hxxps://google[.]com,

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://google.com,
Sample260509-dytklsdw8n

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
5972	msedge.exe
1232	MsiExec.exe
1232	MsiExec.exe
2232	MsiExec.exe
2232	MsiExec.exe
2232	MsiExec.exe
400	MsiExec.exe
4840	MsiExec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
125	api.gofile.io
126	api.gofile.io
128	api.gofile.io
146	api.gofile.io

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-search.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\data\win\large-pdb-shim.cc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\calc-dep-flags.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\polyfill.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\isexe\dist\commonjs\index.min.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-flush\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-doctor.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\lib\reporters\detail.js	msiexec.exe
File created	C:\Program Files\nodejs\corepack	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\node.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-star.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip-address\dist\ipv6.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\parse-conflict-json\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\with-lock.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-user-validate\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\registry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\ci.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-start.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\verify.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libcjs\diff\character.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\events.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf7.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\negotiator\lib\charset.js	msiexec.exe
File created	C:\Program Files\nodejs\install_tools.bat	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-query.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\brace-expansion\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\tokenTypes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\encoding.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_verification.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\isexe\dist\esm\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\lib\version.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\rekor\v2\hashedrekord.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@tufjs\canonical-json\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\libcjs\diff\array.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npx-cli.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-ci.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-ci.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\package-json.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\util\getProp.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-loose.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cssesc\man\cssesc.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\text-table\example\center.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\packument-cache.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\signal-exit\dist\mjs\signals.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\removal.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\man-target.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic2.json	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2015054077\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-ec\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-notification\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_624198696\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF1C3EB99B271EFA25.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_359391162\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Notification\notification.html	msedge.exe
File opened for modification	C:\Windows\Installer\e5aa24c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA346.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1837903986\Part-ZH	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_359391162\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-ec\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\Installer\e5aa24c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-tokenized-card\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1837903986\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-ec\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-mobile-hub\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1336249283\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_543178366\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_638122344\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-tokenized-card\en-GB\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2460	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e689d3d397d010a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e689d3d30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e689d3d3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae689d3d3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de689d3d3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227707441246813"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\PackageCode = "DCAB0170A9ED096498893F755C467418"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\ProductIcon = "C:\\Windows\\Installer\\{943F6D8C-08E2-4F54-8E3D-623E82DC6BF0}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\NodeRuntime	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\PackageName = "node-v24.15.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Version = "403636224"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\ProductName = "Node.js"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\DocumentationShortcuts	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{4B4666FD-1E37-4096-9C63-E625C2B6B36C}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C8D6F3492E8045F4E8D326E328CDB60F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C8D6F3492E8045F4E8D326E328CDB60F\EnvironmentPath	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\node-v24.15.0-x64.msi:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5760	msedge.exe
5760	msedge.exe
2512	msiexec.exe
2512	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1616	msiexec.exe
Token: SeSecurityPrivilege	2512	msiexec.exe
Token: SeCreateTokenPrivilege	1616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1616	msiexec.exe
Token: SeLockMemoryPrivilege	1616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1616	msiexec.exe
Token: SeMachineAccountPrivilege	1616	msiexec.exe
Token: SeTcbPrivilege	1616	msiexec.exe
Token: SeSecurityPrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeLoadDriverPrivilege	1616	msiexec.exe
Token: SeSystemProfilePrivilege	1616	msiexec.exe
Token: SeSystemtimePrivilege	1616	msiexec.exe
Token: SeProfSingleProcessPrivilege	1616	msiexec.exe
Token: SeIncBasePriorityPrivilege	1616	msiexec.exe
Token: SeCreatePagefilePrivilege	1616	msiexec.exe
Token: SeCreatePermanentPrivilege	1616	msiexec.exe
Token: SeBackupPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeShutdownPrivilege	1616	msiexec.exe
Token: SeDebugPrivilege	1616	msiexec.exe
Token: SeAuditPrivilege	1616	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1616	msiexec.exe
Token: SeChangeNotifyPrivilege	1616	msiexec.exe
Token: SeRemoteShutdownPrivilege	1616	msiexec.exe
Token: SeUndockPrivilege	1616	msiexec.exe
Token: SeSyncAgentPrivilege	1616	msiexec.exe
Token: SeEnableDelegationPrivilege	1616	msiexec.exe
Token: SeManageVolumePrivilege	1616	msiexec.exe
Token: SeImpersonatePrivilege	1616	msiexec.exe
Token: SeCreateGlobalPrivilege	1616	msiexec.exe
Token: SeCreateTokenPrivilege	1616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1616	msiexec.exe
Token: SeLockMemoryPrivilege	1616	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1616	msiexec.exe
Token: SeMachineAccountPrivilege	1616	msiexec.exe
Token: SeTcbPrivilege	1616	msiexec.exe
Token: SeSecurityPrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeLoadDriverPrivilege	1616	msiexec.exe
Token: SeSystemProfilePrivilege	1616	msiexec.exe
Token: SeSystemtimePrivilege	1616	msiexec.exe
Token: SeProfSingleProcessPrivilege	1616	msiexec.exe
Token: SeIncBasePriorityPrivilege	1616	msiexec.exe
Token: SeCreatePagefilePrivilege	1616	msiexec.exe
Token: SeCreatePermanentPrivilege	1616	msiexec.exe
Token: SeBackupPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeShutdownPrivilege	1616	msiexec.exe
Token: SeDebugPrivilege	1616	msiexec.exe
Token: SeAuditPrivilege	1616	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1616	msiexec.exe
Token: SeChangeNotifyPrivilege	1616	msiexec.exe
Token: SeRemoteShutdownPrivilege	1616	msiexec.exe
Token: SeUndockPrivilege	1616	msiexec.exe
Token: SeSyncAgentPrivilege	1616	msiexec.exe
Token: SeEnableDelegationPrivilege	1616	msiexec.exe
Token: SeManageVolumePrivilege	1616	msiexec.exe
Token: SeImpersonatePrivilege	1616	msiexec.exe
Token: SeCreateGlobalPrivilege	1616	msiexec.exe
Token: SeCreateTokenPrivilege	1616	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1616	msiexec.exe
Token: SeLockMemoryPrivilege	1616	msiexec.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
1616	msiexec.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 2588	5972	msedge.exe	78
PID 5972 wrote to memory of 2460	5972	msedge.exe	79
PID 5972 wrote to memory of 704	5972	msedge.exe	80
PID 5972 wrote to memory of 704	5972	msedge.exe	80
PID 5972 wrote to memory of 704	5972	msedge.exe	80
PID 5972 wrote to memory of 5344	5972	msedge.exe	81
PID 5972 wrote to memory of 5344	5972	msedge.exe	81
PID 5972 wrote to memory of 4116	5972	msedge.exe	82
PID 5972 wrote to memory of 4116	5972	msedge.exe	82
PID 5972 wrote to memory of 4116	5972	msedge.exe	82
PID 5972 wrote to memory of 740	5972	msedge.exe	83
PID 5972 wrote to memory of 740	5972	msedge.exe	83
PID 5972 wrote to memory of 740	5972	msedge.exe	83
PID 5972 wrote to memory of 1888	5972	msedge.exe	86
PID 5972 wrote to memory of 1888	5972	msedge.exe	86
PID 5972 wrote to memory of 1888	5972	msedge.exe	86
PID 5972 wrote to memory of 616	5972	msedge.exe	87
PID 5972 wrote to memory of 616	5972	msedge.exe	87
PID 5972 wrote to memory of 616	5972	msedge.exe	87
PID 5972 wrote to memory of 3852	5972	msedge.exe	88
PID 5972 wrote to memory of 3852	5972	msedge.exe	88
PID 5972 wrote to memory of 2180	5972	msedge.exe	89
PID 5972 wrote to memory of 2180	5972	msedge.exe	89
PID 5972 wrote to memory of 4892	5972	msedge.exe	90
PID 4892 wrote to memory of 6084	4892	msedge.exe	91
PID 5972 wrote to memory of 5992	5972	msedge.exe	93
PID 5972 wrote to memory of 5540	5972	msedge.exe	96
PID 5972 wrote to memory of 5540	5972	msedge.exe	96
PID 5972 wrote to memory of 5540	5972	msedge.exe	96
PID 5972 wrote to memory of 3156	5972	msedge.exe	97
PID 5972 wrote to memory of 3156	5972	msedge.exe	97
PID 5972 wrote to memory of 5968	5972	msedge.exe	98
PID 5972 wrote to memory of 5968	5972	msedge.exe	98
PID 5972 wrote to memory of 5968	5972	msedge.exe	98
PID 5972 wrote to memory of 5904	5972	msedge.exe	99
PID 5972 wrote to memory of 5904	5972	msedge.exe	99
PID 5972 wrote to memory of 4408	5972	msedge.exe	100
PID 5972 wrote to memory of 1748	5972	msedge.exe	101
PID 5972 wrote to memory of 712	5972	msedge.exe	102
PID 5972 wrote to memory of 5416	5972	msedge.exe	103
PID 5972 wrote to memory of 5416	5972	msedge.exe	103
PID 5972 wrote to memory of 484	5972	msedge.exe	104
PID 5972 wrote to memory of 484	5972	msedge.exe	104
PID 5972 wrote to memory of 5776	5972	msedge.exe	107
PID 5972 wrote to memory of 5776	5972	msedge.exe	107
PID 5972 wrote to memory of 5776	5972	msedge.exe	107
PID 5972 wrote to memory of 4224	5972	msedge.exe	108
PID 5972 wrote to memory of 4224	5972	msedge.exe	108
PID 5972 wrote to memory of 5976	5972	msedge.exe	109
PID 5972 wrote to memory of 5976	5972	msedge.exe	109
PID 5972 wrote to memory of 5976	5972	msedge.exe	109
PID 5972 wrote to memory of 4296	5972	msedge.exe	110
PID 5972 wrote to memory of 4296	5972	msedge.exe	110
PID 5972 wrote to memory of 4296	5972	msedge.exe	110
PID 5972 wrote to memory of 6032	5972	msedge.exe	111
PID 5972 wrote to memory of 6032	5972	msedge.exe	111
PID 5972 wrote to memory of 6032	5972	msedge.exe	111
PID 5972 wrote to memory of 4952	5972	msedge.exe	112
PID 5972 wrote to memory of 4952	5972	msedge.exe	112
PID 5972 wrote to memory of 4952	5972	msedge.exe	112
PID 5972 wrote to memory of 4384	5972	msedge.exe	113
PID 5972 wrote to memory of 4384	5972	msedge.exe	113
PID 5972 wrote to memory of 660	5972	msedge.exe	115
PID 5972 wrote to memory of 1912	5972	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://google.com,
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x254,0x7ffe01b4c188,0x7ffe01b4c194,0x7ffe01b4c1a0
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2297762204451665731,12401465367879108472,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,14958950876470799808,12940171702491537433,262144 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,11659687319902238984,11281184852684173762,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,18445455927799313734,16700735862321792894,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,3929983267760417801,2658925201196822372,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4992,i,12605773548469144222,16063302284530672415,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4744,i,4019385590301771054,9160627812813117754,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,4584710900707385282,11045373489053600824,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,8317892239763824872,5506717949260274457,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,2099098452500064838,8147248125354521141,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3119244884948260280,5053347578605138259,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3119244884948260280,5053347578605138259,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6416,i,7237310501551235203,11291038021304734930,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,1233901869166878517,10353143234111430820,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6716,i,18060236147744276130,9043963849287618121,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12621193744164605781,15736945089351611913,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:12
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16254530977011212235,2231068321725890229,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,8639559245541630877,2874472639564526134,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,15642048119113826222,4603687411044387396,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,17559154350830629732,1540186212605904221,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,16740820738283687420,14574685752989475613,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2196,i,2816196867893966672,1876126204512367531,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5470215141855182984,7226388543452641096,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6848,i,16015991717661605055,1657750758058907943,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6980,i,1328634061394760142,9108937323477446561,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7060,i,2587077500182599938,2762622235661187568,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7064,i,15263025322196030175,7618690926385077391,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,12598264731522038584,8517037045445389152,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=1232 /prefetch:14
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6919727119086770040,1200105976410219497,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:14
  2⤵
  - NTFS ADS
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,15549103559752484427,10556616543724710270,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4965382141032938182,14431768081443148035,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,2991143154883576190,11390904280675111812,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,8125882381860853155,17174170672252697705,262144 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4676604621199213075,17651345457593235537,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,3018727915675048233,18052753934230068214,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,3018727915675048233,18052753934230068214,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7364,i,12578786681640571189,7290518199089362254,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:2348
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v24.15.0-x64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,3105397595012562056,1815184655987777436,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7328,i,3368631790606152974,14262088334653232781,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7948,i,3262554669638991816,4155209773129908662,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8288,i,6350374663406402617,16383766835210914511,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=3764,i,13324943485886270267,13914575768245932768,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,9092565382896370935,6867397901391550603,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8376,i,13776151389697609364,11927792478212341750,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,7296435149715393108,8982829376941118251,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:14
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8716,i,8273714799258981573,4644856645099494130,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8680,i,5096860535827064603,9117995151701402074,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9056,i,6566985201380087136,3134580639688770936,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:14
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9024,i,1698825585877585420,2521979400144019940,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9132,i,1912011950508206160,14962484562130049697,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8688,i,5174748650802962828,13467637194534673560,2097152 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8404,i,11211022888825410944,14948628768997470659,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8476 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8532,i,5400564397536704265,10849813474895679408,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8936,i,3766491183919539446,1040141375414436206,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:14
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9020,i,3519134157851539640,10324836648051174987,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8984,i,9861432271064216288,502516715875505902,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8984,i,4154826669478287144,7121540334928647127,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,16929016979817304248,4770880529485902431,524288 --field-trial-handle=1876,i,16166100825227950392,12958186582446860960,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2682B4E5C7617C74F3D4CBB80E3BD482 C
  2⤵
  - Loads dropped DLL
  PID:1232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2340
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DD8E991EEC763381ED194BDFD1695BCB
  2⤵
  - Loads dropped DLL
  PID:2232
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6A70F970BD928F099ACCDE2770361974 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3C88EA0DBDC9F630795D1317C5BDA78
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aa24d.rbs

Path C:\Config.Msi\e5aa24d.rbs
Size 774KB
SHA256 7987639eee3338a4ac722c34d5af3ba0e4480059247d54032ed209a4dc185721
MD5 67df84d0f662d73ae8e0817ec3df8f85
SHA1 5541643e4b9ff813d0d83c680ebe49c6e0017182
SHA512 795fd915b2ba83bf4181bc50cef9ac776306b8af961ea59372fe4decaa6a3fbc1eef9233a2f10ea8fdb702079bdb4474b1b79502f8d9b27b573bbfd6178b190b
SSDEEP 12288:p5lw0IAjA+S59nDPNWMrhl9Kmf3pZ8lS3TAT+erw27WHdwLGu38M0a:pICUTACd27WH+BsM0a
TLSH
T150F4B7706DF188EEE9057171B39470319FACADCA6F40582D1BCC87BAFD6A6F091B8644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\LICENSE.md
Size 1KB
SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
MD5 236eea678a0baae4690b3fee5f11cd6d
SHA1 0d97e894b9fe7f7a8e74bb99619e415a65726a40
SHA512 e7e720da4ec95a289fdc5acb7d9d06fbab28b15476e1eb51155e0a131a0222d5e44794bd49088230ae602173ec3c49c789b6c2e28a3146778624f4b9244c1d8a
TLSH
T1AC31E02F665E975302D041066F43A0BFF51A457D966E02F23496905833F6B2246BB8BC
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js documentation.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Size 168B
SHA256 b03b50ba347335ad4972b70d673269911b669a05673c58fc9c2a62d935bf8966
MD5 4224bb0d45200da733785788bc72979e
SHA1 8b234c74a4ddc241336657a0e0fcf62fa7af6e27
SHA512 8ed9f025b7c77fafc34b0582000ad58a3c0cd72b71472df0908142b89b3b55c126fc41f104fcbd44c03b5ac7e1708b5728b7940ccde3b5cc9b5ed819ae353dbb
TLSH
T1ABC0809D960DC55AD34105478061FC14EC4F79E60CDFC41D11D4DD4F9D45050C80559B
MD5 SHA1 SHA512 TLSH

Submit Download

Node.js website.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Size 133B
SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
MD5 35b86e177ab52108bd9fed7425a9e34a
SHA1 76a1f47a10e3ab829f676838147875d75022c70c
SHA512 3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62
TLSH
T1CEC09BAD49098155D3424547C071FC48DC4E79D14CDFD45D5294DD9F5D84091C854569
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 1727fe65721879e46df4ec0f5769fd29c42a3d7cc66664e9a6d2e104c67dad42
MD5 8eb2b26118ad15e0f6dd39090fbdd87c
SHA1 da39e0fe5697045dea6c92a074af0d1fb77731b9
SHA512 88a4ad87234d6c0c8e590e4735b63169f54da2b87dac82a834295135113bfdc6938634dcf3138643308953176410a62d5d7e742da4577c1567e2082bb2e5fc72
TLSH
T19351E8CFDA5A6085FE53DFA097D4EDE1B8B94BA33962D5CC5496E1C00C0A3D5670C80C
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 1KB
SHA256 4de1ec96c18e2a42a88e108aa430cb8b6d42e61cdedb38c20d97d2b87501a42f
MD5 87b005a32c60e55592cd9e3046a68717
SHA1 be35338b6696389d34dfef9c420490bd7a18ac8e
SHA512 6ba763e3399e98bd21a2dd03314eaba280036ac92d1571e0eb16480278d9cd1d357d9db9cb66f2232486988c49a4bfbe1d0a43c006a73005b4fb0bf5a2cfbe19
TLSH
T1B34178BC704DA99381E0AC70C6C7AF87CDF5526176D0E21F80716F844869BC7EA976D2
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 7a8a247d4b8ba35919ea815ec569794738968ef0660098106b6a9ab4e8fbae95
MD5 7db3e9e08000d8de550226566005a6bc
SHA1 e3aa488e0bc912ea209804c9a5790faade12cf76
SHA512 9a7c7d6a0ac246424e397d418d69ca6927c2b60a39597e3cab1921fe4f8a855a145fae8894de5e0650d919b025a8a889f4c2f34ab339b5eb2dc22dd37eb46eb2
TLSH
T1A30175A7D66D92C064E46950E728EBA7BAD2D3F23900BA2134BED25D00DD3811701426
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 556B
SHA256 82d154956063d3d8164fa5ffc0155689e4b59d779371f3e6134ae57a19726a49
MD5 e3b375acd6f3cc94a938246f062e7ee9
SHA1 7afaa09e8236773bdd4b694c238ca4ea08e1f701
SHA512 6c56d1ee84ec35735f7b8f6e75c3d3ec58e81bf6c2dfdec07be460e6cae14146f3271994688f3a2f7d5b44502aabb1624fcbaaa338a1aeb576736bf02e3e0bb1
TLSH
T111F0593C29FAC11BD772EE394BAAA57E7C36B3433408566952D505455843E005CA171A
MD5 SHA1 SHA512 TLSH

Submit Download

C8D02B4227BDBA17232BCBB5B61BEFB6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8D02B4227BDBA17232BCBB5B61BEFB6
Size 290B
SHA256 6b24980daaeb39764f916180887aaa1911183ca1efb49bab1b4589c8a691d7b8
MD5 44209cf67bdd3592c0c1ed7a48adb65c
SHA1 5ced306f7a7ef5cc7acd8af0180f4d364bf4405a
SHA512 e2f294efe904d97de5306b5641124672aa5d88580023bb75fd9f5c3d41035cec07a5f4ca6635adbb7c0e1f7a1190f49709fea535bf6ebe6dad536a1f5330ce26
TLSH
T175D05E18E3F50623E0D4C67F59E41A33AA767D2A5511C39501B0E7087064E85EA31313
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 659256f3736dda1e13b2c34cc27f259ab2870f02fb53b076853a19c1b88f5479
MD5 0a475b7f2d455bb6d7582066f57b0ad9
SHA1 db693c6db458522093aacf4a70b43a57056a3ce8
SHA512 4ada0b5a63b7083484e3a43e93f660d0caa8baeaea3c477f28c36243de80fa88719c20a0bd10f944d482dadda8195bc5172243ecba3f0f1464b6a0252ad58fae
TLSH
T15EE05E0CE3F60A16F0C0CA3DA9E01D57B535AE654610835607F0870D7828E51B931703
MD5 SHA1 SHA512 TLSH

Submit Download

53e0268f-6013-4123-9761-1d8fa1daccd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53e0268f-6013-4123-9761-1d8fa1daccd2.tmp
Size 27KB
SHA256 5c56ce49ecb19e863445d580d230f0e0671b09ad9d9e77788bb778a5a8f0edb2
MD5 0c99a9abfd0d835940418f4471f73e6d
SHA1 b94d37007bb0bd87dcf8718a62ec546441db0183
SHA512 37e4d7ec86343f127d77816ba7c3b77de4d479734024d15e994de0b7a9dc20d1326432c658be0ca8209e56a3b79e3fdf7ce401d92cfdf36ea6ac58b706f96956
SSDEEP 384:nWiFavqMg38Nz8TUNTUlIxB4d0sO14fDKn/4UXv9SXmvi3Ra4yVrN1k+5vI+e:9Fayv3MwggHKr/9qma3Ra36
TLSH
T196C25B76E898DEABEDE64FC9A70A7603EFE051A3958C4ED4DAD81D1D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 a726bbc6760f75c0e308adf376cb65e36952fe3d5c8ac2936bb525f17480090a
MD5 25c530eec3008602c21f296d3dddc937
SHA1 8ff80160b84045a0d3450fc56f04038f227b9d57
SHA512 ce1e6abd45d4bcb3de612d2d1c956ff87bb3717d9f8fbad6e8ffeb1785b05b3ab541676dc12b372045a10ac34799b2d6d0f0bb35c9ccca6986a4369d04bb3662
TLSH
T136E0D81D07CAC97543029496F3559F1985D27805994C96F97316F07C3E1088497DF5A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 0d42f1189b186a4dd47fdf99d9693af04b0eb4b3ce832d3c73aae3f0634072fe
MD5 d903b519535f0196ee81e92617fea94c
SHA1 e7c3d42e3362b6d96af6e8d1d07307d84560c80c
SHA512 1dc6c68b232e5ddaa8faf50e12ef2cecef89af644e4fb30d1dad2ae562bcf16245ec0600da840cc2dc961e0f9dbbd975536a3a00a4b107fd1e73da524f9d4692
TLSH
T1ECE0D84906CEC1A8420AB4D683945B1985C2380B998CEAF93754F9FD3E5050047DF8B6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 335B
SHA256 1ed14c74ffa6f627b0ff8f715e3c39d3185be661214b4fe99f2bc60a537f08f0
MD5 2885ced7f3a7690a55ad9310453d60e5
SHA1 80dd38b1b8c86aef9e3e333ea48904a880415994
SHA512 e18dbb5105f5c0143145bf4905244f2dad4114f9538cc744a5f5b97eff44074d86105f00092a32608386b58e8422926018c21342d99fc5e4264a32687d0119b5
TLSH
T1CCE026DC05CCC25EA21464CF83784B8D82D13B0BE3C8EEAF2B29C8883A4544066DA6B4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 385B
SHA256 7df1a8357d7c29d2e928cc2f45e1a238f95a20d4c1edda5cc5d5597d8da30413
MD5 7ba367fce8c602cb268afdb9f9f5c43b
SHA1 21ea11838c5c6968e322bd7cdaa6ea94e083e122
SHA512 da0a63d710ec250d0b628af60a7fa5a1cf00f09ec4ebb9b868457d29e08e0df42a1010bd746aff82a96d6846b4aa61e00f65476945e8f30ff9a9ed8abb245798
TLSH
T183E092AEFAAC9B8EE3E84D7EA7B6B0410B8802B2D80B5B1304307DC035D57B02E75520
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 51cf69014eb06b85ab800694caa052dc5067c4b3aa574bf7f7e224dfc6431569
MD5 6f7b0a4015a2d12e91a1378fe3036fae
SHA1 e8b6b4880461021e5041177c02dacb73dfff6629
SHA512 7975526c486f29702caef2e49e1cb06be753ea850567ccb6bef702095ec07939e7648b145ed3dad33d4d8bdd2607d2e8e855642011fdb2fe204d49f52249a6cd
TLSH
T1A7E022AAC920EC3788FD47282048478AE75017576B80985F3B3CE20D8FB172B458AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 68KB
SHA256 4ad601c70ed7615e044931de2d0d9c24efdb78df38eeafb5b31128b73c608705
MD5 b5062c2c09682cdd63e4fda053acf12e
SHA1 7efe12fd7283fc6aae2cd1206f5f04d36ea6de6b
SHA512 86a64354cb92f4f507f1da0e3315b02d3cabdaca349121723cf4e01b480401062027ec5f9f53e94835e7b44a6e7de35b185c5e6fd49aca7f8c1a0e60070a0ee8
SSDEEP 1536:Rimoq0CZYVaNUf76Z+AGYguWv03e30iIiV43s6WFYlXx:8rmyV8X9GjuW83BUV43sTFYlXx
TLSH
T174630223FBFB076A70E95438F13D632146E1BC5AF00B57061A77AAC67D32E62248430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 37KB
SHA256 346ea97ec5aa47587d93e6347417ac2f9f9e7c85adf447c627a04af5926d08fe
MD5 336366f1121f7cedc056a917bf0f2fc1
SHA1 1d79799f95cdae8946042d09c056c5075e3babf9
SHA512 e730cd5de6b898ad719f905cc8d488945393206baabd17cd1e0902e55b46f71c2de9fea9e1b72981697f979ba084596dc09687e31cfe89c2ad1184e37f0d13b0
SSDEEP 768:zo30e1yjwXoHp8WOPEyD2l5QYnCmqimlrL+78O+fktopf:G0LjwYJgP1DY5VValrL+78O+fktKf
TLSH
T1F103F11C0F934D4984A3DBEAFD5C2B0068191E0F687C4666F3DD67EC3469DA6203B0AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 13710a688a125077500f972d1e5a5c0f367ce3c4042d02464979d76c9803ef71
MD5 07c7ec537302a2a60eaca5802a848ab5
SHA1 c4345d7a5aff6eb3f6d17b452e2324071ad3db60
SHA512 814c185a661edd7a48a35b54ce6f63667dfbb9b55cdbccbd10196fd4cb99adfd04264c9b4ed0c1fc63d9279f6b1682106b8e1f3117c0bff62587db3acfc65f51
SSDEEP 96:Z3//t/bozpHYFtdWsbWmy511JuRqAZ6DXztdF/6ylzGGfbnqtUMzd:Z3Xt/0zpHYF7bWmy5kKDXFTyGTnqF
TLSH
T137D1950650A59263D7F43E7CADED271BBBB0504CE0B34F27839E0A3E1446766E3644AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c1e967a2cb8dbe19f9c0c8d68b6b2e912432d6bc7631a827573db538a992440d
MD5 11e6eb93b6f1689a3c3ec2254d3b2c3c
SHA1 537a1db607ea1b03c4913e3787b50ee290af540a
SHA512 53247b8fb12b3905e3cc18f0250f2f82ef9fe2c2e0865d38a97e9f381b0a9cb4083236abc796c69cc14edf7063e6e78bc2ed90880c69cb29f3ab71799e145f36
SSDEEP 96:VQ9eE/aasv/HqO+n5OCemwnIiPHwlGt4vc:VQ9D3svvqO+kCemwnZHWm
TLSH
T15FA12C4B81958257E7F17AB44EED3723B3305448A4374F1707AA0B3F1A4A7B1E3B00A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 29c4cbd346aa2539c6b96a13f20784122c7f433a97b5dcd8d613825b0522c0c2
MD5 434cbbeaeb6273487075dad55ef41be2
SHA1 f797102f015c6c6fd26fdb14a5d9b358c9057bea
SHA512 5e527d4ad3a673ace9a71d287bac52cc6e481db6a1029a62f74de2326f1dee0ef19007f03397e915a77685eed97b6b2b723f526627cd95615ed3db4a82153a28
SSDEEP 96:w3//t/bozpHYFtdWsbWmy5L1JuRqAZ6DXztdF/6ylzGGfVnqtUMg:w3Xt/0zpHYF7bWmy5yKDXFTyGdnq0
TLSH
T139D1850650A55263D7F43E7CADED271BBB70504CE0B34F27839E0A3E1546766E3644AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 48acece124d21bf7ac34ce1390995bcd62ac0112dec70b3b7b09e5b8c3db1b2e
MD5 e96e132d5006efed3a6fa908288ec752
SHA1 cd6413ed126900601c2ff1fa054213a1b6fc876e
SHA512 8486601463e709193a0a6817ebc92db525d7d25f63161ab6afa771d9140a309e22f9b3aa5260b8c1a131bde47cdf084c0c8d31d19f6b8471239c530629325fc5
SSDEEP 96:B3/0xVGzQVtoFhYoWmM5nxlJMRqAZ6DXxtda/6n78HB1gctUMzn:B3sqzQVtoFxWmM5xsqDBaa8HPgcP
TLSH
T182D1CA0640E54253D7F43A79ADED672BBB70528CE8732F17039E0A3E1447766E3684AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b7a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b7a3.TMP
Size 3KB
SHA256 19ebe1f39cfa960d440b7a87f85794ef7eb69b1522f7dd27a3831bf8db3d4ca3
MD5 f588007d7e0ad99d707e5dd82674ff90
SHA1 b4fb6c6505345991c092c8fcc732d9029af94fba
SHA512 a8c7c1f73c4995827bd9606d90b9195f81b342c9c5006abdc26f59428b538aa549dbdb31a35942cc772621eb812dd14f35605f54a2efd2d957940d57d9585d71
TLSH
T15261F84B81E69868E3E17BB95EEE17677230859841775F2717ED013F1A49B12B370433
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f9b00f6f5fc65094bbb9ef7167275cbf8a1b64732a28c8e587ecd4c54f6954cd
MD5 91e00097c4533ee7441e926b1d94acfd
SHA1 2c41a750b4eeb6d9fee257a953a1db0fefb63bdb
SHA512 8fc55bbf7b831ef4e154588535d9eeb7b25df9d7b0801ed0a2357101710d4cacb87252089c0aac5943dfcc3fcac2b68705f7fdab2320847f33d50b8111f88112
TLSH
T168819EF783F4466DDA1195F0EA08AE1F8E5C0452836C7D6A85D0AE17A3E3471E181B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 80fbe665162eccd226cb33fe1a2fbfbb88d62a8d6fb8136a3896c7031665d036
MD5 90b64f8f4c08eceb23d6e592494a70e6
SHA1 e6e86546710cd9eb55200fa6711b3fb5095eafbf
SHA512 d50a592f04a04aed3cf7f10d75448c4260bde431108186301c980fbdd480c30741fa1e7d7338e579a8547547310041da91da6fd94eddd8d1eda22c1f3d1cde1e
TLSH
T1FF719CF3C3E8826DC91155F0EA187E2BCE1D0956836C3D5AC5E4DF0B93E2470E181A6E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 90af03061ec9cdb31fd4aed674da09d7ca7150e7e543386c6d8ffb4a0c0c2f4c
MD5 13fc795860833785bf4c93da7f88064c
SHA1 3918030b3bd0ff8dfa7e35a84caf462d4efd0833
SHA512 69a21a89385321ac3acfa817918c4d9d250b6c9aee515a011287384a6cfb0509b734cda0654d79a09ff34e392e943a2281c08cb971754004cb4be529e067677f
SSDEEP 96:D2OJcPHiKIzBj6+OfYaEY2BsKL4nqwBSP+yXAzr:DVJcf3I1j6+mYax2BL4nqkSPhQX
TLSH
T14591AFF3C3E8826DCA2155F0EA186F1BCE1D0556836C3D5AC5E49F1BA3E2471E181A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 862d6d15b2f9f72261c972c4c99fcaecc3af52e22b8a0bb4db86b5dcecc22c67
MD5 aad1a005d1aa43ce0691e0aac4eec230
SHA1 89d6096574159e63af252e96b7504d604a8d34a8
SHA512 a81c6b8d235a7fc61ebb3f6bcce1d1331236389070d2456254cfdde0a54ba8cefb699ddfb1dea684db8413f3fd46427113038326a41db2f031be7eadcaaec683
TLSH
T1DA618EF3C3E8826DC91155F0EA18BE1BCE1D0956436C7D5AC5E4AF0B93E2471E141A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 d033fdaa12b3a6ba88427b487bf949c55b2858f52c3acc9d0c3ad8dfb70dac46
MD5 2d37e5e25b34e68e8c539cee4ab716d5
SHA1 06b77a426d599bdddeb4380d08cfd557a6feaacf
SHA512 7eec476d20d02ce18c265f66c90f943fec0fca7ddf3694c65f967e4ef526388b4bf0599149b43ede88d4d230cc8d64b7c72b124e8a417a881b34181bb57f935c
TLSH
T1EED02323134170BD576C3D818069AD4EC727706405829DD510E0555D153585C151F045
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ad19839adb9c33b9937aa5b42489b89a8d884c2d54b872948ae0666e7ac3ee47
MD5 f247483d1f719b8d4797a7207245fb91
SHA1 558ffb41d962cb1f92338dd6c81b6d42ad888a6f
SHA512 456d4d7d5790e5d3e64bc16db7a22dddf90c74634391979c5a5aab0ffe55adf5034469507fc9bd8c7f14ff91094706b1110823326d6b22bacb8a30ad5e2f56d0
TLSH
T1DAD02323134130BAA77C3D8180A9BD4FC727303506C3D9D510E0556D173649C461F244
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 8852f25d41692965bfcb4d3d3e0ce19df0e479e9d2b5e20f8dcef5016895ab1c
MD5 1844fff6e07a208321779f86e0b7ad15
SHA1 309a8607055a37392a1ee754fbc9df4ed403faa6
SHA512 e8f556a4bbef904742898242c3591a5b3a72fc73031018122b33f1e84b755e47d8458f26cf80e2e6f7c2fa9d04dc44535350a5811e08b5e54f4f40c6dfbcb957
TLSH
T119D02263234130BAAB6C3E92D0AEBD8FC32630240AC399D910E069AA1A3746C462F184
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 bb67c05442202caac910dd336ba60785f34933cd429048704961fd37f0e1e67b
MD5 8a29b2e2eed21a3db5c83e41407c2957
SHA1 2df1259879613c880088f6d6414c7c326eff87bc
SHA512 43cf844ee2b75c987b1887d91304321cec8a5ffc01aae28df9345dfaa0c97314e168fbbb4bffb53bc7732370a9eeda3fcdee6d519daff70803d227d4ef628b44
SSDEEP 384:sxZj0qYm49/fJsHYki3Zkj/bgFNTCmpglv:sLjYm49/fyYBZq/b2Twlv
TLSH
T13892FA52AA248977CCDBD619F9617F13D7F91522DA414D8C6AFCCA0C00DBAFD220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 b3565139f95e590667cadc509c0cf8311a84495fa593e6a0ffd1a3b01ca6b2d1
MD5 744e8047a9b0120672842243695d03c3
SHA1 93acbd29ae2d20d68b796bb27652446aa8d100b0
SHA512 10f0781cb29d809eed676d0fd6760bbc35e586f048e8e822cbeeaf47f8536911a181aa77a0419626260104d33e69961f7a2ffd3d242c465c9eee5ef7be678ced
SSDEEP 384:sxZp0qYm49/fJsHYki3fjsBt/bU+59NTjmpglv:sxjYm49/fyYBfwn/bNTFlv
TLSH
T1F792F952A5248A77CCDBD51AB975BF13D7F91522D6404E8C6AFCCA0C00DABFD220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9e34ce770161010798d72a056baf284d71d7e913fe7c66d389c7bb146c3ade31
MD5 ea04b66fe1779a3dbde3ae12076ce215
SHA1 cb437cb2a9b3a9b816d7318ec8528acfccc991cc
SHA512 a2385c9a6c7036dd4fe618aafdebe6be910c0e0fd1e7c974d4a089b204a03299cb4658ee0850688ec759ee61f8a1e484f4d5ca13d9573e7e494158425245d921
SSDEEP 192:sxZjRTyMqZ/K1Ml8MF9/fJs7UHcNiILcUzodpKi/W6+WNPIP/Y0lyaemRIgjZeJ:sxZj0d9/fJs7Uki3nh/bY/55jZq
TLSH
T18C62F9056A385A778CDBD619FA45BF53D7F9156392404E48AAFCCB0C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0e9dc3e3256b7d8cfbd732c585ea26790c08f0347839ea86cecd12321c84fd2a
MD5 4a3824a43b1bd1027fd5dbd2906f5159
SHA1 7b3835e183ec2ae60457f4aa93a0877b4e03f229
SHA512 abe48fc4baa923779a8f2bbe25074f83f35613daa60d1cf2d45311a55df7923a70613c2365ec804fd8c7f5edc895e394e11a1aabd52a2585c9bc98254921d3c9
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3i7yZLlk:EZN9b8PT24ZE/CuWRmCCQx6u1jaKi7yw
TLSH
T1A6031C3B280CCB7E4F804E9CDD26AE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index
Size 2KB
SHA256 549032a0afd53461768406169bfa7514d870eec55cf271e6135efbdd30689784
MD5 8af81c6bee295fab770f59fb6f6532cc
SHA1 26bf609e7aba15c509e593acf099e01052ad40d3
SHA512 21a7cf4a3d1c257547a8bdede8ad441ac79dbcab92ba1e9c407caefa2071e4117a28b067ac7dfe4c47143dbcf6646a45839a8a8293243c6d187ac2c5a864d70d
TLSH
T197510A8D8C4B5B17D97D927164F6006933785CEE1B54060B64EC42765C4726F29A7308
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c8f95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index~RFe5c8f95.TMP
Size 2KB
SHA256 f374e40ae8e255bc3d4a65cf336810d05f606b7ad1cd2eecb4e9dfd757993c8e
MD5 7ccaf4d6d30d867863e755dbd68b320f
SHA1 f0e10919f93cfde465be5d00f089b1674197be69
SHA512 417840a960882f6b3d6fe53ed968aa9497fc41f0532dcefecc6bccb566b3760337de853164bb001b4fc7f88f514fed789d19c180c4a0f6ef1c5e622b2c2dfd2f
TLSH
T14051E95E9C430A31CDA081B359CA5468333E68954904AF0B31FCCA33ACC37AD3D56384
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 926e4984c865a268cb90554097a67352ff95c8aff336d89af6b9d8162c5b6e2a
MD5 26db737f18a735d3793e7bd8b231e8ea
SHA1 aff68e2746cb00562c6541fb6fd003067430e85f
SHA512 579f8dc52b6195951c03198684dfd8805db328bcfb3911871072d216cc73eee681b0e522883f008ac361cc3cb5bf7c9f54de1bd7347f4f6e3402d7f502f1b292
TLSH
T1A7E068722DE61C00F8EFC3E3683144A00454B858E916EC4F141A92CB0074356295AC32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 74e13644c6c9f1d6817daac873ed9545a15a0bccf8830da12ae85377d74e4027
MD5 a9b9a73af9be11e28355796f3de2d5c6
SHA1 c1224e014900841c5cb9e68466a14b7a1eb8a83b
SHA512 cc513b32cdb42b3e23af3f85cbc104f660942eeb3c82be390ad37dfe49f123e8ce6e21cc97ca6ff7c0f5e466651e7620890e10494a29d7c8915001c23143007d
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZNPqxYUaEA9YH0MyOPWrCKvoW:cdOlNXJjSSjroduZNPqxYUaEA9YH0Myh
TLSH
T128B27E15723B13903ABD298A8594B4AF52C231633018E43B7BB954AE0F67E54DDFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 affe921464229b7a3f866895d7578099e68b12e9dade08dd5acb0c1fc046eabe
MD5 5bf92b0acdb404b7855a38a42284c024
SHA1 0623d1dfc35edfef8b32f4f3b1d90a5ffa5b0327
SHA512 99318223f4f61647a98c8ee0501f0db9375bd940d13476adbb5d58006bfd28adae78a4a9fe4250e87b31badc76f3f8ce6c05a8d144558fcac080161899c9f307
SSDEEP 768:8F/cpB3QAwg8gokyYr/9qfahkoFYS/joH:fB3Qfgh/9xhkoax
TLSH
T116E2A1F598DB8A77D89E4B87A73E6D429ABCC153B5484994F7C40D1CCC861BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 86c626af9894bfb44da9e82d4ce618594ed1e3ce4cd0eb095a20d7bea73127b6
MD5 7d576c84cc95a878dc451ca3841e39c7
SHA1 57a486d1a1d67ccae88ff43fcd5ecda646cb541e
SHA512 328e72ee1351be35acc92045a046f7f0be18e487ca44fe6e47575d9211c42167d3c6a94886409ef6ff37616d845906a6eb9b4eb6e517097c7730168df62b5b87
SSDEEP 768:8FlcpC3QAwg8g6kEYr/9q3ahkoFYS/joH:vC3Qfg9/9xhkoax
TLSH
T121E291F598DB8A77D8AE4B87A73E6D429ABCC153B5484994F7C40E1CCC861BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 0120b5bd902b070db36822b86552a9bcfc3b04adcf2f4e58e5ae3da32c5d28c2
MD5 6900f3b4816cd73298ce02202e23d044
SHA1 68e53cbfc326751a8247a4b9b66357d3a2262695
SHA512 07279886653372ea7aa5ab85041621c8a6055ea63cf46cc799db0cc94ab2fcf853e985df96077c2aeb6081b2b5dfd336f460091eae18bfc665dfb09dc12269e4
SSDEEP 384:n4iFavqMg38Ns8TUNTUlIxB4d452RK14fDKn/4UXv0Ya3Ra4yVrN1k+5vI+e:DFayv3TwgLsRzKr/0Ya3Ra36
TLSH
T176C24B75E898DEBBE9EA4FC9A70A7603EFE051A3959C4AD4DAD81D0D00D31DD2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 99b29ffbd090a021e27d21ec3b15589632b44955cd31ac3dc9b7ca6d630978a3
MD5 d490014742c3d5800371d67f8a4ef39c
SHA1 c030311a3d43889560b9834037cff2719c10bf88
SHA512 44dbe8c2e8a29bf5ca5de2a8ebcd5d20a6f7bf9f58b772542a30462158395ae188d4a1124b1ac8ff4e6c1ef1c0120076f1cb4cb22d3f63c02f23a8c2f9063b84
SSDEEP 384:n5iFavqMT38NH8TUNTUlIReTqTg4dFDk414fDKn/4UXv9SX2viJn1nrN1k+5vI+F:QFayU38wg8WBkFKr/9q2aJ1jx
TLSH
T1F1C22B76E8A8DEA7EDE74FC9A71A7603EFE05153958C4EE8DAD80E1D008719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 aa09a7e0ed22ce4b0c0040810c661841fd781afe95153c13ef0c542c086944b1
MD5 9fa026b69e5662e237e51be7e2306552
SHA1 b93e1510368154b4b2dc46d3c79a24aab78eaaf3
SHA512 4f43c80b38f84f748765a68e671c894013dbf8e42e41959031f3492ecf0389fffd0c1b90b45d8da6b952288b28e6aa56b3a29f62ff0f056ffa63067bbb9a6385
SSDEEP 768:QFccpP38wg8g5kJ/Kr/9q2ahkoFYS/joH:4P3Tgz/9Ghkoax
TLSH
T129C24B35E8A8DEABEDE64F89E70A7643EFE01163958C4EE4DAD90E5C00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fd678ef893722a1348cc782487cc9862fc68bbdb7475d66e8ea6a0846e9b7810
MD5 17599cc7bfccebd3d4b991fc90675fcf
SHA1 1b0de3b2d83b79939d760da0ff6280f1c6988b57
SHA512 bcb88d4de7e96a1d869cfc6859dd18eaaaa967aae5fda5a9f955f866ecb81ed83192456202de499075bd47485ee8c44d70b837cf498e889554e79412582718b3
SSDEEP 768:IFccpP38wg8ghkJ/Kr/9q2ahkoFYS/joH:gP3Tgb/9Ghkoax
TLSH
T17BC25C31E8A8CEABEDE64F89E70A7643EFE01163958C4EE4DAD90E5C00C719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 adffb6303864b469929795b715f4816b3627e326a52e262045f458d698fbcace
MD5 bf60ebb34443ccbec1d5c51e07ddeef3
SHA1 226fb0f2c2de629b2628f1aad22dbf2a83fef6b4
SHA512 ba3569630eec509393ef98577149a66f86a96d83156daa8768143dfdfb4f8ebe9f06828e6d7ff2a31942127297176f5bfcf5a122247cce1f0495c620fce0a052
SSDEEP 384:n1iF9CcmyWC+38NH8TUNTUlIReT0Tt4d8Kkk14fDKn/4UXv9SXIvihkP+lFYS/nc:8Fccp+38wg8gekRKr/9qIahkoFYS/joH
TLSH
T166E291F598DB8977D9AE4B87A73E6D029ABCC153B5484994F7C40E1CCC861BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21fbe6b7e3fe9e4155cd6bba1dacdee3fcd16c12d27c421e1cda49b6025f7a17
MD5 bfe8aa873ef723f0031b1a1d5dcf00ce
SHA1 65d76e8f08e015533e692791da30113238d81b17
SHA512 dfc8481aeda36fc5aa0ffdc730877e9277933a82aff1ad26925c2449f3ea0102f3387ac815045969b0971e2c43ac38f2d09ebf65f7b3339161c5677e6f01e7c0
TLSH
T10CE0012BE31482BFC17D433100CB1B34BAE2842602E602461B2405793D233042F64FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c1dcb8a3531b1e4deab7c67f3ef7b19b606b5488140591d8c8530037ea3befe3
MD5 1a57b86d1d8080b03cfee605db53e1e5
SHA1 c8f2fb9fc1b012c2ef8075d78d4166058f4c12d1
SHA512 e8d764a47d6c48b2f1f3247f4d80afd512bfbda30c5943df4e784670570616ed1a7444449bb3cee27509fd5855fc6111d19d055d1a47a970441304e6eb18a3d6
TLSH
T16BE00115E31482BFC12D433100CB1634BAA1841602E602461614056538123081A64BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1f5c08a6c3f8ed7476408cbe187c730ddd7b6e94f987f829361ab08c49b991b5
MD5 0dbd7dbd5a92951fbba319c52108710e
SHA1 dbc000ebe005daf60e1c3e6fa31ce7ef0e0bcbf1
SHA512 38cb6f06e07bbfd6613761edff4eca0cbf8bcf0ec6e9aa662d06d8968673b2f2395fa405b48585ac2ccbf1f64585af11551aaeea7f7ca96f5549c41ec7616b24
TLSH
T11DE0092BE31486BEC07D433244DB2A75BAE6992A12E7068A5A2515697D233041E66EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 496ce7bfe0bf9a1ceb99f748214d91d23312d2c964251f31751f556fe6e8f654
MD5 49fd160ece761da08b7839566dd7f02d
SHA1 0400014cf6f9283732a8ae3432b22b8dd5003b6e
SHA512 f868608f2f559ca3e7545bf7fa9e42875b0734ad7b67e45f3ceaa238267a8c19f193eddbafe481216376fa03f424b796914110e9f1bcf5044825efb3a334e02d
TLSH
T10EE00215E21042AFC03D433100CB163479F1441603E301441614017438123041724BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c9b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c9b4.TMP
Size 392B
SHA256 dddd13989b82c606181c45f0af08d1ae6554344befefbf705ea0d8d855fc6968
MD5 1c4c82bab038a012ca882dbc907d25fb
SHA1 5f9d256305b3cb859fe60499dd5c160a6a9213a0
SHA512 947c06fa90d4c9eb044595561bd82069c8dc1a539246e10b1afd66f334be80ed6b3d6236c00d5f811832d600f6a70861b4aab27244b0f0c076a2ce39a7164454
MD5 SHA1 SHA512

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4cf667c611126a2a3ae9a7e4902c5b6c2739ac366edcfaf4237f7142f88ecda6
MD5 f571352fb8b386fe653be0dd71d9f417
SHA1 32d056f3805daa4490f8cb8b9c3a900a85ba2c39
SHA512 b15cd1eb8fefb34023336c5c43c21f137c806c917ed14a02d2260be7a5e92b6a99de47eaed158447be2a51b5c9a5f1505cc40d628d017b6ae41235b9381350f2
TLSH
T1B94163D04C3D1AC5D5BD1A7E688B38FC95ECD729F494343D2864E9D8067A21C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a7ccb9dabe8aadd57972ebf3f325690181d320bf34f0148693f7e01d40a69b30
MD5 57a2e6c7f9e7e1cf77fe677cf62866f4
SHA1 d4b5044bd1ec41bf64db91ed8a4d82d1e904eba2
SHA512 5b614a0f67da015cea63b36a486bfd5a13920b145a73304deaac36414afd3a8e09909c998c5eeab8b92aff61c6404d26f1c25b4cad5a0a52fa7fda156b3123b6
TLSH
T1D5515FD04C7D2AC1D4BD0E6E648B38FC86E8D725F4A4353C6854EA890AB962D74C983F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 06d50bdae2e6b8befbc216ad21095d1acdbc350b62e28946fb438e4becba5128
MD5 ab31f9a1add62ebff3b2a155677908e4
SHA1 9366670e83b4b8c655f47d88fb461f5d4f4e9458
SHA512 c8f549e0a54f7a936200ee649ce265430cf949192798b0c5e5c4293f5c2232e2915fc1a69c27f55fabfaaccd1e7adc8bcbdacef62703ff42c47ae07b921cabff
TLSH
T1894140E04C3D2AC1E4BD1A7E748B38FC95DCCB2AF4A4353D2824E998067A61C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d99946cdd2d987b05d10f37e80880a10e379f1660d5060e6243c464afae1f59c
MD5 07ad4bf072e29a6b9a45114e42d18565
SHA1 a630402ea8d922e635e2b4c7f9c06ee5ef5afeaa
SHA512 9ac220e658c4e12751f18980d40e0bbd1a64132f59112f522eea5969baf809ae225320368b612ee74f76bd16e6aa363181aac9ac3d7a9e4a424abe9454db7387
TLSH
T1CB4143E14C3D2AD5D5BD0A7E648B34FC96ECD729F494343D2824E9D80A7A21C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f933bdaa50c2bc0e0f30c8c71bddc797c8d8aeaff53245ee1c089e7deba0a210
MD5 763eddba443fc0fa792e1439f53cd18a
SHA1 c065b67ac1d80d9f88bd9597a4429c5df494f25d
SHA512 b6711b3f03e4181ce07e2f3ffc4491edb674503590c7ddbcd8626c34e386cfd7ad7d453d327078eed61e20926194dda570beeef11ef85c30c1a13c6295deb7ae
TLSH
T14F4160D04C3E1AD1D4BD1A3E649B38FC96DCDB2AF4A4347C2824EA980A7E61C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fdb2e4a7db8599f69ab2fda6bd08f71eac1f757b5a06d1400da28ebe2d78a4dc
MD5 e2a2346bdc900087004ef619d13f5917
SHA1 43ba2d5e35292e1f5564a175cec4afa9710d9943
SHA512 6d7334e2dcaa2b8e9954c0efd13543411f34c48d3018f3f7a418651c1c7475eed455e675b0c30aab098e49c8622ed0e001c14d0f3c565c3f57587297b97472b1
TLSH
T13D4140E04C3C2AD2D4BD0A7E748B38FC96E8D72AF094353D6854EA980A7E61C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5803c876b283b6e726ff775c384e8dc2506a2de2f231d62438fd41021051ed9b
MD5 ec8c1fb18b64d2d7d8ccdb853591987d
SHA1 19b7af731c28b33d5723ed0e32e53aa64469cec2
SHA512 48d5a734059700e0cd7f3e44bf3bfc72f0f6e6d6c7a4a497721b629214ce8039b09d9ebbc0d36076000ec962efa2b9c2c8195bdf23a7abf9fb74f0103b6c0578
TLSH
T1534140D04C3D1AC2D4BD0A7E748B38EC95ECDB29F094347D2864EAD8067A61C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d5232617fcd36667041c38b9534282ab448524e130f458f1cccc530f919a8312
MD5 fb38934122e4bd3b7d73851b7956893b
SHA1 04aec2ff0a63103bda1f04a4b2e17e0ce11d8985
SHA512 464dd302e1a9213066b94bc0d51884b507b8dd710008697f8ac150482cca35ad5b98c88ab73d5f3191a3d6492ac52da2d24e83997b3bd4266a7e06230d718a91
TLSH
T178413DE04C3C2AC1D4BD0E6E648B38FC92E8D729F4A035396864EAD90A7961D748483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4b226453d83e2fdd88d6e3970df0b9bd6e70fb594603f3edd87f014dec675c64
MD5 3ddb3aefc6b7a2021e46e850b879c60e
SHA1 aa321fa0d6fb532376b5c97b3c54e5e236ad15fe
SHA512 26d0f4923117b0cfee39147b9b19d8d9cd05f0ef777d67e2302fa8c09fd98199c37889fc8db699c606c6c11ae46794d9f147d6b4d434c7a1f7be30ac7f2e1736
TLSH
T18C4161E04C7D2AC1D4BD0E6E748B38FC82E8D725F4A4353C6858EA950AB961C74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a1967dd688ad5d0cffc2047ac98befc705f1bc8cf3bc5925b5ed9d61e194e5e5
MD5 9571f28d3cc6f13794ffec7b1342b82c
SHA1 203bc14df3ba65b995a0b4db5c756cae954f945c
SHA512 0cd521895e9d1a228abadc87cec34c2372c7506a182bc5ee50e98d4edfc13989b09eb84e3527823674b4900f1df4b9a924741c1d1bddc304c10722cc61e36bd3
TLSH
T19C4130E04C7C26C1D4BD0A6E648B38FC96ECCB29F4A4357C6854EA950AB961C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 265f973437a74550f0c30381751a4f0f7d213749a0f577bc45e283fb51a94f96
MD5 c2b390104a44982afef3bb0b6fe6d3e5
SHA1 b206a8bd4b4b75bc793c7ce1a0257ffb8ae39fc2
SHA512 c6a3b5eb814b9984b58fa60a0e3e8d3f2c81b23b6b417e8926cbd5ddae05a9fc3daad14c21be81330bcb5844e3b667843d800cdccd22c94670844fd67cd3b2ab
TLSH
T1AD4161D18C3D26D1D8BD1A3E648B38FC95DCD72AF4A4357D6824EAD8063A61CB08443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

MSI519C.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI519C.tmp
Size 142KB
SHA256 ea8946f1f6f647813929521c2a3690ec837621f04ffa201f7d582b5ab0833ab4
MD5 9e7b95219f738295eb7404e9a4013e7b
SHA1 939d3fec45acab6ae23d6ea3543bea14a6e1107e
SHA512 5ea2a601c40bec5f2bef8b73f83ff6069ed26826b48a178fa0395acd4f417b205f2eb539b6f605d40e739261112c0c2514cbd3ef2ac6b77071f1eb573f4cc5e0
SSDEEP 3072:9gKZ8Ob4WzPJ6FMngCb0xi+wCJkLcr3V6N:CA5dB10xiL
TLSH
T125E35B1BB3A500FBE1778239C9670A45E772B85117609BEF03A443662F277E49D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI521A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI521A.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-v24.15.0-x64.msi

Path C:\Users\Admin\Downloads\node-v24.15.0-x64.msi
Size 31.0MB
SHA256 feffb8e5cb5ac47f793666636d496ef3e975be82c84c4da5d20e6aa8fa4eb806
MD5 dc465d13fcb94dcdf2e8b1182ea47cdd
SHA1 81e3cf1a9fabeb0e8469372ec4ce88a2ffb72f1f
SHA512 49266048925b0f0c44b4cfa14822fbb51786db38c421b491efd7cefb8dc5ee8a715891c7f8b5e9f36cca19a0f6ff72582b41082c111e7f7a53aef97ac7092833
SSDEEP 786432:xPcUPcgy0oIT5uz+ql33L38y7EGIjfAm++P6Nl:GGc/0oQ6+w3L384Eff9P6N
TLSH
T1F4673327F2C20977C59B4136E0A3AB11AE35BD142721459E47B0A05CFE366F06BFB74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-v24.15.0-x64.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\node-v24.15.0-x64.msi:Zone.Identifier
Size 134B
SHA256 482ef1d1cfa5be2aacdb055de3c1839bc6c1a8439b77fe35fa3913ac5001a7bf
MD5 3b604aeb63dc86aa7f3574b0166a4cd7
SHA1 5597b1ddca8bcd0a1b2c99c9affff968e2a5ff89
SHA512 420a81a177b0eb79673f19ef4d5735aae2c0ac7d5e732c3e9f0329362f96204d7a710c006de1aa884fde177ad1d99ecca8120320f320f4cc30f76054b0c09278
TLSH
T191C09BD795055B210BD511F456ABF17C70CF114518D54108E85048ABFDD45B449B455B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1190959998\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1316945807\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1417042843\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1417042843\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1810926158\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_1837903986\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_2015054077\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_359391162\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_359391162\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_543178366\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_624198696\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5972_638122344\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 44e985cd68bf37f7e7c5bf47357003da13bafb818f15f8011f07e30c36e62785
MD5 2c3b09723db7a77fb5430c3322021650
SHA1 77f0b37980457912e3a185c92e96d51c3f680100
SHA512 1f5143a5c4b401943fb648f173f7aae2326a094c37fa0375cd82bd2b159bd35e161582ae2495c76f3f3bbd2ca24a63f770e13680d81b165cac22cf636d3185b4
SSDEEP 24576:12gmSp1mdoO/vvTLn2MeREnqfqpnA44mWWPd3pksVX6IkQIJ4Xdb7BmrB:y
TLSH
T1C947052436F92110E7F79F3CA8F0AA23493A7D5B9C15DE8C46411B4E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5a75f929-c10d-40b2-96a5-44215e9a7466}_OnDiskSnapshotProp

Path \??\Volume{d3d389e6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5a75f929-c10d-40b2-96a5-44215e9a7466}_OnDiskSnapshotProp
Size 6KB
SHA256 f61ea78022ba4a22716233bbc64243c2ba3b54f4ae7441261acc17adb3728874
MD5 be88bfab0ca318c2e7145dd4fb77ef54
SHA1 7ceb954afc5e708821421bc067f6f81d730e60d9
SHA512 6e6e00734309e6d30c2cb101eb33a8cff2a3343ea4cb03409cc250ff8ae40d7bd07ff9cafdcb5b5a5bdf2f485a803367b1a9cafa0f7cf9b5cb5db19de2986838
SSDEEP 96:Fm9BXuOfwjtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:U9pcb++ZVm
TLSH
T1B2D189085AE54711E2F3AB3129F18557A877B911EF33CB8E0298238E2670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-1279-0x000002C3B2DB0000-0x000002C3B2DB9000-memory.dmp

Download

memory/1616-1278-0x000002C3B1300000-0x000002C3B130C000-memory.dmp

Download

memory/2512-3196-0x000001AD57780000-0x000001AD5778C000-memory.dmp

Download

memory/2512-3199-0x000001AD577A0000-0x000001AD577A9000-memory.dmp

Download

memory/4840-3354-0x00000000025D0000-0x0000000002BD2000-memory.dmp

Download

memory/6084-77-0x000002771EBA0000-0x000002771EBA9000-memory.dmp

Download