hxxps://esyverse[.]itch[.]io/stickman

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
311s
max time network
532s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://esyverse.itch.io/stickman
Sample260508-vxtyesbt4y

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
463	discord.com
473	discord.com
152	drive.google.com
153	drive.google.com
156	drive.google.com
157	drive.google.com
460	discord.com
461	discord.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_492712731\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1779461825\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1779461825\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1840234423\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_492712731\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3200	msedge.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Stick E-Crew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Stick E-Crew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Stick E-Crew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Stick E-Crew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227345740691704"	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{C669D0F9-EC0F-4807-ACD5-A26FB2436633}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{B62F9276-49A7-4156-BF94-E9F29C9125F5}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Stick E-Crew v1.0.0.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
1204	explorer.exe
1204	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: 33	3120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3120	AUDIODG.EXE
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe
Token: SeShutdownPrivilege	1204	explorer.exe
Token: SeCreatePagefilePrivilege	1204	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe
1204	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3124	Stick E-Crew.exe
1204	explorer.exe
3212	SearchHost.exe
4044	StartMenuExperienceHost.exe
1204	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3536	2472	msedge.exe	80
PID 2472 wrote to memory of 3200	2472	msedge.exe	81
PID 2472 wrote to memory of 3436	2472	msedge.exe	82
PID 2472 wrote to memory of 3436	2472	msedge.exe	82
PID 2472 wrote to memory of 3436	2472	msedge.exe	82
PID 2472 wrote to memory of 1932	2472	msedge.exe	83
PID 2472 wrote to memory of 1932	2472	msedge.exe	83
PID 2472 wrote to memory of 3096	2472	msedge.exe	85
PID 2472 wrote to memory of 3096	2472	msedge.exe	85
PID 2472 wrote to memory of 3096	2472	msedge.exe	85
PID 2472 wrote to memory of 2384	2472	msedge.exe	86
PID 2472 wrote to memory of 2384	2472	msedge.exe	86
PID 2472 wrote to memory of 2384	2472	msedge.exe	86
PID 2472 wrote to memory of 2328	2472	msedge.exe	88
PID 2472 wrote to memory of 2064	2472	msedge.exe	89
PID 2472 wrote to memory of 2328	2472	msedge.exe	88
PID 2472 wrote to memory of 2328	2472	msedge.exe	88
PID 2472 wrote to memory of 2064	2472	msedge.exe	89
PID 2472 wrote to memory of 2064	2472	msedge.exe	89
PID 2472 wrote to memory of 3484	2472	msedge.exe	90
PID 2472 wrote to memory of 3484	2472	msedge.exe	90
PID 2472 wrote to memory of 3484	2472	msedge.exe	90
PID 2472 wrote to memory of 4616	2472	msedge.exe	91
PID 2472 wrote to memory of 4616	2472	msedge.exe	91
PID 2472 wrote to memory of 4616	2472	msedge.exe	91
PID 2472 wrote to memory of 3036	2472	msedge.exe	92
PID 2472 wrote to memory of 3036	2472	msedge.exe	92
PID 2472 wrote to memory of 1660	2472	msedge.exe	93
PID 2472 wrote to memory of 1660	2472	msedge.exe	93
PID 2472 wrote to memory of 3860	2472	msedge.exe	95
PID 2472 wrote to memory of 3860	2472	msedge.exe	95
PID 2472 wrote to memory of 3860	2472	msedge.exe	95
PID 2472 wrote to memory of 1004	2472	msedge.exe	96
PID 2472 wrote to memory of 2784	2472	msedge.exe	97
PID 2472 wrote to memory of 1004	2472	msedge.exe	96
PID 2472 wrote to memory of 2784	2472	msedge.exe	97
PID 2472 wrote to memory of 1664	2472	msedge.exe	99
PID 2472 wrote to memory of 1740	2472	msedge.exe	100
PID 1740 wrote to memory of 2740	1740	msedge.exe	101
PID 2472 wrote to memory of 3928	2472	msedge.exe	102
PID 2472 wrote to memory of 3928	2472	msedge.exe	102
PID 2472 wrote to memory of 1568	2472	msedge.exe	103
PID 2472 wrote to memory of 1568	2472	msedge.exe	103
PID 2472 wrote to memory of 3236	2472	msedge.exe	104
PID 2472 wrote to memory of 1868	2472	msedge.exe	105
PID 2472 wrote to memory of 3236	2472	msedge.exe	104
PID 2472 wrote to memory of 1868	2472	msedge.exe	105
PID 2472 wrote to memory of 3712	2472	msedge.exe	106
PID 2472 wrote to memory of 3712	2472	msedge.exe	106
PID 2472 wrote to memory of 4636	2472	msedge.exe	107
PID 2472 wrote to memory of 4636	2472	msedge.exe	107
PID 2472 wrote to memory of 4636	2472	msedge.exe	107
PID 2472 wrote to memory of 3712	2472	msedge.exe	108
PID 2472 wrote to memory of 3712	2472	msedge.exe	108
PID 2472 wrote to memory of 3712	2472	msedge.exe	108
PID 2472 wrote to memory of 2140	2472	msedge.exe	109
PID 2472 wrote to memory of 2140	2472	msedge.exe	109
PID 2472 wrote to memory of 2140	2472	msedge.exe	109
PID 2472 wrote to memory of 4508	2472	msedge.exe	110
PID 2472 wrote to memory of 1220	2472	msedge.exe	111
PID 2472 wrote to memory of 4204	2472	msedge.exe	112
PID 2472 wrote to memory of 4852	2472	msedge.exe	113
PID 2472 wrote to memory of 4852	2472	msedge.exe	113
PID 2472 wrote to memory of 4852	2472	msedge.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://esyverse.itch.io/stickman
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffade9cc188,0x7ffade9cc194,0x7ffade9cc1a0
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,10967778349715390935,12402203947530027738,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,12753961053685583819,1988486273180966834,262144 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14075211154675908797,11536577089222554801,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,516194178311797211,16995352477481594193,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15325470313664020266,12846725805221900765,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,1488199783015092227,6984749375215008005,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,1691959426391607263,10316548002837812456,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,15739331986955956626,12014577380804285221,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,10472619151170437176,7714531326320659813,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,5299655971475800554,4898737410593234516,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,15132889644504125475,3931182771284591622,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5368,i,13756465443406252346,7697873072687078161,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8809667441497910392,10662361672885943611,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,14147000468545691723,16881398650761723479,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,11443537533475695552,2146461786640238218,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,11443537533475695552,2146461786640238218,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,8570354571559671427,7181396417575635055,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,7877786162157762641,11381297675485079445,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,3972008332280409582,3916864288771564433,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,13096728399216321445,9377654077368471159,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,2071341396469293959,5662417195639668445,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,13999364870324336738,4853445641716318550,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4788,i,2030625861618426934,1184422109320350082,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6100,i,5579554297430153667,11003801499128628782,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5000,i,10125611028299908837,3343246341991488997,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,15079174524696118763,14276291262317855773,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,14164234051887503519,7806460230433633882,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,17691145203416676322,8078030132208742459,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5252,i,11382033543217552069,13601464206039773820,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4716,i,8704450742725639783,4118435471711823811,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3804,i,4788352106345444016,17647790846438203752,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5260,i,11230587792175578786,6483182340552424749,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,10925898832872186612,12214664213569692224,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5700,i,18056279220934848346,15743108944189953287,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,6617988348290551596,7824671661985557003,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,13267729225839189305,12117035295766793511,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4288,i,6552453599041716252,6535692535772770637,262144 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,4490430508819508176,11510330436696193108,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,13983155868069642833,3563429079456083554,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12621872216192983169,11158205892469138792,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,6817155658502287916,1129959933979813682,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,15731829201108355937,16273747999699068894,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4976,i,2182775078299815431,15742084082052652130,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7492,i,5432755937335560930,8862481312911962798,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14917308428829779262,2510044354135108889,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,169915695730373948,6258529094460552389,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7504,i,1343168373999287089,12129969095780985789,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,13245708793345746126,3893070808887957008,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4884,i,13140868455520066898,6533984072217791844,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=5660,i,9339315800200194128,13854069462349152647,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,17034038699716467519,12873751588717816883,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:14
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7732,i,13974203498956789396,1617998806238173469,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=3992,i,7354581699654916984,14104481399781546257,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,14168855173370690750,2930099270723879818,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8012,i,15368386847164724326,14472620589659457601,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:12
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=3428,i,13688059538740738593,17062722724518551677,2097152 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9316,i,2166953658164751427,18026396875194173896,524288 --field-trial-handle=2144,i,15210831160570075992,8390948464775739260,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:14
  2⤵
  PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260508-1925.dmp
1⤵
PID:1684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1684

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4572

C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\Stick E-Crew.exe
"C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\Stick E-Crew.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:3124
- C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe
  "C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe" --attach 3124 2539676700672
  2⤵
  PID:5032
- - C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe
    "C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe" "3124" "2539676700672"
    3⤵
    PID:5992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5072
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1204
- - C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\Stick E-Crew.exe
    "C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\Stick E-Crew.exe"
    3⤵
    PID:912
  - - C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe
      "C:\Users\Admin\Desktop\Stick E-Crew v1.0.0\UnityCrashHandler64.exe" --attach 912 1797892411392
      4⤵
      PID:4132

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Player.log

Path C:\Users\Admin\AppData\LocalLow\IEP\Stick E-Crew\Player.log
Size 4KB
SHA256 8a25d5cd71b9ba41c0e966614074ccbb15f18cedfabd31dcaa06a02290006450
MD5 449194af712d756ba6fddce77700ffe5
SHA1 7f1b0106f1b90c4dbbb99b81943dd45464fbf55e
SHA512 2a76cfef47a8b362ed8066ba052016789ac293bcb63553f81625cbbcee9a6e083c42cd4eddd1b4969d2f4eb2ecb61fbf8f5a4d5e7df2c17a20802382eae21a5d
SSDEEP 96:FBRzBcMwQnQ+vSn4zRia/si2D9jlQmB5UUWPZ+U3h5UDnU7Z6N:FBZHT2D9jt
TLSH
T1CE9196307788CB8700DB421BE018D05992747B6A1ACAF85879CD8719ECFB5A56BF9DC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
MD5 35b0754e7f5b0bef0f59e6474c3c9e30
SHA1 a5dbcd61883043544b184e46e47beb3bf5d259a8
SHA512 0a14f00d3bf385bd104004e3adb021fc5b135483b30669a0f446d235f67bf00d734e76a56ac18adc3d6765163a992c78b2c6833f0e764506a9c06ff2ad8fc90e
TLSH
T1ECD0801452F17C64C2E65975484677153D1DD4E346C3537225A3267C4C461881C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
MD5 9093390d9e798f9a4ccc25251c10fea5
SHA1 96837bd82509feb4ca69a53466162950148f0394
SHA512 4db01b0d83eba59662ef7f147a96bb0034c92f2c5d5ac83ceeae12ddc800fe8dbce64d41320c2a3031796e981edc605460e3a1da207a6a9d39812740085a86ef
TLSH
T1A7D0801412F17C64C6E65975484577153D1DD4E346C3537325A3267C4C471C81C953C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c76327f4369a107795e5ec2f884906a37e884af5599b9c621e8990ad3551ebba
MD5 353e99085db8e7f12b45af69c1858ff1
SHA1 d6f4063df2a56a57bcc697904a3a77e8701b0288
SHA512 9abeea677d90eca467fe30874aade23cf4108a7dae147740b276d2ece1b3b7fec32b5f3dcc805ff9a163b31d8a8c8d0e6e4e1995dcf65dc99d99afced45e2fbf
TLSH
T18FE026C454C8C26FD608A48F42BC630CC2D03B0AD2DCAACA2728C8D43841840E7976E8
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 60d479b21cc7e4f8d5930b255f1b2a9c12024f166f0fbb852fdaf36962ac99e6
MD5 05a34b8951ad234587330fbef2cdcb14
SHA1 9dce4e2c317a4496be7ba9495e75670cc0d741e3
SHA512 a2e3650334674bc2e53cbb3813d0657cd624e22d84a94de8011cef2772c0987edb0c38ea4c2e5cb57d1049fa81dbfcfc4d0796f116d63cbe642f49dbafbadbc9
SSDEEP 192:RHgw2BrXoPcHJCGYi5V4lXwY9j50gQ1aX3XBqiBKUxD:32tXoPcHJCGYi4+Y9ygQ12hyM
TLSH
T1DA4281B597A74437EFE40434A1EE6B393AFC9E806A7B2EC38788C1BD351776C50A5025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 88dea809df8ef43743fa73fa7b8d12fd911760caf13e8a02afb5b58f8e8d0f51
MD5 fcf9c47a5992e7072332bf9ac3538c6e
SHA1 2d99d3e17d01cbe7bf506fab4e6c1746eb12a5c5
SHA512 2cb8ca16b4663c9ef0a6ec3a4b41a09e7979b981c75cca7391ed3004a097cbc58f9d408ce62da5ca7db67818fb7e0f9155614ff5c35294ab3e4a52323c113b9f
SSDEEP 96:mDKnspv7xOvkyhH95+om6F5yrw56Qp17Ug42B7xl:mDKn6akyp9AozFIrw5Vpbtl
TLSH
T133D1838591A84413DBE04038B1FEBA6E3D389FC4483F2F478798C2BE79177A900B6038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 86b79210b7d67b97a73811a0a64e864a28f8d938380cd9bf3fc6382a2fa688a7
MD5 2934a82b0c8da42f1b4b908f284984ac
SHA1 9deb3915f7e3edf5e5c5e3fbfd2a393c4c8f69a6
SHA512 a8816979a686fe2834631596ad47204969fd7f78026d7876d26290e3d6683e5563f658474926b42714f5d57aea9dacb8856e056169f2cd7e5cc7edfb02d159a4
SSDEEP 96:0HPUneuvuaRodui7hP6DCm6Ox55w5zBuHs:0HPUnlGdu6t6DCzOx55If
TLSH
T160916F46D1B89017E7E0117935FEB84E367DAEC9883E2F8745D4D5BE7A0B7A140B2530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591340.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591340.TMP
Size 3KB
SHA256 1d827037a314aa67abdece9b5ca9fa5be950981061947b0578678c199090697e
MD5 9d6ef5f6e3207be3d2d0420a865f6680
SHA1 2a6b1efe18db82f07f8a434bbeaf74a47665414e
SHA512 c953f812a962fab00f4d6ad96924a9db762adfaacebc848dca208022f90032fd2669331a89f6ddea376e2dd6db839ede9d5bb233ddeabfe0aa3b6189fa854eb8
TLSH
T17761D805E575851BE7E001B97ABEB44E72BD5ED98D3E2F4705D4C43EBA07B6240B4035
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 113KB
SHA256 89e4e80c9aa07b6f4067623e80ae998bdeff0205736efd3fa52e4cca119e66e4
MD5 1cd03716c9441fa10a7d507c4a12cc77
SHA1 86ad58b0b2dffa82b96f314f8607a8c21e9969f7
SHA512 7837b47a2217d0fec850771283360394e3808ff905d281325ff2ff4533dc836a4fb640a9e885779c110686d1e461f4f8f35ccfd719a0f9d36815f34c6ab31cb6
SSDEEP 1536:7Hipstf5alZepPRb3eJpUlEA9xUomoHYlIuCAIAyoL:7HipspVpPRb3eUlHxUomoHYlIuUoL
TLSH
T1B8B3D76E72E4B2D7CA0981755C418E9247FE2E08158C709FF4D53A2DFABAE852374D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 73d2369bc8dab5f820f91afe148869d4eb3793e5b4b419232f67f01af485cffb
MD5 52bddffa57e914525f6b2fc4e923a6e3
SHA1 aa06996245f14fea86fbb1056849f862f3e4c278
SHA512 b56be15d666af1ed696e93a7a77018856add599c80ee11ff99c73fdf5e04455d1b636fea05810737d15513467ee49548bfe001f4750ab3834f022115b7b1135d
TLSH
T110E0202CC9C9C25F6114A5DB563C7B4FD5D7760ED7CCFF860F44D8007046548A06E251
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 16a4e329ef0fb2d1eba4c2d52fb9dba585a0d337098bd2b03b65c97d37de44f6
MD5 9cde6b17adff0d529682b4b95cf0f886
SHA1 ab201ae2b918faf9365a27da32977e0c309212e4
SHA512 54e45da5434df85de580a4f1f54381afeea30dbd38ac68cd6eb6378518fae766b01fa8ef6ad20a2fe1ca737764b35d9ad04e9263d1d5013602662452d6b04d9a
SSDEEP 192:DWjdduze6O1jGjW/jzCMjqJjvnWNOtYUvWlOZT6VVma1oMrm/NZiQRcNjyhjpjVF:DWjdduze6O1jGjW/jzCMjCjvnWNOtYUv
TLSH
T19B32DEF783B4822DCA0096F09715AF2F8E2D0519036C3D6A89D4BE4BD3E2572E255B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 e289a8a26a3b35e307ec5d0316b1334f45536ebf16aafb75241f093fbd0e9a0f
MD5 d09d44acc98eebeb702a22d9f05f6c68
SHA1 64fd6049825545f36e071da297875950a2f64728
SHA512 507e7a0fcca8650ec32d31a10e8b6bf5c3f3edd481613d55a9488ef3478d30125382a3bca149f7dc701b6bbb53ddcb0b429ba63c22be35e058808d7fb96e4b81
SSDEEP 384:DWjdduze6O1jGjW/jzCMjCjvnWNOtYUvWOZT6D2jZDRz8gf/KQd/QVzgAXVma1o+:oB/DRt1LvF7
TLSH
T1CB92CDF783E4822DD91156F0AB157E2FDE2D0928436C3D6AC9D4AF4B93E1432E245B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 439d3bd56847569141a0ba05c076bc9dc00803842e9a987766dd4b2cbf02a041
MD5 b5ab0833dcfd909495c44d4bf09cdf40
SHA1 9313877c8904f41188f4267f2296f8ce937878b6
SHA512 024e64259051f022f9f12250c23ddb84a73ac4e84d93cc621c1edb3c67ae206068b123e47baeaf70560ba05dc065177396939426547c0b21669eb064b622297d
SSDEEP 384:DVj98vte415jqjebj/j3jQjI8NAZtEIvqlOtXDVm1AoMrm/WZkGpC2QWbajahjpD:oFvFX
TLSH
T10862ABF3C3E8866DC91116F0AB156F2FCE2A091943683D5A88E8BF4FD3E6471D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3f6cd1f9ca102175702a7e67505cb1daf4f44c078a06f5602d99b13c2cc81587
MD5 75a367e05831a443c8821e8a092f4f97
SHA1 858876e943484331bf90ab7ca77973dc6a681908
SHA512 d30ef20f5d7f2ef97150d6d152e30f05fda7246ae09d8889c272ff61ed9dc78a0335c95c1de31eeafdcb73a047abe8816ecb3fa662e504b4baa2ca70bd397d4e
TLSH
T1D6D023533381F1B6A77C2D859459EC8FC32610170D46E9E410F0A4DD063145D1617244
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5e5c56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5e5c56.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b157992e27200383a602bf1bc00afb481c959dce981ea4f13c20576bd689713c
MD5 1519d8802810d29d5cc8610b92349bc8
SHA1 0ceebdc3b27c8f366ebc5a2a80c6da91f7ffd5a9
SHA512 e51f5c2a7eeb8dae4f7ada05a95b5f7269207371da38f72b877d3bf9d7103c11781d232ea48769c872f268c85b7bce1ad60d53147bdd652da5de9542206f9fce
SSDEEP 384:sxZ2PqzNz/fIsMTToQjK7/b3MZm+rkH9R:suy5z/fgTToQO/bEXQHL
TLSH
T14E72F953A5785D778DDBD229F555BB6BD7F5242692800E46AAFCCA0C00E6BEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bf58217a2f93c593bbf6f2a48c7d461fb29d1aad853a405ee45ddbc492102c3f
MD5 ec667e9c07117cd7b33bd7b85277d8b4
SHA1 3201bdf032dbcb15c081956f061ef226e206adf4
SHA512 f9089e347a9cb5fba351bf78aed1c4fe3a54705c4c2eccf9dacf6e66e66c1158f321770efea81d1c09e132ada7d1bd026697f13f6a5109d1e662bc274171ac26
SSDEEP 192:sxZ9RUyM/OK1Ml8MFz/fIszTknoQIhIdpEll/W6+WNOQ2/eIzIrIU0tF0XpzgMCc:sxZ9Pdz/fIszTkoQIK4/b8/eNrnC9c
TLSH
T1EC62F917A63869778CDBD219F555BB67D6FA146292900E45AAFCCA0C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6350e6e4f3b659fd5fb2e346e8ed2eaedc88836c96e3b67bbdac4060ca876bfc
MD5 d5f7783501f7460afaf1a41073f029f1
SHA1 a02ab142247bd00311a79fb3f16b44805a98dcd4
SHA512 38533fa682ecee6a379259458d69cd2d912553461e0540fac8dc8d6df95d85302a6200c2d408aa1df4c62bc2831fd4b5024fd1fb5b48a2d4cb744a741176f461
SSDEEP 192:sxZ9QRUyM/OK1Ml8MFz/fIsMTTnoQqhIdpyeNoule8/W6+WNOYcXeIUI3orIU0e2:sxZ2Pdz/fIsMTToQqK7/bOXeXrSo9m
TLSH
T19962F913A67869778CDBD219F955BB67D7F5146292800E45AAFCCA0C01E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1d5921252f0cd4a559b501736c48bf6e577720317fd6a023fa8fab398b692ab8
MD5 4a7ccf0fc988ca44f3c8591802a48a39
SHA1 137837fc7bee256a5a06116543afe3e51939b704
SHA512 a17afc8af93e3f4d148abc1ac5f687b2ed19dfe1da405d27b208c13163eb323e3f099a7b0ea7c60e22805dce293ffdf4d82a3abed8e6d504f6429f39918d0e32
SSDEEP 192:sxZ9QRUyM/OK1Ml8UQzcoz/fIsMTTnoQjhIdpjwzeNo8nnle8/W6+WNO81ZSNPIM:sxZ2PqzLz/fIsMTToQjK7/bXZm+rkb9R
TLSH
T19772F953A5785DB78DDBD229F555BB67D7F5242692C00E46AAFCCA0C00E6BEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 a188a555b9388ba301b354bafc60af0737f7fc38a714371a9043851486d55918
MD5 6d9dda3cf3d8043ec2fb650683797123
SHA1 1ccc57695bab02466d379cfb53e6cece2722b00e
SHA512 9d6b71418d7182e5d70b08c01d5be77c961db154e7459c0d0a6ab0d33bd1836e40f8e75490681b7d549e19531152cd0a7f07ecc0bd429b6ffad8e5ed2342c2e5
SSDEEP 384:sxZ20qztz/fIsMTu66s8qMpRiYnazAW8pZS15posJWeT+xoQjK7/b3MZm+rk9CR:sujRz/fgTu4Mnc7WeT+xoQO/bEXQ9u
TLSH
T11FE2F746A924C8778BC35D29B43DBE37DAAC145252C4CEDB5AECCA0C019D5FCAB07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 31KB
SHA256 b84631380e771b7bc007e27dd5ed1dcb1a712155d2614b64f9c309478e143a46
MD5 e6e248f3972c0499350b4a4eddd2f6b4
SHA1 1946283286a8f10c4d8a8e5042b77f8e5ec0f95e
SHA512 68582f27afbbae15a291ed0231449794b5567028b1e9a95bb11e69303b22b19adcfdaad383a64bf21d1e5317e2838b284d0894e0e1879cb21c48b5855065b850
SSDEEP 384:sxZ20qzhgz/fIsMTu66s8qMpRiYnazAW8pZS15posJWeT+xoQjK7/b3MZm+rkqCR:sujyz/fgTu4Mnc7WeT+xoQO/bEXQqu
TLSH
T1F4E2F842A924C8778BC35D29B43DBE37DAAC145652C4CEDB5AECCA0C019D5FCAB07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 37KB
SHA256 c5ae52301c374a1c13e5ac2cb52bb4305062a567b6ef7be034979a9cd003e75c
MD5 f6d555ffe075fde3e15c7370cf2179e3
SHA1 d80c2153a406cede538706c04de91c19404fc9f2
SHA512 2fb7d47da5e5a519b43fad7057a0ab11a3a5556f5e69d662b83865a7b5a64bc0f159f6eeb661f0d26606251370849960fff934deeef47936e08cb8ed97f1a9cc
SSDEEP 768:sefmTm4z/fgTu4Mnc7WeT+poQq/bT5MtX9TDR:RmTm4kTPMmWnoz6tXhR
TLSH
T151030843A524C8678BC35D29B43DBE3B9AAD14525AC4CEDB5AECCA0C00DE5FD6B03857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 35KB
SHA256 f38b944b98c725467e14f770d6ba41da15d939333fc515b6e17fa344aba6396e
MD5 ed67ded5060aeec036a80a1ab1292425
SHA1 f84d9526589571b67a9cd2aeff397aef7447f711
SHA512 1b0a499f86c96320015f3dddf28fb0773f76be0de38335a54e41aa68f595c0c401921dd3385da8ce4aafd81a71af73522258bbb47c08632f51397c1b1bab785a
SSDEEP 768:sEjTm4z/fgTu4Mnc7WeT+poQq/bTg8XhTDR:1jTm4kTPMmWnoz08XVR
TLSH
T12BF20843A524C8678BC35D29B43CBE37DAAD145256C1CEDB5AECCA0C019E5FDAB03867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c8168aee49f13ab0ce48075e4c777b197a27e373223f770e78c4219f271da2d6
MD5 230a2db18fd72fa641206008ae352585
SHA1 ff3492eaae2b542862d2cde753de5fc01794e1c4
SHA512 2d6eeeefbea3f48164b91f97130686d66b6d71466f31517c5132d5f1f19582961f2297ab152d67ba1eb19323f361f2e9141747fb99df6659e7d2c289f36742ff
SSDEEP 384:sxZ20qzNz/fIsMTToQjK7/b3MZm+rkVCR:suj5z/fgTToQO/bEXQVu
TLSH
T12F820953A5785D778DDBD229F555BB6BD7F5242292804E46AAFCCA0C00E6BEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 223e19f2bf845ae28d8f1df82580736a74c3126704260f6d5f8bac8a69a14025
MD5 1af87fc290aa3f72780f096d7aa75d7a
SHA1 06d31c575b2cc9fad2dcb7259ba580102292c8dd
SHA512 16d017b49da4ec9c4635aa9d1e0606bc329b3d0bf46468a825fae4db3e11314470eb8e75c58b7e49b116a3f724b2ff7db6573913fd7e2c7741350f67f91c8d5b
SSDEEP 192:sxZ9QRUyM/OK1Ml8Moz/fIsMTTnoQjhIdpdwzeNo8nnle8/W6+WNO81ZSNPIUfRK:sxZ2PQz/fIsMTToQjKB/bXZm+rkg9R
TLSH
T108720953A6785DB78DDBD219F555BB67D7F5242292C00E46AAFCCA0C00E6BEC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 70fcc8f5571c006b288116b0391f944b39433d6e96c6ebf7a358b9a08ed0f231
MD5 5d28c44be70d14fdcf9c8b4d67631221
SHA1 95454e2d4b02f759d420a266e80a81b79ede72fc
SHA512 b08cf7f378af3ce88f39d41dd5fe9786c0fa3078e47e6b12258baacf1e8e1b24d50d3ff2a44c150499da09ff09982c655235f634ee50c5fef1dc2b117a0e95ca
SSDEEP 768:JMTTF8J52Zu7pLuLnYwWRmY4QPU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3D4tfLlc:JMTTF8J52ZuEnYwWRmY4QPUu1jaKD4tq
TLSH
T10CF21D3B280CCB7E4F844E9CEC26BF9A6DE8018B9698C99447F9844C03C67EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5bea325f-eab9-4f38-8878-65cbe89fa2a1\index-dir\the-real-index
Size 2KB
SHA256 6323d95aab99059c9e4af88780ff1cf141e22bef248f2f316c7d9ccd82f547a1
MD5 edec4072dc1a2bd56113083fa7dc25ef
SHA1 c15fa4c04e5c62e683be528b851936f31176c222
SHA512 bceb218ebe828f62fd4d8b6ff421401a1b7134d04e32b9e9173045929e1a3f2ba3a807778f582776ed28a0ab5e4a624c320ea863349c07b231f39b9b6b1c60d9
TLSH
T11B41668CCD80ABADEC7551BA1D9815B653752D28FC58C7928164B1A6340397817879FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5bea325f-eab9-4f38-8878-65cbe89fa2a1\index-dir\the-real-index
Size 2KB
SHA256 33e2e3fbdd08cdb6823c0689876b0de940906886df92c5b6e28cc6efeea963a2
MD5 cadcb43bf73b484439e902b5d7947054
SHA1 5b7b547c62f720ea72954184d02153e0303ac079
SHA512 12a71f39ad26be7623c41838c64246da8671e8d0c74bd1391804a7fdbfdc014e4e28b235c1ace996f806f66cd5e25b2266c9f2be5bb3f8ca90ba0f9380d579b5
TLSH
T1F351968CCD8097AEDC35A1F91D9824B247711D34FCA5C792C064B1A2381397C17474FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ef877.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5bea325f-eab9-4f38-8878-65cbe89fa2a1\index-dir\the-real-index~RFe5ef877.TMP
Size 48B
SHA256 4360ce7d6a4b5b0d3e9c4630c2a7750405f33819755ad6ed73fc49e21a4bedf8
MD5 73c8616e75eee461ef6c05c88eee52ae
SHA1 2773befd27067ece9563d05a8788130d5a4aeb34
SHA512 02fd02a84f6d1dd79b620cb36b5c6461f99dc1c6603522e5501cc978e9d3ed275239cf6fdafd3282fbd5911bf6efe2f876d1a9ee049a928444e43db0a5c1bbab
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cc2a7f6b-bcec-45b0-8ce8-66f09ffdb14b\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 94f701a89ff37e7815bd8621a96556e87abf9fcf1b898772f1df6621b8b09305
MD5 8c8afc027c279d8cc5de64e1c571ba10
SHA1 92beb7e06499b1ea0c92d61ae4c72594690a1fa7
SHA512 d093ff25af8191cb7c684b91f09682846ade1d1a261abdc8c61f12b103696313378328214259d6a775997cfa1156fc5f4650f78eba269a501ca038f3f4ced437
TLSH
T1C8D022C19531C84B2730AAC3E034258E846ACC9ECD82CEAC5859F05B30F8E03C502F38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 0243d7aca3bc73d2f8e24f8f120c9ba66ce5b5f3987abbf109e9302ff6b9c348
MD5 46497e23b8a372271941340221fac360
SHA1 b7d942357ec2b7046749f56bfdf4247abde7646b
SHA512 cce1698ebbd688aa071d357bd70766acbc214f87834156a5893284b4ab9642d62a73af3903acb64b4a43ff2343bfd9eefc51c87aa384b567dff7aff7d001eaac
TLSH
T1C4C09BD21914C58F05B4ABC51074671ED51BC58DCDC0DCF4544890063174D174402A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 e78b2a75e8db892f86ac42dbc8281c8d2eda2dbee466436331025b730c09c758
MD5 32d33e4014a4c4a58f9750f1ad2b2483
SHA1 e3af4fce5e66847e5179beb87bb395db913b49e8
SHA512 3bf925875e3b7e585d45e141bbf7a3004ec6d295ce73eaf2c3204eebd3ec1cb0ea409afe44f669f87f7fd09171d0a095144b8dfeb09e5737eda65d089d5d07da
TLSH
T1B0D0A9968A32D88A0730A7862838698E8426CE5ACCC0D8A89C48F00B32F8D02D012A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 142b0c60515a73ddb84895766e2d0b3b1c83a5c5ef4fa3a29a3abf55161df472
MD5 be367814afacc772e1768dfbeb9671d3
SHA1 6d827a13ac22a87fdf50eeb1c65851907f52ade8
SHA512 4d014f84f81185df03e9547f858782dbd9a73578204e86b4b7672058cef258b0efa917b4d71c537b2eb43f4b84d210374e329877e5712836a00b02cb9f4b6ada
TLSH
T1ECD02B427D14805D9C73ABC67872629FCA7A54858980DDA8688E400E32F0D065C02E2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 f4af14af632a0428ed16ed32a726b5d2dfa155b44a7133a17ce15588b95ec847
MD5 b295401ac031cf0efd298375665d8705
SHA1 eaada39e340d9910dcaa679519004334bfb11232
SHA512 5fc38f029f7a16ed0295630275b314ce27db90d79ad0d949cb7701ab28cbeaf4a30c6403be62074b80de7114a54d05358ebd9441e5bfaafbd14ddd58a56601b2
TLSH
T143C09BD21D14C5CB0670A7C93478771ED51BC58DCDC0DCF45848900733B4D174411A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 116094d89e29baf661cf0cb6acfd38e6f86d333157a551012f1391718d6f1dec
MD5 c31af4d5827cc7a4907932820189b503
SHA1 805a38ab336c143160695850f0adaace821c6b7a
SHA512 1e20b4916ea92f8de58df175a9a10b8a512c6ff0021d0d324594ef856986250bb4021bf317a244b11405c48a623050231c52cdd4e870785c200cf478f68272a9
TLSH
T155D02B827C25448D9C73A7C6B93265CBC97AAC858984DCA8788E600E33F0D0B9C01E2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5edee4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5edee4.TMP
Size 137B
SHA256 54e48b049b20bad5817dd34ba9e4a877978c8f120df7f3b8aeb67b42feef12af
MD5 f5ef7b245aa6722addcea49c6015e6d5
SHA1 9181b24b98878d6718a4fbf7d7775d763318648d
SHA512 74fe4ef048baf265887881529386064dd6ff6f4601ac6c5f27ab11e93cec7779a5de5a1223cf51834daa22739ff150f9ac0ba7b6d15a15d636b3f5e77905f863
TLSH
T165C09BD21914C58B077067C61074675ED51BCD9DCDC0CCF45449F0063174D178415A25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
Size 2KB
SHA256 297446058322f97040d7c1f5e05bbed5033a2e6dde2b34a604346a4178208f4e
MD5 aecf2d76582416bd7b0faab772bb03e6
SHA1 25ff57a4f9fe033d689a6f73d6df7d56357900a5
SHA512 e2ee102e666fa7aed88bcf980d03a76ce10258a1a3361b6e5679fb35a3f2c6b41923caabb1fed8fbb24da2608cb635c49dd98b5785e0f40f872a277f7901ae84
TLSH
T11F51D44D8C8A4A17EC7942B150F2246C33B858ED1B885707BCEC15399D8B2991CEB308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ccc9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe5ccc9e.TMP
Size 2KB
SHA256 18b5b5f615dd1b7dbfd1e35d4f8acfcc06438f0f70ebc8fe962c4b3b76fc2516
MD5 c9fb2a7286fd324e2144cf44696a5b8d
SHA1 4c07031a616c07613e2197eb137a1d637717f08e
SHA512 c1f5bd7fc9ef8fe0160fb2ccd9c9be40e0fe84f637b2c171a167e34bcfbe9d780414e230974ba10c52807fcb10b32449c21e42967ee7a28849b37e433f0f00df
TLSH
T19651A69E5C824A32CD6084B389CA646D333DA8954948AF0734FC8A339CC76AD2D52255
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0b4063a17b307a623fc503fbcc0442baf0cf9a83e7ee1137b44ac5ec422c9b77
MD5 c20cb407f887126197b5a0f56374c1e9
SHA1 24900a21e19617b4e8d9b09872b698fafa15bd9d
SHA512 89e95184cd56bcaeb98766a6364d4e98b91b0609c11070b4c9a156325b72e6c1b75f73e1c27b215f85549d504da2c9718edd71f4e5d87d92c2834b95e99d8d2e
TLSH
T114E068B72CFA1C20DCAED3E2103094E00181F96DC410FC0E104963C310B1351344AC2A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 f9af47c023da891e6985f3efc1021bfae33708190c49b3b91de55da2185d6272
MD5 cd83d654526651f6f2c8421b4f6e2934
SHA1 bf7bb2b05ed57a8be86531d1b09cc6aa3c5ca1bc
SHA512 648fb0b842245a531851f2cea7a99f9fa492cb03ab7959382b9089e2ea46c37f2547c2818aaa0f1e35bf853480597f525deacd013fc2227c66eff46341821b1a
TLSH
T196D0978BE4A30041C7E70BC21A228AAA83703C8820D140CCE002392C2830706D12AFA7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 5567bc9284d278aab6125dd4767ea33d95cc4752c0f2c29efbd3251bc90a1c40
MD5 a49f68ca3385696c05090d487199ed4d
SHA1 2db39fe24efe7369452d858c9515b64f5972acee
SHA512 81a77ed0138d3e7e44ef215dacc182cc08f10a317d191edebb7427f0bf5bd860cb55748c80cc830006487788e4295dbbd468a6fecd5987bd171ae6404d1eaee0
TLSH
T1DCD0A78BE4A6105197EB4FD62A269A6A83303C8820E590CCA15219295954656D116FA7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5f6d98.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5f6d98.TMP
Size 138B
SHA256 711d4c25df34c2e4b0b1c377f47358cf19efe9ae7d09bd979976c1b1ec1c9bf0
MD5 8feefb7419a88047ceaeca182ae05ed8
SHA1 d364374653bb3b504173f3e72e97da48497ad865
SHA512 5bd1c9c3ef892f5b4f2029ec14dc2936ee00922214350181bae940775944161f81b5a7c2b0006759a453f506a3deca08814a06a7b13f64740521c929a028c88b
TLSH
T123C02B97F0C20002876113810633C34CC3153CCC48C3808DB0633E282034E23E103EF5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 971014089fbe1dd3f97af8fdbbb06f4ac0093d1a6695525e8da189889e9df5ee
MD5 3dbc666234134991287961d0077f23aa
SHA1 4b9625d2906ce40990ebcf4698a585493d550c1f
SHA512 6348f5e3dd002d08e8be2ff235081a5724c9c0cd40e18404567b1ac514d8a8dbbd1503ba832eca7851dafd1e62124cb582102dfeee0841ea8d92a5da88d1a020
TLSH
T171B02222030C00C2C0080FB080C380A2B22C0C2C830333AE0BB8E0FBC830208F2AB200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8d268df2c0563f22aabbc3565114628ac1f7e3a4d2414c08926e01505f688bdf
MD5 f1f9e003120d94e169a2755791d03d0b
SHA1 f9ce6cb0688672248489d4c3c79870b695b13a93
SHA512 05a8159fa4678e64b2bd89c0f0ae8d6b0e89f1ceb14c3b3c451f4b07798ebd85a7a0754768af8c2b999d4fa4f1a9bf75243d135ac2a556c3f2dd3ae8fcdda6f3
TLSH
T1E8A0025653940092DA190670E4573194A3114C10010B739296A4A4778C58541C92A044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591340.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591340.TMP
Size 48B
SHA256 d211c819a27b432f570b4314417d2150979053ca3376eedaa637c88b23319e2e
MD5 f0ecff976b9fa61453bd0a7b9bb48a69
SHA1 80c0a0d25fc4bbfd8cd49ac4ec2d5016b03b7056
SHA512 90e898834795ac73ae255f7894ef0a67011520e0ce3e36b2095c460dbb5a42626f9243e2d2460453ebbb8696f7fc014fabb9b060b833028b421a26de8c8c83b1
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a9304bcff72bd478ac4486db1f94599c1039d92b3ba25bf296b9a94ba8010eda
MD5 9090dceaaf1bba47bf8bb12b6102a686
SHA1 6904d7825d6be7a7e8e5a13b61a975e2f6da6cb6
SHA512 c7622c38de06b5c9314588ec84576f1a19fe1a23f5999929d3fc889d60e9b3e6c4cb8c7bbc1d81301d279b9b7b3632ddd9852e4e2a7d6736e50744b6bf266aa4
SSDEEP 96:KwzeKc4maoIKpeuyKgKPacsgKZqKezeKsAWnGRlw:YFzH/k/FLnGRlw
TLSH
T124E12741B33A0382397D288A91D1B83F12C130977068A57B7BF916A60FA6E21DDFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\30aea495-eeca-4bad-abf2-ac271cc70e66\index-dir\the-real-index
Size 72B
SHA256 2c95229101071d57251e800fb286f41a749770d5b18267edfd82a060a5e823db
MD5 2cec71e5e2501d036e7da603dad4ecd0
SHA1 de8609fb258a7e6a36e3915f6578eb3fc73e8fff
SHA512 324da321ae132a4275f8f59a09cc761f205a5e51102a21e4a223ed97b67fa5c465f81e87eb791733bcb708b2bf8b093fd757f90df773613d4cc9922c625c83fa
TLSH
T1E9A0022811901202C4054271645B0161B37A5E61F945021685D56194C8952A5811713C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587fca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\30aea495-eeca-4bad-abf2-ac271cc70e66\index-dir\the-real-index~RFe587fca.TMP
Size 48B
SHA256 ab2635250e166ea2e9fdf12d5d9eee45711a453908430520c2fecb40410c40de
MD5 e52e73b8eaf75728775aaa64abda62c6
SHA1 c81cfd8375a086123d272779cd2de2442501bdc2
SHA512 181c22052127f279a7530b3897ccdd79f935b56d1fcb5a719fed51cc78c93671f3bef3b12b13098a070c6a5575e2997eb1817de29f0bb598d4c53ec2461caf15
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 73B
SHA256 c3bef144f4e170d9176d152c764bc8646769e918f899e5992473b18b73cb8efa
MD5 2de2db5b529eba9aee7a4df0f5ed6483
SHA1 d9d4bdc2f8c30e565ec1cc1e3f695d6df17e09e7
SHA512 a27dbed5073c38667297d6062df0321bb095d06a86babeb0c8b1c1bdebefb0b2868c1eb822972a6dbba0514c0d41de6339f61e4491e9f30231de6528995049fe
TLSH
T163A002F70800C08E0F30ACE8353ABB5DE00B95DC8CC4CDF4C41980422138AF70402854
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 154B
SHA256 57c2e450b26b07a4ed43c0a7a4accc2c963b6f2ee658cd39fb7ff5a565513f43
MD5 1b337abdf0bd570fe2ceb357d0e3fb1c
SHA1 6b06fa58e785c34b6bce87c3967ed1ea33e49ecb
SHA512 e5fbdabdfa4f25c5759d8d1401a43bb4b374b3280b45d21fe59eba410c7da59b097daba8cda217c135d812b503be2280251f7e9a54bfa9c8bb4ec1b803080c16
TLSH
T189C04CA715708A8A4B307DD93529B69EE6579C9C4CC5D8E9D50570452034D574C019A8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 232B
SHA256 4fa296c48d2644c858cf28e84bcae3dda89fc351873aa460e4cd16a92019daa9
MD5 7adae8713f846412de87e5a2fdc979cd
SHA1 7009e052f2d01d3fc6bd0292fdc4dbb8f28ad39a
SHA512 a775170fcabc024b86b32a6e1e5e50f21f88073a97c1db693268d9f8b327b147b97d0bf59b6f0012ed27d555442ce6d9d11982fadd3bbd2b112db5cf78fb2e23
TLSH
T110D0A7E64231894B6F30ADC8751E658F81579C5C4CCDD8DAC905B04220B8942DC11468
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 148B
SHA256 4b16f525c15902845882235a953090ee7633bab584a9e51d639d1d81399b19ac
MD5 9d89b7034af364dd6f79f3e40b4ed971
SHA1 6cb19d80bb8ce7501b74cb442634e99519511a5c
SHA512 ae6ecb87240247036d2ef7ee7e9120f1812a3b7828a1944f76e78c3343f79212019311b766c6217dcf2a3c265f6461a7a2deb4d00638b335adaebfabda0e832a
TLSH
T16AC04CA755608A8A4F30ADDC341E769ED647958C4CD5D8E9D50840412074D574C119A8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe583004.TMP
Size 157B
SHA256 9dcf3e3318c52b5d8cab58237a41ac210004d98b623129c12f9edb099fe90295
MD5 c08094a468be5d8bc97bee87d364707e
SHA1 71c02779f313ffa224a9fa1dbc56749551f9ccbb
SHA512 7439ed19933754933e35cab370b99377669f21935156b0bc132e345c4d9fc9835dcebaed6924c7edf79212c5118903bb5dc97befa1d45dc8dd1a04ab50367ca5
TLSH
T16EC08CAB0622C0260B209AD4743A734CD02BAC4C4CC898E88404B08130BCE528011A28
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

6afe33b7-fa3a-495f-a3bc-946e1d5d468c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6afe33b7-fa3a-495f-a3bc-946e1d5d468c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ecdfbb14420e2e0be01cfe27669b384e7b2b6e3c027a9bfda015df8b37e8339
MD5 10a19fc117d375d68ac933fd39c39fc8
SHA1 ba33f739c614633470c7eae3d21f588381692291
SHA512 04fc4de3654fc71a11120e7869eb5c4668bd81ed8bb60ab8232bddfdec1915555df52d745a60c31255c331aee79fe2a58550ef134842c001787d0aa19051f655
SSDEEP 384:nrCcmyWCX8NYaQeHl9CCkc/TNF+4fPH81yILcQJw:ecpXaQkOhc/3VH81yk+
TLSH
T113827E3268791C77AAE7AE59F04B36275EB4247B86C40FAAC9D95B1D01DB2E81307C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 d3fea84ea257100c6184d82cfe887d6a736e8de670984ecd1cadd55a02108f21
MD5 1ab0a6a3c9e1becda90df861f0a29500
SHA1 50d4c3c4001d2834018df98d514af1cda3feaae8
SHA512 e0c7ef0816df627642bd6db6787da4bc5ba7534f86657ad4b684b8f156b863aa055d7bff2c527d7f5b04f5e74b8cce2b826321e50ad4d10ac4e6f4265046e347
SSDEEP 384:nSiFxCcmyWCq8Nc8TUNTUlIR1QeQlStGjifhac/TNF+4fPG81yILcQJw:ZF4cpqFwg3QFKNac/3VG81yk+
TLSH
T195D2B3F198E78937E9AE4B87A33E6D169EBCD057B5884995BB841D0CCC871BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 18b8ee16cade0801b322ae5d07d5aa93ba508b89a9427387a628b4de25bb5fc6
MD5 e3dc72cf13367c9ea32c96a207952b9a
SHA1 d179f22ae468ffb1990c5bffcdeda66574523617
SHA512 7a7b5fd57270cfb880fcb6dec9fcd9a69ba2bbd3a6c10793cbe6e646d451cbc0520a074e0addb89e4c519cd5dd0ebc6ed3c04e33adf8261c959080578bed4f41
SSDEEP 384:nSiFDCcmyWC38Nc8TUNTUlIR1QeQlvVGjxfEac/TNF+4fPX81yILcQJw:ZFWcp3Fwg3QFzXac/3VX81yk+
TLSH
T1D5D2A3F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 53b4d46143032aeaae4270d59cb617d9147490d894a827de6b600f8aea707c49
MD5 7f649cd806cad06cd512d63bcc4bfc99
SHA1 a9d10c39a6b4329f55d4c14c4a1dd9cc05b0a4ad
SHA512 8f137b96df6cc1d6f8040920c18439aea81b2302b8ed216fb515d6c16b21b5ea0453671077d7927d8fbdaa89532276ca0d9e223a244102cb2187c5ac0450cf13
SSDEEP 384:nSiFZCcmyWC88Nc8TUNTUlIR1QeQlAVGjxfEac/TNF+4fPf81yILcQJw:ZFgcp8Fwg3QFiXac/3Vf81yk+
TLSH
T1BFD2A3F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 167665a70a4b86d465300bdabb9c7ec8811f1cdd8cf0a5675f9a55d4ac63f2ba
MD5 1fca6bcfe8e20540b7d7536ed54123bb
SHA1 eec896e047a1707acb552286ebb22d4c254c2578
SHA512 7b0b17da8d0d82ceaee4ee46b1d45762168fba27b6bb118c9196348a7c4eb6a202bce18c6aba4830745ec36d86ec39e3627246b879ace06ed0d34da0933f534a
SSDEEP 384:nSiFmCcmyWCsg8Nc8TUNTUlIR1QeQlI7Gjxfjac/TNF+4fPD81yILcQJw:ZFlcpnFwg3QFokac/3VD81yk+
TLSH
T1EDD293F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f044ab5e7d67281b973294562f14fc849c7351a92075cbac3eb4bdebe3291d5d
MD5 92cd37851a16955b570b561d126bf57b
SHA1 110740f12884e40b7592a8965045fb309511d406
SHA512 91565d3272274b65b422c5a8794e39ee4ee88eb81222e34c8d1ddc3f3a0cc79bf9b04bacaecd399a24baefddac2e37906fff812847005f1f039ae7a807400e7d
SSDEEP 384:nSiFlCcmyWCN8Nc8TUNTUlIR1QeQlTtGjxfhac/TNF+4fPL81yILcQJw:ZFEcpNFwg3QF7mac/3VL81yk+
TLSH
T16CD2A3F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b51ec463b1224d4e2ecb7970824b685ccb0497efdc0257a4ae8d2ca8cd993f34
MD5 05d13ca740ec6e8087083fcb840be20d
SHA1 c3613eb672ae0d21b6581fc463ba44c172ad224f
SHA512 6cdbd304375af3086475c8c83493f2a2fce0295dfa86d26d403d3887ffc787e2d39e384b8c636d8c7b0aba09932576a3253a802548d8c34910dbb0322186698a
SSDEEP 384:n0CcmyWCX8NYxQeHl9dGkc/TNF+4fPH81yILcQJw:/cpXxQkRtc/3VH81yk+
TLSH
T145827E3268B91C77A9E7AE59F04B36276EB4247B86C40FAAC9D95B1D01DB2D81307C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 50de22e2a56a8bcc2d0383d4da105c312fb9cfb7e7f4b6279b3c0ae2aca99069
MD5 500e39106583171595fbc973891f1534
SHA1 b1bd183a91689a956a2358af21d063f370866fc2
SHA512 b1e35affa749170d8820d199c27424c1ff2136dc49d79b1965595d7fc45bdc3ef5c9b5e4c5145ff242f89d73f8a5980b552a6d1c74def0a7b86db14e50e8acf5
SSDEEP 384:nSiF9CcmyWC/8NI8TUNTUlIlxQeHl9dGjDf4ac/TNF+4fPG81yILcQJw:ZFccp/5wgLQkRzac/3VG81yk+
TLSH
T122B21832E8A5CA7BADF79BC5F20A76579EE010A786885DE5C9C95E4C01D72ED030BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 90e06f12bcb42b1aef9b8f1a2939508001dcd081148e3780787511ab8b0ca6bd
MD5 bc46e36f684df20e65731efa6397e502
SHA1 b3d97e8287e649a4d62dfd0f513080054254ea07
SHA512 ee60d081ca013aa8db6c7c141f6a1f3dcf1c2e2fe07747d95ef215391d7002c6e9d52f2f5c8ed0a6c3431ec37c4f813707d4c9ab3cdfb19e1c769ee9489f9d0c
SSDEEP 192:lGNy6IMGEQmiUy7Ti6xc/TNF+XSepHTIIlU6:lGNy6GU0u6xc/TNF+NPU6
TLSH
T14302E83178787CBB9EE36E55B5473633AF94207BAA942F99C9E41B1D00DB65C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 00cef38ea83aed8c90c0f9e154a37c93240c6c54ed2e0abe1b7ae055c282f428
MD5 4d677495defbdbcab3e289c90b023e13
SHA1 c6315b7ecd1d2983d3f1577b330d49d218e2486a
SHA512 e694d7401197455d4334e54147abc5e6bf160cd731d60985b269b8d6aa3e9b6647a2c4bf986e6214dd2186c6c650359e5b61583243b4889a94b9b473f25901a6
SSDEEP 384:nSiFACcmyWCu8Nc8TUNTUlIR1QeQl97Gjxfjac/TNF+4fPI81yILcQJw:ZFjcpuFwg3QFzkac/3VI81yk+
TLSH
T194D293F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2bb5ebb113591de84f42f3f0b0b51bbccbfb681441c76719b85e66acfa10f61c
MD5 75fd95afca196534d5f6cdf81a4ecb00
SHA1 c9fbdb9d0751262154e006ca739cc7f1861d652b
SHA512 6c2ea2a66794a2d9140e6a96aded254664437716818e8c5adf6468a59741ce00e723c078a76ab90a88d51d3068a1ea0ff42b1a23fb93725f3d5f6f9cad1c578f
SSDEEP 192:LGNR6IMGVQmiUyPiexc/TNF+4fPXYIS66HIqmv1U6:LGNR6Gzxexc/TNF+4fPw81U6
TLSH
T157121B31B8787C7B9EF3AD55F0473633AF94216B9A851F95D9D81B1C04CB6D81307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 305917987cfbb22e75370752a69c1cd25bcbf101bf6544dce6aeb25589f9c4c3
MD5 687bc921faa4a9f68fe95b1a3c7b064d
SHA1 6448fa621c7e37de8235b1cada5b19e3882ed129
SHA512 a0c436d508533b7b9bf9c05736fda6d3146a1a59d7640d1445d9cd24a6be8173812b931e43d482e9c52adc528f95e78a3bd489ca0f6f83fbabc7b03f6e9b0425
TLSH
T145E0012283142AABE128073004572F202FF2E06103A2030A4B30086C2C32B913E21B85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b272788c6dd15f0085a9bd85e650fbdc26a956f9a1e441eaa547cb2b41e9ba33
MD5 78243f49a59966668207236a4fb0482d
SHA1 ade7064cf3c4e91903d36dfaa2600433ef6212b5
SHA512 1329823f0d3a18556903399fcb99051647c6ca55f762da5ef8baa8308826602dd4789213159813b48539d8c1a3356d52682e7b36f437b9319e7548a31f165645
TLSH
T1D8E04822831419BAE02C073000532F202FF2E06103A3030B0B20087C3C32B913F30F84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf9e84bfc3c31fa8d9b954c2b2fe1033918a05026a041d1222a6019148b57b74
MD5 e9ef3a7a8bfe1db815b41254968c1adc
SHA1 beb7ad9e1cf2386403980146b4754092733ea8a8
SHA512 54fc9c03e6d5cd4339fdd0c392b6909a610d437dc98d1859b92099dcaa8d75f100d0e50b6eea4607df079c37083a5a3a602ec0f74a4bf74826d6b2236b960aef
TLSH
T106E00936D31446BAE12C173004A76F256FE6D4A512B307470B7105AC7C33B813E25B94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cb8efe347da8479b45baf18a9232c666a8bc1bf707977df11d82609d4c76ba13
MD5 ddb39c4d70b05b3d95248a09c4b448c5
SHA1 bfd0a36cc0ef06822846df155aa64323592a164b
SHA512 fd046160da5eb9305956ad769517f622798a0124df007db27ae460b65855750241c61832a9c7fcf595c270640aa426132dc6e0a476b83900b78ddbaf23719e51
TLSH
T1E6E00826931459BAE52C173005976F256FA1D4A512A3074B0B61056C7C72B913E35B94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8f5f664e74d76e9702f6424193dd9d6774efd471f6ab8310b6ae516cdbbd26cf
MD5 b23b7a7409f59650095531a9a13687cc
SHA1 289958514efb2bd477fd7d5c8ea70c299c654d37
SHA512 2c479692407b1efa18b2e82a456963c1e242b56376442316147f20a43bcf69c2abb27aa40f989b2edd6f231cb60fa4b13b64ef91a77b776be07d6baf444bee09
TLSH
T1F9E00136D31446A6F11C173000A72F156FE6D4A512B307470F7001AC7C337813E25B54
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fde6470ff5d50eb68f728484886e4fe3bea1fce0c53751d71e8ff13cbaaad4e0
MD5 9474cb0ade1de83bd0f9347f4014380a
SHA1 31256ff229c18536cb1148dac5825b425ef95c19
SHA512 cd406e11db499b67c0e832fbeb7407299e697c06a82c766db739439905afa9c99fd5f4d1f9253b170f0e88cd1d29d97bf5b0725ec4659055d43d9fe01e3771d5
TLSH
T17EE00135D31046A6E158173000672F215FE5D4A502B347470B7001AC7C337813E21B54
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21fc57603c02cf770aba456ab711070d04c8fcdc1645bb0b936e8acb558796cf
MD5 3289b28ca9bb51340a86db227075cf8c
SHA1 025ec8af1eac938b03ff57588631a639d37f51c8
SHA512 01aa79f4b31c7d4cc9fbb9965340b86204100113f8d74a842fcc33c120c4f8fcf0463b8dfb5fd23ea71a8464b15727ab8a3fe2a6d9e85c1c1e237b2e336f81e8
TLSH
T1D5E00431D310435DD114173000571F3117D1C47401734305077001DC7C133403F11754
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588af5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588af5.TMP
Size 392B
SHA256 80b3b8f9999fdc7f6b228bf14330a72d0d184eda427ec429f817e5e4c7f73385
MD5 9955ac5e79644c7e3162448aac5fbe4e
SHA1 f6a72d8ed881515eb83c5b05bdae91b2a7aedd4d
SHA512 ea0fa982706e1ec196de95888bd2d00edf2498b97c373922089c84d7a243ed6ee44329d2ee91ec8c5f714f6638fffb7a0cd697b4a8325a4cfdddb1f99e500e9e
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

bfd6a821-f372-4e59-8230-619f3c08083f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bfd6a821-f372-4e59-8230-619f3c08083f.tmp
Size 29KB
SHA256 0916235a95c1c8c74b413d2acfd8d065ddb587269b3117748989fd48e00c7b83
MD5 de62a049f5680e49aba8d414047dff40
SHA1 1e9b3d5d0b82e48613301b3fedb42063b51e68c4
SHA512 493fb606fb04bbe3e707b66462143c599a6e8013f928b808cf9888efec706abc3080af3e29cf790b5b86471a06a2dc732aec32c1e14154c10756422043d765d9
SSDEEP 384:nSiF0CcmyWCq8Nc8TUNTUlIR1QeQlTtGjxfhac/TNF+4fPL81yILcQJw:ZF/cpqFwg3QF7mac/3VL81yk+
TLSH
T17CD2A3F198E78977E9AE4B87A33E6D169EBCD05375884995BB841D0CCC871BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WIY19NIQ\microsoftwindows.client[1].xml
Size 96B
SHA256 5f06fe20762729803562112d8c7975266ea1da04765862d1f42b8ee95c3526c8
MD5 f567835aea178e0be157a51c167d9f22
SHA1 5ef5d4b34cc0b1e4522052e701aa147ce866defd
SHA512 7a96088188eea175db34f7192a0cbc93eb167874b553d4779d3fcfdb567549d30aaf30e0d9c801016c2adeebe8b77dccbe0b567555f3bab3566b52d166bf8fde
TLSH
T1EFB012653544CC18175889F62E1961E473ED00C6D305B47434E4BC01B8C5D46D412CE1
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WIY19NIQ\microsoftwindows.client[1].xml
Size 1KB
SHA256 aebd91dac39c65fc850f3297cd94fa265b73217db3780e8617120d27eb5962cd
MD5 386fc6b082ec145cedc5275733ef2663
SHA1 5e0b15fb1c5a717d58d269225964913701ec2028
SHA512 2c4032b47269432e4d54667dc07a88ebc7bffda4fdb9dc6d1f1d0fe5c0f45312c3c9fc4312c24b9eca42995dd071660946314082e7be5524dc10ab81bac8d400
TLSH
T10641592C9AF34F2E2D0CB479A6C423C8AB9FC34BA5E933FC1CAC3DC55249945651B469
MD5 SHA1 SHA512 TLSH

Submit Download

6013537f-da97-4ae0-83b2-5825ef419619.tmp

Path C:\Users\Admin\AppData\Local\Temp\6013537f-da97-4ae0-83b2-5825ef419619.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbecffa4-ede3-4621-a877-d60e201ff23e.tmp

Path C:\Users\Admin\AppData\Local\Temp\fbecffa4-ede3-4621-a877-d60e201ff23e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_1840619596\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3711e2ce-e4db-4274-9704-00234bdc5297.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_1926694245\3711e2ce-e4db-4274-9704-00234bdc5297.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Stick E-Crew v1.0.0.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Stick E-Crew v1.0.0.zip:Zone.Identifier
Size 186B
SHA256 f5139cbe8592fb3f24f8b326918197c20baf4c21b5905dbb97b10a025eb89ca5
MD5 0cbb7961014f517a8f06b2f94bfcdbda
SHA1 ff6d8f053ea45c9af31a010227db400d7e48a5ee
SHA512 f7d57d537d8233362ae76d7f37d8f025e051dcd87bdae1a5ce93864dda37f768c31ed07314c9b3c8bda79d0a8bf02fd74c7b8b4f6f2c66502cfffa72d4640a06
TLSH
T1F5C0228FA8348E4EAA806808128E9288140B92860807C2818C3008AEF0C116E88E0123
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1287466819\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1779461825\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1840234423\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_2079724912\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_492712731\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_551230090\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/912-1408-0x000001A283BB0000-0x000001A283C9C000-memory.dmp

Download

memory/3124-1207-0x00000250F20D0000-0x00000250F21BC000-memory.dmp

Download

memory/3212-1975-0x0000015C887E0000-0x0000015C88800000-memory.dmp

Download

memory/3212-1244-0x0000015C81FD0000-0x0000015C820D0000-memory.dmp

Download

memory/3212-1282-0x0000015C83420000-0x0000015C83440000-memory.dmp

Download

memory/3212-1272-0x0000015C828E0000-0x0000015C82900000-memory.dmp

Download

memory/3212-1301-0x0000015C834A0000-0x0000015C834C0000-memory.dmp

Download

memory/3212-1300-0x0000015C834A0000-0x0000015C834C0000-memory.dmp

Download

memory/3212-1974-0x0000015C84890000-0x0000015C84990000-memory.dmp

Download

memory/3212-1990-0x0000015C88600000-0x0000015C88700000-memory.dmp

Download

memory/3212-1635-0x0000015C88110000-0x0000015C88130000-memory.dmp

Download

memory/3212-1910-0x0000015C84C60000-0x0000015C84D60000-memory.dmp

Download