1111ec76fd38df9bdf41a44bfdd26cd063f293614d7c52fb76cd390f613f3b3f

Analysis

user interaction
yes
max time kernel
421s
max time network
434s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260126-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
02/05/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HaremCraft-0.02.5(Beta)-win.zip
Size 242.6MB
Sample260502-ppewmsbs9j
SHA256 1111ec76fd38df9bdf41a44bfdd26cd063f293614d7c52fb76cd390f613f3b3f
MD5 071d8eac86b6e5a68ce2f8b899184170
SHA1 81a97fd49aa3510c1b3284f3d090399681c2e6d1
SHA512 7905fc5357f3917d4c977dae3412bd5d47bc8c56b1bb8ebb353e18034b522bff895140324b33f6b5f8e95d0779a9e67df392cb8464c3e282208684151d96c4b0
SSDEEP 6291456:fiAppkva4Iq3iEIjfkQXZpan3ZRhBdkJgFtGUMFyW7nFDKdCg2ik:fH4Iq3ipfkQUJ/IgjGUMFJFK8gRk
TLSH
T13CC833D867AA7988D8EFBCBA0DF01D2CD30921DD525E257A204713DD1DAB6A3DB7B010
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_1215438097\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_1215438097\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3968_1480473585\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\kk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3968_194014855\_locales\en_US\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5592	msedge.exe
2396	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MyNovel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MyNovel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	MyNovel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MyElfFamily.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MyElfFamily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MyElfFamily.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MyNovel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	MyElfFamily.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MyElfFamily.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	MyElfFamily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MyNovel.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	MyNovel.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222028619823977"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{D029ECE7-B889-47A3-B619-98A5EA6E7D69}	MyNovel.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4214655515-2537246629-1547560666-1000\{4A50ED75-D1F0-4DA8-9EBE-9691F83A0BBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3948	MyElfFamily.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1592	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
816	msedge.exe
816	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5676	MyNovel.exe
3948	MyElfFamily.exe
3948	MyElfFamily.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 6028	5676	MyNovel.exe	107
PID 6028 wrote to memory of 3384	6028	UnityCrashHandler64.exe	111
PID 3948 wrote to memory of 5196	3948	MyElfFamily.exe	117
PID 3948 wrote to memory of 3348	3948	MyElfFamily.exe	119
PID 3948 wrote to memory of 4864	3948	MyElfFamily.exe	121
PID 3948 wrote to memory of 4968	3948	MyElfFamily.exe	124
PID 4968 wrote to memory of 816	4968	msedge.exe	125
PID 816 wrote to memory of 4948	816	msedge.exe	126
PID 816 wrote to memory of 2396	816	msedge.exe	127
PID 816 wrote to memory of 2124	816	msedge.exe	128
PID 816 wrote to memory of 2124	816	msedge.exe	128
PID 816 wrote to memory of 2124	816	msedge.exe	128
PID 816 wrote to memory of 5140	816	msedge.exe	129
PID 816 wrote to memory of 5140	816	msedge.exe	129
PID 816 wrote to memory of 1420	816	msedge.exe	131
PID 816 wrote to memory of 376	816	msedge.exe	132
PID 816 wrote to memory of 1420	816	msedge.exe	131
PID 816 wrote to memory of 1420	816	msedge.exe	131
PID 816 wrote to memory of 376	816	msedge.exe	132
PID 816 wrote to memory of 376	816	msedge.exe	132
PID 816 wrote to memory of 3684	816	msedge.exe	135
PID 816 wrote to memory of 3684	816	msedge.exe	135
PID 816 wrote to memory of 3684	816	msedge.exe	135
PID 816 wrote to memory of 3968	816	msedge.exe	136
PID 3968 wrote to memory of 5184	3968	msedge.exe	137
PID 3968 wrote to memory of 5592	3968	msedge.exe	138
PID 3968 wrote to memory of 5868	3968	msedge.exe	139
PID 3968 wrote to memory of 5868	3968	msedge.exe	139
PID 3968 wrote to memory of 5868	3968	msedge.exe	139
PID 3968 wrote to memory of 2328	3968	msedge.exe	141
PID 3968 wrote to memory of 2328	3968	msedge.exe	141
PID 3968 wrote to memory of 5092	3968	msedge.exe	144
PID 3968 wrote to memory of 4936	3968	msedge.exe	147
PID 3968 wrote to memory of 1416	3968	msedge.exe	148
PID 3968 wrote to memory of 3620	3968	msedge.exe	149
PID 3968 wrote to memory of 3508	3968	msedge.exe	150
PID 3968 wrote to memory of 3508	3968	msedge.exe	150
PID 3968 wrote to memory of 1396	3968	msedge.exe	151
PID 3968 wrote to memory of 1396	3968	msedge.exe	151
PID 3968 wrote to memory of 3604	3968	msedge.exe	153
PID 3968 wrote to memory of 3604	3968	msedge.exe	153

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\HaremCraft-0.02.5(Beta)-win.zip
1⤵
PID:5624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2276 -prefsLen 27136 -prefMapHandle 2280 -prefMapSize 270279 -ipcHandle 2296 -initialChannelId {eda4206a-efe7-41a9-b122-1d975aa8e73f} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
1⤵
PID:4868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3616 -prefsLen 27277 -prefMapHandle 3620 -prefMapSize 270279 -jsInitHandle 3624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3632 -initialChannelId {c92f8e47-cd7d-4c9b-829c-653d76490776} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
1⤵
- Checks processor information in registry
PID:6040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3780 -prefsLen 27277 -prefMapHandle 3784 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {101505df-3693-4324-ac6b-33e0ca143c47} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
1⤵
PID:1488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2496 -prefsLen 34776 -prefMapHandle 2660 -prefMapSize 270279 -jsInitHandle 2920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2500 -initialChannelId {96dfb5db-8759-4eac-83d3-a112b79f2ce5} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
1⤵
- Checks processor information in registry
PID:4904

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4820 -prefsLen 34825 -prefMapHandle 4824 -prefMapSize 270279 -ipcHandle 4832 -initialChannelId {6401f0bb-8455-4248-8f1d-07c58b8c3fdb} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
1⤵
- Checks processor information in registry
PID:3500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4388 -prefsLen 32952 -prefMapHandle 4392 -prefMapSize 270279 -jsInitHandle 4400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {43a5d108-3ebc-4afd-88ac-784458912bca} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
1⤵
- Checks processor information in registry
PID:4056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5368 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {4ff6b5d9-9b29-4344-8393-468eedf74d31} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
1⤵
- Checks processor information in registry
PID:3664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 32952 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5572 -initialChannelId {d6a4fa68-c72e-437b-991b-2acc992f8780} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
1⤵
- Checks processor information in registry
PID:5068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6236 -prefsLen 33071 -prefMapHandle 6240 -prefMapSize 270279 -jsInitHandle 6244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6252 -initialChannelId {088499d5-236d-49cf-b406-eaa31a39a72d} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
1⤵
- Checks processor information in registry
PID:2840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 33071 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 6584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6196 -initialChannelId {73fe8cd1-f208-4280-8035-7a0d68d25a9c} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
1⤵
- Checks processor information in registry
PID:920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1944

C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe
"C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe"
1⤵
PID:3248

C:\Users\Admin\Desktop\RunRunRun 0.1\MyNovel.exe
"C:\Users\Admin\Desktop\RunRunRun 0.1\MyNovel.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe" --attach 5676 2420923174912
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\RunRunRun 0.1\UnityCrashHandler64.exe" "5676" "2420923174912"
    3⤵
    PID:3384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4 0x454
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6976 -prefsLen 36958 -prefMapHandle 6840 -prefMapSize 270279 -jsInitHandle 4624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {f9ac3a13-7c62-4c89-b371-289c33733f87} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
1⤵
- Checks processor information in registry
PID:2164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2540 -prefsLen 36958 -prefMapHandle 6208 -prefMapSize 270279 -jsInitHandle 6188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6872 -initialChannelId {b40cace7-64a0-4ebc-ab8c-41d0c7980d8a} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
1⤵
- Checks processor information in registry
PID:4364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 36958 -prefMapHandle 7220 -prefMapSize 270279 -jsInitHandle 7104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7248 -initialChannelId {572652db-7ea2-40f4-924d-d43daf76f3fe} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
1⤵
- Checks processor information in registry
PID:4220

C:\Users\Admin\Desktop\MyElfFamily-0.0.2-pc\MyElfFamily.exe
"C:\Users\Admin\Desktop\MyElfFamily-0.0.2-pc\MyElfFamily.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/MyElfFamily
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://t.me/MyElfFamily
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x268,0x7ff86dd0c188,0x7ff86dd0c194,0x7ff86dd0c1a0
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,9176392568769198872,4917022362591636390,524288 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
      4⤵
      System Time Discovery
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,14648875766238359790,164710295614634961,262144 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,11069953892309569327,17555459532516145239,524288 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,11702887399832325329,11359606477464213619,2097152 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,12135943756982346423,11622798777231625538,2097152 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,1583573767502443136,7490554796628880818,2097152 --field-trial-handle=2292,i,6807500903886744,1321475296875939181,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff86dd0c188,0x7ff86dd0c194,0x7ff86dd0c1a0
        5⤵
        
        PID:5184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,8442338777784744248,13011518856800653687,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,11799180706196110857,10247336780532409313,262144 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
        5⤵
        
        PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,6704091450657865417,9766287650008210204,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
        5⤵
        
        PID:2328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,1664751397534722496,17647081656350897154,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,1664751397534722496,17647081656350897154,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16132747233173928089,15620591793659782372,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,8149437362790693028,2030237372830872891,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        5⤵
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,8059735057249378420,13858164225504084675,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
        5⤵
        
        PID:3620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,13781478436689411927,11440834805579735735,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
        5⤵
        
        PID:3508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,11044696580346331829,13661147573136377477,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
        5⤵
        
        PID:1396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,18183002002273289280,18323219513451215564,524288 --field-trial-handle=2260,i,4283083262436207911,2754647787881151445,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
        5⤵
        
        PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e61c9f908475582ec0a8eb3b5cf00399511c5e42d8f5f9e1bd10dee6c3382278
MD5 00930effb53150b1c15782f203b6b229
SHA1 f2d3a801df3b68ee8a225ab8aebfafbc557fe47c
SHA512 baf5ecdc128b0737fee0d6a21544bc1de0f07159bd0b831936ace2f6b71df216792cbd6f9346d50bcb17ca955a247d1d414d019e9f3233553a84f8ae7ace1c7f
TLSH
T138D0C03812B13C34C85EE47024043B0B3619C47306534F1418B314FC0C4314008970EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3bdd57139d99fb171187e241d0c03cde224f9c176dac9c20c60f28f29e64d27d
MD5 45635e74a1cb997ad7b0c65562e1854b
SHA1 410a8995e5f0ab9af3d7133e347ff08392ea8653
SHA512 239eff3e5a6810ecf550fe74b8292209366c145d90efbf4293b3f4e3842c2b505baa3cc749e27b80454fe4c792925cdb299145af908b40e927282f7899be7372
TLSH
T1DBD0803C52B57C74C86EE57424157B0B7519D87756535F15187315FC0C4314015974EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f75c58c33f249ff6ec0152bf87477c5b2acd4f2d4eeddfd0134eb445fc64eae1
MD5 a209b3a599c6d971aa166d8d992e81e5
SHA1 7ea759c51bf83d3ca01170805a44bbd50222d09e
SHA512 4cca00fda2f520e83e88f34ccf1265c2380d0274a81607d3d38b3aca404805988c04b35dd097c17d2842600ac838126de3155ef2e76ea777d580077c52d169e5
TLSH
T198D0973032A9BC14C42A1070181022563A0A889239A34914A02600FC881B04017D10AB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3dea9e79b04c91acfdb3609f6202df9dc4d49a507a052fb3f459810ef724c70b
MD5 935bcc533cd36c03b4be6fd5440edb5d
SHA1 269614b7d0ac61ad8054b05fee1fcda30c825286
SHA512 0c43d2a7e2dcdbd9857b4b845200e6e7fb8e29156f14df81502e2994d6b9cf39bc45ca9388edcc15415ec68c03e2b59d753447c31f733c671251701d243e8a55
TLSH
T1F9E02BFAC820DC2718FD1718A458074AEA0143572A81845F3A3CD2088FF853B0985D6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 131d0a5955ce343e5c5e014922caf945eca8cd5f468b7bdad815baf086dc71cc
MD5 cfe041de45eb116babfb48f456941198
SHA1 345bba0d51ebcc16daa0412add9a63d32739f432
SHA512 993c5121da8e74fd8299b38f11466b183e9923ae796493089a80d233bee7646fef3a911ab7f64323a92ac4db43a4394fd4c2e7c0a4ce688f47c5358f4b9ada49
SSDEEP 384:WVImzdY7kauUTaleu6LWAbDviqvBFSMjZ8+:MbTauUTNu6LWaGBMjZ
TLSH
T124133ABD3A603D81EACB143D318FAAB0B775E83CE6D59617477E391483387429D1E886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a7a0f0ddc71498525ab40378f1febc396955876e2283227955157125a1d3ade6
MD5 1ae45622c9500402668425d0ffcf7380
SHA1 37ab20ce6933519f306f01c87e9aa70a27686318
SHA512 8033bcb57d9737d0d9813caaf1687efeb3ff3060838ceedc6f031c5907ac5b408b95a5e47e356ee86d6540f41dfd24faeb9e78efa9c24fd4fcb1afbd10a3a8d2
SSDEEP 1536:xkF7DupqL6kv+qeA5xcxaXUYdStUi6A/Z7KcJgwa8U7rEopI0kC:XINstN/gwBwrXpI0k
TLSH
T14C4450F71951A01BCFA812F6E2033A3DD17B055D6CE1F8EAD63C0C952825F21B6BDA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 51bae50252b39f9c86ceb292393e4e9a8943a91b01af44499f7b420622f6ad47
MD5 2d30ee84eaa7f6150406c7278f51375a
SHA1 190042c95598b5b780a064c7da4b7b578e0bebef
SHA512 612b1259ea85725e47c8451224f0aa2f962515f70a6e9e4c7661066a7e3dd1eb899abf535f427be74e4f563b3d18e219fbd2816b3aab5c49c2001bd008ab3262
SSDEEP 3072:pZM5mlHHQm+GDsF70mHxLHjSb0xotwrZy:pZM5zm+GDsF5xLHGb0xo2Zy
TLSH
T13E256BEE9B382C86DD6B4D70B4E0FC22BCB41193B61AE1D34C18C990875A3C6679B5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 7abd14eb561364649e2850f4ceeed70494d1f1e9e6edf9d7a370e25f36f9ca3b
MD5 8224c3d63a2c2f450d63c864447b7b4c
SHA1 631c01cfd43c5e6d7cfb4b25a43f2deb5bbe0052
SHA512 5f9b81dcc8a13b4e8a07f61d07eb1042b83c7c37b1a74949bc33839539c12c2d6285b1d057819438c2415fa9839f74e156471531bfd77c4750dc44e3fa3026cc
SSDEEP 24576:fWm9l+DJybLMPE4h4XGp9/yc81tIAltXkp/AfgBUfTfGSNDOjsLKUJY:f2DIHM84hkG1g6AltXkNRU7fZDOVUm
TLSH
T175867DEEC6685C83CE678A30B4E0EC477C7412C3F595C1D38958C69442A77C5BAEE2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 018c401f7e6925ecfba3668841e5cb774de2300cd6fea6ef7092ad25a73c943f
MD5 f01398ce7d545d81553e04ee4053d19e
SHA1 980f95717fb7ef1865f350251940b776b839c6e9
SHA512 dd708a352287cbfc4b36630697f078fbfef60a7f6affe79c2f4705970a19d2c2e243764b93f32a2dd4ebde1349c2cb28af258dc47ccde3bebaf1df1797ac32e9
TLSH
T195614F9BD19E5829E39747B47AE4749D32F08CA8430BBE1C1D5C08F84A3DBA3858CB60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf6cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5cf6cb.TMP
Size 3KB
SHA256 bf50cc98c5a730c34651b2923ae9fc9174434495113240fbe3f1cc47f2acc26e
MD5 ccb49dc71c53bf9009d08634b39a00d1
SHA1 c7357c22b047cdb38b7c7e8022c5b3b7257c7635
SHA512 e33e433843d2beb8fb2a17c6fbe1cfe6166d8b80c7ed5d7f508067397a9ce537c803bb9f94fa060d18f3f2c198afb7a7e0f6df57ccb74e60c537c52e02a901d6
TLSH
T14661209BD19D5829E35757B47AE4749E32F08C68430BBE1C1D5C08F84A3D7A3858CB64
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 e734210f35367d367448d7f218be01e2e801a455b1bdd1caa6a30e08388ff5f6
MD5 b87f8ef7404806b44959307d95d9405d
SHA1 2197e38ba90da6cb605218a76c5ef747e6cfeab8
SHA512 a280e4b128c8d5297376f7a782ed36b37b8de99daf1ad924f12577a3de84772b910fceeb87c5a703cf5861080124ac3f408ffdd2ba335fd845c9465266003664
TLSH
T15AE0DF98A4CBC2AE662038C2C26C6B18C2C0344BD7CAEF831704DCC07E03029B28A796
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c67634f2857a012b0fb5be093bba24d74631a0d2c20fe405adfa9b40b6932c25
MD5 5a4f65c3f17a2e0bbdc5bd5efa834ccc
SHA1 48abc5caa59319b50e62da00986b5285fddf664e
SHA512 6941b05262d27add3a652323c18ef32fe36b56dc5a8e350e25add485983f24cc49ab7095d4d2b903a8738404fcc0784e808b234b650d17041ea56802afdfb102
TLSH
T19AE0268809CFC929D0286CD7C76D6B0CCAD23803BAC83F83974BE8406941241E28A790
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 0f5c5889237fc1a16019d062e250fbb045350bb5ba9272757bfc9ef2dc21d48f
MD5 c8a63b0dff2916e5be46cb5d2bfe74fa
SHA1 43be894f5f9ff632158974f582cda225ae6c6b98
SHA512 0fe186b4ac9af046411ff114b6257bd5af23169dd8c26ce6625ca75950dbeaad6258462f6042754b5d48cb94f501c71ba1139c3745e8d55cde8e010953aab47b
SSDEEP 96:nIPIU+bGz83uy3+u4tgp4DLjGQLBze9z3BtjBHMsDEuspU0wbtqrOQpPfR4J+MCT:nIf+G83uy3Ct7XBBKtPH7DXspU3iV
TLSH
T14B141F1E4F243721CDBD917669E744B35D7CF03FCB5266DA686104B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Size 8KB
SHA256 1960d8f4daf651762abbccac2d1a471be61bdc0bca27d2ca6df66662bb884088
MD5 149b6fb2b99b4da60b794889077d15c0
SHA1 4a5c0e475bbd2a97ec301ef7a4f9c648d4d962d4
SHA512 e51afa94460062b5b248bdc8f4385d57b3f5d99a05699aeb897c7dafb8472ba6a8b884cf2b65c8996703a59b62d699ea6f9f73d55a0026dbb96d589671c5d465
SSDEEP 3:h19HlFlljq7A/mhWJFuQ3sVkWURE94dwenqFtjE9SFcTpz0WWaV1vGrV9RUIKkn:j9HE7nVk8ud4FS99pzTB1eBvn
TLSH
T13A0212A04A60AA73EC4CDF3DA2C642E92FB2290C8CA1DC02E1288C110A009CC928856F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 3fd9a9a58c16a8d0dbb53d94b9b3f1a36faa9d403cff7aa946271a5b621baf90
MD5 7c4aa08b0da0482a20cc60a20cee67aa
SHA1 b8c218013ebd7ac873c924c36d67bc7340cc029e
SHA512 a06ea88ab619968693c992bb1b3dc2b608ff5c50e2120189f843b1fcd35b08ccf3c9d50f3c4870e88265d8aa8a35e2508db2ea1c06e433f995e7a01658d19fea
TLSH
T14DE0D8A645DEC1699318609BC3197B0CC3E1340BD6C96F835B05E945B843044B2856D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 eb0a286cf038e7ad5bc7e3bfa2642e53b6194d5a5c5cea8b9dde3f8d82922c6f
MD5 ded72c200f1eebb9f565c22ae9eb9758
SHA1 d99779e4797173592e95e82c370bb120bf2c7ad6
SHA512 cca9eb1867df455fb4f3fe1dc397fc29a4fe83ab8f251f960fcd48451f970962335665abcc1c94f392009719ca3af6a1fa3f69e9b05cbd096762a979dcc4e2c9
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBBLooQoadMuIw:T2SLopFMatSaw/auUOt8B2oQoauuIw
TLSH
T18F92FF0E5F302220D0F04B36DDD1855B2F7C201CC3B32659AE1810F3CEA25ABF5050AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dbad2aa93a412fab1ee45a052bcbdb30ce1c75eba2b3120908a0580c4fc6276f
MD5 b2f81d4b468c30be0187c5719a991489
SHA1 bcb0b7578fc445fadf8910da9defff3741d517ff
SHA512 aecb9409006b2826798b7b0ffa37676dbf3ef7978f97be48bb2e99244f2a44506591b5ca008645d358857e04ba6b045f3fcaaca1dae1504e62d0f3eef5f65fb2
TLSH
T127318CF743B4866E9B11D6F0BA186E2F8E5D0112436C7D9A89E06E2793F3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 716260f9de57b19b11c0c3064085933012e12a8c9da2044c387411201b314b9c
MD5 384ec261988375207e2ca891aeca5e3b
SHA1 a47d0ffc27689909f53e7293bc6de0a343f273c2
SHA512 3063fbe0ed979392ef22fb069233d9529ca279a6f7c3b795801078425213097c2d17e492bd5dad4993a1c3e596b39760f63d81701b07518d02d67536179d4a75
TLSH
T1CD41A2F783F8856D8A1195F0FA187E2BCE5D0511432C3D9A89E4AF1B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 5d09da05d156f5dcf76133c985c3923fdbe258ad936775db16888935580aeb78
MD5 0dd153ea2c351b1012b2a62ba3dfbedd
SHA1 e42e9cfa163e0320b5e787e17294ae27409c511d
SHA512 a2057b2dbdc8403f82e92b5a067b948b747e29235aef0b3a7837eb24616966a5e60fa08469919e8986fcd6f65a97d647d24686b91ff115fd75b99a65ad734588
SSDEEP 96:uIEumQv8m1ccnvS6CJvtxAefEnFBsycGM4g:uIEumQv8m1ccnvS6wvu8J
TLSH
T107F2D0FA07276105D98444B0E400AFCFAF16404B47B6B2ED76D447E3F3A25E2B2B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 a2859fcc20c34a32e330f32dbbd5aeb5d54eaa186e3d631e4faa38100b66a765
MD5 f6b546669c80f50cc1cbab610545dad6
SHA1 98c073c37e005f238d56eb588a6e3a611e1bcfba
SHA512 68412f0bab56d2ea00f46c80dda091f00b8eaae5f6f63ebfbc62337471c8ae9bb8e16b0b4be3006c3a25e2b7a1b3085e8216013d134ee0ed9e610b1f47062ed4
TLSH
T177F0E95BC5B9A53610AC0D7A6D84FC463ABED4341241E4B1DEA7C3ACB0C90F3CB29966
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f8fa3bfbf1b4751fb22cc4acd87647037a8a6b468ab0eb93a2e7854a64be8365
MD5 22a25d52b1a2be8a8f14823c5f8e92cf
SHA1 1ff65cbe99f6c41263e550a40fbd98e96bb33113
SHA512 f4566ebab59e317f85bd4261e22a815b6e77dfa7dc13e00c03343c77ce9a74a20d34459c404351f7458098027ffa23a51d2fecdfdeeb3a63e72b33ea0e55130a
SSDEEP 192:sxZ6RayMqZ/K1Ml8Jgi/f/swWpV2jN8Z1Nzodpt9HW6+WN0L1ryv/Y3YlcK7ZIg0:sxZ6B3i/f/swWv2jeZ1GLHb0po/FZZ6
TLSH
T1EE72F855AA38597BCCD6D219FA457F93D7F9056391904E18AAFC8E0C10E6AED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 cd142f2f8eb05e8bbbd739e318b29b1fd74f395749a77b25394d48cd5dc12ec2
MD5 58b9782de6d0ab594b02d3f15bd59dd0
SHA1 a17e3d66fd329e5396840163eccb50b0d7176e1e
SHA512 5cb29cca7b6f00db44115e1d2eceb8641ba96514363c38cb7935e85e119f019761afc6b79e6b6e27a350f2e7b672fc6f5951995a8256272019b9aa0ed24a7f55
SSDEEP 768:FTsxA8P7pLuL/tpWvIMLA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEn4zLlusg5qroV:FTsxA8JE/tpWvIMLAu1jaxn4zLUx5BoI
TLSH
T173F21B7B6C0CCB7E4F804E9CDD2ABE8A6DE801CB96D8895447FA940C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 9dfe994cbd26da896626ffd968057c3388e90084fe2ce90ccaa42177fa62c0ba
MD5 a3351acf0f8690c53427e9a35dd3b80d
SHA1 5b770e52b6215be9376a9acaf350a2dc6b8ef301
SHA512 e40504be99856316e4f7a60ec1dbab89338c45e2aea60738719e681375ce4121ac1e07745fcaaa949430c079b9b960129150fe2b330059ba16b053217bfa6c9a
TLSH
T1FBE0269C05CAC17EA12D2183833DD70CC2E67447D2C83FA22F85CE40A543508B29A2D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 cf53f553af958f055b755dfe05e1462f51a414a1dcce22deb43322a1f108e29f
MD5 7951f58a74a07be89b0dbc049142efd3
SHA1 9ad16d10727d8687560af674b78531aed3d06053
SHA512 8b39f6100ceb241d19d8ee7eb40b5b5df6d7559d75aa7ec00310cc8fbab09bfe8662cef5261546c76782ac02cfc83a60f4fc1470d448f268c78713ffbfe7c6e8
TLSH
T18DE0486C15DAC62EA15920D7C37DE728C1E37447E6C86FB12B09D940A6071547357691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 055800e13fad2ddb9112e095deb0c2bc15eec8af04ddb0006322490012d63994
MD5 6449a0198aef8324736bc8354ff96957
SHA1 815ec2cb0f9c9c62a7a23211875db48ba44e8aed
SHA512 68e20fc2dc41ccea69fcf2ddfc1ca32517bc360480659a2df8f5ca8e4f26bb98197bf58964302ea2331589fdce5b478ca7cecc58a2be7a086deec42631a9ec3e
TLSH
T150E086BC4BEBC6395419A0C7C379AF1DC2F1780BABC8BFE75709D840A901144F6AA690
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e72cd3963b233bf6b51ce149161f4f14c2368b84b65efda41c93212d3a71995f
MD5 16904c2967a94c536c2725d02a528c84
SHA1 a1affc95443fd3361b07c7d50e98f072b94195c4
SHA512 1ccaadc5d6d18036224714634dbd5d236ae0711b722ce0b7c3729d95fad6ee4c24d90b3fbc9c3d4ca39e5251a5aa92ce993a66b42c19dd08433f9ec708b9ff75
SSDEEP 384:cnF65VzPbMf4xNR5BbslV4jFC8VOaUWWpC/WSY8B0Hs0XiXN2B+7lI3MoemWZmdL:cOhfN2B+7vnPtk3iLiX7NxlYxs/zfB3V
TLSH
T144B25C3471BEC211397D3AC89199BC26474230A23458F57B7FE940A64F67E281CFDAE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 13e8c845b0fc0a85b1f3a35740233399861d6244a187a39e0fa8a865bf4766a1
MD5 71235c869b8305cfc343f54eafc6fc8c
SHA1 bf5e9678d456a2bcd348963c7ce51eaf3e5dbb51
SHA512 23e8f4fac3d8e289cf8d4a8afadcf71591d63648086965ec79aed1f777e766304525dd0f6a3a03815b939eace4569f67d9b7b4af2e0e71f5dfa6cb1f522ee4c4
SSDEEP 192:P+xW4xfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxNfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1E724730A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 9b2a71d063d213e4c5919d6acd43f2e17f1e02973d5d34715a3dfc893f305b46
MD5 be2494dc48130d9d5ff23761e5af4487
SHA1 86ffa191ef416a90deb1015cf17d25a1ea0721d8
SHA512 cfad3e2510cd5ae72da33f074dc99da1a4f159f66fd53dbd477006d554f81c85ea8b5bf1305ff30ce3dc63b063ee941517b7c3c253f7a24ab8e7019c684105ce
SSDEEP 192:EQOQ4AsklrNTssUQ/n7lgQiIIIBbFMIMLuYcYOK9:gQhsumsxiQiIIIBbFMIMqB
TLSH
T19052B5192B051F77C39E9F7A125A8B961BC4C881457122AD31601C5F9DF3F9387D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 e405d6176bcf130cb443672e1770e255f8f069c89803d68997186c0aefb7f3f4
MD5 3d4912ab624f4d44071a9991ae7c24c5
SHA1 306d86c91c86b4091a874d5a5a83bc5cc30433b5
SHA512 8e51a1c1240beab7d8d0fef9090d08a1e61e683f8a846f05f2439e276cf78feaebe3475b0eeae3c572094203c709265fdb1387cb6772142f5df1251587ec6e93
TLSH
T107E02094F5DDC19FF03820C783199708C3C23443EBC42FC59F01C4446541100F349E51
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9dec63bbc38a90235af4ab03e1ba03befa91123037b3743d6724de34f9a90942
MD5 98828989befbb739145078705c35ec05
SHA1 ced45abab59401fe63604869a301fd5fb4b20a8d
SHA512 09dd71491454d43904147c834e3599daac658fdcd6e52844fc1be0804a5ca26e332f99349d3245e9038addd158b07bf5535f6939956e4ca605cc672339fae14b
TLSH
T1C121C455F320C198E149973EA02A9B391378DC529FFCEC1F857930352DB2E001E9B6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 1022ead5a948f48cbf423ad66d94903837986bd1fab6fc9ab6549c2aed0756af
MD5 d46145cd51bfb8b6c7944508fba4297b
SHA1 427f665952bd64d5ba88492de702104b6c979971
SHA512 beaa795884373451cfaef2a9b01b08b8fcf5a0ba46228ce6d53aceee612d6c3dadf38486b527479618a5c696bcf752110544f58708c37119b808a8ed36f34d1d
TLSH
T128E02694F8CEC1EFD02820C38369A748E3D23883EBC82F829F01CD84A941141F38EA91
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 dea5c653cac68098f7c80a76d97f289d010fef5707049df0f65dbcbb8eee27a0
MD5 83718fbfc9811714cb3abd16132a7926
SHA1 195f8b3a2ed9910564d8e04e646818e1de96122a
SHA512 ec3e1152cb260f6f3e4a560adca8287318bd4cf76acd1d3465a271204bcea03910ef7b8d2d9ac97f83ff9c0669c8a33764418c04d7b6d09b1bc1101645f06615
SSDEEP 3:MsEllllkEthXllkl2zEflio+:/M/xT02zn
TLSH
T132440444FFCC0405C50011304551C7501370D4107511D75735D514737CC75400C00300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b32c8356b287ae6271b6252138a5c02faa1f43a77eaf0699c0e5c187824c7735
MD5 f87f48194e663fbd1f1b0dbd18f7e265
SHA1 6ebdfa3c4e6c81a8cfe94b6212ed94c32a11763e
SHA512 43787a2019ae76fa7566d42593ca0516214b50678ab14c0c7db57e87389df31b6e2f40a86328d3808e193b27c1c8a9b9d3c52f548767a9555b2b12c004697553
SSDEEP 384:nxiFocXqnssNI8TUNTUlI4kGq1/LyuWWkIfTbIiHaNZ85LCAMjGlTV7/uJJnPF7m:YF6snwghpvbIiHaNZaLCdGJV7/uJJ4
TLSH
T129C22839DC88CD7B98EE6B88A24E76539DF42273D5984ED8E7C81F0C40A359D6307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 54ed27172f55c26a09664db05211a28269263b4a21a669fa1ee0f89863395f44
MD5 bcd4f1f319058f34129e6dbcbd2130e4
SHA1 c782265c2933396e00005749121f6db9280bbbc7
SHA512 c744be948cf8b6592848ff107b7a961a5a69ac4491cd2954a10928089688e5777bdac194b659484cdfb043da765a98e9cb0fcd8ee3251e3dd726919684f4070a
SSDEEP 384:nLiFavqMg3sNJ8TUNTUlImkrq1/IHd9wfuYHaNZ85LCAMhnkX+VWi9ehQRBLNPk1:mFayv36wgpbYHaNZaLC/nMyeuRnc
TLSH
T170C25B35EC98DEA7ECE68FD9E75A7A07EEE001A3858C4AD4D9D81D0D10971DE130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 f32846625e37b9ddb17fad65ea57a6dbca0feb36b84dc4bd9fc244044645c5dd
MD5 3e47a5ef570d117551fc97720067c871
SHA1 632d99f4775e7c0d96df7acc6a9b84fd7135a47c
SHA512 74e8960094c02ab75f6b41812b9dd8fe6ebb5ca612e7b41f3bb03a9c93ca8431f9576810b85402f19d956f8a69dbaf1305bb04e1b06e0c0c7ebcbe701b62b12f
SSDEEP 384:njiFFvqMlsNU8TUNTUlI4ks7q1/LyDW9wfuYHaNZ85LCAMl1HKLXrm7j4u+gdJn/:OFFy07wgIdUYHaNZaLC7Ynm7j4u+qJBF
TLSH
T1A1E2067A9C54DD7F98EEBB89634E2A129DE01133C5AC4AD8E7C80F0D90B649CF347865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 70d5e357218e088cb4e73aff3e77421e985d470168eea9bd17883aea492ccac1
MD5 a04343b112d918ab06ea1347937c3f03
SHA1 d0ff473ed560ab67ea0fc54e078795ccc815beb8
SHA512 c0ccd7ec47941ae23db2505c7caffef7fd54b3cfe7fe22811657a097b02de14542bdfb861d836076241cd717c3333912271a97f5f62cc4112de26d9d614aca10
SSDEEP 384:noiFavqMg3sN48TUNTUlImkrq1/28X9wfuYHaNZ85LCAMl1Hr4wwkX+VWi9ehQRc:zFayv3LwgAdYHaNZaLC7pcMyeuRnc
TLSH
T100C25B36EC98DDA7ECE68BD9E75A3607DEE042A3858C4AD4D5D82D0D009B5AD530BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 91adee4b9fa95a7126327c01c49148398d06d2c2737b11ad9b1550afb9fc60be
MD5 9c682431a703a46f9fa39d1f367bc1d3
SHA1 fcdf38281a46ee15487d0f6838af75455fe2a642
SHA512 dc001adb56c907357a301fd6c0ab4382780f259098e9d2bd2246692bcbfa2535ac8067ceffb5985c2e617a2c9c8091d81426d0bf5399cf276010ea01a57ecba4
SSDEEP 384:nHiFocXqnssNI8TUNTUlI4kGq1/LyuW9wfuYHaNZ85LCAMl1HlGMA1JnPF7Igw:CF6snwghUYHaNZaLC7zGMKJ4
TLSH
T14CB23976DC98CD7BECEB4B99B25A7643DEE421A3898C4ED4E9C85E4C00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 474d293f01b530f7ec8de89f81ceb6fe4b0bdae3297d315ca82d4f93459f01c8
MD5 e23f4ff162a22ab3e8bce61d2dc7e031
SHA1 fade7cc82861e1270ee607345882a9f30c763aa6
SHA512 f07593073cbf54bfcae48874b04f814100d2a4dce8333ba116f645b94dab4e5a755fea03f8927f6a5b5093e1b4c2ed10f34460a85cf1c77550ed76eef62ba755
SSDEEP 384:njiFFvqMlsNU8TUNTUlI4ks7q1/LykW9wfuYHaNZ85LCAMl1HKLXrm7j4u+gdJn/:OFFy07wgISUYHaNZaLC7Ynm7j4u+qJBF
TLSH
T13EE2067A9C54DD7F98EEBB89630E2A129DE01133C5AC4AD8E7C80F0D907649CF347861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7271be9f1ba69fa5b98450dfd059f9a48bfb348662a38c76fed4877d15df1901
MD5 7b644205806f25e3c9b8f2c4103acd8f
SHA1 baa55d8757a58535e3a7abe64767aa679c749cbf
SHA512 85c2f9cd5b5863b610837cd9543405062527bbb9a6b09cd54bf9a88db178f647a5daec4d47d865996bf90d93d2a50fc4841841cedd71f5fcfe532586854940e9
SSDEEP 384:njiFocXqnssNI8TUNTUlI4kGq1/LyuW9wfuYHaNZ85LCAMl1HlGMA1JnPF7Igw:OF6snwghUYHaNZaLC7zGMKJ4
TLSH
T1B5B23A76DC98CD7BECEB4B99B25A7643DEE421A3898C4ED4E9C85E4C00875DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 74079c420aebfb85125ebb6355af7054aaf5b7996e499c253de06828466bbd06
MD5 108a9b263828cd6a01228e88d062ef51
SHA1 a3e14bb4f88730a4d6b58921aea07ab906764ccd
SHA512 224a9c9a6c0a1a65411796ce2375f3b62b19b9095736e722814628dda8512e0b74f6dfeb8236abbd5eb381c3de696ffb926d5ff8559dffa13b0187f066875aee
SSDEEP 3:MsEllllkEthXllkl2zEfle:/M/xT02z
TLSH
T106440404FFC50C05D54010744053C3503370D41045115F4735D545735DC75414C40100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b7ac350e84a9a53e3060bf885c31e0336202857e4c3a3a795765a5dbb0a13eb
MD5 684e2282b2ffe900d7e929b7e6d91e6d
SHA1 aba5e371610e9280af6b764bd6d79734c1ea6626
SHA512 5548d258a612e4bd0d7b9dced1d927bd912c1a8dec0c55902204125e9dcbd627388f65a59347a01464162f5e681ea8dcd76ce6767bf804fb9a20d4b7d21c66a4
TLSH
T11441275CA2E91109B3B77F5AABF6A86D547BBC772E46D09D10110E4F0A22B40DC71737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 2508f286ae952c756cdecd1a0a10dfd50c6d496c9ef65ee888c681f49bf04ef2
MD5 5ddc045ac0d30d69c9f8bd355292883a
SHA1 d2de57672fb043325f4aef57f85c5edaa0540454
SHA512 e2c50c47d46e14401d4c4db80967deb6d5278d0f47b846263dd3ee0265d87a004dc76e9659cc0f587cf529245b3a3d72a7e6e5a79251840d2fd09207b91e97d4
TLSH
T1035140546AE91158B3B37F566FF7A86D547FBC232E07D55D10010E4F0A27A41C891737
MD5 SHA1 SHA512 TLSH

Submit Download

fac9acd7-a2f0-4fca-8cfb-3ef0b27cf81e.tmp

Path C:\Users\Admin\AppData\Local\Temp\fac9acd7-a2f0-4fca-8cfb-3ef0b27cf81e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\MyElfFamilyEng-1719163556\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

auto-1-LT1.save

Path C:\Users\Admin\Desktop\MyElfFamily-0.0.2-pc\game\saves\auto-1-LT1.save
Size 134KB
SHA256 f7bdaf299da6539358e9fd09d404c6f96948ea7dfe8d1fd11ed6cec929148499
MD5 1028d04136cd9cb9626263e868bb5a66
SHA1 fc834dd2ca8528439c827d12ba95bb096df3db9a
SHA512 6fed49499c83bb305d3c6850d18843f3fd52ba7e7f8019f4b85f9bc9764c7558af4b4f137430235e5c7175c32b8a2b5f21be0391707b62cdfada386821f3a1e7
SSDEEP 3072:dHqjFj+JGSj308Y7iLOagUm07iLBXi/IGLWdpWVOPE8EDK3HX:RqjFjRShY78SUmPLBXgWdMn8EMHX
TLSH
T1EAD312A6950B035CEE83E25F5F72C8C50AE6FBE17199C5C4853B75D50C2AE84C2F4A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persistent.1777729253.tmp

Path C:\Users\Admin\Desktop\MyElfFamily-0.0.2-pc\game\saves\persistent.1777729253.tmp
Size 4KB
SHA256 951d02ffe56ee953bad3a6a990496eeba64d442d0cc5ada39cda9197e4d98015
MD5 6a1ccb2fd06dc56b5511182b9952bd7c
SHA1 92f45d1ec293efffc410c8591113e202154e86f0
SHA512 bf12b9170c24e7b791426dbaae647bacfef19dc15b5fc7281be81572a966a5966831a543a749760497165409b4f02d2b1697075e823479e106500b0be72bdaee
SSDEEP 96:yM33m6cHiYNLqBMDSKH0MKgwWTpaiT51K6Zc0DWyMYdYJwNKokfYF:j33SiSLKKVhwWTJ91K6Zc+WnSNKokfC
TLSH
T16CA16D0014D1D3ADA9712A87FA1AF2DE07B8934CEC7AA6EC13CBC609D9548F6700FC58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download