B
SHA256 1aa604ff33111e77cfc755a3713857a65f8f50dace006de11a7e74662d697053
MD5 3a82f69f1a92aa31f7ee1a9cd436f947
SHA1 586f1744a4ed181e83c022677f4b1a94e2abc442
SHA512 042893f0b714b042e91b01070fbb06a11448b74b931581a579dd2876206b27bace875d0e01510a33c7aa24f02cc3279eb81095fb4c2caaf81edf4e4c8e589edc
TLSH
T1A2A002512390000AD11311B11952C7C21200ED61A100120660F64957CCA4871594328D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 8b6084a47a17b745838ddfeeaa61631475ff61c86d7ffa7b3fca4296fb836a17
MD5 5f8b824ab53c856064440d0aac2e0644
SHA1 afe18123014810dfc83fc467ec5a95cf34cc20e5
SHA512 2f9302dc8cb73b8d26c76981199b2f3170f7ef404e4c4270cf9411ef4a18f744e40df491fd5336fbb126f9f366e35f3b19926242b78a77af08624dbc004c4ce3
TLSH
T146F020F72FF30818FDAAD3D520B182B50051BC08C586EC8F255EB29794B1759389AC62
MD5 SHA1 SHA512 TLSH

Submit Download

fa813c9ad67834ac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Size 114KB
SHA256 0ecf2d41829c32212d74323e22a5b406d16958721d463322c2db02cda1b05a1a
MD5 238188d99ad2ef8fe32dcace07fbf6b3
SHA1 73355eba09c6067c37bb199cc8911d561301510f
SHA512 589b9d9c68e9a92cac7d1224bf16a107e62bfd12445cf1f27a07bc6ec2f4ae0b0aaf49f7c59a94960243374a067699bdd1a5877d06e427009b4bd68fa59900c9
SSDEEP 3072:l49K+xPCJWjtG/EezKL/oTXTmYnbvZU0Z:l2cdKL/ozTmgbve4
TLSH
T185B39932769C50AB0E8ABEA45156B50352BC7467B844E078F21467FC25DBFB013BBEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c009ffac66d16dffd17a88c32cf5191c60c5fc3ad415e4fe450a3d59d0d66211
MD5 92e6a6fc12213b797003583785328836
SHA1 f543acf4bf27d2e50315032f356f982b3c87111b
SHA512 f6a6294adace6a554568f3bdd568d2cef76c1dabb707cd2b284b449a82714cc51c3dd9c036195d02dde3d91ec4c2ede03a7d3ab6f71f8b8a8d069c7af332e7ba
TLSH
T1EDB0122A819D9411C41C03728A26804F324408B942552BA601E5507970330508213543
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b84617c8708e380f8c581886ea3daede2c10c82b098ed44476993f4d4a3d0274
MD5 1be3d6bf812782f4e8abe8d16a56e240
SHA1 ec1909ae19de03a4f9d106b8310fb7c93e2a2583
SHA512 34dbf981b2c4e4f12a94dcf6fce74798b3a89b2bc66d597ac2e455363ac8ade888a843c9ef2a66594f430a371c912cf0babb303822c4e3e977eb40b4e1f00c5c
TLSH
T169B02202C02EC002C8880BB0C0CB208C33B00CBA0B22322008ACC0FCC8002C0F2C332A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5951c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5951c0.TMP
Size 72B
SHA256 0391ed12c5eb33f777929469875553120623aab5911d4a29648efabe98e4448f
MD5 2d7625b9ad440dbc1a5724f26d07ecfd
SHA1 f4bb5cbca6626c3897e0e788534cb11ff62945c8
SHA512 c69e4fc8fa8fe37eeeccbac8dd5476363482c7576df5c24aa1061ace7991e691a97e05612a5bfcc99d98170ce4798fd8b3505ce3613fb4c201b0ad09ea3a7b2e
TLSH
T111A00224835A2C01C40945F91605A28013709C99400116329891E1DDEDE50D55EC2513
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3cda11c7d52e25dfa605b1053cc4a5515f44749ec0b144006511ee95c5b92125
MD5 d76ffea2e7ca98d9a45977b9a54654e1
SHA1 c3307084695de700d0bb8f907bf62f07666fa627
SHA512 9a49aefb64fe30538c976e44a69befa578b0b0b83c8580d149c6bb96993164c51795102c88bb76f600b2f1486a3afba51b0e90ee24909a157d88d12a85b35be8
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa20b:ardVTNBbfw8nM9fgzNJ9dvz9L51b
TLSH
T1CFB24D51357B03C13ABE259A81A1B5AF46C230633118E42B3BF840F64F66E25DDFE5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d119a40cd90c2a4c126410e2700eabba4345f43025d7d3cff5f86dbce6055294
MD5 e1ddc75e59d05aa40c5e2ba81f04b4ee
SHA1 887f4402c072266c1f14c18ae30d5cbb985bad1c
SHA512 c25b649d645677148c65206e5218fb812e5463864af8da87ad38a0399d3a5a7b3afe973265ca888fa3ec75279b0d5c6a6907d493cc0432838c2c40ad706438ee
SSDEEP 768:kFIccQ4Qgwg1yKATOucAbm3fXabW6zR7d:DccQ4Q7yufbkyWmd
TLSH
T133E291F198E79976E9AE4B87A33D2E029AFCC157B5484994F7C40D0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e1c25dc81597ac56a4d0965bb56169f744caa5c18a8258d674afe4a26b4a24b4
MD5 2443735c6d41ea56b59a3a6e38bd2485
SHA1 b59f0a4db897f949a303cfe97da5072ec636a074
SHA512 2a45f69a544f3e3ddd276df79c64c49647679c24b467582ab155ca8163031abceeb3c0d9f0ded786f68c4a989579879caf3cec76e17a581cc95ec92bed5a6ba9
SSDEEP 384:ntiFJjccCs+Bt0S318NH8TUNTUlIRCvHUqxBrfRKADvOYtfkwdLlRorDfXU/AatN:kFJccQVcwg0hKATOucAbmDfXabW6zR7d
TLSH
T1E5E291F198E79976E9AE4B87A33D2E029AFCC157B5484994F7C40D0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 033982a6edc0fac6cdc2ddfd24b05706c605dfbd7a46e517719bdaa5571f14fa
MD5 1d3f44bba29f2c5e4ea55418307d2836
SHA1 d1d4426dfce08d75f6a799b059c41ca703341572
SHA512 1cf5dd83ce34bfadab05f94468981113560e59f79e22a1b7961db8107c05bcf692a5ed6f13940125b3ea7122208616a927334b0891a0939ffc0c63cca118b0b1
SSDEEP 768:kFzccQcQgwgi6aZKATOucAbmSfXabW6zR7d:GccQcQPyufb5yWmd
TLSH
T146E291F198E79976E9AE4B97A33D2E029AFCC157B5480A94B7C40D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 52f1bd4df475caeffa4f0e5e264ecf611e40c3cdfa5abb2167413555f0a2dc8f
MD5 7e26451ea68e079d71e2644b8d2586e0
SHA1 dcb24deb709950e7e84ceda8fbb284f7052e1ee5
SHA512 5770021804d7640a281e68ab2af5453ef9c9e1559e073d94080952d1512e038f115793a18f691f5df7c0cc785979336f6d8c169d533fb5dcf2e891c456f2d05d
SSDEEP 768:zFJccQB3cwg9hKATOucAbm7fXabW6zR7d:fccQB3OyufbcyWmd
TLSH
T18DC24B32E8A4DDBBADF68F99E3597A07EEF01167958C4AD4D9C80E1D008B1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e752c76325f6a3ecd84aaec012bc91013ff5bd902c069327409f53787733ab62
MD5 9ccbe2d0d2c4612acb92890c262a542c
SHA1 54e17d2cf00ed436d883f443f637658908df812e
SHA512 55d4b8609ae6205c91dad4f7f8ab8f9a7cdd23c1a78940c9eca7eb2948bbc20947497969c5a829727c2a855bca7c75855b40fae9b5c018902fa6b9882cdbc732
SSDEEP 384:nCiFavqMg38ND8TUNTUlIxBvHdOyBrfRKADvOYtfkwdLlRorHfdnS4mtmEerNlkj:JFayv3swgEqKATOucAbmHfdS4smE2a
TLSH
T14CC24B75E8A8D9B7EDE78F86A7197A06EEF05157D98C4AC4CAC81D0D00971DE134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6e81a57a3c0df9665ea1e3e6accb21aca995ea90b406eb2ba152068f7faec731
MD5 8a2802f0c959421c5897bdcab73e091e
SHA1 1ef49d2481994b97769aa60f255e54a0bb22525e
SHA512 d6f063c386b5c463357fdc5c22f23fd1dc78714d1db34b4554f8135782024bb5d4016a8aeea3c10dd51cbb350e5d590b2f9058e7d040d98eaa5d1f5b7c8afb9a
SSDEEP 768:kFBccQeQgwgeuKATOucAbm+fXabW6zR7d:0ccQeQMyufbtyWmd
TLSH
T115E291F198E79976E9AE4B97A33D2E029AFCC157B5480994F7C40D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6c614732f08e19241230abf5ef665d42c833fb7305384be685f9d802f7fffe80
MD5 1dd9a221d610a2e660ad500af9b6b495
SHA1 a387afab2732164eb0e5a12f5ba370995e8779e0
SHA512 dcf97ddf89c03845857e0c33ed923aee52f6ee5ffabaff179f26b9080df95182d92cc265b615a2ffbdbc819a7cfa1cdd635f489210c220d523e45a94c7cf3980
SSDEEP 768:kFJccQ4QgwgH4KATOucAbmMfXabW6zR7d:IccQ4QPyufbjyWmd
TLSH
T1F9E291F198E79976E9AE4B97A33D2E029AFCC157B5480A94F7C40D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c9002deb2b0b95e87a3dd40f5d577daf96d8c2fab57832aea31db7e3a78747a2
MD5 a9443bd01b43b5b7de6128ffe3fa4c3b
SHA1 75296adcb61bc71a4dea64d723b2003d6f5e1244
SHA512 b64e66b28dc52ad0e1a081d61463d9e1e3570a3e99d96cd0ede9c571f3851acd5c2075bab2f0c82c0c1bb4f272847ca73274bcc255bc3a90dffff57ca2497b7f
SSDEEP 768:kFLccQnQgwgECKATOucAbm3fXabW6zR7d:6ccQnQ+yufbkyWmd
TLSH
T12BE291F198E79977E9AE4B87A33D2E029AFCC157B5480994B7C40D0DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a4f9f8803e332efe8abd6902f683f136b469ee3d1e5be10de379eae772ae5654
MD5 afedaa48ffa50b8c4e68e372fddb8b80
SHA1 f2e12009cebe899b8813f37dc33df51cf373c841
SHA512 71cab5b10befc58b57b96714d76e040466c5b0adfecedafaf58e499d59142881008eae2933929d760494ea568311e1398c8f247afa3f770863bf68b8db2a3bee
SSDEEP 384:nFiFavqMg38Nv8TUNTUlIxBvHT0uGBrfRKADvOYtfkwdE1dnS4mtmEerNlk+5vIT:MFayv3cwgAu+KATOucJ1dS4smE2a
TLSH
T16EC23A75EC98D9B7EDE74F89A7097A46EEF01197E99C4AC4CAD81D0E00971DE130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6b641bb103780768ee2f8bf11b7c46385367cabf874adc6853c59cc41ff5586b
MD5 9a1c88d17c109a902b99aae97763bb2f
SHA1 61caea1efb9503b83a6ac75e9b3d8cd1ce2d557c
SHA512 3c0f17c91666fa10b38251a524465de75d054dcc3df8bdf22e0b83c2871bb6e2136fc2b822d6e387d2809cfeb12ac01a28c8b2bac0dd8ba674026d7910699e1d
SSDEEP 384:ntiFLjccCs+Bt0S318NH8TUNTUlIRGvHUqxB2fRKADvOYtfkwdLlRorDfXU/AatN:kFnccQVcwg04KATOucAbmDfXabW6zR7d
TLSH
T1CEE291F198E79976E9AE4B87A33D2E029AFCC157B5484994F7C40D0DCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c1ffcec725ad2918cf6b220a94afdb7aa2a5b6548f9fb9c41a50e308562eb6f4
MD5 ee7c174e4db552f8a6ab315f94fbcc00
SHA1 c9376cd08bf477192a10bfcc55f8eeb76614e43d
SHA512 d11ba26c2c0f5058d265ea1b49d5397de64f69b02d1c20f8659483b571f087a46a6c4fd0610430f6322cbe049736dd09d00ae6711996202ccd36732a150cc25c
SSDEEP 384:noiFavqMK38NH8TUNTUlIRCvHhFxBrfRKADvOYtfkwdLlRor5fayrNlk+5vI+M:zFayN3cwgMhKATOucAbm5fayA
TLSH
T1FAC23A71E8A4D9B7EDEB8FDAA71A7A07EEF01157958C4AD4DAD81D0D00871DD130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bb3a7097c9428f22c682ff55e956416e677a1533c7876acc06c655ee654c2a62
MD5 187b3a19b637ddad184f1bfe53a7d93e
SHA1 471ed0c924a1b3e0f7219aab5f62d6e5f0ba0f55
SHA512 e353241340206d1f02cafb6018c18311760e95fc7d800583c320ca34ea12f13e4d62ced5eba8d5472b62dc5023bd46f7a564aa02bd460c64f1c662401864934a
SSDEEP 768:+FJccQB3cwg9hKATOucAbm7fXabW6zR7d:EccQB3OyufbcyWmd
TLSH
T17DC25B32E8A4DDB7ADF68F99E3597A07EEF01167968C4AD4DAC80D1D008B1DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\crs.pb
Size 251KB
SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
MD5 3ef7a7be0ecfef355a5d5d6e77ebddfd
SHA1 5c6e47340a710019b97b1fd58624f714420b79f1
SHA512 812f5a4e1f572b7a012add71bc210281fd362f48ba5a863b2e5a7d7b6405dd08632dc39ce650a0d032f926d1e41acd8f1c84d5b60552ad9ac98ad6d2abb7f265
SSDEEP 6144:q6ik4li77VpRldVW+J2i/P66k8LyST+uUX:q6XnVpRN2GZQz
TLSH
T13C44AE9A0F3C3E11BFD2DEA466C8D9377D79B3E066A928172111C4E169927F07D8C42E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\ct_config.pb
Size 16KB
SHA256 dfc86083d2fa2463f12d1d096db6084c860cb8bfddc3d2cf8e818f65353241d6
MD5 85f3a17e7255717d8e9508b8081fd5fb
SHA1 9e24a4cfc81bb9f5fef0a4b69c5e6060930a076c
SHA512 5869837a49799d06e81d7406999b4d297eb6f759c556366e39a29b383a0f0ebfb1d15ada95c34c131dbc225ed1abeb695b08fd1c77e28d2ef5564d46ee9019f2
SSDEEP 384:BtomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:Bl5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T10172C8BFA1169F000383E558D6E157AAA12363DACCF3763DB1E1C005F5423E6A1A967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 9314218dc6642ea1980d504ec45e23aa2b4e7775ef13f7c7121271dbd60b1df4
MD5 eb5319aebea02b8c51c77a2a2b981614
SHA1 64b3fed053dcd2c33c3eed422d8e4ac7eec5d77d
SHA512 f56990428a679d56bdb9d7957ede9d6365d585f0c74f548b1fce439e835580210628a21a7704aea53e1f2bc75de6c845100a5c7801f0b03e9299671f539b5c0f
SSDEEP 96:Jxk+yBjecaikDBwrBnzowGbMAy5z5tBT6c5MUfFwnIXq6g/8yy:A1IDCrBngQ5jlMUfFwnIl3/
TLSH
T1502204B37904F99390E7E0BE1041F59AE933436540ADF98A528C4A7635F1F0729BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21d4a822743e2e52bdab7b43441da7bd7cabd1303ac36d24b72d2305bb4804d5
MD5 4315895f846bcfee6a7945ad5ea6c62c
SHA1 e20bf8bb7a2727807589e9822d651fe8dd7eda9b
SHA512 114af0d6e5a16988e49f8fc0efeca3ebacb640f583cee3ff192a67ebd8e3dda058cd2697c600ff81dfd7fa226bd638a2a1ee923bbd944f3f2137a833ac71e453
TLSH
T1C8E00125D20345BEC03E573111C7A634BAF2802202F306099A225A7C2D23B901B34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bd4cbd63176b886afe2cd27f3504558886f92d127f59c05ad7601aaea871b8eb
MD5 d141a0a69d4bc96f684e75687eaf74b1
SHA1 3bb7d8a8179793e61c581cf050784d09002a656c
SHA512 3ffc571952e33dcd5af8879e22e43030994187ee6c9425a2f47c4369b9847f41546ff2d023e6158b1173a2d474c593a868ec73d027a3aa1640a25da75e0c5ace
TLSH
T124E00216D30345BFC03E533011C36130B2F2802103F306055801057C29037500F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 488e99f481509a8925e1699045313314c20b8c3a3acec5dc16292fdf6c8f4d82
MD5 49c87102d019602ffdb156263178b896
SHA1 7b5497e418aabcb6bd2f4d18185de7b8854d1536
SHA512 0c31cd191bf75380043050a1af97ebd3c0a4b7fa42ee97fb7e88eb69df7f1d32247e279b893f8ad0f8883f8f1a59f4b0ddebce2125507812da68714537dc708f
TLSH
T14BE00225D30345BFC03E533111C7A134B6F2802103F306055812097C3D12B901B34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 730be6bf4ebd994319d50118b815463448538342726f605a7c1f01a925d129cb
MD5 445c0417ea118342d2d9b945a90077af
SHA1 97cf18898693c80d71bf7a47b568d38fab34a697
SHA512 a8f6297b6047854e54efc46624382c2b239258ee854a9a6cf865b63a8aa4364b1e7015f2914a2cb083edf5c01b950356e5a4090d4ea66bf357ae3be1e2f8b357
TLSH
T142E002159203457FC02A533011C26130B2718011038306055401057C29007500B24880
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5cff76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5cff76.TMP
Size 392B
SHA256 6b54c421510935cc2bf788a526ba17784cea9926b03d2b56b22ab466d35657d3
MD5 4f93442c5e71a003c9170794d0a64b46
SHA1 9a971d8e4e8370fd6ef256edf09cad067455394e
SHA512 7aca6021b75dfb31f968c77b05e59c4bd83ddf81542ad4636d9aa9ed8dd6d21936fe73932d2fbc02edd44ba7c5d2b057b39638caa0b64100d66ba1028d87c741
MD5 SHA1 SHA512

Submit Download

Ruleset Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\37\10.34.0.84\Ruleset Data
Size 3.5MB
SHA256 54bd9731392c3850fc347fcb09c4dd558c915e742dc491ae4173ba1f00abaa50
MD5 135db4e8520e0c6ad4abab7bba2c621c
SHA1 ac85f5b7858165aaa8cfbdde0919364ec14654c8
SHA512 2bcd8fe87a02350c49a18327b614294530721c9456487732108eb0f2c4842faf2b329f04983f36f46424febcd59c0e5e14d69a9f52e60a6dfd161926ec6b7ce7
SSDEEP 49152:aLNynd3uBgOEqeaZjRBwJHKKZ80LkF8AghdiJXRhPgjEdqmGe6BL69hCO4bmMNP9:mNIT+wuO60
TLSH
T1E706A352572D4B22F0D2C03A88F5CB357700F7E4A19592EDBAA8414F7D8E2712F5A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc3aa71b-763d-4b37-b470-559808e2cbd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\cc3aa71b-763d-4b37-b470-559808e2cbd8.tmp
Size 2KB
SHA256 7ae0232c13c530028910551a51e4382ee41d115ce1bd51015db6e5c9fa327c67
MD5 bd5db244e5417c110e586484e594bd72
SHA1 99d037f05daf8d2033c8b4dd00517e5cf3115f3d
SHA512 a0af1f0f6d5fd8e2e7dca6d6247ece807c0d0ce699bfbfe78a5c7b9fd6d018b1d2c3236d418e81cb935574e41a7bd97854151574f9af4e58ff538dc88fcb185e
TLSH
T1564141E05C3C26C1D1BD1E6FB08B78FCC2DC9626F5A4353D6818EE98463A61D648547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 52605e12c200f2057bf0bae102503f115c2369de19b9ea689770af0c60d39994
MD5 f6072baf2f708b150e88938a5365f28b
SHA1 4043bdc962986553f89ff7e93443a7fcaa1b3822
SHA512 df1bc615ec54c36dbd630cd823717f7095494a14043b9bb28c355b12a2ff10fb41c106d7970675b68ea75001a6c912e0a7da42958aca765deea9c919172d1896
TLSH
T1665130E15C3D26C1D1BD1E2FB44B78FC82E8D626F4A4753D6818EE58093A61D708547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c4e0083311cda1ef215c0364df432e07da056fb20b15a3d57fef69c409996632
MD5 15a955a0c7a344b84deebc895a13fb85
SHA1 a50aa795a1c3c97355ef916143413c5c13938c19
SHA512 c9e51d2b73c7289e0546f14274c7373883f32321374b8092848b43e0f25750d12c368b037baa1c32448a54847c6128cdf916d15a764493b99b60e5d3f7a25d6d
TLSH
T154414FE05C3C2AC2D1BD1A6FB48B38FCD1ECD62AF4A4317D6818DE98463A61D608447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 485572d15a1d9458b743364ad3c58dd375f31661783ea8d32c933a9a1225c83f
MD5 b71cb86aae148f86dc8cee4e4fe4d896
SHA1 420ccdc6c3099b4668ce663ddd1f517406d90fe0
SHA512 adba6a81942940cfe3a27b6011f8e9305aa3030e2702c8670afe77e8a353b2ac7d424ac98064433963c41b7ce77f6bec15e12d215c0670624199947be33bd114
TLSH
T1994150E05C3D2AC1D1BD1A2FB48B38FC91DCD72AF4A4347D6814EA98463A20D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fcde7c6957b5d403992e4d55e7e639e41989caee045682949379d8af361f90a9
MD5 82001f1a7efa46e9cd2b856ff741012c
SHA1 78fd744f3e593dc10f332c7f00792d733e412521
SHA512 4223f6d8f4e297cc8a7c6562e75b58c7cf47358433ee6c383dc71c7d7c9349a10224ea4d0c57b7c4f76443444a73549019f0f7ec585259cf7fa1e1693a99c25c
TLSH
T1CA414FD19C3D2AD1D4FD1E2EA48B38FC91DCD72AF4A4347D6828EA88463A61D604083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 987d18acbb1a272bc9675529b202ce90d55c8c7d35c49aa3432b08ef0a54304f
MD5 29c4453ce194d0c5dccea6cdb983697c
SHA1 a6a0344ab7b9d753362b18ae5f7022526905ad6c
SHA512 4242dcb893a63b0a34edd6893c0f2b027371b43f856d18b5b2dccbf47427964e50a3dac89c45afd6c2fcbc50abe2a22148e70aad0be42b01429d93d1642fa058
TLSH
T1304141E05C3C26D1D1BD1E6FB48B38FCC2DCD626F4A435796818EE98053A61D608547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b5a2e4e8228d5fc1beb812c1440fda3bf91d8278e04a9fd4e24d570e6faaa2dc
MD5 1bc65043c9b94b103a7704e6062abbaa
SHA1 3e70f3f156f715d15700dce482abd250a1444969
SHA512 9afe9901ceafaf562d5dae8cf93286f592550aa9745f662ea0a394356708d4652fbf6588dae688cc80490312282bf9d36432bb3a2215b6174bccc3d4bc405d5b
TLSH
T169414FE05C3D2AD1D1BD1A2FB48B38FCD1ECD62AF4A4357D6814EE98467A21D608447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f62345482c0c454329c0d955bc01b59207007b1d67cfbd5e164da9130b58aa3e
MD5 d8aa95e424449173f7c7c9cf7324dc7a
SHA1 ebb04e050c9521f2cc299dbabcf79b00c34635e7
SHA512 7abecd9437fd46a627d135d7f5a5f2e9ef69e9887f1086b0d7699e07f4446a707180e1639199aff5fc8c8419e08710ede33034c16abf52ae7eeca680854910be
TLSH
T195414FD15C3D1AD1D1FD1A2EB48B38FC92DCD72AF4A4347D6824EE984A3A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ad65385b2e488fdd1c2c38d0436309188878ee1e583a2f61c97ebc17868b9159
MD5 228a4035a56e6213a7e1dcf4eb1a4470
SHA1 8ffe88842a02659fa92e949c98ee8b9266f1069f
SHA512 b9df6cb87360620f627d4218a9aa35c88b5a53e5337473d924f176af409e2c0aa91083e159c5b97a167cdf8cd22f31315ab7b471bc429ec42eb249f78196e9e7
TLSH
T102515FE14C3C26C1D1BD1E6FB08B78FC82DCD626F4A436396818EE980A3A61D708147F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\143.0.7499.110\chrome_elf.dll
Size 2.6MB
SHA256 564cb9202ba0a312a6135204bd0e8ab2b6fef3954db3507db31aaa2e6cd2b584
MD5 c7da437e40c9c55e4c269feb404a430d
SHA1 e39d0aeef72f19abd3eecfdfbb489655be941dbc
SHA512 e9a5b1cb838c5381dbfaeac7b62e6db11d939262ee6b2e07cbcad8ec0fad638a362c828166e614d18786489cae2c9947188915de1fcd60f5756e81346334b90a
SSDEEP 24576:CRT505L8zjPrDh9qa+xWZHIm6HSUcmc17cvgHCxa57Z9:
TLSH
T1A0C588F0AD01D8C1F57E5B7AF3ED7908A1343227EADD5A4A00A466591EF6A01FD0ECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32_LinkNoDrop32x32.gif

Path C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\backup\ext\images\cursors\win32_LinkNoDrop32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

valorant_unlocker.exe

Path C:\Users\Admin\Downloads\valorant_unlocker (1)\valorant_unlocker\valorant_unlocker.exe
Size 15.2MB
SHA256 b9277014b5a639d3c63027263b25480b693fa0b9ab1049604577c8ae9d863c1b
MD5 20d00fb56dacc7ac0e66d079f88aa029
SHA1 59ef961e9896b0048462ca8670e877c58c76f8a4
SHA512 196f24fe096050937a50ee6f52a420484015105a8226e4d29d82b54a5e14ebdb8a62374b6765b15553b8c69da8dcde2480a4a06458dcb74b55dcc5a13d0148e5
SSDEEP 196608:XnimDUm8J3E0Ji+CMy+g7fSB5Up2CWESXa8E/CMgqfxvOLjY+meslTF:TqE0JiBMz82M2zfdMFy0+kB
TLSH
T1A2F6129635D562B8D0E3C730768722CA70D0795A86FC8E5F2AC72C036A31DEA594B773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

valorant_unlocker.zip

Path C:\Users\Admin\Downloads\valorant_unlocker.zip
Size 45.7MB
SHA256 3bff4dc901227a44e6f40aa6e56b9d8ec3f85c6bb20182e1edf35965eae8a50a
MD5 79320962cc533cfdba77a9f716c86618
SHA1 e804b74c853baad6d527db9f9057a69aa9cad811
SHA512 8ac23470e979aa5c80a9e4dc3615e62d15937276b2ef2c2a760ca437f8c611596c0e6e3f028d0b4e5524fede0e586a905892be5f8053344812627d6a670da25c
SSDEEP 786432:zv3aiL5LNO+kkNtahMgt0rbXzAIGN/UwNeOyIhkWa1REcDflocgEvgHt9l:k+kKRrbXzVGN1NffkZRLqWs3
TLSH
T14FB733365963CC80F62D8BB5F61225732BD243875E407E4B81B8795A8EA76C43CBD0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

valorant_unlocker.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\valorant_unlocker.zip:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1154241471\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1543392193\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1617882595\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1800033596\manifest.json
Size 102B
SHA256 0b11bc370854bd2e625deb04fdfc53ba444e4af63ba831f9de785b44464b59b9
MD5 271bc950e4220b8345b16f5906fb1c9b
SHA1 8b35e3d7ac8aae625e65f3b37d7362b1d2e958d2
SHA512 43412498abc311473210735232214d8272a4e637cd5c1cc234e79f2636f1a3c7260c6c9e6035efca68dc30c6c3f50de479fff69f527b773b17548dfff9cd0107
TLSH
T180B01224EC10F8B3040503BC086CC3D063272F032C4079180DE19F84E80DDDBE071528
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_503373111\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_670039558\edge_checkout_page_validator.js
Size 990KB
SHA256 217a62797b59bdfc667227a422876ccd0f782b2ea41d33fc93c36a6a0db35b09
MD5 80cc733f42616192c044a04fc5abcf81
SHA1 1bf191a0a41ffbe64d3d92c4100421282edb02bb
SHA512 8b521e98dbb71462a19e6c783aaf62dca949befa830bacff12d0c13b3edc38e676b8cc70cd5af98dcd06fb50191747e37cde6e0779bc27515d65751af1487b42
SSDEEP 24576:cs4emRApsqvGzkJUAKjKQmwzErmdJt3LPafik0BwrpiU8LRKLRzMEiJsfaGx1huq:cs4emRAqqvGzkJUAKjKQmwzErmdJt3LC
TLSH
T128253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_670039558\manifest.json
Size 146B
SHA256 d864d826358b5a17c17818c4beb06143f6059377079f0a576764e29f92635145
MD5 154bf0b4087ebebf71107f7c67bdf6aa
SHA1 85886e83753ef9a232bc6a85ecdd90daef3ccb07
SHA512 a388593c464894b76fa730bca7fd4f27246883174f12ef4d53648efccbe9fed6d570ff6217106618cbdd2a35ca9ef260301bc476abf18213a29e973b5e6837d7
TLSH
T1BCC09B73C931AC7115750BD849F59B45EB74574BF511B0563B34018D0B3D5B550607D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_749738399\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_865295243\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_962279956\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_962279956\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-193-0x000001D683AF0000-0x000001D683BDA000-memory.dmp

Download

memory/1360-2879-0x0000000140000000-0x0000000140F3F000-memory.dmp

Download

memory/2592-890-0x000001F3F0EB0000-0x000001F3F0F9A000-memory.dmp

Download

memory/2592-888-0x000001F3F0EB0000-0x000001F3F0F9A000-memory.dmp

Download

memory/3252-2851-0x00007FF81E650000-0x00007FF81E652000-memory.dmp

Download

memory/3252-2852-0x0000000140000000-0x0000000140F3F000-memory.dmp

Download

memory/3252-2895-0x0000000002220000-0x000000000222C000-memory.dmp

Download

memory/3252-2894-0x0000000002120000-0x000000000220A000-memory.dmp

Download

memory/3376-809-0x0000018BB3A80000-0x0000018BB3B6A000-memory.dmp

Download

memory/3592-924-0x00000243A49D0000-0x00000243A4ABA000-memory.dmp

Download

memory/3592-920-0x00000243A49D0000-0x00000243A4ABA000-memory.dmp

Download

memory/4744-798-0x000001C760B40000-0x000001C760C2A000-memory.dmp

Download

memory/5640-74-0x00000151218E0000-0x00000151219CA000-memory.dmp

Download