hxxps://games4u[.]org/

Analysis

user interaction
yes
max time kernel
849s
max time network
820s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/05/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://games4u.org/
Sample260505-th885abw2x

Score

8^/10

discovery execution ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
381	540	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
6012	8o8pctZk8.exe
6448	Setup.exe
5364	8o8pctZk8.exe

Loads dropped DLL 22 IoCs

pid	Process
3132	msedge.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
2980	VertexDo.exe
2592	Crisp.exe
6448	Setup.exe
6448	Setup.exe
6448	Setup.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe
6448	Setup.exe
6448	Setup.exe
6448	Setup.exe
6448	Setup.exe
5160	VertexDo.exe
8448	Crisp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
84	discord.com
207	discord.com
81	discord.com
82	discord.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
595	api.ipify.org
596	api.ipify.org
670	api.ipify.org
671	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2980	VertexDo.exe
5160	VertexDo.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 6012 set thread context of 2980	6012	8o8pctZk8.exe	187
PID 6012 set thread context of 2592	6012	8o8pctZk8.exe	191
PID 5364 set thread context of 5160	5364	8o8pctZk8.exe	232
PID 5364 set thread context of 8448	5364	8o8pctZk8.exe	234

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_415586509\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-uk.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3132_1933297574\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_723020055\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1077638571\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-la.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-te.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\es\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_670448544\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1487928284\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\bnpl_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1487928284\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\crypto.bundle.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-shared-components\zh-Hans\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1023049265\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-ru.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1517470005\shopping.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1023049265\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-as.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-en-gb.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_972348201\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3132_519328421\json\i18n-hub\hu\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4780	powershell.exe
4980	powershell.exe
6132	powershell.exe
7748	powershell.exe
4228	powershell.exe
2976	powershell.exe
5964	powershell.exe
5408	powershell.exe
5504	powershell.exe
8008	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8o8pctZk8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VertexDo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8o8pctZk8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VertexDo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crisp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
540	msedge.exe

Checks SCSI registry key(s) 3 TTPs 15 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224706937088672"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{2F81E624-15F6-4B61-9F33-C089B8590F6E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3576	NOTEPAD.EXE
2380	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5572	msedge.exe
5572	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
5408	powershell.exe
5408	powershell.exe
5408	powershell.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
2980	VertexDo.exe
2980	VertexDo.exe
2980	VertexDo.exe
2980	VertexDo.exe
2980	VertexDo.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
2592	Crisp.exe
2592	Crisp.exe
2592	Crisp.exe
6132	powershell.exe
6132	powershell.exe
6132	powershell.exe
7748	powershell.exe
7748	powershell.exe
7748	powershell.exe
8008	powershell.exe
8008	powershell.exe
8008	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6940	mmc.exe
6568	taskmgr.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
6012	8o8pctZk8.exe
6012	8o8pctZk8.exe
5364	8o8pctZk8.exe
5364	8o8pctZk8.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	powershell.exe
Token: SeSecurityPrivilege	4780	powershell.exe
Token: SeTakeOwnershipPrivilege	4780	powershell.exe
Token: SeLoadDriverPrivilege	4780	powershell.exe
Token: SeSystemProfilePrivilege	4780	powershell.exe
Token: SeSystemtimePrivilege	4780	powershell.exe
Token: SeProfSingleProcessPrivilege	4780	powershell.exe
Token: SeIncBasePriorityPrivilege	4780	powershell.exe
Token: SeCreatePagefilePrivilege	4780	powershell.exe
Token: SeBackupPrivilege	4780	powershell.exe
Token: SeRestorePrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeSystemEnvironmentPrivilege	4780	powershell.exe
Token: SeRemoteShutdownPrivilege	4780	powershell.exe
Token: SeUndockPrivilege	4780	powershell.exe
Token: SeManageVolumePrivilege	4780	powershell.exe
Token: 33	4780	powershell.exe
Token: 34	4780	powershell.exe
Token: 35	4780	powershell.exe
Token: 36	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	powershell.exe
Token: SeSecurityPrivilege	4780	powershell.exe
Token: SeTakeOwnershipPrivilege	4780	powershell.exe
Token: SeLoadDriverPrivilege	4780	powershell.exe
Token: SeSystemProfilePrivilege	4780	powershell.exe
Token: SeSystemtimePrivilege	4780	powershell.exe
Token: SeProfSingleProcessPrivilege	4780	powershell.exe
Token: SeIncBasePriorityPrivilege	4780	powershell.exe
Token: SeCreatePagefilePrivilege	4780	powershell.exe
Token: SeBackupPrivilege	4780	powershell.exe
Token: SeRestorePrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeSystemEnvironmentPrivilege	4780	powershell.exe
Token: SeRemoteShutdownPrivilege	4780	powershell.exe
Token: SeUndockPrivilege	4780	powershell.exe
Token: SeManageVolumePrivilege	4780	powershell.exe
Token: 33	4780	powershell.exe
Token: 34	4780	powershell.exe
Token: 35	4780	powershell.exe
Token: 36	4780	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4980	powershell.exe
Token: SeSecurityPrivilege	4980	powershell.exe
Token: SeTakeOwnershipPrivilege	4980	powershell.exe
Token: SeLoadDriverPrivilege	4980	powershell.exe
Token: SeSystemProfilePrivilege	4980	powershell.exe
Token: SeSystemtimePrivilege	4980	powershell.exe
Token: SeProfSingleProcessPrivilege	4980	powershell.exe
Token: SeIncBasePriorityPrivilege	4980	powershell.exe
Token: SeCreatePagefilePrivilege	4980	powershell.exe
Token: SeBackupPrivilege	4980	powershell.exe
Token: SeRestorePrivilege	4980	powershell.exe
Token: SeShutdownPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeSystemEnvironmentPrivilege	4980	powershell.exe
Token: SeRemoteShutdownPrivilege	4980	powershell.exe
Token: SeUndockPrivilege	4980	powershell.exe
Token: SeManageVolumePrivilege	4980	powershell.exe
Token: 33	4980	powershell.exe
Token: 34	4980	powershell.exe
Token: 35	4980	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
4452	Setup.exe
4452	Setup.exe
6448	Setup.exe
6448	Setup.exe
8984	OpenWith.exe
6940	mmc.exe
6940	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4212	3132	msedge.exe	84
PID 3132 wrote to memory of 540	3132	msedge.exe	85
PID 3132 wrote to memory of 860	3132	msedge.exe	86
PID 3132 wrote to memory of 860	3132	msedge.exe	86
PID 3132 wrote to memory of 860	3132	msedge.exe	86
PID 3132 wrote to memory of 5368	3132	msedge.exe	87
PID 3132 wrote to memory of 5368	3132	msedge.exe	87
PID 3132 wrote to memory of 5404	3132	msedge.exe	88
PID 3132 wrote to memory of 4980	3132	msedge.exe	89
PID 3132 wrote to memory of 5404	3132	msedge.exe	88
PID 3132 wrote to memory of 5404	3132	msedge.exe	88
PID 3132 wrote to memory of 4980	3132	msedge.exe	89
PID 3132 wrote to memory of 4980	3132	msedge.exe	89
PID 3132 wrote to memory of 832	3132	msedge.exe	92
PID 3132 wrote to memory of 832	3132	msedge.exe	92
PID 3132 wrote to memory of 2036	3132	msedge.exe	93
PID 3132 wrote to memory of 2036	3132	msedge.exe	93
PID 3132 wrote to memory of 1632	3132	msedge.exe	95
PID 3132 wrote to memory of 1260	3132	msedge.exe	98
PID 3132 wrote to memory of 1260	3132	msedge.exe	98
PID 3132 wrote to memory of 1260	3132	msedge.exe	98
PID 3132 wrote to memory of 4304	3132	msedge.exe	99
PID 3132 wrote to memory of 4304	3132	msedge.exe	99
PID 3132 wrote to memory of 4304	3132	msedge.exe	99
PID 3132 wrote to memory of 912	3132	msedge.exe	100
PID 3132 wrote to memory of 912	3132	msedge.exe	100
PID 3132 wrote to memory of 912	3132	msedge.exe	100
PID 3132 wrote to memory of 3252	3132	msedge.exe	110
PID 3132 wrote to memory of 5676	3132	msedge.exe	111
PID 3132 wrote to memory of 5240	3132	msedge.exe	112
PID 3132 wrote to memory of 3028	3132	msedge.exe	113
PID 3132 wrote to memory of 3028	3132	msedge.exe	113
PID 3132 wrote to memory of 5592	3132	msedge.exe	114
PID 3132 wrote to memory of 5592	3132	msedge.exe	114
PID 3132 wrote to memory of 4128	3132	msedge.exe	116
PID 3132 wrote to memory of 4128	3132	msedge.exe	116
PID 3132 wrote to memory of 4128	3132	msedge.exe	116
PID 3132 wrote to memory of 5952	3132	msedge.exe	117
PID 3132 wrote to memory of 5952	3132	msedge.exe	117
PID 3132 wrote to memory of 5952	3132	msedge.exe	117
PID 3132 wrote to memory of 4764	3132	msedge.exe	118
PID 3132 wrote to memory of 4764	3132	msedge.exe	118
PID 3132 wrote to memory of 4764	3132	msedge.exe	118
PID 3132 wrote to memory of 2276	3132	msedge.exe	120
PID 3132 wrote to memory of 2276	3132	msedge.exe	120
PID 3132 wrote to memory of 6080	3132	msedge.exe	123
PID 3132 wrote to memory of 6080	3132	msedge.exe	123
PID 3132 wrote to memory of 6080	3132	msedge.exe	123
PID 3132 wrote to memory of 2964	3132	msedge.exe	124
PID 3132 wrote to memory of 2964	3132	msedge.exe	124
PID 3132 wrote to memory of 2964	3132	msedge.exe	124
PID 3132 wrote to memory of 2744	3132	msedge.exe	125
PID 3132 wrote to memory of 2744	3132	msedge.exe	125
PID 3132 wrote to memory of 2744	3132	msedge.exe	125
PID 3132 wrote to memory of 2212	3132	msedge.exe	126
PID 3132 wrote to memory of 5384	3132	msedge.exe	127
PID 3132 wrote to memory of 2212	3132	msedge.exe	126
PID 3132 wrote to memory of 5384	3132	msedge.exe	127
PID 3132 wrote to memory of 5384	3132	msedge.exe	127
PID 3132 wrote to memory of 5816	3132	msedge.exe	128
PID 3132 wrote to memory of 1800	3132	msedge.exe	129
PID 3132 wrote to memory of 1800	3132	msedge.exe	129
PID 3132 wrote to memory of 2284	3132	msedge.exe	130
PID 3132 wrote to memory of 2284	3132	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://games4u.org/
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x2b4,0x7ffef614c188,0x7ffef614c194,0x7ffef614c1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,9416740638853278200,13251856925632820439,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,3699253806664070319,16496533928248333846,262144 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,14877960870195487826,6932861305684167979,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,7324864098537742213,5977984883844179540,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,13946886888755753033,2442311971046575297,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,6719859115573783424,11110119848224296876,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,6940590156629294576,7648017260441333422,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11743837114379413464,9076337218791627074,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11743837114379413464,9076337218791627074,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6076,i,13068959038246558355,11278408705222515887,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6504,i,6737310778536057,12158602479222840463,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6560,i,1867448578086870481,10225816070965050574,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,13224899641218313678,12951016301234803453,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6680945102095994066,8737161175396305474,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,4145153843186130071,15781147009510556693,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,13525317136155135052,2951962896325542608,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,6207807241839906722,9301650118140487708,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6804,i,13833148707558021424,6764331347497749317,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6312,i,18070472251283901123,3165109981666800124,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6300,i,2777264235230755625,13438994388896490268,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,2035339775613819164,14463814189283769803,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7008,i,5687728940665350582,9513588076848156666,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6432,i,11419047450940701415,15503324973304050437,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7316,i,6003751791028698752,14192283092921783496,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,2048911149314421071,12808809798345059977,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6712,i,18138697061346491048,17866361349232020673,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,10786579363331891023,4297286055900129462,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,9855614636294811903,12865593866599960722,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,16762249139880421528,5089032460711964171,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7428,i,15283114127989029234,16760469089935603649,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,6348889444894035406,16826802273648586981,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7984,i,10580969300171207399,9297295497947776757,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8060,i,16762675796333768917,6210142538006415023,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7260,i,7875059431136057916,15927907072222584773,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,15363360589615547892,16793196251804077853,262144 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,16825581102528288601,774179053931217010,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5840,i,13732020590517083549,9393946405845001228,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6600,i,9021589202409847409,5044032694457302670,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,11842649301318425220,15110340210739919278,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,16071629337089215956,2761487425898164424,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,16071629337089215956,2761487425898164424,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6608,i,14286397701035614478,8509126903384312605,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,5207583961764653057,10801895651678790458,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,9185457413035681484,1165926732908410897,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8032,i,12978993232843285732,8802802631942471449,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7996,i,7863808902608779764,18371463186946472071,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,5510700954488239071,10982701714248841043,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6896,i,12103978763541463314,16583082770743046198,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5104,i,7434647341681572300,7137745067760729625,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7568,i,6231047567147421630,3766756463952745129,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5172,i,17143960648420204151,13805036912624087600,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,9969982334275373971,13033498229158864561,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,9969982334275373971,13033498229158864561,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,13772154138928392184,5330623872788538137,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,11486232330663620550,8669271732379336433,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5092,i,9200268138711518076,6723810180890595649,262144 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,2072356326365540433,15613683952163858345,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,8315886846583608146,14964887666262605853,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16984706717695542781,8448855254204770857,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,15922439416994206355,15521574587094325675,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7176,i,4526263898093028599,3658707028637132107,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=5720,i,17155905919219828603,4058415137091978329,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=3776,i,13833958949944921106,15107431725249111432,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=5336,i,7970363205566118770,5608188686217449065,2097152 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8364,i,15473551565086015265,8452361241359842686,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,7138594502211001945,11621486901465046628,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10183959932663095728,9207346577435345475,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  PID:9084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,8215702709800034903,1007114351794213422,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:8304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,10257862962021109668,17902685282795322610,524288 --field-trial-handle=2228,i,2905643904027973368,2537643139761624368,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:8
  2⤵
  PID:8640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:416

C:\Users\Admin\AppData\Local\Temp\Temp1_Archive.zip\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Archive.zip\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  PID:1704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  PID:3212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  PID:3400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  PID:6124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  PID:2136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5504
- C:\Users\Admin\AppData\Local\Temp\tmp-12482-I4kfooOyyy8M\8o8pctZk8.exe
  C:\Users\Admin\AppData\Local\Temp\tmp-12482-I4kfooOyyy8M\8o8pctZk8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:6012
- - C:\ProgramData\VertexDo.exe
    C:\ProgramData\VertexDo.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2980
- - C:\Users\Admin\AppData\Roaming\QVHproxy\Crisp.exe
    C:\Users\Admin\AppData\Roaming\QVHproxy\Crisp.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:1680

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp2_Archive.zip\data\script_version.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3576

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap25064:72:7zEvent25799
1⤵
PID:732

C:\Users\Admin\Desktop\Setup.exe
"C:\Users\Admin\Desktop\Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:6448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:6960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:7308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  PID:7684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:7748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  PID:7936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:8008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  PID:3136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  PID:4196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2976
- C:\Users\Admin\AppData\Local\Temp\tmp-69036-7V8s0CdMeKMR\8o8pctZk8.exe
  C:\Users\Admin\AppData\Local\Temp\tmp-69036-7V8s0CdMeKMR\8o8pctZk8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5364
- - C:\ProgramData\VertexDo.exe
    C:\ProgramData\VertexDo.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:5160
- - C:\Users\Admin\AppData\Roaming\QVHproxy\Crisp.exe
    C:\Users\Admin\AppData\Roaming\QVHproxy\Crisp.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:8448

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\log.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8984

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:6568

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6940

C:\Windows\system32\perfmon.exe
"C:\Windows\system32\perfmon.exe" /res
1⤵
- Checks processor information in registry
PID:7228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1023049265\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1487928284\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1493302540\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1493302540\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1579332177\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_1969866526\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_275200310\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_415586509\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_723020055\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3132_730443010\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 15d5db2d709306df16fb0ebf06aec3ef91af94ad8e40f66cb6466d0f37edcb50
MD5 92f60af406d2b80d372ba1a490ea18d4
SHA1 40607747a3551da0aa1fd80ae5e7bf0375f1fe32
SHA512 8a7a9a072d42c60c84c64322c3f01b7264d904ebd16bcf9e6cfc8d6ce5e39db00f8ecfe864fcaf09fff50deade44516c5ec7fdaa632218b3da232809f754a1bf
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fBPOIzoZcm0vmlvWPfsNySI:iqdYqGAjdx4qKkq3qktznEuZq6cIzooB
TLSH
T1EB81CD323375B0D4C8667F072A2819D063AF4396EA94AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
Size 212B
SHA256 e02d9628c4c925904ff914ba843ff9c7198f14bc9893b8e6c603a29c0c0d2a14
MD5 74aab070a3967adf2e1c8929c8bb2e71
SHA1 60666efd114c8fced66d36f016bc8794d2ffbdf4
SHA512 1e87be1d7dc78e6f257a2c3039841aa3201ebb74c93dfd3d22d5b2cbf9acaa3d3c3af15479b5e8f5aa05d825ecccdd1dbb6cebf6104ca4a296e2834f5a6c7bdc
TLSH
T14DD0121A37671857C2D36DB112E2B7E1A13FC521E32662E3173A56661F00BE50A75312
MD5 SHA1 SHA512 TLSH

Submit Download

53bffe66-be56-4fc1-bb36-86446dbe95ad.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\53bffe66-be56-4fc1-bb36-86446dbe95ad.dmp
Size 663KB
SHA256 82e049c6298f1e0117e6ef770b9c2012c98623cb82a75a979edc97f3d93959eb
MD5 b458870ec8d3e67d837bcd87a3ddde33
SHA1 44c2d91ba9ae4b5b9a5e7d647ef9d5c9ea7022ae
SHA512 3fb9f1e65ef1b87ca6764d1118e80faa2ebba32d2eaa798d9058f9d604e8fe8fb6477920e1a7a355e1772d7529a0e299cf7e15f5273c9c0cc52143db293bf1eb
SSDEEP 384:kFhEJOfH7ohHtVOz8KDjyjxbO0Uz2sBqo4P0XokZhcqRPTKKKKKi8CgUcSntm1:kHEJOfbo5tVvJDU9BqzkZ+Chy
TLSH
T1E4E440E6AB4324B7F82913B14EC777107BF2D4605B63434EEB95213AACA73506A31F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

676c3e96-e2da-4d27-bf4e-1dfcb5688562.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\676c3e96-e2da-4d27-bf4e-1dfcb5688562.dmp
Size 5.8MB
SHA256 ee783b668da6c3ee7952a05bd3625f21db6655f9ca7696f77622a6b18c3cbef7
MD5 105c5aa7586e67ec958aed4eb1a409d8
SHA1 6a3e30b8abbf0e88acafb78d7a30e5d57534c731
SHA512 a7ee6353b9187bc285a108b6e3a3363fe24b5b136c46cd36c8235b225f8c1cfefdaff5e3d92195d68eaabd572ca4d6f7d0e4625ecb5fe0b26f06a298a8161764
SSDEEP 24576:HOYWi80e9Rb7Tm4u8CnOSGbwsHlR/U7Ge:v8r37UnOra6e
TLSH
T1E756E67EF74A8656E009A2304B83F796E6F1EE618AF9A3472747336D1C732085F26744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c87a64e1d2125148247c09afb02df2782122b54d8a0688711dc68ff824403145
MD5 7e8f9fb22a99c46f608448a001e8101d
SHA1 51e079b978173aa097c5a765f786f2f79f4cf20e
SHA512 0dc870e3c1f47e8da84071b590634241433c132c2da810ca6807faf22406f455c4d3b35effeae4aac48bc300a17be405ce0adebd94c8a591e22ca177817b3cc9
TLSH
T139D023757795B007C29D04B2005186D5254BC48534CFC3C5F129404D58E91DD77E75D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 f384e9909a2b1ee6b1982a60e15ecf6ee2534b9ef24a015406a4938d4f66861f
MD5 9b7356a9bb3f3ad67a509863f3913587
SHA1 9c14ee39a95bafde1feaa4494447a98dbbee49cd
SHA512 0cf00fb2c1fad1f22ec852986e5fd111c7d249ea4082995bc07c25ecdf5eceaf65dd89205702f3fd7b53caae7c1ad13871066cf3acfe2647514bee27dc360f38
SSDEEP 192:CjErG222Zjy6IJRTUUUZFRZFReeobbxMRuBVDRDR2wwbdhSh:CjErG222Zjy6IDTUUUZPZPeeobbxkuB9
TLSH
T159F17F568398C69BCB1D10CB4AA1635D41F03709EBDCD65843DDCEED304D8DEE4AAAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c177af5dee8233a3bc1316be9aab543bafee91e6ecd76712f74b3974f72d1712
MD5 1202936921bdb2eee7f5277970a7ae8d
SHA1 f22b06af9eda4112529d05ff59b10193d01d0172
SHA512 ffd77507d8eefb6bfe9b8ce327e3544e6d11615e441a91bcd96a49ec3d1a9865263b2611e2324418ac1503b622145776df5827ff7ab08f622193d24d8204c853
TLSH
T1D2E0262C43C4C5B51A29D6DF82ACB35BC2E43629D7CC5AFA3304F384A440804577E8AC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9bcb52d43b47aa5144286e3d9749b7ae1ab2b111943979518ba154b18e5dea1f
MD5 3792d9024658504fbd0c40288592c754
SHA1 b308cbfd6d9021771752f85e3dcd7e1e32def191
SHA512 25399ccbc15aa3b692c1555a69059d783b73906d358c8127fe9ae303269ac700ca4501eb528f20729be5090e910b9daa4c557f27882de5c59676ccaf9e0c3ed2
TLSH
T19CE02BAAC8319C6B54F90B1960164A47EB51135F1F61890FBB3DC10C8FB1A3B0555CAC
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 23KB
SHA256 4d8d7cae3e9733637a78c6d1e1a7b90b1778d0e4ae55ec9d39f7909417f5ab5a
MD5 f19acf9cea9b47f91ef7ac6b5e963695
SHA1 cf22092b303870432d87c6b273b4b4f27be0c276
SHA512 36ea79a972c5bb0e85fb24e6b2fc5dfdb161665f72afa82ca2c6dce14ba29e545947f58dfbd0f79fb607dfc089efff125bc834e2f3ce9ea0b6551fd06b7f492c
SSDEEP 384:uGmJCJ5c7KhWHQ/Ep0fXWFJDaf44hGTs//LrYls3lLTzHYM9mog1CMJD4IF+R6IJ:3Js+WHQcimDDaf4460/RZRmR1CMqIIRx
TLSH
T1A2B2E1EA8CCA5580774CE50C6BB609F568D7BF931730C0751EFC8D6B78D9814710BA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 18KB
SHA256 3d27fe621f0f843c9a2f1975716c4269a9f3801d77bb954739233dba6666fb77
MD5 294aa5d8840ec869978fda9d972850b0
SHA1 d75c80e37f4194187cf21121feeef9bb643ae516
SHA512 4ff7ceea3e39f788448f927bb313b303ddc61c0a944f534bc5ee0a366b1000403553cfb31f91d22ad64172b1afc856345cc8a5ed1836a64aae35646aa364e2d8
SSDEEP 384:OPBOHCSNUb9ffXBco+/fbta3PfyARbWZX5DRLjFa:OZ+NQ5Go+JayAVWZJDra
TLSH
T11292D0B7175738115F6B26C8B53B87359AB1403534E2E2FDB4FC00D562EC99D493CA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 18KB
SHA256 6401d86ae711f69bf1d20ac5aadca74a611393b649bec24f86f7526e5e287f0a
MD5 c1708f2c254e437b85ece6c0bdb8d60b
SHA1 258236315128a46963f287e73187d322638de5bd
SHA512 6168cb18f3dbf1600f59eff3cb0607d8bd20ccc184c982614734ef58f52b2d70402276cb52d3a79407f8885097c6a1725befca6eadedb63fbbf65f0ffb130032
SSDEEP 384:FtzZdD0i0E3InEMvFFp2xowVenIVyyCLC3IQy5KRGm64ZSdp/4+7G:Fttl0a3qBDp2xFVeKyymh5Kj6sw/xq
TLSH
T15182D15B64911C84DBDEF2F0978B2B7211B449AE11C3472E7F48D36DA7EA00252A7E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 19KB
SHA256 f0f919c605c2b8706ac3b158dd879b5fd6cee91fcbccff81ed4217d83f131ae7
MD5 0c864b168430ccda78f02ef0a75bf00d
SHA1 0c761c76ccdf2d099a8cbe7bbfd56696356a638b
SHA512 235f0419e2dd3e426f7445ca8dab93d2686f7a333bdcc4acc0d83774bc0f93bb79a5e60d54fb793854082484534bc6875d8afcb167bd357e45093e57c9176760
SSDEEP 384:PFuG4RRNOQX3aC8yoXiG/eraXWwa4ZGFpXA18J9GzZRYcea0wOG:PFeDv3aCNoSG/emZGFa1o49ecebc
TLSH
T11D92E1ECAE7696B7EC5B48DAA0F3C965045920A33CFE071991CECB424198C798EC7712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 19KB
SHA256 0e9b50e2f56677e0db0226f9c765a144058453daa14283f05602e82465b96ca5
MD5 da2f763b6d943c5dab2d5cc39b2c2d29
SHA1 cc3645cbd070747b6e6ddf1f91176bc8da752683
SHA512 3fdd2bbd30b1fc258f582a58af692c709f15df0e5428d3399ae8bfbd5917205c77e13569766c8528d340ca2fcf8bd63bc0f9c13b7bf409757494c11f57c07dad
SSDEEP 384:DxWvcazY7Gw6hC7hl0N225ne52nR3qYnKjBnPA5:DcECY73kCls1VhqYnKjm5
TLSH
T1FA92D10A8FC00DE9CB6D9E291B9804D80D46F32A10F4A891F2ED698BFB23F545E93174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 17KB
SHA256 4485c670e8d9c5e57410826f3ce02ff2c3fad4c3af0e004e2a51c1aba1e7377d
MD5 07381a8e9664fe7c4ae85a2a871c02d7
SHA1 1b8a9c8fc966bf20e929ba784dd574bf51dd1dd7
SHA512 dab2310fb70bc6df76aa41277d96537b92b42fc17188bc016f3732083b4ce41e2c716fad4aafb8dc51cb813b593825270f8778260eff6ead1331b64ab53a3815
SSDEEP 384:NG3lkc+P8vgFZXn04NnHnEr8Yff6Ow2xaiQz+CprMnMCeHBXri+X:NG3Z+k2X0EHU96Ow2xaonnsBXnX
TLSH
T1E282E1DFF0E0713815385A19CE394E863A95A09166EF714E7743450BBEF2C686FA7209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 19KB
SHA256 07e3ab6f6439e1b78a25ac2562a5e190fcde7d19b90fef0acb6138996aba1540
MD5 59bb373428af8f9dbc8b8e72c9eb8d3b
SHA1 9c790e3b8914f9e69d5efe2fb7d56b0a5b38030b
SHA512 980c37cd18a258623636069f069ca4e4f14ec711eb8d4e6f2c5b36fc7356283785d39b157f839b6e94bae36e1327bba143c64faa38a9aaf134dd70aefbc10932
SSDEEP 384:tYf6EQOv9yBuoZAodcOshvPNBHWA3yo4Es1Ffq8+K4ViBQKtDXy:EQOvYBDZAo+51t5p4Ri8hci3Ry
TLSH
T19C92E0F0FBAAE588DC639A619C237FF075FAD947023B6241219D9C988C20EC475C10B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 19KB
SHA256 097b57da1942e5d1e9deffb85172c3b1d529022bff68ff36a9519fcc1396fa27
MD5 aae710e05ba36ead376d4c0595593e07
SHA1 672ad3da5851a05866b6ed420fd379efb5a05085
SHA512 acf3cefc1c8a5961ea8ee3a9f887939454b2160d123010e571caf521e7f93dcf2efd6483917824b85abbef098ab71b994e6f25da9a5d8cd855e34c79a06fb00e
SSDEEP 384:rEyZAHZFdcSEgtYiOKtQOf0sN1WR977+neR9nxoLxOSICUfPtL:rEyZ2FdUgy/Qxs8wH+nevnxwXICUnl
TLSH
T17B92C00602DCE53F9EEC7AE8DC4590153A17FDCFC5848D80BA6A16B73802457BD5C9B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 19KB
SHA256 76b4825bd45401126c9a7aae2b64ccb61093981f3bac3182a3e176ab2558ae84
MD5 af32c97829a775ca6cf55fa30d20de3d
SHA1 85c4c1473e852a366cfc47d6009f45ad1eff6359
SHA512 c928feb08b18c8a0d70577ef9022b18bf1883f9d0824fb14144b96a321ab44ff952c1e62d8d70f76d535b8404153aafb828e94e2ad9bc5430aa88109689b5263
SSDEEP 384:s5+Mefx5RaxbSHTdkdCEGPQQTDZBSaaz+k9YPAAHsevBrdWBnEFNtqzzVkdXw:s5bKRfHTmdCEkQQX3Saaak9QBJIElqzX
TLSH
T1C392E1C34E9C6356CEE9A701B9C152A814667043B7E02ACBDC1ECF88EE75B6449C119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 18KB
SHA256 c870d3a31995446212471a7111dd5e5adfcc222a095410f0ffeb9429100ba82a
MD5 b41410ade2482bf7ab3beed7bb9770df
SHA1 4555a18fc4cb6ab73ebca4ba568c2569ad831e7d
SHA512 2d8340ccb2b732fbe8e966c2cc972996a30e511510a37eecc8a0fdc643d53714d905abed198a78ca0316b6ec55f0f224da19a1655871e196196b9ff547b0279d
SSDEEP 384:ez0y+ChHCValUHYZ6xipUz8uvwUyO4gh1YLX5UV3UW4kDsTnH:s07gCwlX5aFIXVgfu5C4
TLSH
T15A82D0DB693B210DC2DCF0BE4B50529A8D4D195878CB386C7AACFCB8A861701784BA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 19KB
SHA256 1b212dd4de7577b6d098f032ad0922dd6fb107397218c9ba521e8d21c064017b
MD5 abf4c24745907e5bf6d7dd6912152ee6
SHA1 4f8bee23f47f869ae14d40b5871e040c5be73e91
SHA512 ca7075b6b3e992d1c9ed9da3e2a8c62d4d67323d08caca8c5de397e0aea59a66b3b4e7c861391812cb633d70bdc9a8320265a0d9496ba19e53d99b939b04bd3b
SSDEEP 384:aorsfrCB/WDrKtgeRDfTVr9mD76CsuuLLalxfxUX95:aorsDsWDrogeNU7ZvuL2nxA5
TLSH
T1CA92E1AA0CA931484D35A014F8AA2BCC89C578AE64B215997574693FF275B04238C9DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 19KB
SHA256 a23a157c20467c389e07f8fe363d458e32566024be6735792b0848c49c153481
MD5 3b18c45fdc8888ec98ddecd2cf088448
SHA1 1409262d326a33463a596a6f319ccfa4fb856cfb
SHA512 4ec3ffafaba7526bd05c1630b80981d0955ea0f8afa5c75e98769e8549872f37effa49f305625521a44535916541dc9500523cca5fd1a652413c7dc8218dec99
SSDEEP 384:S7EdZuCBFI7yIepIEpHfVXCXmxfx4HbimRo95ps7Kj1gqqmOXdbHQ7G:SoLuCbayNBfVSAfx47c95K+XqmONz+G
TLSH
T16392E1F11658DC2249AD2FAEB4DE8FDFF22F914D018C24CA9E1C5B34BC622C660CDA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 18KB
SHA256 a4fa686203c4a14fe689e395dab8a5d49798ca0d8f3e91ddf317823c8b00834a
MD5 eba5c4d9c4487c0bc146e914dc313f3a
SHA1 528d3e4992bd48c8eeaa17d0a53e83ae991c2fe7
SHA512 4e190c0351716ec91972e3339a0939c6075c642a89ead0ddd5d06580d10ff25f14d2e6dd7898c463bd70ea1487fe7b226ebd9f77f0a33fc71aaed7f1da7acbf1
SSDEEP 384:XzlhnjZOrGA0EdkPg3iyVKarwclfW1tJ8x7au5l34C6onnyVWW8ZWOAxqq4cqhUe:rN8kPgRVjrwl1/w+uL34KnCUZWOAsq90
TLSH
T1E682E12BDF3DD2BF066569EC74B8042AA144BF597756241836832FF604682F660B2BCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 19KB
SHA256 3598aafd52c0820dce0f22489b211afa869e784fe679a277d605471c99a65d14
MD5 041eda736322b028184c95ee57bd3403
SHA1 9468789a783c53044575b96ada254766e6df0910
SHA512 a4ba5217b5831f9712d6a5e2f612b511286fe248a65dbc5f564e9542ded9e0c5188f0a2c5634e06efbdfcb1d235660aef22673a527fedb2c0f1327c120e17e2c
SSDEEP 384:4aAhiDxKxEyr4FWwO54/e6kxhjt6Ng7mNsHPSO1T9OREcR8noXgrCMySFu3BIA:7AggxEycy42HxhjH3vboZErqXb
TLSH
T15692E1D2BC4B97304BBF2AB52E9D94771DFA08DCDA111FDD1A8274229D40E801DABE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 19KB
SHA256 2b6b67c08e618287877af966522177c2988ee7be4006885927d3fe9da919e1e9
MD5 1483e880259fda4c27810be392a7a2be
SHA1 11b2ab9195430d4db0059e2b630d6edd0c0cfa44
SHA512 0ef1e24da540c241af6ea73450aaa8550d95fbbbb1275216bee9e28306c73ab8ab1044fcb6bcb2570810004ac1f619514a50cf488b4352dc5c4f5f358bf3df1d
SSDEEP 384:3B3qgAHZCjprzAKTNrmO89dtFxEgW0Xx515hg9F2rfA:lA4jVc+NiO89d7OMz15he2rY
TLSH
T1EC92DF6EF9965C888F9EE8333021C96051C5ED0AD046BAE876E1BE711EA1ECF4658D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 50KB
SHA256 d527ad32e71232cddb2734b94d24edf0816749ebb5dcc7840095f1872ef910e7
MD5 fb8168f9f1d7c709056ad65e859eeb1c
SHA1 bb21886663ab314a0a9e1864ce8568669d8367a9
SHA512 12ec11a401b8a64cbf72ebd09fc93d9bb550261dab890178ce558f1c9382958a589473f72dcf9655cab446e667b6fdbe2f9965f63283bd677c67ac54917b6b16
SSDEEP 1536:kNL0RroOTT53LV6N58po9vxRGSDedhnBOaZip:UL0RuIp4vGSDmnPm
TLSH
T19E33F12DC04A8F6CDA9CC751DCAAD014115E7E75ACA652F21BF2CD368840E691EB3A74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 19KB
SHA256 336527e64070714dd9814ab9b572c1b705831855e42fa66b3b555c9eb0256487
MD5 299a5cf308b3b958def40e0e4379d59b
SHA1 258a18e21800f1db7e4500e819a2edd9487bf346
SHA512 f03f7bd746ac2e53bef8391c03e398a9fa37ea5a0e170d3e2a3e1772e13c926973126f0336968a702a8db91c538927779f97b5f474008d00878c691375596df0
SSDEEP 384:fIdavgegV1P6e8cEJ4nGaSP/HrhVKfkjtkHJwj5rVo6NNPf+g7ffSZgpGzS027JL:fIdavgeg03fJYC/HrafTKLoUNPiZgpGQ
TLSH
T1BF92E168900E8E8F7F6CC923B56CF6212C220E4F43DE295F4297E5335436F65E24CA25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 19KB
SHA256 369064261d3de882c34bd703ad6599da38a1ac4c7e66074ae8e08afb88b63003
MD5 3847b10b0740e8ec04d691ecf9f0bc67
SHA1 c44903a3065512f00b1e6c66ab64750b1785a473
SHA512 f0f0e9a3a58291c7a63093bde8bc145233443aa98a87e9a845133f45bead8d26366264f4d8e0993bbe5e22859a6d3219b753ef21dbc40e21b09f98dfbd9c1bbd
SSDEEP 384:76vYn8doyJVgFJV/8XxxQ7SZ2/AzyIh4cJqN0M1nu1VPI7:sYn8do2uFb8h+7SZFGIh4coobI7
TLSH
T13092E131266EE41DAB8A109BFEBB0179743F380DBFF4041E72DE6412C6D81645AA25F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 19KB
SHA256 1a5d3f0ac470bad129f4da772c8c64bea7ff54606fbfeefe1d4c97c209ac547a
MD5 be72685a0bcd2ae3d7c63300a189ba49
SHA1 c9f712cbcc5aa685e4b27c2c29049d603ff27526
SHA512 e78ac8dcda3fa0c1890576db62ac574799d39b36a7dc92c96a04713ef49597564b7c2515e3ef1324ec6e5d609d9352739687f126dc47ddc0b062ebf9b074c23d
SSDEEP 384:VnGo8wDsK9Efcj9FCAy32eKmC5R/6L4JTj36JjbPs9tEdBmry:Qo8jTfe9FP15RDvKBMEdR
TLSH
T16592D05E125CFC7EBD61209211895B5AEFBE33DB36295719F1E8B23404017A3B43B72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 17KB
SHA256 3c42780c508a17a74cb63f3e6ddeadb491f2a73d0256cfad0fcb028793d41535
MD5 61dba983a1cb523d1426f7b07bbe8042
SHA1 ecdff3aeb3c62410091d1e7bd4112044b118fdf9
SHA512 c7abfea30cd8ec5e7156109ff49ddd035ac31a7a33d493c599a0f6a9502ae24b1126c909fea673084e1ffd33aee3a72ee13ba8f9c9bd5b5a5e8efb888082607d
SSDEEP 384:EPbinWjGi+rQ5KRqlmBC0kIqkctDjpJeJsJOQE8sA9Vtxun:o+i+rQ5KRqmd5qPgZAFxun
TLSH
T1A282E11E178E4B1AB92007D245B32A3D56ACDA521ABE1FCB010D9F48B0EC57417E1C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 17KB
SHA256 b4e9fa886ae4b38de9b6003cb4264c0592873102c83316fc1139153f37d548cc
MD5 b5494fda038d5bbbf8ae0baa613bf1dd
SHA1 25398ec43d34f31e78ec90eccbd9a0e8652dc5fe
SHA512 3a7c33f191c4abc18da88d907d8c784e2c6fd0543f2c82a39e2cea0473e45c14aee1c9ef48801e82c2ecf5dd23b9470ae6fee6f038c3d4ce11cb01381698ed85
SSDEEP 384:Ngzbu76p8wA/Z/R3c1Jim65zxGio62FAnhYaHwTaTYBH8xr7tpBZaD:Ngvu76p8wyJ3cOmKsGhYaQTaTYtErvB4
TLSH
T1AD82F1030741B27381EBA297E7AC3F75A392EF8E739F21961CC46746799B00D8478B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 31KB
SHA256 f474ad4f6ccb439b4af08f25fe468b33fe83357470c0480b79c8d53c70f34fa5
MD5 ad4f574b02f266871bc1fb66714475e1
SHA1 8bbb6a42b3807e28d5ced46006d60f9bb246d371
SHA512 393d4ced654fd63778b9b7394252dfe9d07afdaf6eb8a9ca2d43013c2598ec19cae1713325f3b5579d37a334ec938d5b38aa2eaf18fb81496abd5be7f553528b
SSDEEP 768:f0Q2ajuFOscQ9IaYgigM742YudJbO0W2NMJj/H2X+WNXvCG:fwIu9hHYR174nwdGLeHpvCG
TLSH
T1AFE202D500DB70AF6D26131F6A2D1825062945C7350600ABFFFB4B595F0C8BD49B72FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 18KB
SHA256 e139638f66e6b656caf5a22c41f0c6c08c0382cf0449d722224e82c38ebbf727
MD5 bfe07070bf553365e370a16a8592b289
SHA1 b12cf90a41398666bbd08cd4f6c50a4ac1e03b90
SHA512 b800b7ba312a3d6633a2ed2a08f92624864dcbd8906e69e6ed046a5cbf762603c2c5a8d7d075b188dca4d8137531c6c2deef6e7bbe17672596ecb743e6a03354
SSDEEP 384:cS/P7DSpy+va2yC1dhY/GJve1X2BiZhNj4Kpd2nUDrvepoLHb7XiC:n7Wpy+y2xQGJveJ2B9Mon05d
TLSH
T17282D0ED966420BD9BC0EC10DA03758B99733B52548E9A8AEF0830AC09ECDA957C1EC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 33KB
SHA256 836d74c8858b3c1e8082b0c9cbd4a372daaa7b12d1c4c30a0fe391bd89c15a87
MD5 2a6306cb2c667dcd30069814ebfe9c9e
SHA1 6183210fdce310dc91c76de7b53d0fd615112e78
SHA512 0fead616a27cb31c56bcd3a945c60907fcdeb0024ec07a4bc019e9218e2ee1dba704026c7660da073e4f1d01c106da2de82b07d30b2c9e14de6ffcd616b54b03
SSDEEP 384:TYGJyL39P/reEAeaXXQbv4PJFtyw4F+yEZrP20HuyHGb10OHOFAAkydzbgfediL+:jqPzedFXAbQPJF34FEtHGJ0r/zcM8MN
TLSH
T14AF2E1E75AA2556349353FABFAA1F8CDCFF9C0B94438561F836D42DC0160C05DBC64A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 23KB
SHA256 c8afec57ed7a6dfe209ec88803a8bb1f933e3ce07df82da2c516f392b4b962c8
MD5 3bc604963ba571f344d1fd6503492e75
SHA1 47cc7c77bcb33030ae2941f025357adb0a7786e3
SHA512 95e64ef51f5adf70cb06b16087f53725d99958147f0c4137cfa1b86c47050f24f654dd9f77b72243850d17f15aa7281b25088cfbceb1b7f4638abd9c83a2d47d
SSDEEP 384:lOS1t+5Rwmza/nlwvhH0iu5rORVC6czv5X7jCZRcYvI89nHILWgjeKCgNmqWPoX6:lvS5RwmzaWpH0iMORI6Y5CZnA89oLWg2
TLSH
T1B2B2D1C239FA1C84682400B4EFAD6FD39429436EF655663B0A96AEF8192CD802D58D71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000db
Size 363KB
SHA256 5ac6c3c8c9045405f3a89ef0e0c80536a989becb552e97bcb94a80cdf090f0a4
MD5 f007441abab99e3a21d27dc2d28060cd
SHA1 c35c3f7bc29f579b8fef5bca815d8166f25fe620
SHA512 e425a78e7b98639ce278743929745392f47677447fb862d7dca3a9a141ec7795e4a26a23af660f868c400c0f309588e681272c0a437f3fc089944d5affa90f09
SSDEEP 6144:qaBl1GmDy/PFE4focYk1uyBbZ/zf1HV40+0/OuS8c9EznEmePW9OVBfJ8E/DxMI6:qaBLGIULocL1uyBb9BW90mGoErMGObJ6
TLSH
T1958423F5E4B83899198D4DB762DC5A4483D38BB20D63B1A89FC2483E4F40E476A1B4F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 18KB
SHA256 a39d3f631344c49891655e092b8aa481b429dfdfbb5214273133a460af3b67fd
MD5 a286a3a37cf89359aff4b9ce78c9a28b
SHA1 a7c64d1d829c8969026358c5076c117a85fe4414
SHA512 3c49be5edca339cbb702210c71c3dc6143cc4e89d3bd3d565a39a9886a7c585210bec7449625c47f923ba45d710be02c7abf361e2f2deeac85c701b10419e4ac
SSDEEP 384:HzRz9tScDGP+0jXrt91XayunH4l8VW4vXf/9fdNZcCTvMDO38H:TR5srtvOHFVN9fdNuCGM8H
TLSH
T1B582D0C3E1494612AC7289AB2E8BD277D576BCE95A80645DC0BBFCD505280F83D7C670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e3
Size 19KB
SHA256 6c30b7616d3b86ff16f7b0935a8a35800a22a4950f2598e2aa5beed6dd6773a6
MD5 fd25ba8b8a3a65a1675530d776155214
SHA1 a632ec13a6767c01cb7c8eaea7f57db75da33e07
SHA512 a4cc2238b9661c74b850d731b379e70757da47295f42c1055bdeabdfb0ea2641be7a6639a802f8d7fcbb8cd08d47afa8581cd66077c5fb45394019b05b9211cf
SSDEEP 384:NjJFw/3gIwnCHiFLGFGl3AHmHdjomHiQ/7TJEO+meuNgmGc9T3V600:nFwnsCCxm2dyDOaldc9Z600
TLSH
T1B592E050655834474A3C79629A8CC32FDDCF402636F8245A046BDEFC308782F6B5AAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000101

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000101
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000131

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000131
Size 32KB
SHA256 31fbf5f753231bdc5c975deedf0785645cdb08c5a924a8853d7b684ced28ade9
MD5 59414d5891dc3b1a82a50d851e585693
SHA1 f8145255191fb67f9087c57eb67c622e0f221cda
SHA512 773f7229a8488e8de7eecad57cf0d0ede54bf4a912d0d3c837cf74b00527dacbbe9bab41f0f1b8440d23a2869a337762774c794a5d32c8cb2fd72a25132f3bc9
SSDEEP 768:kOYHCLRQvcdOg7A9bWQUURFhtqPBUhKES5sWZkKVy:ZLrOFWrEztqpJEILTVy
TLSH
T195E2F11F4DF9379C42450822D086D5C490581EEA73E0FCE519A20EC47D9DAB0BE87FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00013f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00013f
Size 30KB
SHA256 f9761b451840099f5780e512509c8b762d60e7cac36186d398c13b3e004922d1
MD5 41e2df579e72738961c19f52bdb1f923
SHA1 574666e3c43952471c49505f3b5142cd70f5f766
SHA512 d9d3262abdc198d887d12b2a8b0192a378edd292120abef15c445ad34a0f8f2aec8f0c5e03d7286fd5f8389b06a7e664b52574c6dfa46189b13b9e87d3a3f13e
SSDEEP 768:m+Vykjp+ABW/z5434PqWXoAXiwImombsdRPVxv4Vrcs:JIpz543GjiwIyQRt5E
TLSH
T12AE2F11051D895688E03FEADF94BDF3D18EE44A2D1A4281D400CDEBDBEE1E98BCD94D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3774eae14d6907dc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3774eae14d6907dc_0
Size 5KB
SHA256 8836b711be0343a007cff0ba647acafe7a67d1e7990bcc0bcef59871a42f3f7a
MD5 1cdd3fc1b52e22acd5511c5c0c14b1b3
SHA1 adc21ab4568712ce5e916ff3f7ffa9d5ee6c4633
SHA512 efe1eed0e79c794994389f7447d72fa866e01ab4406b8f7d98cb2ef47ef6147506e75395dbd0b570d3fb67b5c48c0431d8ada29d7270ed323ece7111fbb77ec8
SSDEEP 96:GgzU6O1RKH2WnA9l+krrMgD0B6HW9feI+L1XQuowV79YDUIY+wMbY0p:KqWWnsl+kMgKq82I+JXQuTG4IY+R5
TLSH
T1C9C108E28740D53BCDA15BFA52A4C67B3B3681443F9383256A7557B82C173E704AF507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

493746b197de67ec_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\493746b197de67ec_0
Size 289B
SHA256 3f343c8f82ad1ba6101fbe19ecfe28b862f3067eaa459880d86884412ecdec78
MD5 c18363a36c2836fa9d041a7bd0443f5a
SHA1 53faa48f20c938c97e9f86e32ee82d83ebbeef29
SHA512 eec412564eb3014531d54bf7f1a20279a37dbb8e5bdf3aade315f8a057fdbc5232c0e7790cd04d38f2a0dd1235df3aabc66fbcec32c6a5cefbd7000c490de593
TLSH
T19BD02B73002AAA6CE9359CB0D21A66DCDE0140917A98C031A98A88F79671AF3CF25C0F
MD5 SHA1 SHA512 TLSH

Submit Download

5623ad2ef95a9d78_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5623ad2ef95a9d78_0
Size 47KB
SHA256 dbd4c197cdeae70c224f071bf841745dbb112174224a7e019d9c24306d6a2b24
MD5 f51a821336c683d77de3892b122a17cb
SHA1 bc868835e2753a3bf90796d9b73295b5a25ec3e6
SHA512 c9ce19577c7024d82938d4bbea502a971abae81c6771bd0dd1026610630e24fecddeda49dbab6a5a80ae36d9373ade3334068e24fa6274959ff3b33b595ea276
SSDEEP 768:q7CBLj37iB5olhxxwLIQPXMWW9NgHT6k/OjixK/Al:q7OLTuoXwU8clgYjiQ
TLSH
T1F523F91527519A6ECE7613F591A28A37B33680493FC3E72614E1B3396C253E78F4E84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb5e96962ae25409_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb5e96962ae25409_0
Size 304B
SHA256 b16469fbd4bc5f13506294ea4b8749bd6685a4da78d3862382381e067a68c7d6
MD5 b51a4ff3a145aad19d05cfd54041fbf9
SHA1 4436b71d4cf5b156617a9262fb533e45958436ba
SHA512 ad035294d5b7fc71d0e7a47df51c7aff5175c87bafcb962b505fde0e61765bb330b79232426bab377d396bb88e29f920c8a5987d7d02a16fe76c8244243657c2
TLSH
T1B7E0EBC380621A8AE32F89FA905300CDDE0601F84BBAC1F18082CEA1026E0B3CB08316
MD5 SHA1 SHA512 TLSH

Submit Download

f224d36aff81bfd2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f224d36aff81bfd2_0
Size 23KB
SHA256 e60fd011e028f737065016fe47016fa90c611cc09d8e38acb233d1808e2cce7b
MD5 04d678beb238791b4893ce0b007346db
SHA1 e1a1ef6d61275765c20f2aefe5eb00d6934dd1ca
SHA512 1df9f1fcbe6b223f50eb0cb549734523a9a106943cd1ec261d08631c13583f207d4ab6c1768b9d67485dbd752b1f79012d76700deccfc5a4af5e666693682071
SSDEEP 384:c1uRfNRpZ2N31t/Tw9+hezARVsDCrpAJ8/rMEQ3awPL6Pab4rHjHfQCprpxxshrG:VdFZ430YskoCrOx3P70rjHprFP
TLSH
T129B2C552AB21D906CE3657FA51A2CA2B733681053FC7D32624E463397C693F75E4E80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 37ce219c0c2760b9e658e40905906f9029d6553d4a11b163ed54b155ec87900b
MD5 1719d847699579370ea670375a75243c
SHA1 31259e0b9ba99b0c97177938f18c2fe0238aa538
SHA512 a466620cee353d48a0a45390941eed2d20d1d4290031463380b3bc0b64d7bd0ba68ccb05c9ece47e769569b76ca40a336f2d49fa12c11d22f4e08b0d59b0663c
SSDEEP 96:p+Hw/2lj+jRfbHj1dufCR4opaJbwLTJN3cSFHi48C371wuDeijc:MH/4j/ucpwey44ge1
TLSH
T1A9E1A40583EE8276EFE4BF32FAC54D9AF2B8645C81C7CF560681407C1AA67934097B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1014391b6246e6824cb17b014966ea9b169437d857398583ef42a3ef13dc07c9
MD5 e7ac67b363760129b9ef47fbb96a5323
SHA1 5f9d92c6ef24b65610508dd2aef24a7ee3061cd3
SHA512 9b41fd6e6a84fb766ccf11578762ba8bbcb56016769494bfd9c9d343a7e36202fc5d3a9e62a3e48bf2d9b61d3084d9fc67b65b08f6d6ee272864abf0e7590a40
SSDEEP 96:C+Hw/2lj+jRfbHj1dufCR4opaJbwLTJN3cSFHi48C/71wuDeijqu:VH/4j/ucpwey4Ige/u
TLSH
T127E1940583EE8275EFE47F32FAC54D9AF2B8645C82C7CF560A91407C1AA67934097B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2e21c7a9ad3b498b3b63dcaba6d379f216e6f8f56517543792efe28c67fbdb98
MD5 fc6e4374b3364d27f7620d46b7cd5630
SHA1 b09e949e946578f494feb35ebbec6be1ab893216
SHA512 dee87ec3fbfaef05b8c3a34856979b8f19100a927da7cff77a7fd7381bea8f76c657f9d7baf6b01ad7a7a908af294c96f0f29ebb4052ac6c4e2465bc363f772c
SSDEEP 96:w+HRXVlj+jRf0HjldufCs4opa8b5LTJNDSFHi4DCbRmwRgyiC:vHRNjvujp9X4W2yD
TLSH
T13DD1B815C3AE81B5EFD47F32FAC5499AF2B8605CC2C7CF560691407C1AA675300D7B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1a0cb4a1f062ac9ea3b799e714594e06e941de27cbe973258fbdcf6fa59c0dd3
MD5 3d8661bd133f495a5ee91c5735328c1f
SHA1 182bd5db445a49a135e434e57decb2f87ffc7bd1
SHA512 6d7b08c5ca4bbfaf2383e27b9b59101e9d2315d33ae74569897cdb3f87086b94e6d80d5d9b962589ffd73ad8a0695370fd0aa0566c7ffdf36134ae1fc9cbbecd
SSDEEP 96:IyN+8w/HFj+4fqo8Xdo+fCR4XpaxbSrTJg3vBSkHi7S/n7mYu1niju:IyA8Wv8No+DpYDY7Yanj
TLSH
T197E1A606C7EE8126EFD4BF30FAC51ECAF278605D8187CF525681803C1AB67834997B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f16b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f16b.TMP
Size 3KB
SHA256 0d4dc096353fa01687654bd4e4ba960bd54e96691c85666710024b2405f1ffa8
MD5 9d732ea31067dd8ad6271ba3e46a3b47
SHA1 e98a79ad18ea413f15c00425d02e2316cd9b4541
SHA512 0a0f1bc20c38134b65bd511e8046da0fa55df0d32e6eee79c0d7f50563d498355655825cbae10c0a7e55719d1a95876f5efcd1c4199150f535d563a55910806a
TLSH
T1A7617064C3BE8469EBE47F70FDC251D972B8496EC2CBDEA646E1807C4A66B0340C8F55
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 0e4cb883ab41cfc9c411606f67a96543772a94f39c0f185aa1c2f35cb2230088
MD5 1969dff3cd7338176b9b3ddc7d503237
SHA1 4056dd2b68032a3e5bbfcf6a96083a041b4e029c
SHA512 a4782d87b4d6dad0fbd336d6a3e088a5a41668dd65994686e2c81a15ff16afac188d7642d7b3a868c3d31d58c8c4253a3d79fe7109445d0765fd3b7801eb12dc
SSDEEP 384:DWeYrsz22SAoeghWFCDYccEhtNMwHYnKo62EtsfEhl+q4GmjRDOOqVpkM1Da1qQa:5xkEWWFksS
TLSH
T1AFC2AAF7C3E4C62DD96152F0EB186E2FCE190829536C3D2A89D59F4B93E2471E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 939e63466c253c2f285cb6c4ab465fd2376117501ba3cd14df2eacae1a4788e0
MD5 11f48fcf00394bce8bf9b4a62b933101
SHA1 fff6357439e7f8e520a3d86d50fe1a0706da541f
SHA512 0664f5510c97511906d893fa834fe1006d79df009668fe65a67c1bd9aa8f6df13fc92bb7541cb23ed88672b2ed2b6633166f95e5d7598ecd263d4b74932f44d3
SSDEEP 384:DWersz22ShWFCDYccEhtYhLWrbYeQHFlIlt6IXkLGmjRDOOqVpkM1fie64ea1qvL:rEYF3ZWZk+
TLSH
T186B298B7C3E4C62DDA5152F0EB186E2FCE190829532C3D3A89D59F4B93E2471E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 c7e3da4cfd0c2f7dc592f53d99c587f3a69147a2c00a327f9dd8a11b8bc3581e
MD5 84db1134697142fe57e09fb985671ccb
SHA1 be63fb427c6da454fe8b74acca261a6fa91a0875
SHA512 7f1b5a41097976a87b74ebfc2dbcc1eddb644c7c1e88612fdf707926b552e4e504edcca6887935a290c4b90ccd32578de3130d0097f9584b91709f78e93f59e0
SSDEEP 384:D40y2rgdnP74eMgBJeA/z8QxjNMwHYnKo62EtsfEhl+q4GmjRDOOqVpkMNK1qyuj:62kEB6qLM
TLSH
T128D2ACF7C3E4C62DD96252F4AB186F1FCE1D092953283D2AC9D59F4B93E2470E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 5bcba92770b75cc66555d790f759267bcec9afedb3f0e2cb4ccee8f8845a1b61
MD5 06ec2f785514f537f4e9aa7e19e5cf51
SHA1 6fbf1fcb86ebab9d9084dc97692bc6049bfb6fce
SHA512 9593e68b8fbb679b2431c3f59d3f7cef5969ba51a113024a819c79e884be719f663d9b8c59cc25eb5fa6b5006e4ac73640caf1202230243b083f2001e603d76d
SSDEEP 384:D40y2rNdnP74eMgBJeA/z8QxjNMwHYnKo62EtsfEhl+SK1qQGHup9vr74EKUTZba:x4O49VER
TLSH
T1FDB2ABF7C3E8C62DD95256F4AB186F1FCE1D0929432C3D2A89D59F4B93E2470E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 ede55c90c42f06f5055500845644c0954ad2c9197c7361b60197879536567aa8
MD5 a456b21e9b1f785627a972740582616a
SHA1 9ef4e35ee7f2f534fb10aa6eec98bac9db3d08f4
SHA512 8d26043b0b8c212219792931ddd35b4315c791e16c1a32d789a91cc7fe7725b6b18def0c77e5d73b7acdda850d0c1905102a823254e9f75be5e08365c040958b
SSDEEP 384:D40y2rNdnP74eMgBJeA/z8Qx3K1q68GGHup9vr74EKUTZbIUdFK6UKU+BB3WE6F9:X4O4PM
TLSH
T14452ABF7C3E4C62D999255F4AB146F1FCE1C0825532C3D2689D69F8B93E2870E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d88d6cda-c792-4e06-bb92-b1007afcd4d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d88d6cda-c792-4e06-bb92-b1007afcd4d2.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 21d9a2cfd2eae8462f56c0feb47c604e8cf43e6682859d893ed285fd149fb58c
MD5 b24aeba4059896f3113f2011bca083cf
SHA1 1036bac8add8b5d5a1999e648afa195629349802
SHA512 bc5e19737868db6ffc27cb972e4763f7ba7e99c5af7ed4610caeaee8c8c0c6b1b4557addb63d986efcf5fe6af8720b24230c63907dcd0fc6c7ebb45c0d6b9bcd
SSDEEP 384:sxZmLqT+/f2sfesuUvd8Hb0gsX/QXiL7rY1iRINSeq:sumT+/fdesuVHb0/rMLNI
TLSH
T101A2D757A5340ABB8DEAD225F550BB2BD2F5142696C04F84AAFDCE0C00D7BEE7102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 313f863bd326736e47ed097361ca1cb29a36fc7bbacfefbe48d586e2aa3c43be
MD5 9a56790f84b5bda5ea7e844bf2b7818f
SHA1 e0aa26a40b11061836428d1d2933e8bf53a5b541
SHA512 7db9b8d620171134a7d514b2393182b96ecd75985d75affcaabd222e50ea1cc3c60b70bc5df8b1620c6ef21f1d51fc82b6ae7012f36864c3e7b04a8d69694d1c
SSDEEP 384:sxZm8qT+/f2szesuUvRPHbxgAX/0nrY3RJNSeq:suLT+/fdesu2Hbx7EMPNI
TLSH
T1C0A2D757A5340ABB8DE6D225F510BB2BD2F5142696D04F88ABFD8E0C00D7BEE7102C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7fbcc61858f66552ba3c3ec919dc76f6bb728eb9ae0fa45c03f3a6151ebeae6f
MD5 f9ed0f578e5eb2cf3cff6c24ee3b6e82
SHA1 3795efe5f9b7eee91d93f4e40c146e8b375deb0e
SHA512 c580126fc331ee21cd45a857ee54a0a76870bbae85dec20b1b19cb16f78a30bdf0b365455c2fce6729fc7c292dd0de1be48e756b86b0149a9a8d236fe4d2df57
SSDEEP 192:sxZmRyyMqZ/K1Ml8MG+/f2sfesrqBfJ36vzzodphtHW6+WNQuEfEWIbad8qErIDo:sxZmLe+/f2sfesuUvozHbKfrGrYPNSiq
TLSH
T1E282D856AA38597B8CDAD225F554BB27D7F5042796904E88ABFCCA0C00E7AED3102C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 ab014935b19bcc3edbe42038899d7faaa2995cbbdd9e6792b795666edafc404c
MD5 ae713fa99b2015aa92779a645f4a78ec
SHA1 523279656c3b7d6a63b3521eef47f137b00e8639
SHA512 90381b0df2e112f74809fa61917674ec692f26ab81ae7cf43630fa47751b3a6a514f2a227b973a042c74108242fd8d90918681b3f9d1fdea0036602cb853ec43
SSDEEP 384:sxZmLV+/f2sfesuUvvfHbofi7rYrRNSeq:suB+/fdesuWHb2gMrRNI
TLSH
T10A82D757A6385D7B8CDAD225F654BB27D7F5042796904E48AAFCCA0C00E7BEE7102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 68aa6dc61875d721e90e10dedb36286504dee486e17dbda91d3b0fa3a250d256
MD5 1ac0defa472c4f8d35cbd75ece4817d2
SHA1 5a48abfd4e450334ae1902bfe3ab47a46cbe1870
SHA512 81b9ee7e4b544a225fae5f763270c63850bbe3d247098d5a9b7852bf8175ab5b2217538383cd172123f860e99d02d30dd8950e2405fc12afcced5b143409c6f4
SSDEEP 192:sxZmRyyMqZ/K1Ml8Mk+/f2sMe7prqBfJ36v2zodphCHW6+WNQDX/EWIbad8qErI1:sxZmLM+/f2sMeVuUvNQHbU/rGrYANSjT
TLSH
T12C72E8566A34697B8CD6D219F555BB27D7F50427D6904E48ABFCCA0C00E7AED310281F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1003146764de90c4f576b01b799b4204b5c846cab8c3ccf2e3eda3a02eccb03d
MD5 5abdeb74624bbe9fa523c827e55c05b1
SHA1 4fa6f807c8776523a50736b553e08c45633e0a3c
SHA512 a40e02569ff0d307a289266a2392d1af00af8796c37362ed4a52ee6dc16cc0dd0bdd5d732f32828427d7d8b5e22652c4fc70187fc96227d2f545678d749f2376
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaEx4Llhf51YroU:AasqZl+E/BlWvBDeTu1jaLEx4LXB1jAJ
TLSH
T10DF20A3B2C0CCB7E4F804E9CDC2A7E9E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d864f7e2-3df7-400a-972a-26ff447d73c6\index-dir\the-real-index
Size 2KB
SHA256 2839492df4791ac594ad364f948072d7f9c96e735e2beadc64df77e5b4792c31
MD5 6f252c9b3fabae8461645fb62987670a
SHA1 5fb83fc13feedee9f2b70d824b2b61c04e379416
SHA512 9b50143e803ffc4b399ea7c5cd74e564455db947feddd409883c62918d4ba46aab79ce8b42d62ed910052930889dc014c4c6303372e28ba496d398acef0efc0f
TLSH
T13F41B74D5C868D27CA39407118BA1439337498EE1A8C470B38FDA139AD5BE51299333C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb463.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d864f7e2-3df7-400a-972a-26ff447d73c6\index-dir\the-real-index~RFe5cb463.TMP
Size 2KB
SHA256 285ebdbacf4fc7087af7749a538370a6497d1d54ba07ff905f5f09db4e77e035
MD5 8ded4e9598a67eb38e9342a3ded21b44
SHA1 5a6340b996ffc19ee892ae7bdefc568b2650cf58
SHA512 185dea34c52f7cf4e47f5e76bcec76e17bc453bf0008dfc78fee06b575c88ac80b66e23702a9a77d2cc69dc692c7bdf989f39d5351c0aa8ad387e043b5aac86d
TLSH
T1F241B95A5C864A13CD30907149C96429333DA8954940AB0F75FC8633ACDB6A82D52194
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 a18baf7ebcb3f9f35f040d968f0ae784d5f3631ef4829202b2cce0963d474e19
MD5 4d39c157eb7e668a37c438e8ec28a1a8
SHA1 ebaf09881c86e6e827467fa83729e91e1d0f8cf7
SHA512 1475801dc57551c89cc1f94da62290500f9b92a7acd0c02c0a619e86a5f0aed0b97cf9327e8fda0cf31668402e0b24205d667e2516d74a9e317ef93ab9ce2eb1
TLSH
T130F027B73AFB1814BD9F93D92471106500013C249945ECAF6126A39794F1319348AD63
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 618ae01cbc5d3951cea5f3819f70792759e59b290a476e22c9c40a8a8d7d9948
MD5 186b0035c561850a2a56117e57e5b546
SHA1 f286b73973b5b2254737c2e6b6eace54ef509b8b
SHA512 76f4ba6b0362b9451693b5cac357fdbe5ab373aaaa927d22638b89a6f520c783208efd58b059031de86b1d3df67a333e5b3360d1d6e2439805271a3e6024550e
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnr:+BOVglYXrbtZqRvJhnN
TLSH
T144B24D11763B0380393E258E9594B56F62C170A37098B82B3BB944A64F6BF20DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\0688228b-b417-4767-97e1-5ef1090b6ee7\index-dir\the-real-index
Size 72B
SHA256 1b7c17cc75379f21ce7e8cd973f027b1135fe986f4fc78af04cb8d3f7f9237f4
MD5 95bdd8f2b7e1c049b38aee0cafe8069b
SHA1 e1abb98acb4a7d788cef4505694611ecc0f27da0
SHA512 60486c73f8edad39016167a48d34f49a38e1e05356ef730d0f28894492d79defad0ed109e05b3ab20f26ec743deaf9ecbff9dc03a98d788a5895acc964feaff7
TLSH
T1DBA0023811604B11C40002B56497417136356951E985170281D271D5CCA25E5454313C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5889ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\0688228b-b417-4767-97e1-5ef1090b6ee7\index-dir\the-real-index~RFe5889ad.TMP
Size 48B
SHA256 c7e78ed90a3fc57031a3d63c9681fc32d1b39a83add2824b12f7cfb30b7793cf
MD5 731cc7b6cd0a415d02938d0fbee4c7c6
SHA1 67239a13116d43883ea710688518b47552997cce
SHA512 f5c679ddd3dab15a3964945f638e0802a475e2d8ed56ec46a5c42e95ebc0fe2a18d5d330771e3de289c65ba6ffe76d56ae2d5e5f085520a35d0161db659999e4
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\b6f23217-5c9f-4135-8531-1646a56e04fd\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 85988d2e015905888dc9cb3bf26e910c2306916abd96610b276396d0b3508045
MD5 5bac0ed0fb138d4ad67c2cc32780fe91
SHA1 0960f7c2a197f02012513957c0f4b9fd0c300b41
SHA512 fb2e55d3e2d61902ae46ba4aea8d180d28da8fac0fdcb45626935d63efdc4ed6f9af4275a7b8a673f8cf45b75a4245d8e4d57d73755438f1a3365a8868551f6c
TLSH
T1B3D0A7E75730E4AD0B759698A034355D95179C4ACCE0D9E49641B05A20F5613C002D36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 235B
SHA256 f772a8e87a0dedd10550f70fa191210c255a30c6e264da01e52c4f201966b89f
MD5 cc3d7281053e28a83a9feee9d474a013
SHA1 5ac38526f80d82cf1ffa4ffddd10074f24f656e7
SHA512 b912678aca501921984a042bd646c51bb493e4b996f0db46e175ba181cf7ac13e6c172b1bb906d84684cb5b08a7b29d0b5c6bab139d6dd0b93a31446a652984a
TLSH
T12BD0A7E787346C6A1B70AB99B034680D9A174C49CCD0DAE4D444B09A2074612D002BB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 151B
SHA256 4048b78e4cc8fb7eb65b9312a7ca06738304926d96376cac06c6040cfcb0005b
MD5 7f2d115418d69bd63ed0e76518dfd201
SHA1 15cc473ba3d3bc65fbd895a369412cc809a7a349
SHA512 329dabeb23f0cf7d09a37b7159a02e1100e47af506c868a46a71b2f9fc66c140d5bba0b4791b9225f4db696b6aa51eb294aad0fd3cca28f7942b25b734185c27
TLSH
T16CC08CF7051055AE0B709BDCB034750CEA1B408C8CE0D9F0904440412034A23C402924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 91801e143c1f688f2bc5d2f4b1735b8d50cf484186c512e74b45dae4cb39f10b
MD5 0452a853692ac313d2b6f11e7f542bbb
SHA1 00b08ff4768d4f89f7ecb23ce845a0078ff6a623
SHA512 454968d7deebdc5adce0681e905aac53d1cc39dc41cf7b38137b0f075252a666a6d7c522a988bf25616e01e360ab9f7ed1efb1b9cb8df92aa568d775cd4f84e4
TLSH
T1F1D0A7BA5230A55D1B30969DB074706E95269C49DCD1D8F09984B09130F8613C443939
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 152B
SHA256 9f011bb993e594da4565c0325186a99db40b3a59db189538e7769369819d3e94
MD5 230ed0629daaed85ab0f1c567becc9dd
SHA1 f8e49db84eaf4aa4544f385961a6de4ddf1fee1f
SHA512 47e0b1524a291e18f34fba2f31361fa4a6fe5c637d2af396856bc6a95baca029a793468a9fe8c342d0623746bb8427131c91bb330997e975afbde994269d62c1
TLSH
T12BC08CF7151051AE0F709ADCB034350CEA1B408C8CE0D9F09044404120B4A238403925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 ff7639250514270e6bce23d6408eb68d5ef28ff6ca924d7183027aadb3ba9974
MD5 31b175a345935337577b756e61baeb86
SHA1 b324608727889a0347dbd2296e03a434e9626faa
SHA512 bafd0e6009e50f51d5a1a8854f3a15634666ebded966c654803d7f8d03a839e268c5d8d0acca401aba7298ae757bb3511cd12cd0eca18cbdf4ea682f8b6f3c21
TLSH
T1C8D0A7E75A3054BD0B30D798F134304DA62A8C49CCD4D9F49544F09631B4623D402A75
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583544.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe583544.TMP
Size 158B
SHA256 fb168aa462e0f7d63c0bd1c6f0a8cc0f550d2d08c156dcce6bb949558f6371b1
MD5 fe0cef88eaefaf4236f2cff7a03278e2
SHA1 8108432c2fe69608b6f8a3e3f3342db6ddd05aee
SHA512 163cb8b67fefcb141588ee2aa255ce18cbad08e1c5ab74dfc6db9e3be8da631cedc3341de60d6925a3ddbd3e30bb5c645b257d4a1cb98398f98251625462eacc
TLSH
T1F7C08CF7152011AE0B719AD8B030354CEA2B4C8D8CD0E8F0904570412074A23C402924
MD5 SHA1 SHA512 TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000005.ldb
Size 18KB
SHA256 9238397ead961779893d3de45d790ff6ffd8880923a9b66fb5ea0a8e2f5901cf
MD5 6d18917ddbb758c8e16c00f7bda09e0a
SHA1 5f5c65f8669ce7c86ec61ca87d98b1e0f44e4833
SHA512 bca7f6968debc900f292f55caf9b1e0522c61b6a512bde5582b11e8949a2d0419ac159bbc83f35af22bf32805f1c56fdb01a663c5a36e4281b3e5eca85d714ba
SSDEEP 384:tUh8OiMROIj3o4/PR4Qlc3o6FE3o6FZDWMJB1Oy3muH:uhTifITlJRlMjEjtXZ
TLSH
T1E3828EF3279866B1E5B5422797E239EC8AF1F309B762CA807C81437D53A570A503BF16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000006.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000006.log
Size 23KB
SHA256 4196db9e26fd1f36f16332fcb6b3f26912c9e835f24214decd6c7bc506c6a1a9
MD5 0c2bf13bef96407043103fb0dd104db4
SHA1 1c621493548e124bc061ee184d116eb70d215de0
SHA512 7fddcd14431c4b3487dc0c8a207257d5aa55f70f70648d1d241a05e6658a95dc5ef3a8f94ca08ed40d2d6f2bf27d3127770f806ef988bc7a02104a4931e4a9f2
SSDEEP 384:bFb+T4QmWM4GrcrIYfrFfFsHy9bFljgytkF2OAtvFzJ8:Qu4zJ9vtBbOWH8
TLSH
T1E6B2E9306212B5E4F03B433B5B529E46E736CEDAE7512022FD626E1C29FB708295763D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000008.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000008.ldb
Size 1KB
SHA256 5782d17668d34910c9a1422aba6051bf9f387138863fc5f5036106b840b9b832
MD5 7a4271358e2b77b5c5b7c35dfdce27d4
SHA1 f06c8e3fd71f519676cc02831fe00900531d71e1
SHA512 fc46ff4e439b159a464207716da507963a7d5af6923ea13f4feceb85c5e36942761fd5e3f1441489b4a3997d6a76942cad60620d8010e9b765cdd40b829ca839
TLSH
T141213607CAA5D095F1331B7795F1C29D463573472611C68F8642814647696817CBF74E
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\LOG
Size 1KB
SHA256 001c05c15ee43565fff8edb8ab2291e82753bb2a6101661b898eec68b7c6c4e1
MD5 266fb96cc6731909db3d8834302cd4e5
SHA1 08aa78adf43440fcdfe44ba8eeb83066334a75ac
SHA512 03f32e92972ff149d0008af321d724be6e8bdd683a36e0a0165dbb5cc75c4b953ea6f333c3e61ad30f5827a897eaf7dc85766d91b25560a02a201443b1847ba8
TLSH
T1BA31A0DB06058DE4944BE0E3C228F287C6EC7222970D1F74ED4DE7AB16D0806D45E4FA
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 335B
SHA256 87d172c16106ebdd18657174a120928f0bd4b000a5e690929ca906354988eaa7
MD5 0ccd15f3e7900311ba1ca4a9aef5c5a7
SHA1 1170fc22300adcff5100b7613ea84a3233474c3e
SHA512 9d5262c5a2aa18a5ed1dc543ef358d08f17dd928980c01de9d7abc2519b7932c212a911e27948004d2a7df4a0d6aecade37a3627b35a91d3d7c1fd13c2b87ff1
TLSH
T10AE04F27DBF4D4D8E174CDB84AB745579321B68E1E02D31FA784472E0452980CE3421B
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 70fa4e93d5db3fad1c1599c545523543710a921bf19ee65b9db973dfe44d5f56
MD5 93817426e1210db4842a9b28d0a9f7a4
SHA1 d3a7823b755378a6ec576695e48359ec7db95bc3
SHA512 40f9755691151f558011b8e3af9db03f9a846908514b020f7a3bef9024826019d9942869def67e44bf346a644951220d63b3feee65fe1846585e605d187acfbb
SSDEEP 384:nuviFavqMg3sNU8TUNTUlIm2RihYpcr8vfDYHLajdTYgCuQMS7o1dKuiNTX7rN1p:u6Fayv37wgTiH8YH2xThCbMmo1tiJXfp
TLSH
T1B0C25B31EC98D9ABEDE69FC9E7497A07DEE00197D58C0AE8D9E84D0D108759E2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b2569cb71012d5c6868f58589051de4c438b882894159fb629d5807f148f0668
MD5 b5f2588574277c53f8d868ea00ebe82d
SHA1 5d5fb294f20f44022e5401c0e10fed222a3b7aaa
SHA512 7010422b6a018be9b0b42b672b92f490374a227e065827d200c780debbe33534a154b589432afc64b66f72517b61bb32f09a97a2a1dfe08a009956df2cd7d9f2
SSDEEP 384:noiFrcXqnW3sNC8TUNTUlI4rRihqkp928vfDYHLajdTYgC2vctXnzqFvvS3rN1kd:zFzW31wgoih9vYH2xThC04zqVIy
TLSH
T1E3C24B31E868DDABEDE68FC9E35A7643AEE011A7859C0ED8DAC45E5C00C75DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5a006bcae9d1be562ce09130bf2fb271816a630a1d49c69c894b19e110e95ced
MD5 5ae502be41708a6d4f03263fbeb8134b
SHA1 11cdc21d005c8cfb6c4fd7a79a377e414f53e23d
SHA512 abfbe0cb4f8d0b869e4aeb9c833ddbfd48200a6c4571e1cc2b2dab79328dc7ad1eac9c043b4af41e0456d42870a959213f8ccc8663c1db27779681bf3a983d08
SSDEEP 384:nyiFrcXqnp3sNC8TUNTUlI4TRihIikTb9B8vfDYHLajdTYgC2vctXnzqFvvS3rNU:5Fzp31wggi+5b9WYH2xThC04zqVIy
TLSH
T1A0C25B31E868DDABEDE68FC9E35A7603AEE011A7859C0ED8DAD54E5C00C75DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6ce33e4283338642b5a0b679e2d393a1f4eb5242a257bd2bfb1eb79eaca3ec91
MD5 21fef2cb60ccd7a01aaba98a94a6ecfc
SHA1 3a44501cf4b4b64c7c981bc43c517b73a4bb11cd
SHA512 31bf19fa6f1aca39daf4ca32acff7a8838f8ff2b6bab912219aeefef82f0f241d906bf4e93ac036f2b4280bc67380eaa59e2d1a09b4f8f80b4022b8d13042e56
SSDEEP 384:ngiFscXqnZ3sNs8TUNTUlI4/Rihhkk9B8vfDYHLajdTYgC2vct+pzqFvvS3rN1kd:7FuZ3bwg8ip9WYH2xThC0xzqVIy
TLSH
T125D24B31E8A8DDABEDE68FC9E35A7643AEE011A7859C0ED4DAC44E5C00C75DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 533e814f54ed57896326768b6756874769fc89dbc7e8dcd5c0c2c7a6e45f4552
MD5 efc3f2e023125d2b37bdfa35ba76e4cf
SHA1 71b5b95c68a24582321ea959ada493d4f6e10d6c
SHA512 f0b66cab96f1711231325cd3b71bd83190f01af06e088defd13367242ebca897a73e981976e25e55d83a2772221561527bdf1eb75f8a14f633bb62a831c9b376
SSDEEP 384:ngiFgcXqnwsNXB8TUNTUlI4/Rihbwo18sfH22HLajdTYgC2vctEerzqFvvS3rN1y:7FCwABwg8iLK2H2xThC0j0zqVIy
TLSH
T102E2C3F1A8E78976E99E4B87A37E6E025AFCC157B5480A94F7C40D0CCC865BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d7d3bf0e05b5dcf1ba22b3a20cac3121a44b54c36131a75b0b8c66e9f6b22924
MD5 26295022ec514c40005aff1e2065fcd1
SHA1 435aef560f3a4555f3264558c55a5d53f29a8858
SHA512 ae27ba3a10d0ed4b3a43f846f406b0c02a3ec86a925001e183377d548e9bc662cff147e9944eaf0d9589df12f747e7b838beeb79cb592637bc0a77e52bed9f08
SSDEEP 384:ngiFLcXqn6sNXB8TUNTUlI4/Rih3w6O8FfA22HLajdTYgC2vctEXrzqFvvS3rN1y:7FT6ABwg8iNJ2H2xThC0j7zqVIy
TLSH
T12EE2C4F1A8E78976E99E4B87A37D6E025AFCC157B5480A94F7C40D0CCC865BFD306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 096d26d67266f54f433be18e77581ca4808c0c948f39806609e149d5f7642c4f
MD5 4c8e88d105647e3a7d703d17d6ffe638
SHA1 2bb8d9e0da6b6ca64eb5e4e08f8638e3951f3532
SHA512 b267e4e4ca4f0299069561e1f9310bf41d2231aff86c410759bd8d61159b54deb0ed820c4c984eef66b1f6590f7cf9501de10b8180e576438e4ae4791ff4fe81
SSDEEP 384:ngiFNcXqnnsNXB8TUNTUlI4/RihjwAO8qwfAw2HLajdTYgC2vctEsrzqFvvS3rNU:7FxnABwg8iheW2H2xThC0jOzqVIy
TLSH
T1E6E2D4F1A8E78976D99E4B87A37D6E029AFCC157B5480A94F7C40D0CCC865BFD306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9a0169df38a965d320935aa68d2dbb1b2c10c2ddc70c7ccb7cebf46d2d49d8f6
MD5 d812d7c446d2b985b8d91f26338e9b65
SHA1 c1c17d88f359aeafb736f9ceb144eb42d2705a51
SHA512 861c77847a27b7d5f03d9ecf970d6f3e3196a624618dabdc8f14fc6b3c39aa99dbcb094c6e66959ccbc70f9681454cd495dc42ec01736fb45f81834cc37c45c9
SSDEEP 384:naiFavqMg3sN28TUNTUlIm2RihvPNJ8vfDYHLajdTYgC2vctNnzS7o1dKuiNTX7d:RFayv3FwgTibOYH2xThC0+zmo1tiJXfp
TLSH
T163C25B31EC98D9ABEDE69FC9E7597A07DEE00297C58C0AE8D9E44D1D10C719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8499df06a90a71b6f288213ce6ee7bc3e1641da93bb57c5cae9420897e9f03d4
MD5 26477ddac8f728831107882e5e99fc56
SHA1 d4e66f6bf08d9e85c6b78171a097b65cb5929372
SHA512 9b444dda53dac2285c04719580b3976226541aa07eb220f321d7ae748730f94d4b5741493b7432db85452eb8b5db107c849ef4be58068e1fb0fe4b83bab41c39
SSDEEP 384:noiFavqMp3sNC8TUNTUlI4rRihqkcs8vfDYHLajdTYgC2vctwnzJn7rN1k+rvI+b:zFayO31wgoiUZYH2xThC0fzJfh
TLSH
T10CC24B31EC64DEA7EDE68FC9E71A7A07EEE00197858C4ED8D9D94E1D008719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 4de40cde1bb401bb3312bd2241bb3ee792ecde105f1fa2da0acc027451ae36ec
MD5 f7f4fa891bb3f87c4c932bb03a668068
SHA1 2907c6e2612cfd47073cabf0bca49bd38da03a11
SHA512 dac01f1fff460e2266b8f17cea64da708c135a93ec12122cf68b1e29893e177e20b314e2a683593c7b41cd4022646ff5b01780b0846fa26cca873bf09208af43
SSDEEP 384:ngiFocXqnx3sNXB8TUNTUlI4/RihYwjr8wfi22HLajdTYgC2vctETrzqFvvS3rNU:7F6x3ABwg8i/N2H2xThC0jvzqVIy
TLSH
T1BBE2C3F1A8E78976E99E4B87A37E6E025AFCC157B5480A94F7C40D0CCC865BFD306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f6bb04f9283ad7ae8fafa1ae01cbc92787a86b9bec88b2c283623262026252f9
MD5 2e24f7854fbccd8074339b5c6a00320b
SHA1 56899132748d374abc5dd566089e8cf51c76df52
SHA512 bfe5b5ec8b5872f2adccd543df73b65b46618e2e409fae6b869329ecea0e5d3c5bc80a45a06599412ee768373ebe18d1dbc2e5bac03bcb16a651b9077838cb02
TLSH
T1BCE0010BA74014EFD038137001DB6B393BE3C07213B38B4A493122782C23340AF20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 04982e72cc410e8eea30d4ddd7572241453cc92c334d30d4fc7f60a85b769b06
MD5 4df771ff24ddb5d722263d8aa2c93402
SHA1 f3200c1af73f67acd45bf0c1afcef6123f07e49a
SHA512 9f8dc7d79f2e3ac157066b34aa99aa60e5f67b7e11fa7696bcc00e1f7e8e4ec72d616798846a3d3f442ee865643f4f6aa13ed88e466a51770ea187feeafee98e
TLSH
T1C4E04807A34014FFC038133000D76B303BF3C03102A3074B093012682C233006F20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7c065be71881533abca29a1dbc19b2fc91f8e60c8ba7eef35180587245c0e31b
MD5 04493d173e932c822d0136a9647633c7
SHA1 ae90ef2888f4bcf0578ab6ede94b0c317123e950
SHA512 4af199f56c588d787f437a945e829cfcc3e137e96351d51acfd4b2e3bc3d14c8c56ce8e83f4f63d5f565774130acef69fbeefca23aabf95b8e7b2e8022493ab7
TLSH
T125E0090AA78015BFC53D533055D72B3437B2C16492A3474B592552A92C27340AF24EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 99b95ca8629562cac2ef1285a762b40f3655906d5be504b2d96363886a29684e
MD5 0511dee640b6353042065938779eed28
SHA1 aeed01ee8d3aa50aa19d4d02993162576a9bbf17
SHA512 69f83e20a79a5c4428242cec791eb36b8267c8ff83f3d7ffb71e1b5eb176c7a50a5952e76ef5c2373ab77e870b2b833470f03dfebb9b390ac3b935ee7fe332e5
TLSH
T16BE0020BA74114EFC179137055DB6B3A3BF3916103B34746492112753C223446F24FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9965c46d6f4a5c6c1fffd75c023b9b49ec367976603c5629a62d91416bae159c
MD5 4193dfcd91ba54f6de6876525133e97e
SHA1 985509e8ba2f65a7f3f1e1817da71d4d02f34635
SHA512 83fe98c139e7afa2ac9841b851f66d6c131b87558b0e5e8eb28ecfceb63fa9aea50d629ea49ba9f02696d1d234e73783c2ca43b935078212c98badb3de840c89
TLSH
T153E0440BA38008AFC038033000CB2B303BE3802202A30B0A0A2022A82C23300AF20AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 241c90b0ba92a234b6b6dcdc260efbe1c3384fcceb06cf87259ac48e63e803dc
MD5 636b873affa919960676e76f24b70f1e
SHA1 5a2876592a97d1e0490d1d099a328d43bcfe572b
SHA512 07c55bbff5c1c0f4863dc99668ba62f07b59c2c32d3ed31808e649f1deb9eb5248665b16d8b0cc11dd3418ee909603a4514262ff2c294d85ead355f45f2f00eb
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4b3a679a56be75d0453e400511af973d59c62936a8fdd0de68a992d4fba96267
MD5 a5fd03974d3b6a2eec7e11f1a743f0df
SHA1 855b0c9812397520e8ff4e2c78f23267229d649b
SHA512 6c48c1ccf0511af7709abe8f852b7b4ed3c2b3e80d2cb08fd68dfc283797fbfc2e9f71de501b068d561f9e91b981ea5db8059c5ad8e98d57510b8935bdaff896
TLSH
T1C4E0040AA79015AFC539537155D72B743BE7826492A34B4A5A2552A92C27340AF25AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8fda5dc0f25a7b30c6f4a30775980c9dfadf208bfb3466694d50d3707105d1a8
MD5 ee3e16b5fe0ee58df9487c6bd0a8b5ce
SHA1 2d1088d942e6d771b2e6b1901b6504f79211b674
SHA512 338236de21cf68941caa39ca8530836f47c4d2e2e0c6abfcfef1497ac31221ca6c256925dc1e771ae141dcaa3f7fb4a1b93bc049712cded07c8f7e98c7209ce0
TLSH
T1C0E0020AE74011BDC12D133005D7273433D2C06411B2034F582413513C131005F24B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 563fd9db3c778814a53cb448835c0a17b9495d735a6d6b3d2c53c8e6888746cd
MD5 f0ee005948f622dbf08ca7addf37ff81
SHA1 fb978e6b706c5f6d3daca18e25a29560a55afc0f
SHA512 d868dfb24a7c35d039a061e16358a2d071d80da403510954fc2c829c3452f4133ac6290e5ab322a835d6ec4f49c8fc5ad03b320cc4a8df9e20b27540ed2da2ad
TLSH
T142E0EA07A65114EFC079137055D76B392BE3816503B347464A2112782C223406F20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 054508eea44e9271a2938f36279a7b3353e76fea226ba1415884ee24cfdb190d
MD5 926477fa2a35d7e6310ac801bb1b9155
SHA1 eb3a812c954542f1db622541e7ff4978cc49b31e
SHA512 6df572252e9b4479b45e969584312353b581fc444e5c69abe823673f9fca76228cf475230bebb91378c1ac5c25bdab7482f45650c41d5fdb04ba7e52726da650
TLSH
T11EE0010AE74011BEC139533055D7273433E2C06412A3074B582512A12C122005F24EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2166e72aebfa00aed9dc1119b5ec8c56672e2a0938d0d4b7e0c51e3bd1b48a3b
MD5 90ce55c12a56212f22605deb10ddc1de
SHA1 1d4137d7fb52fd10c9363ee5b3d729565ce7f4de
SHA512 7d4416e879c5ed2e95565e31f7a9a5530dec78d12b94d629beed78807869abe8414933c9c3dea10c3dca1bb8ff0bc5c4cca17d1d88bc2693161ac434934d3afa
TLSH
T171E0010BA65118EFD07813B151DB6B793BE3816603B38B4A8A2122782C23380AF20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ac13f8aba2e2881a0b9e34218925b78f179476ff7b7b538ce8a77b4cc81171c9
MD5 e9579a26197301170144caa4d7dc7ee1
SHA1 85014f989023f845bc09bfa607dffd231c6f9639
SHA512 1a6024e969cbcbf46fdf59283c058344dd2da44a9cda0470cd2c1e92d75ae9892f91e4281eb05dcff0f5a4424afe8ab2b8b42ef3262ceb32d24f91e52d39fe95
TLSH
T146E0010AE74011BFC139533055D72B343BF2C05412E3074B593552A92C233006F34EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5879ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5879ee.TMP
Size 392B
SHA256 0d1343759f4f87607fdf3656730bb9e0bc3621a2c019f68764c43a4c48d2ba54
MD5 2dba2c6b7f7efb1c34642f24e20678d5
SHA1 443d6b2cab5077bf0c203c13d3708f09a37e8d28
SHA512 9bcd5c40db931eb9676ccc3e02da06dc873fb153c97ac893a0a4bc10042a5dee6e49a48985317345ea3e235888d2661b655e2dd2dea0b8377b5ba88cd866d69d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 d07382aa4ef9211670e2472c817f35b51d597b313de33f0329856bb0440e55af
MD5 556c989b11cf8445d65c990a85427df1
SHA1 a56a9c0ef7fd96078b4d015a578110d4af9f6dea
SHA512 b2ebba406f4daec244f4ebee6f7603232ccb2cac8428152885d4d0c5459325f4b94f3c554565ab2af268c2942ef72a2a5746cee6f3c391b268892c37afd396c1
SSDEEP 3:MsEllllkEthXllkl2zE/mGu:/M/xT02zJGu
TLSH
T11E4404047FC0C415DF4310304013C75357F0D4544531574335D504177CC57440C4D140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3ba42e57dd0cb05403c94224757e144a0ae72237c8b047b9b988367f319892a3
MD5 ee8a569d113c36a9eb6ffb7a9951f409
SHA1 8a23ddcb915b9160112f3f9b0c20d8c2ac99f673
SHA512 5566a53767938c8c5e8fae05b4f19ee626c0ecf8ec22ac1fe4578bf3c7be3806085e46ccc3d2eebf3e2cafc1939375fe85e71ff75cb40caa8fd86af59bf00cfc
TLSH
T144412FE15C3E2AD1D0BD0A6E74AB38FC95D8C72AF9A4703D2854D998473960E654443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b93c3edcf15a7a4d6e8aeeb4e0421bf9cb8fb114b3385fee5c7f9d96126557cd
MD5 57d2e3eb0048deb027c02104f5ca8bc0
SHA1 d5ec94fa1ab32784ddf5a29a9b38aabab9266c2c
SHA512 88c97d9985d099e0269ae98079d446a0121c4a73495baf0ea2cc2af857d3de6fc940730faa8817e5751643aa2eb297e18315a045b9b9f5ea68980e2d3b945ac1
TLSH
T10F412FE15C3E2AD1D4FE0A6E64A738FC95D8C72AF4B4707D6864DE98073960E644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c58cd649ee95c481a176b1797b02e49a6610318ef5c873551fae7e301fd8e4c2
MD5 f9d338be6fa725ed357da0bfdf3c9c32
SHA1 c88f3e893de895d7cb116ea662874f4bfd406e07
SHA512 740d23902b157c93fe42d6ccce83760e5c92f60e3975313557b34d969e9d36cce6e242c942e9de81cc0b7e0c629e85ef1bc10cff50a2e9aa565ce99730582efe
TLSH
T1894153E15C3D2AD1D4BD0A6F785738FC95DCC72AF8A4303D2864E988077960E254043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 963f9203ed759a6c09866b140c772b076256b0953e9245d17791bc26287ba7c0
MD5 727c712d3d546c09db5dbf0b4578fd3f
SHA1 273412494661d604fee8f83092c08485dec7d031
SHA512 5ce793feaec1d1c97ec7fbc24a2007372a225c5e4229aab03248323ab3e3c22925070bbf5995c7b193fa9ad80d1773cf01f961469da0f2187125e7e23c6afc4d
TLSH
T103414FE14C3D2AD1D4BE0A7E789B38FC95E8C72AF4A4703D2854EA98077960E658443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fdc53a73fb7838ab36c2e32317dca5c2401eba96ddf36be2dcbf2eb1606957a8
MD5 7c828e038fa14fcfaf7deb58b338e5c7
SHA1 faab6fb509cb1b6fa90a2a23e4821d4bfe7e335f
SHA512 53eb0407597119fea21df2706ab9f1189b7dcd0850b9314da9e5e0eb7f362ee1718fd92e475a7d2c8a763f9c0c56f382e5f5bf68be567c65758dd33cb03b5f07
TLSH
T105513EE14C3C1AD1D4BD0E7EB48B78FC82E8C325F5A4753D6824EA980A7961D748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 51781af0f5e862b2cd3157f703ea1f44fd0499c95afb1ec8e2db9a5c6aef8aa5
MD5 abc82f334eaf42f6ebad41b7b1005dae
SHA1 238d38e3e6a875dca31b4e10994cf18b3eb5e6e4
SHA512 34948d14ebedb683431a2d1475497b93f724a89c76db5b05ec5e661ffaf2bec1c9f4428f968c248181426ce42bc033ea02ae9cef5eb44e0f2227f6fa72ed9df2
TLSH
T132413EE14C382AD1D4BD0E6E748B78FC82E8C729F5A0353D6814EE980A7961E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 73c79ff8c5bc15d42006529f3afede878c88ca04be3919676a73ae535ea71ad6
MD5 eb1ac33918bb57d93c329b3ca8ffe648
SHA1 ca256f6bcdac5a8b9bcf77b29f63e546a966a1ae
SHA512 57301b9b0376e7665ad959f6237aab21ec55302c5e09e56d0378bf3ba1af4bcaf4108c9b38dddb89b158e0fc86b74e3d10c3d010d1251903494d2e2138a78b80
TLSH
T173514EE14C3C1AD0D4BD0E7E649B78FC86E8C325F9A0753D2854EA880A7961EB48583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d0b593f387eecbf35a855dcab828f6ee6cda2fce18c5ee369a0d605c110a95f6
MD5 b39857b93b84ca287f6bee11975359f7
SHA1 b88e04ec3951ba587962e406bac21bf4336bb416
SHA512 ed6d3b24a328ce192f93a1604ed70b4201b2117b4477bbe9cf6711d33bef31bf2f5876b0c1b2c528d1150385cff8c3c11285880f0528a0eb93b81f7e1bf8135f
TLSH
T118513FE14C3C1AD1D4BD0E7EB48B78FC82E8C725F5A0353D6864EA980A3961D748483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a564c8fac26c1c848ae0f5b55feede3d719c1d74c31f2409130703be038bb4f
MD5 e4bdf4b9e0df24f7025ae9f2497440e3
SHA1 7e47ffb0c7db2456c88ecb75c97579ff63c6c99d
SHA512 5dd8c7e0b85e822f1cc5f6658f8f233fef95cd2f870480e5ee6e65da216b57eb7d7eeab2a9fe44f7c85a9491cf947b9a0d22c94d00d3cb8a98fb00943ea4d9a3
TLSH
T1FA414FE14C3C2AD1D0BD0E6EB49B38FC81E8C725F5A4703D6854EA94067960E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 527fc2db7f6ed30788bdfd3b849bf397a376ad78284c92ac3a85544d6bbdcafc
MD5 5caef7aa11c9e44e0f1683a084e24283
SHA1 f289cbd4eba3c70dcf7d89dfff717ba3294a3cd7
SHA512 572baf11fef6acec1ee0ab4d60c273a0eb075e3a7489ab6817d6128a34ef9ff5fddaa4aed61aa76c73392377cd8b500e4ab953ea77d7da78a125cac01fcda6f6
TLSH
T1204150E14C3C2AD1D0BD0E6E789B38FC81E8C32AF5A4703D6854E994077960E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 afbf82fdee9c45426bad6632b940bdf68562965deea835b4e293731317ed03bc
MD5 001c5dd902d75a63b210b7b76c39eb38
SHA1 8a9c7c861b2da379bdc6c788317abd1d1ed62ef2
SHA512 4a444f7cb57b19f8d90081f0d44af2eb739efac061ed09c5070821a5cb2e76a533b47663b79ca715c33958b753fe340ec2356bb30e9f78cc7f555c2c65be93c4
TLSH
T16D413FE04C382AD1D0BD0E7E748B38FCC2E8C725F5A4353D6854EA940A7960D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cbc2535e9e5133da03829a7ea42fd41503515bdb381bd6e7e109b15b98ba37d4
MD5 571b59858aeeae48dd9c085b5e998337
SHA1 69ec35e925a9422562e27ad8dee5cfb43ac9fad7
SHA512 91ffee93946153b7fee9e5817c4d8e8929d03a2c3b088a6f9f060ea1f5b2f369bf3a6fac444bd68192931e5a1ef15d78339e73bdd82552a869e391181372b10a
TLSH
T14D4153E14C3D2AD1D4BD0A6E785738FC95ECC729F4A4743D2854ED98077920E658443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

Settings.Xml

Path C:\Users\Admin\AppData\Local\Microsoft\Event Viewer\Settings.Xml
Size 109B
SHA256 50fd9d76d1c43bb16b166de02aaf8adec09eb5bc4cefdca9d1af2e0f7b1d8f64
MD5 884320a9b8f018f309f5a96107133f89
SHA1 102e8a8f3c91a10d9d670e0b3715bd2e0acee5ff
SHA512 b815fcbd7263b6667f01478b955f9734b1bddbcd7ca8e62ef8ff1ec46ed99931ba466c976ac781f1bd899125571585d580f6f232cc37b8e9ed87935981b99b78
TLSH
T1CAB012A2B84231B28C732970B643910E6BC4379440EC454FDA2F170480FCC088300C03
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca7c963c8bf290600d8cfcb7b0adbe8fb95e60697e28d6adeb70326a92931a03
MD5 7ce360d77b5149a8a8f6a8393edc1f5b
SHA1 d0a5b6ed8c2f17ed55cdbc46aaeae1524c9e9cf7
SHA512 1518f3f53e68c61a7b21bf19a5ba71dd4d9ecbda742d2f0d3c63b3de90905d2d869ac4f5495ed5285ad402dbeacbe543f5989c004fbee0db8b40cea8031f9264
TLSH
T1B941E958A6F91108B3B76F5AABF6A86D487FBC372E46949D10110D4F0A32F40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 887da996d3009b90a639e02f23a07610e8120d5fe2047437491f66c99c9c0d07
MD5 845e1041d07868c1daf17f6ea32b08ad
SHA1 5dd723361244e75f696b2f84e4abd2931150da2e
SHA512 d6d536e85d9bfc55a0d3c1a4cc40fd7f325f6aa751f0000433f59e85b625d44dd12d9691bef15c40af42daa463fc6123c04d0177f52f87de90e9520f74a2118b
TLSH
T172316627B3DC8822CCC9153B209C9C1172A682C7819EDF9B6FC0D225957FAD9CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d69a7601cc0b96d9adf27047424948faeb2da05521f3732e78226715cc43accd
MD5 6d7fb1e5dc71bfe17f6b6debebc58da8
SHA1 b3cb487b0ed03de7f5e6689dc6be0680624a5c79
SHA512 c29fa3c37f73591b7bb213a132184c4e5b426aada3450c193485434ed1a0a089113fb10b9edd396ca892281f87045b1bce2681ae6ee76bdcdef0cecf9bb6416d
TLSH
T1CD216527B39CD8A1DC85263A209CAC1172B783CB409ECF8F6AC0C224A57FA94CB61154
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 020c968aedf44573c2dc9945010abb1109638dffdd9a627c503321068b79d845
MD5 3f81481f0251165ee8051799d5487156
SHA1 dadc07e6eff95dd6fde0f3fb3eca0a4aa1941434
SHA512 c93f39f6f41ad4256c1c6e6fb5afd4a44477372c8459d369ef962b42ddcfb3b7c84ac8b93f128fac8e9e8405c84c62c8891ca05ce97a84a0e6a411fe50371efe
TLSH
T1E0216527B39CD9A1CCD5253A209CAC1172B783C7809ECF8F6EC0D224A57FAD4CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3fe24938bb98e0b73a269de04a1674499a2cd0576141abd7e7d9f893dbe510a6
MD5 8f0e9e5d80184bf56ff7c4fccbb6257e
SHA1 e45b9ccfc82bd7879dd8631f724e79780e885045
SHA512 859d02d7c5a78e2d98fd7946d6ebd21d0ba6555eb8df4a60dc0581e01b789ccbbf68c018c18f85c0865964ca488a4bdf31776531bdfa09a1f1d581de80a22a39
TLSH
T1DC216527B39DD9A1CC95253A209CAC1172B783C7809ECF8F6AC0D224A57FAD4CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1777997371.tmp

Path C:\Users\Admin\AppData\Local\Temp\Temp1_Archive.zip\data\saves\persistent.1777997371.tmp
Size 1KB
SHA256 aafeff81d7eecf98927131cc0a4482ef21a7d3afbc5793b7b7afe9141650090e
MD5 ee142e6e8448f040dc277e6784b1a593
SHA1 22fd7643131f81749bf30b6dda23f4207456aa6c
SHA512 5270155281bcbeab96c4a925bc17a6fc531f54406c7b18673182e5599c880837c55730dde79f21cd078d8ca3fb1c9a24a7749e8c6f743205a1b7212c64c88660
TLSH
T16D31EACBD71B9DD75A84CD480A60C662B29CE89980FAC531311BF453BCE05FBE914241
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2h3kbimu.edb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2h3kbimu.edb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

8o8pctZk8.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp-12482-I4kfooOyyy8M\8o8pctZk8.exe
Size 543KB
SHA256 d8c7a4930ca3ea0c18af25aea6f9e526bd5073ba889dce5ae4399ff9d4ab35f1
MD5 721f72b36a64ac73058c730d013bb235
SHA1 f6505e4a0bca4d5c40ccd573b414d2fbeddc6e92
SHA512 4cd5c251e7f6dc87d9e0e0b015afe35055f53f0c6c588d3c4b9bf4118297b4d49ce128aee6f507293b0364d8af526e29875adddc97d296145dd0c2e738a59ab8
SSDEEP 12288:uMl2tXkk8a0Y6HjGr1WwJ1BfJJsx2hb7G:DvkkAr1WwJvfJJsx2hb7G
TLSH
T15AC45A30B744CC39E9E105B28F78DA7E446DAFA55B7340C7AA88386D7D746C21A31F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bull140U.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-12482-I4kfooOyyy8M\Bull140U.dll
Size 3.2MB
SHA256 a91cf1ac95094c500a1b1d109cde6167ffe83400806aac027e25ba10230f25fb
MD5 1b7e3f263ee9c0bd6124d6eaea52610a
SHA1 41e6f8980fd5d19c5645c6981b195afa5f82e756
SHA512 e6a4646109011d2138549f559182a9e7363cb5749849465af84ad70e1ef8bd0cf5e314c5edc970ab66fd04216b253473418ea9045fcd8d2c12e72801ea434189
SSDEEP 49152:DCn9/JhsYYJy+O2/NduXIbU3PlhntTf8N9Cih59c3eJT:oPwZ/NMXvNhnd83nB
TLSH
T144F5BF12BB81C561E6DE00F9553A5FFE587A9F20431494E397B1F9AA4C305C1EF3A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

minosagent.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-12482-I4kfooOyyy8M\minosagent.dll
Size 5.2MB
SHA256 a066c91fc3076f91d6cda19040e609807789726b1661791dfa9ca9daf2157d6b
MD5 35f8bba6cf649e1c7c7b459713a2940f
SHA1 b8e9709db540566255ea99b099e56bfb36ba05a2
SHA512 f1919918b8be3f3eead1d919392963684e4c1fb0592ff04a9bce54158dfed024713f47e83afac36ba691cd30872d4ad0dca33a4c5a2bf822ff81a2d9df1dc057
SSDEEP 49152:fq5eHy2Wr5tep/JEHkz8FLsPplwzmfVbfYH7h//T+KfvCRLyzsrmZC3H06:aJ2WLeJdz8ZUOA1MnSRLyzw
TLSH
T13246AE22BB42C1A1F9CF41BB52FF4B7F8C399614473884D3C59479A99A345D22B3B782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 11KB
SHA256 9fa59b2c20af27909846298baad3fc2b54a10872abc05d3d64be086df9e9ad4c
MD5 616db438adef17c2231e8dcd6105050f
SHA1 63fbdf12455b890490994d483c38e438e87fcf37
SHA512 4313f1447a657795e4c370f15657f661bfe4b6ec601166b8aa3885e882ce102918d30fa0ea7581f3d8082c5db23f76366b6c76fcbd82f3b83a95d658cf5c46f9
SSDEEP 192:Blmz+mXZDOAElxVUAs+mg94kzm5mwmBI1:Blmz+mXF46As+mi4kzm5mwme1
TLSH
T170420214ABE71916F2F3DE71AAF67721AF3AB905A5244D1D009002091D63F04DE6EF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 11KB
SHA256 473899d29b40d5cc12a66adeaabca4987e2f67cdd944857062927385b0845345
MD5 d7fec9c3e7397d804a1b67a00d90c778
SHA1 8a1430d385f47099458264f059adc642d8bdb230
SHA512 81466b689cc83305f1d8cf727c0d4f47f7fa9a42f0ff5c3d5f7fa82d7c34d1cab21751a64979ed734cf26e9bb47d55ef71164caf9fd36e20b4a66f330d3dd3a1
SSDEEP 192:B+mXZDOAElxVUAs+mg94Blm/aitzm5mwmBI1:B+mXF46As+mi4Blm/aitzm5mwme1
TLSH
T12E421314ABEB1916F2B3DE71AAF67721AF3ABC056525491D00D002091D63F04EE6EF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 6e7bbd65e451196f578e3a0836c59c6e6d993de8ac57c9eaa93039b7f1ab3c66
MD5 73b64457ce0970d939f286ffbb083f23
SHA1 70e1d18ace2bf4e83a21fdceb97a3243028dc7d7
SHA512 f710d910756c781724436d61a19bc2bdc6a3513082bcb8c5adc18d0b2cffcd21589ae03be3d34d5a916e69cee600b76270d4d0b6dda556165b4f4714076c3a45
SSDEEP 96:FtmJvLgwGl7kN151ypWmJFm8u8151YtmJVXBDw2B0151CKLmJru8151St4mJnIuk:bm2lzIma8immm5BmBI1
TLSH
T1BB222414ABE61A16F3F3D971A9B36710AF36B905A9258E0D009041091C73F04DE7EF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 b2ea75892c15ab7e41c68794a6b507de8c86890855b7492ae8bc023d47aeb42a
MD5 da4c31050f606c95478fef93dff6180e
SHA1 a6525b953843509ef886a299d34a5c2d3b4e833e
SHA512 58158df7d9a8521aa0c19003989d99f0e6eaf2b534d58255f855418358e4933ef5c8deb2176472cb081303a97472d0eab6bf38816a9820724665f056ee0cd19d
SSDEEP 96:B/kJmm+zn4u8151v/tmJKsku43+LwB+8151iw/WmJ4fu8151oi/LmJru8151SZ/w:BMg94Blm/aiw+my3zm5mwmBI1
TLSH
T17F320114ABE61A56F3F2DA75A5736720AF36BC49A9254E0D00D002091C73F04AE7EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

persistent.1777997661.tmp

Path C:\Users\Admin\Desktop\data\saves\persistent.1777997661.tmp
Size 1KB
SHA256 8be800b47306b99cabdd0fac2396faacb095f437ec6872bf6fe16ae0d0e6e5a4
MD5 08bed0523b3c3e7df21ddc8aa7b744e6
SHA1 6b5f80206caef575903cfda02547fa07604f602f
SHA512 8fc607b2aac683577e37428fddb633773de7980a6650fd99f1ec07c9aac89d8dbdf9e7a3794c1a85d76349023a1160d8317a17a0aab636a924ce4ac5fc23c910
TLSH
T15D310ACB9A0F98971990CD884160975672DC9449C0FEC421351BE493BCE45FBD614242
MD5 SHA1 SHA512 TLSH

Submit Download

OperaGXSetup.exe.crdownload

Path C:\Users\Admin\Downloads\OperaGXSetup.exe.crdownload
Size 3.9MB
SHA256 2e17f0012b10a36aaa8fb7f221dcfb2bb4e3a66d572f48f998eee4e335d389b7
MD5 dd89419a6b7f7fabce8b3e82ca122085
SHA1 8a82aa652566e5f8e552be7bd9f4c3415f8290d5
SHA512 160387f70f58c7c98e16a226d86d9f558c79c00a91d414e657f6bbe0dbd7f6687baf07019da621ce915f64d2093a3e207404cd37e6ffd54fb7439f1ffafae0a4
SSDEEP 98304:WAYE9x9Vef3KZ/x7E3dhqSiBfu3ofErPql4FEl5:4E9x9BZ7EHu4yz/
TLSH
T1531623227B4484B5E5C322310F68F7B9D1FDF6251F6A244F37C40E6E8E70681AA36B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2380-6853-0x000001592E220000-0x000001592E575000-memory.dmp

Download

memory/2380-6850-0x000001592E220000-0x000001592E575000-memory.dmp

Download

memory/2380-6741-0x000001592E220000-0x000001592E575000-memory.dmp

Download

memory/2380-6831-0x000001592E220000-0x000001592E575000-memory.dmp

Download

memory/2592-2702-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/2592-2705-0x0000000003280000-0x00000000032BB000-memory.dmp

Download

memory/2976-6689-0x0000013C626B0000-0x0000013C626BC000-memory.dmp

Download

memory/2980-2549-0x0000000000EA0000-0x0000000000EFB000-memory.dmp

Download

memory/2980-2580-0x0000000000EA0000-0x0000000000EFB000-memory.dmp

Download

memory/2980-2553-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/2980-2696-0x0000000000EA0000-0x0000000000EFB000-memory.dmp

Download

memory/2980-2562-0x0000000000EA0000-0x0000000000EFB000-memory.dmp

Download

memory/3576-3215-0x0000019CB7320000-0x0000019CB7675000-memory.dmp

Download

memory/4228-6680-0x000001E1AA680000-0x000001E1AA68C000-memory.dmp

Download

memory/4452-3176-0x0000000002000000-0x0000000002355000-memory.dmp

Download

memory/4452-2831-0x0000000002000000-0x0000000002355000-memory.dmp

Download

memory/4452-3331-0x0000000002000000-0x0000000002355000-memory.dmp

Download

memory/4452-2546-0x0000000002000000-0x0000000002355000-memory.dmp

Download

memory/4452-2511-0x0000000002000000-0x0000000002355000-memory.dmp

Download

memory/4780-2425-0x000002AAF48A0000-0x000002AAF48CA000-memory.dmp

Download

memory/4780-2426-0x000002AAF48A0000-0x000002AAF48C4000-memory.dmp

Download

memory/4780-2429-0x000002AADA560000-0x000002AADA56C000-memory.dmp

Download

memory/4780-2417-0x000002AAF4430000-0x000002AAF4452000-memory.dmp

Download

memory/4980-2440-0x000002605B220000-0x000002605B22C000-memory.dmp

Download

memory/5160-6776-0x0000000000860000-0x00000000008BB000-memory.dmp

Download

memory/5160-6774-0x0000000000860000-0x00000000008BB000-memory.dmp

Download

memory/5160-6753-0x0000000000860000-0x00000000008BB000-memory.dmp

Download

memory/5160-6739-0x0000000000860000-0x00000000008BB000-memory.dmp

Download

memory/5160-6740-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/5364-6737-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/5364-6720-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/5364-6732-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/5364-6721-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/5408-2460-0x000001DA2A570000-0x000001DA2A57C000-memory.dmp

Download

memory/5504-2470-0x000002CA80060000-0x000002CA8006C000-memory.dmp

Download

memory/5964-2450-0x0000015589E00000-0x0000015589E0C000-memory.dmp

Download

memory/6012-2547-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/6012-2497-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/6012-2498-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/6012-2509-0x0000000074620000-0x000000007466F000-memory.dmp

Download

memory/6132-6638-0x000001BAE4B80000-0x000001BAE4B8C000-memory.dmp

Download

memory/6448-6949-0x0000000002010000-0x0000000002365000-memory.dmp

Download

memory/6448-6830-0x0000000002010000-0x0000000002365000-memory.dmp

Download

memory/6448-6849-0x0000000002010000-0x0000000002365000-memory.dmp

Download

memory/6448-6734-0x0000000002010000-0x0000000002365000-memory.dmp

Download

memory/6568-6865-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6860-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6856-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6855-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6866-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6854-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6864-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6863-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6862-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6568-6861-0x0000025F32CA0000-0x0000025F32CA1000-memory.dmp

Download

memory/6940-6878-0x0000000021290000-0x00000000217B8000-memory.dmp

Download

memory/6940-6880-0x00000000055E0000-0x00000000055EC000-memory.dmp

Download

memory/6940-6879-0x0000000000EB0000-0x0000000001205000-memory.dmp

Download

memory/6940-6884-0x0000000000EB0000-0x0000000001205000-memory.dmp

Download

memory/6940-6909-0x0000000000EB0000-0x0000000001205000-memory.dmp

Download

memory/6940-6930-0x00000000055E0000-0x00000000055EC000-memory.dmp

Download

memory/6940-6929-0x0000000000EB0000-0x0000000001205000-memory.dmp

Download

memory/7228-6934-0x000001F32C0E0000-0x000001F32C435000-memory.dmp

Download

memory/7748-6647-0x000001EB17E10000-0x000001EB17E1C000-memory.dmp

Download

memory/8008-6671-0x0000023925380000-0x000002392538C000-memory.dmp

Download

memory/8448-6785-0x00007FFF06370000-0x00007FFF06565000-memory.dmp

Download

memory/8984-6834-0x000001FF168E0000-0x000001FF16C35000-memory.dmp

Download