hxxp://159[.]195[.]43[.]121[:]1529/WINRE_BACKUP_PARTITION_MARKER[.]exe

Analysis

user interaction
yes
max time kernel
542s
max time network
541s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://159.195.43.121:1529/WINRE_BACKUP_PARTITION_MARKER.exe
Sample260509-weq99aev2j

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	3336	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
2976	WINRE_BACKUP_PARTITION_MARKER.exe
2920	WINRE_BACKUP_PARTITION_MARKER.exe
1600	WINRE_BACKUP_PARTITION_MARKER.exe
6084	WINRE_BACKUP_PARTITION_MARKER.exe

Loads dropped DLL 2 IoCs

pid	Process
4760	msedge.exe
5296	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
87	discord.com
88	discord.com
98	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
86	api.ipify.org
96	api.ipify.org
85	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 1600	2072	gt4e.exe	177

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_247574538\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1698736774\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1698736774\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_942784408\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_75459322\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_247574538\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1516302585\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1544991421\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\passwords.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-et.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1979930809\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1544991421\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1979930809\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\male_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-hr.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-bn.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-lt.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-pa.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-sq.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-ta.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-und-ethi.hyb	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4760_1924118542\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1516302585\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_444646136\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-hy.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1698736774\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_942784408\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1979930809\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-sl.hyb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_942784408\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1400755410\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_661517850\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-cs.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3336	msedge.exe
4524	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228226322182657"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{17180964-D51D-4415-8471-41F11FD978B6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{8BD1AC37-A142-4E04-BC24-878B9170EE61}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000008553306c7e91dc01a37ff4a78d91dc0145467a77dcdfdc0114000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2072	gt4e.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3136	msedge.exe
3136	msedge.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe
2072	gt4e.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3048	msedge.exe
1540	msedge.exe
2072	gt4e.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	gt4e.exe
Token: SeDebugPrivilege	2072	gt4e.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
3048	msedge.exe
3048	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	msedge.exe
1540	msedge.exe
2072	gt4e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4868	4760	msedge.exe	86
PID 4760 wrote to memory of 3336	4760	msedge.exe	87
PID 4760 wrote to memory of 1456	4760	msedge.exe	88
PID 4760 wrote to memory of 1456	4760	msedge.exe	88
PID 4760 wrote to memory of 1456	4760	msedge.exe	88
PID 4760 wrote to memory of 4204	4760	msedge.exe	89
PID 4760 wrote to memory of 4204	4760	msedge.exe	89
PID 4760 wrote to memory of 5308	4760	msedge.exe	91
PID 4760 wrote to memory of 5308	4760	msedge.exe	91
PID 4760 wrote to memory of 5308	4760	msedge.exe	91
PID 4760 wrote to memory of 6052	4760	msedge.exe	92
PID 4760 wrote to memory of 6052	4760	msedge.exe	92
PID 4760 wrote to memory of 6052	4760	msedge.exe	92
PID 4760 wrote to memory of 2044	4760	msedge.exe	94
PID 4760 wrote to memory of 2044	4760	msedge.exe	94
PID 4760 wrote to memory of 5708	4760	msedge.exe	95
PID 4760 wrote to memory of 5708	4760	msedge.exe	95
PID 4760 wrote to memory of 5124	4760	msedge.exe	96
PID 4760 wrote to memory of 5124	4760	msedge.exe	96
PID 4760 wrote to memory of 3228	4760	msedge.exe	97
PID 4760 wrote to memory of 3228	4760	msedge.exe	97
PID 4760 wrote to memory of 3228	4760	msedge.exe	97
PID 4760 wrote to memory of 8	4760	msedge.exe	100
PID 4760 wrote to memory of 5524	4760	msedge.exe	103
PID 2976 wrote to memory of 5624	2976	WINRE_BACKUP_PARTITION_MARKER.exe	124
PID 4760 wrote to memory of 5508	4760	msedge.exe	127
PID 4760 wrote to memory of 5460	4760	msedge.exe	128
PID 4760 wrote to memory of 516	4760	msedge.exe	129
PID 4760 wrote to memory of 3428	4760	msedge.exe	130
PID 4760 wrote to memory of 3428	4760	msedge.exe	130
PID 4760 wrote to memory of 5288	4760	msedge.exe	131
PID 4760 wrote to memory of 5288	4760	msedge.exe	131
PID 2920 wrote to memory of 516	2920	WINRE_BACKUP_PARTITION_MARKER.exe	135
PID 4760 wrote to memory of 5240	4760	msedge.exe	137
PID 4760 wrote to memory of 5240	4760	msedge.exe	137
PID 4760 wrote to memory of 5240	4760	msedge.exe	137
PID 4760 wrote to memory of 3608	4760	msedge.exe	138
PID 4760 wrote to memory of 3608	4760	msedge.exe	138
PID 4760 wrote to memory of 3608	4760	msedge.exe	138
PID 4760 wrote to memory of 4416	4760	msedge.exe	139
PID 4760 wrote to memory of 4416	4760	msedge.exe	139
PID 4760 wrote to memory of 4416	4760	msedge.exe	139
PID 4760 wrote to memory of 1392	4760	msedge.exe	140
PID 4760 wrote to memory of 1392	4760	msedge.exe	140
PID 4760 wrote to memory of 1392	4760	msedge.exe	140
PID 4760 wrote to memory of 2084	4760	msedge.exe	141
PID 4760 wrote to memory of 2084	4760	msedge.exe	141
PID 4760 wrote to memory of 5168	4760	msedge.exe	144
PID 4760 wrote to memory of 5168	4760	msedge.exe	144
PID 4760 wrote to memory of 5168	4760	msedge.exe	144
PID 4760 wrote to memory of 3600	4760	msedge.exe	145
PID 4760 wrote to memory of 3600	4760	msedge.exe	145
PID 4760 wrote to memory of 3600	4760	msedge.exe	145
PID 4760 wrote to memory of 4688	4760	msedge.exe	146
PID 4760 wrote to memory of 4688	4760	msedge.exe	146
PID 4760 wrote to memory of 4688	4760	msedge.exe	146
PID 4760 wrote to memory of 5376	4760	msedge.exe	147
PID 4760 wrote to memory of 5376	4760	msedge.exe	147
PID 4760 wrote to memory of 3048	4760	msedge.exe	150
PID 4760 wrote to memory of 4008	4760	msedge.exe	153
PID 4760 wrote to memory of 4008	4760	msedge.exe	153
PID 4760 wrote to memory of 4008	4760	msedge.exe	153
PID 4760 wrote to memory of 5288	4760	msedge.exe	154
PID 4760 wrote to memory of 5288	4760	msedge.exe	154

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://159.195.43.121:1529/WINRE_BACKUP_PARTITION_MARKER.exe
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffabed3c188,0x7ffabed3c194,0x7ffabed3c1a0
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7850074237137282130,1311855449388539883,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14322597677825911790,9797449198536309772,262144 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,13454611272132427768,1104512590588229283,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,13405357669939489827,17387529846106808349,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7989748674916682038,11723760483555686521,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,11229363560456148686,7424508396042037008,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,13203594685270082051,6358576889179139013,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,8156610884453261285,5997494887403367925,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5528,i,17079311745509732775,13313234070604714494,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9800140546772953344,13956364166507120377,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9800140546772953344,13956364166507120377,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14310193932529106427,1949805864692035317,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,16548345559840699191,10802173445452414471,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,14330835376580460952,8391579665992415546,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,12298306187654747182,891438069978644674,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,12128011346795055149,9315905536862394548,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6087346300524069502,10650072726475664729,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5260,i,3695025707305181496,8655472558607219050,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6608,i,13069075615860889722,3689731542203217582,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3548,i,241036947730968078,18242998005532401529,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4960,i,8193355553689440278,5237743772712630933,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16685420415488510924,13577081088861654261,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6784,i,7174774841677355533,9143841862726630385,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5676,i,6240934383075806445,4901991668337133800,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=2936,i,9030346924548996564,3668333508823895987,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9649825434564043793,8482737673752821670,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,7968239865288967922,4951475345062965603,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7448,i,11044103672715771458,5418851168127280522,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7288,i,2591341909106654632,4957043661724278896,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7200,i,16398833648282883665,11187194763908954335,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5672,i,5087588553800273354,4181911466494118017,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8160,i,15714331875932044931,7091634292828781986,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,16085635780077555067,10357270747735522299,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7268,i,15055407495249956523,604930651008631364,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8012,i,4763952289182767042,9511720909731445844,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7464,i,6266658846751797272,7208644164739017762,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5624,i,8527640409902875310,18339984366526629920,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6356,i,5711502793917345556,10538702453669047774,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5152,i,2455806331377728077,18249708805908530762,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5624,i,1496427667449215801,7713835213675688275,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7320,i,17047869981631942492,5122635494097764802,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7276,i,4562002876167909130,2674280395686043852,2097152 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,13612203763049880206,2737120514479853920,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,1654389636537014124,596823794035371654,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7952,i,4462616628955601298,8295990689265010501,262144 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,16099923526449783819,685743043226440161,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3304,i,15200658494391289126,5717367053706290574,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=1612 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,1862692549441866514,8948608693166080636,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,10782325058686837556,9992370045477129766,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,10572100504251220681,1850740313573253792,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7672,i,4024338425019359367,8009935645460639163,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,3603871111648970546,2469884620573312617,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8622009964493029753,8984499229716124814,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,1407237027644708177,12217832909332997185,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,16135400697889367186,14028356697964502167,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,11924487394760227320,10222602234558933476,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8020,i,7057859969429768629,12205007432031070590,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,11661287431045817996,16706517865313513182,524288 --field-trial-handle=2192,i,6682790440434487271,15843613854414543708,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffabed3c188,0x7ffabed3c194,0x7ffabed3c1a0
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,4453536475449537895,8009979026879051302,524288 --field-trial-handle=2288,i,2050252902125503631,4846516936387922160,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,5224353024333682235,10512780259305967353,262144 --field-trial-handle=2288,i,2050252902125503631,4846516936387922160,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,2877917308013929211,3133857593515458064,524288 --field-trial-handle=2288,i,2050252902125503631,4846516936387922160,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,8496225472491975152,16186014474482148438,524288 --field-trial-handle=2288,i,2050252902125503631,4846516936387922160,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,8496225472491975152,16186014474482148438,524288 --field-trial-handle=2288,i,2050252902125503631,4846516936387922160,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
    3⤵
    PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4324

C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe
"C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5624

C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe
"C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:516

C:\Users\Admin\Downloads\x64\gt4e.exe
"C:\Users\Admin\Downloads\x64\gt4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe
"C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe"
1⤵
- Executes dropped EXE
PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2268

C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe
"C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe"
1⤵
- Executes dropped EXE
PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1366135636\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1516302585\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1544991421\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1653189068\manifest.json
Size 52B
SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
MD5 50ba36034cb8b97ce52eb941d76e9103
SHA1 a8757a3700f2af777ce5efc382010d2619f51491
SHA512 001110c3e45514a09cf6f60ca14855524e83ac15cf56776cf3005e016464dc6584b107c63842328a7c1738cc7f2154d8689f84d913b9b8199367699c3f9085aa
TLSH
T1FC900260082491171AC10E506570F8859391661A95851D1D0445154802A646CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1698736774\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1698736774\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_1979930809\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_247574538\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_40346582\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_444646136\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_661517850\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_75459322\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_75459322\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4760_942784408\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 876a6a1e54379d576a0f2bf5ad8be9d35dcf2f3464c029a679b3f9d0cd20ff7e
MD5 59ddc37ca2fffdaceb0810afc631a68b
SHA1 ece502b96c708721dc805def55e8dd7421a8d4ce
SHA512 61a0a89afce0b8e1ed186432c476b37dcc2009a1eb12f6e381abeb9accfe192c5eefffbb3db76acb2ae10b8d72fa838077ae539835fe2a978a858089550e1494
TLSH
T197D0A724778AF856D5C66472C5D5178123B968C330A2D611B86CA4DE5C6349895CF082
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 beffe5d2774a5ebf15b86e837ed6f5f216bdf32233515a5bae933009f21c5392
MD5 39065951f3c6e72083a6f4a473d3c99d
SHA1 0a445362f6fb33aa329f5a9f10ad0195022a069f
SHA512 feddd3803f09e1a5eb938ea231fb888d7512ed0927ce1eeacd6405054945f02233297eb7c5c602e9221a52ee9cbd16b74272ce7e4a06e58eba2454677a8b4713
TLSH
T144D09734760EB506C04220328690028122B9180230A2AE11AD18D4CE4C2342881CE082
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6375c95c3ab64a90a702cb499acb04712f794bb3c60a29e20ca397aadf5c203e
MD5 d2f2d0fbd7d8031629923d44dc7214f0
SHA1 dd72ece160fc8c4c267d0f95e0b60f4f9ac654c8
SHA512 464d3bb72eb35bdc18f416acf4a44859e37d3e802934939123a67f753c77d5beafaf5486ed6069facabe84e85cd3000659c91af9446c125dfea847a884c406bc
TLSH
T171D09730760AB606C042203286D0028122B9180230A2AE11AD18D4CE6C2343881CE082
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b1dcd617e91b6f4602ba5dc25b51bbe1474b02585b17205476b51570e2de5e15
MD5 efbfddff57d999c4f96eaf835ff64a7c
SHA1 2daeef80efaa41241cb8ffbf67d435bc315640b4
SHA512 c4f25739810e31c481d6ff2b3c25f78a350322e500d5971e691e2d2c77cba37461b7a675574fab68ff5268fae6d57da8eec7594593b717a7b9e74a0cc2fa429b
TLSH
T1C4E0D85904CAC32D931064CB52746B0DC2C17B0F96C4EF8E3B08C4883142841B6DA561
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2c2482d2d9e303a78f04a01ad8b67013f9ecbb0962701538071ad282185cff37
MD5 9204956b7b2f5e823cc7f689243bd4c7
SHA1 bb99d599c88c0f578a54714f086da16ef60afe5a
SHA512 9b46889eec7e248e514094e6424776c80bf7cf43fb1853e5a3f22a0a8540e5d28d12ca3713a883e40e0731c785f76433d094d73cad4248f35d0a530a055f54cc
TLSH
T182E02BBAC831DC270CFD071960644649E74513472681590F3A3C81088FB8A3B828585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 50KB
SHA256 41bf4332484156746dd9bea82fdd907d70a605934458383be3d5aabb0721ba47
MD5 655df4724b0e84cac305dce980820c89
SHA1 54f579d2973361d3cbcd54c831f6e67922c40326
SHA512 cc59087e0bf212875bbb14f2185d47bca0b1ae8feb7d356be03dc1ae1891ebca6cd8563205d46f848e100daf19c775f6876897c6f32ea4d2f784397284470ee0
SSDEEP 768:0qjCFhHLFOkGSHMI9MppzhDHoye9icTMO41TChf0kfmK9enBkh0N90xwUv7qX:/jYhrUozCD+0cDaGV0lK9SX0xwUveX
TLSH
T1F233024C3E7C47E9B462D812DD638D71A90BCAE0E344F18442EE63CFF5A1A5215AE835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 41KB
SHA256 33aa5e8bffcf51b8d945bb10f76f7c98059360470e1fde400b9bc57e8db0db86
MD5 893fffe3a6effa452759c2df38328bbd
SHA1 0989434607fe3bdf49be139bc825006e3cf3e248
SHA512 7d588c8bb025295fe1aa02bf73857a4fb7db72ae3e30d9c30faf27869308cdb155ad00df79a0fcdf2899d6df382131d27d2df341a347b49566041845b6e6f3c7
SSDEEP 768:aS1GIh+o3q6EIwDYsUe/O9A4A2JceXx3aCBm/VhZ1zxVAUYlVJ:aq9/EIwDBUe/yAb2xFo/V1dqVJ
TLSH
T17913F251F946A45F085E783B6EE49EB74510CD7E4B58C3B8AD590F92DB10BC36009BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 76KB
SHA256 c000867486fdb8987e65808652a1286d663557426b30c84ce247e275e3c94284
MD5 89d40ce260242f9b55552e4b26166c62
SHA1 ce647180fe09a410b3e7f0017501cd8256b8f9b9
SHA512 5a291cf101743328be77cadbf350aa0fff68776434ebed0b3b396302c5cf5d7375c637d4c15ce5db95f18cfbf0bbe53b97a6d9d46e9892a499577820f86bbd83
SSDEEP 1536:NP2s592bW7IJubXC3TbkksnFR4sm7mHWJhIE6KB0THJx7W1fVge3:N9592YIJuLyTUnv6mHaI1K6jSn3
TLSH
T1C67312A319A54F689465841D33EFCA51302412EE6CDCFE83D0B6EBF399B54CD110AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 6901463cc1cf785243c2a0c482ac67c0c8fea3d695ddd595bbcca7c47fc530ec
MD5 681f006d81baf6ab1e22d1d2c01a7520
SHA1 17781538bbcbd1b06103ed0d12e7db97f826b5f8
SHA512 49a245d38daabb190b9fc9683ef4781bf2d2f7b3aa4ca065186c51641fe2e5133ffc896e2fbee9ce4593c18167a33de7eea62f7433b3c048d7e53ba6b680bd40
SSDEEP 96:muwSN9HB9olyEDdUlaisxc4is1jsiwtXYFI4Y4HLo:mzSN5Ba0E5UAcyR2XYFzdLo
TLSH
T189E15C6355A65EA6EBDF5870A1F61BCBBA30D39B02335F1AB2F480FC521239525C9038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 19ae755bbb334ef4bb60351e6a84d55a90381068da87f93eaa406eca9dd58b72
MD5 34e712dd0e85269df79c7f8d2348582b
SHA1 25b8950e7e28af9137c4ebd280a04f6e08e68368
SHA512 d7b273b735904773b75b53c1041dd3ff51970331864ce43d3ba506f13411d6c73b7eddd3da19037154ea9a55383702bfdf0b27c76c32b7aa60697c75de9b29e5
SSDEEP 96:1Hu4SN9vB9olyEDsUlaisxc4is1jsiwnXyFI4Y4HL7:ZXSN9Ba0E4UAcyRUXyFzdL7
TLSH
T1ADE17E6354A65EA6EBDF4871A1F61BCBBA30D39B06336F5AF2F080FC121238525C5038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a41cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a41cd.TMP
Size 3KB
SHA256 4f68c3ed051dd4e8b2bf95c908b6c7894417df5515f42cca75113aafbc32d47f
MD5 f9ef8a6db4bb17e08abb701de0966cb2
SHA1 59eb10d6cb85f33a8852fc0769ca67e91182b312
SHA512 f33763801767c6a535223ae4cef0e01b7a7100ad363115b37b0233409914baf64701f5f91880d42d72b005a86fd76fa308e7fd5cfb9c9373f60826f18a1d1430
TLSH
T188611947819A8F94E7EC88B596F603E772B0E36B430B0F5AF2FA44FD4B147018849938
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG.old
Size 350B
SHA256 afcfe47a726fbf1750ae39ac12551231027063f8f448903316f0b131ce064fc6
MD5 8e5849416f37268128dc22ab15eb88d1
SHA1 dc8f8e9fc76d1dbbb8a5b3b6a95d2d2262d29c12
SHA512 04b9563edc048a4f7ed69604404e00900f7a2c2d63e237c1ef80dbcb8a9ddd3eb0de188176a05e0e33c5dfbbd58c0da2789fd34d9834b6d7732bec1a7c2abd2a
TLSH
T109E0D86458CEC26E624164D753385F08D1E1365BD68CFF4A3B0CC884760604973AB654
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 10db43ebad106605a573f3cb5db03716223d9d1db41bb69be168c3a3abbfce74
MD5 718c6533acbd7e0fcf09ce5b1742b60e
SHA1 c3ba7b68b236d483b2a9855c5bcfad03c5f9fe8b
SHA512 d66dabea601f38e2ebadff479a2ea69f857977329c78a038074f1995d4b02f51f074d58ecc48c1d5fc4890bcaf674dee2d6b89058e90001a0b44e14795e57e82
SSDEEP 192:DqvWQb84En1j6Xi4jaIKKRYxjPG7XfR5OGn/jTfGzx9Sf7W9XKVtN:DqvWQb84En1GXi4jaIKKRYxjPG7XfR5D
TLSH
T168129CF3C3E4862DC91166F5AF187E1BCE590924536C3D5B84E4EF5BA3E24B1E24064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 724343cfdae62468ad83d8d6220da4da8fdf17f15b3a0e6ff933a11b5c5c5a36
MD5 975555b161ec79c2303dbf022d97d01b
SHA1 878575a5a16279af16751543e1d1cc6da2a4bef6
SHA512 3814759b61225601ea464e1c11f840822fcca2e8b3df9efe7ea598069d1ed22c51fdeafa733d806d9a9214299ba608506d9725a0b14a3312a129b63837169302
SSDEEP 384:DqvWQb844qhq1A+C1ee7MgQM5pgdw1n1GXi4jaIqRY3BcGjOztpW6VesEKe77+7M:FILW
TLSH
T1CF82AEF383E8C66DC92266F1AB147E1BCE5D0524536C3D6A88E5FF4B63E2071E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 756cefe86157c4822dae04a22aa67a4e7854df7f7b31b9f0786d90305d65fd40
MD5 0be5d7ed881bdda3d269631a74a46f88
SHA1 047dccceb4bbbdb03251c1b686a84f1f8a181bc1
SHA512 58762bb9fc9964533aae020944bbeffd84ac232f868bfd4155c9002b5b866e2212e98facd7940b14cf07cfcb1581a923c69819f315fe11f5dc5f4e2a7ef42c36
SSDEEP 384:DWLA/r6xqhpUH+ms9tnLKo/n36pjdBJa36jazqmmxRGjOztp99VpsXYg3+7g75Tx:wdrhO
TLSH
T19C62BBF743F4C66DC92166F19B147E1BCE590524536C39BA89E0FE4BA3E2072E141B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a6fddba6df366d61379f37f845ec142b5035ad054a6acdb2f2e69eadd27b8615
MD5 db4cfe0e0442a1b95a51719acaecd21b
SHA1 a6650fc081c7f2cfd49b6922ae9fe846664c8242
SHA512 f0dbd4dd93fedd74fce70a358d8f5ccae7b3ad89e6ca2d91ed4f941269966933ad6448bdfb05431f83ca3f074df0548d02777d5990bdcbfeb49aa64d4a4c2d03
TLSH
T13431CCF3C3E8957D8A0195F0AA187F2BCE690955931C3C5BC4E4AE0BA3E28B5E14185B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 c1e1e5230ed1daa9c6e82ae5c48f812fa26d7f15f1a4ed506aa5e457daed85f0
MD5 bf55f5813a2f2ad92ac404f6bea51033
SHA1 4e4b95bda56b2ab8e77c63be9764613753300ce0
SHA512 81dafc76a075bcd93d5acdff79570a89e968c4133bfebe950e5d08d7ab41ab9daaa931d97c65a5fb65681cbe2b32c7cad1cf103e941c4a81f8e1bb3d315180b9
SSDEEP 384:sxZR9Ln/fCsvxmjNyD2A/TEALieH1HbUtaAy/F0gAVvDhR0:s5xn/fBxC4D2A/TEALPHb8IFGVo
TLSH
T116A2D757A434897F8EE6D129F541B76BD6F4002795C04EA5AAFCCE0C04EAEED7102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 37KB
SHA256 d8090460f8bf7c74410867f8bd7c5e91adb236ae3254dc7f23b9674ce39239c7
MD5 a1d2b236fceaeb90ec0a6e3c30f072d2
SHA1 33839398731dd0b54600648f047303aefe373a2b
SHA512 449f0d21ab84dcf1b0503e405665b2256afa65245881c42fc4412906f9d058091a2ab3fc2a4647bbacc7ac876c2d0288fbd836bff4b540d68ec2ae6b63e174fe
SSDEEP 768:s5MAn/feYFa4Mnc7WeT+It4D2A/TEALxHbGMhe1:4MAeYFLMmW62D2A/TEALNG8i
TLSH
T18603D746A420C86B8BD35D29B43DBE37D6AC00565684CEEA5AECCE1C01DD9FDAB03857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 41394a678f75e95ea201ced6920078d754e014d0f67e06824d439c82ee231080
MD5 f8cf08a70722939157e7a8947e049140
SHA1 016b189e96b32ec95651b384fcd490d0fa9c65c0
SHA512 75463f3fa4acb8956689c87cf26350b8708622d01b18a1c9e758b0b0e2c97482e633927e413be15feb0d24b456cd90d4af00f20cc4298766a4b174c1c2f4d04c
SSDEEP 384:sxZR9qnn/fCsvxmMNyD2A/TEALieH3HbUtaAy/6FHRgAVphR0:s5Mnn/fBxv4D2A/TEAL5Hb8I6Fpro
TLSH
T1EAA2D757A5348A7B8EE7D129F541F76BD6F4002795804EA5AAFCCE0C04EAEED7102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 4531bef27a4d8e1df7fd9315e9dbda27821d1ff09f0707ba339f76b4ed6c0b15
MD5 40cfb20473fdbd7c699b5f3061ccedfd
SHA1 8e9c86e9d8009d702d3838438113068264caeedc
SHA512 0a5c7380e2e29e72ae77edc825a8b7096c8b0259f9b15db3252a4568439ba37f4cfd85c469f1e6b4e3cb6ace83da21026590e23c0bf7a042bcf46ea9f9cc7347
SSDEEP 384:sxZR9An/fCsvxmRNye28mLeizVHbkHp/eYg+9hR0:s5Sn/fBxA4e25LeAHbYeoo
TLSH
T17892F9176934997B8DD7D219F945BB63D7F80427D1808E94AAFCCE0C05E6BED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3c75379b546112c9fbe55944a03f220250accce41f09bb93040b20ddaba45a0d
MD5 5d400ed274fc190125fc63e564b67a9b
SHA1 b30414baf54864c7868b782de4c6f908d9eace57
SHA512 3ea2f1934809f938868e26a87b6cadff9cc0e2125df90087653a60175382083e6df9ca6341bdb39798b8e9f062c6367f1217c047b9a88d0fc53a2512f618721d
SSDEEP 192:sxZrR8yMqZ/K1Ml8M9n/fCsS0twlIzodpLHW6+WNGYxisTetu2IgjXJ:sxZrz1n/fCsS0ml7LHbGRhj5
TLSH
T16962E8166A38993BCCD7D209FA457F93C7F9152391904E58AAFCCB0C05E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 95ec57c144c363959f8440f81a7d27e9d33b7cb06e002cc6ae92f816b97d966b
MD5 71d778dbe92a3dc739e39618cb70a440
SHA1 e03729e9ff423c03e952693e55c7be1d450eb51f
SHA512 4452ae53ae1a16f483a61597fd318afa4e52e671b2ebc6439416cd3fc3fabd625f9ba8159a09e13bb0fa2130263c7dd9fcafffb4ee2dc063e392b97567468cb9
SSDEEP 768:Jdc+tx27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDDFkLlMeNtFroy:Jdc+txWE/VRWvV/qHu1ja+DFkLO6t+oX
TLSH
T1CDF20C3B2C0CCB7E4F840E9CEC2A7E5E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 7584c7b9c95a91c71304f23d1604742a5b1a8b72210720e7b6884cae11ec5242
MD5 5829ea92cbc256b33af14319ed8da119
SHA1 c4b274f5cd472b3e990673bf5ba3ed71d1cc5716
SHA512 2c12d04349f43cd4684d90a75741ecc227aa2db7c1c57c501c9c26a78a1004d0b2fea9ee576f9b94a7028202a63cf126de31355ad6b9a0d6e84f4e5a235b6a88
TLSH
T19851A3CD9D4A6B6BF9AC12B205B31490337409CD6B8446035CAC627ABE5372E1D5B6C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index
Size 2KB
SHA256 c5dff2e4156f055e90a6ba3479fd8ed57a4868b0976429ea2a61072fd6b75155
MD5 9dd1cacefb0585b3bc03e4bd3c5fef6e
SHA1 79f89152bc41bb3af50ddee9c141deefd58015d9
SHA512 e7228b212ff5a33869bc9702d1797ba41b08b8808a5e91c7e5764db21d5585098a70b446a2daa1b8057c4bbc8a2a72f8dd6b9f3cd76f058f57e490e0ea3465f1
TLSH
T16451A59C9C8D8E13DE7D02B159FA1428333848EE5A9857072CFC6639EC872951D97218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e1b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9ee838dd-a441-435f-b78f-4a16a5581428\index-dir\the-real-index~RFe58e1b0.TMP
Size 2KB
SHA256 64b133b247f4f1e6422effde0c76658c04e6f15c0570bed086d337e3fa49a7a3
MD5 f555b3197327bb3aa40874c8555cacc4
SHA1 3fae01af9febe4b3c7909a4e7289ce290d77f54f
SHA512 36619cad47aa6876984bc3ac5c5f7210fd6b5f080e378326276ea7eac2246af541bd211e37535a741a0ec669fb09985a15cfb03a656905b0dfe8ef51d0006057
TLSH
T1C851B65E9C424A21CD6085B359CA2468333E68954945AF0B34FC8A33ECC36AD3D56394
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a2b900d3-6a19-4f41-9264-f09beb3c04aa\index-dir\the-real-index
Size 72B
SHA256 f13cd58dd7dc7af00281fd0aefadc7359d4a23ba01cc033bde22face8567100e
MD5 83aae25f1c07692c7b36cc9e7d8a0940
SHA1 2d6d41922cb376437000a04dc98acc437ba04d89
SHA512 100085d4848536a7c546252d7cc06fdb3dafeb17ed6a2f1f7f1e39a163703e7d22080d89d1e711108d322ac8e3640970cd50cd990178477af203f75245c3034a
TLSH
T126A0026339944DDEC02503F3204B156C2731CB515105CA47459D459D8C712855789844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59932e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a2b900d3-6a19-4f41-9264-f09beb3c04aa\index-dir\the-real-index~RFe59932e.TMP
Size 48B
SHA256 5a7f9571eb8d65933a4c7863243524fe15a44df655320ff518a2208b46e8b58f
MD5 2e4e77a7f31749c5a92da95d8870fe7a
SHA1 dd7d3e69950c05c510306820a9935d98170118f4
SHA512 35bd70c0114a654da75834d20be010acd42baf6e098116ef213b7d844675f2f13e16a6269ad9d055f51854d01f6a2099afdca2a4dbe8443d6101563c208022fe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c5c3c74d-341c-48de-ac10-3ec789c3eec5\index-dir\the-real-index
Size 72B
SHA256 54531067976400ec459f4bdb8c303ec17c1f71b300c4030821bd79bf4a396104
MD5 60838d6acd18857c27554ebf84a09914
SHA1 5807294744cc4ef1861b1f14edd3cdeccf5938e2
SHA512 ab23818fd8ee110bea71301c26e840d1ffbc45ee1dcdb4a8d4746107281ad11e9ff06525d4a312dc06f5699eb82776484c6f4a4b330a63fc2d57a762e3909ecf
TLSH
T132A0027435988149C18616B5D94305513328DC9D4145830742A88A998C511AC4DC206B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 a9fc8ea9c2625ae07e9b66d72c285307d64f5e0f109c2fb93c9c816cb0dbfa73
MD5 b70a0d0852fa4a59b1130db8363947cb
SHA1 0ad54cc35a5233a6272562a2bdd6b3ac08851a2b
SHA512 106236908db4e3a664871c2fe7621070d265d5f3108ed55b63df5d517ef9349898cb1ea46361d7246d144b5a8215ae717ba509977675d979863fb27859b99d65
TLSH
T1A5F027723EF31824BDDE83D6647240A44924BC45CD50AC8E1426B6A7A876225148ECB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 a196b42b471468ea83ffbe90bb0d52b10708273ba4b4dcddff2d4b66a67a87b8
MD5 7ba1db6357ade273314e6bfe4f4aaf0f
SHA1 8f189a1c679b69b51c1c3ade42c0674d1c3e4cf6
SHA512 5e8ee4487d364f71fcaf691114a894e799cc0f8f2c349000c14f83c960eb38cb16045de3ff5b6cc5fb0a29844a0decd31a7301e3765e88a41a792e76c03a9dd6
TLSH
T165F05C733EF31824FCDFC3D5247144B449297845CD60EC8F143666A76876224148ECB7
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 168KB
SHA256 6ad329f7805409495b3ddea8bfed8c549291a54bdf82bba548737f7c4c653037
MD5 17a723024519967b0c61c08a58142732
SHA1 3a34348a1a0a4e336a51a090f2f6f70cf4166608
SHA512 7b069bb75374eca8979da7bfab2f7f19c8e37a81fef59184d66bc5454f866c730d009d87adfeead0fb43bf07591dcdd78b7fa4847b4dee4831bffe6e23bd2c26
SSDEEP 3072:xQe+sswSjnxPCA1jOTuDK5NvawiHvwRUt7m1KULC1XsD:xcsswT5MwCvwRUbTOD
TLSH
T1DAF38346D1F8D863AF7B0053E8967E82F32C3147E619DAA0F587BFE1501E62A70B5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 eb6b2853c42cd9d844412c6c9405b0c3debe101abcc7b0c22cfcbe9d84770057
MD5 2c9067cfcc14430331f86e1e2cfbdd85
SHA1 7e04d059803604127a26c46f5d0f224f5a630b5a
SHA512 7776052f238dfc132fd6180edf25ac5386aa347086e44a9672641f5254fdeb5522ea3c6b94cebbd616264e920d57675637b4c85bff699aeb10cfc0778924036e
TLSH
T122B01201C03C20C9C01607B45082089C211CC90407491090017448A4413D54100B9009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593723.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593723.TMP
Size 48B
SHA256 faffaf1da104690e38282e220261739b33df522e26232818b5ffbbb7615da4cf
MD5 887b4dbba0f11e260f4ac54cd871a9bb
SHA1 2e68965b1436fec692b2ae880f8b9e00f7b0df39
SHA512 13a2aba886aacf2d7abacca1c8a90a53f93ff76d568749c10ccd62f6946af6da54be57d353e103e46d205943ed55e1269f1a163328f25f7219ff30c8f203749f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6cd4d97b7e16c23496d951e166332646ec2570dd3866c37a6fc1146bb4424656
MD5 161e2c2d8fe1ed19ec4d89c0d1daa4d0
SHA1 3b8baff999f03a8bfc25697d9aba3c9ae1d51ace
SHA512 9cb77e91009a67ad297823c021c966f53865385adfcc6a4f42245bdd3f743394ecb0448d53ead8ace21ab2002c3365d3aa120dde9c37449ff9a3d8615e4ce507
SSDEEP 384:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xfkJ0:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BDc
TLSH
T19EB23C10323B42803A7E699A9595B86F66C270633058B93B7BFC00A54F6BE14DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

d1a0bac3-c3be-4804-b561-ac76b4f9f154.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1a0bac3-c3be-4804-b561-ac76b4f9f154.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
Size 145KB
SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
MD5 370210ebc9e63f6f39a4185846435533
SHA1 17b63f65390d236465b6952953a7df4cbc6fce1e
SHA512 e594ebf58d19f6d9e7024f98107c738142c6cc2504a0ba89e13f8f771c6a600427e75951ccbfe105983c21b735dcde6e6e173f4da37745c4de51bb9f5e86b989
SSDEEP 3072:7PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEI/tLZjUd6mG:LX1aI5aZoKzMJ07NI/leBG
TLSH
T105E3F1108EC41FACDFA8291C70BE0B1D63E1C79D84676585E773FE0AAFAB90462275C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ada60e05b0a43cf1fe1b44efc2a41359ec86bf18ff3fc11cfbe5845b53f863bc
MD5 161072a05e5ea3f69fcfe95a04a3dcb5
SHA1 c903832ace87bc76f5a9d51ad1652ad972e91836
SHA512 0abbb3ea57771cce0eed393be15f75cc6fdbd2844f5a9615c9e0c26a4c291b820d9de2ecaa487497865c9d4949c38476c46c8fecf8498554a1882c71d57e7f5c
SSDEEP 384:nhiFavqMg3sN38TUNTUlIm29JCrvRvfEPOUfolO5dnS4mtmPAcrNlk+5vI+B:IFayv3gwgAqPXfp5dS4smPAUt
TLSH
T16FC25C75EC98CABBEDE78FC9A7097A03EEF001A7D5884AC4C6D81D0E10D759D1347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7eef38c62006eeb2d0e9969bdbf3acb52bdc9a217970db30c13e26a122ac0a2c
MD5 855284d2cdc27d9c2d104b0d919bfe93
SHA1 7cbc23e0aa49092d3fefc731be5aeed5f12f4d63
SHA512 d4bc4d2e2d628c6de12695a1139fd22c089d600f78456d2ca39579c7757c1b41a68d4565ca23442215b67c35ce2298163a1f5dfee60eb4fc3cf17cb15c3f19e3
SSDEEP 384:nqiFD5q3KI3XosNp8TUNTUlI4ka19J9l2RvfEPOUfolSuol5trMOiPyn67KgrNl7:hFd2KIoqwgNaRHPXfbjvMOijxF5T
TLSH
T1B0C25B76E854C9BBAEEB8ED9E70A3A43DFF00197858C49E8D9D81E0D00C759D1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4f8ec18e770622034dade3b04f6784d5702bebeabc6ebab67e0a305344fe73d3
MD5 2cd058a5f4ebf056b5e40b1b9c85dfe3
SHA1 6a38408b0829d863eeed7b043934e7b673e8e088
SHA512 e553bf78585d4bcc60b46f5ef14ff3b71de2bd9a49c9b648c92f728d1fe86f5a07a93fee5d12a726e0dfec323715dffd1e29c1b3c41dcb248f2b8fa4f8bc5237
SSDEEP 384:nXiFX5q3KI3XosNp8TUNTUlI4ka1TiJQB32RvfEPOUfolSuol5tdMOiPyn67KgrT:SFJ2KIoqwgNaD3HPXfbjRMOijxF5T
TLSH
T1B7C25A76E854C9BBAEEB8ED9E70A3A43DFF00197858C49E8D9D85E0D00C759D1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 daa795c83d665c3216aa04ebbfce4368fd67b7f3caf15abf4e85503621c5a30b
MD5 74620b02e9a94ac6dbb0937ba7cbb520
SHA1 0b0414340d3eab7b99a93ec1301fdf1783df64b8
SHA512 22b826de28cde4f55af8300514f6b039f742af5e62e4e48b6740cf15b778d0a87f679a849503397c53f794451333eea7303baffd025c66592c18a939310eda21
SSDEEP 384:nDiFX5q3KI3XQsNp8TUNTUlI4ka1TiJAy5U32RvfEPOUfolSuol5tYMOiPyn67Ks:uFJ2KIQqwgNaUS3HPXfbj0MOijxF5T
TLSH
T10EE2C4F698D78977E9AE4B87A73D2E029ABCC15774884894F7D80D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 64047fd8fac2af228483407bda50cb857ea301b5f0e9686becb4fac1f1b2cb3b
MD5 63a94af5b00424a1d99bb0ebee07ccc1
SHA1 6f0c77c11c07a66bf00c70e6ac8d6f0aeaea7abc
SHA512 64ff0bd597f14eda5f288b812b6b3928b516fbeabeb6926bad1d32e54f4de781de99a09d064a48d9a45be6389f515bb4d4209d1e2d5d8f600179edd44e4e6d77
SSDEEP 384:nDiFq5q3KI3XKsNLe8TUNTUlI4ka1TiJfy5pqRwfiEPOUfolSuol5tYMOiPyn67R:uFe2KIKgewgNaDbXPXfbj0MOijxF5T
TLSH
T181E2D5F698D78977E9AE4B87A73D2E029ABCC15774884894F7D81D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 384e22b2fcbea8b54760e5fe29ce645349f4aab13632117e0341ece1f862c4e2
MD5 d9e7772f5d8ff22d19ace855394c467f
SHA1 d4577fecf86f048e74405d531bd4a4ce47a2c5ba
SHA512 82ca27a5b120fe033ecd15d116e14432cffb384b696f1ecaba86482faa8a1284964af5b7059b217f679ac3776d3985878eb37982351ec0c9c06e6d2d11ff9f30
SSDEEP 384:nqiFg5q3KI3XosNp8TUNTUlI4ga19J9l2RvfEPOUfolSuol5trMOiPyn67KgrNl7:hFw2KIoqwg5aRHPXfbjvMOijxF5T
TLSH
T1BDC25A76E854C9BBAEEB8ED9E70A3A43DFF001A7858C49E8D9D81E0D00C759D1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 12a858cd3def641fc42098dff0a3c5170f77e0d0dbc49da0d9e3aa07f3a9635e
MD5 b8a5b02b7f320348fee6bd50425a66a0
SHA1 9a8995acec0bea8d256c39eb7fb13de864f24238
SHA512 29dca55bc1bfbf6a02c510155e8b5b4b6cf5c4b5ebfb74313e86c4777b31dc6d23bbd151a383cb8da6484ab7598fc00c20f32e353d31cd18c0ae211a36549229
SSDEEP 384:nDiFj5q3KI3X6sNLe8TUNTUlI4ka1TiJOy5pq3FfAyrOUfolSuol5t0MOiPyn67R:uF92KI6gewgNaQ38rXfbjYMOijxF5T
TLSH
T1B7E2C4F698D78977E9AE4B9BA33D2E429ABCC15774884494F7D80D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 92d7a39adcc85ff57cec4338ea54dcefdf3eddf504c7b77eb3aa5eff70443cc0
MD5 10c8e63313a329219e8562253a172813
SHA1 2ec8172b78539ead7ded956feea6ccf89a66d6a6
SHA512 ed2a9ed0bb00b6c145f6ad36d7985fe3b690c37c757eedf5828e434d3db0fb6b0c054650a02ec2b07528a6e6c9418df322721bee26a782f5cbb4820c563cd47c
SSDEEP 384:nXiFD5q3KI3XosNp8TUNTUlI4ka19J9l2RvfEPOUfolSuol5trMOiPyn67KgrNl7:SFd2KIoqwgNaRHPXfbjvMOijxF5T
TLSH
T1F8C25A76E854C9BBAEEB8ED9E70A3A43DFF001A7858C49E8D9D81E0D00C759D1307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 66ebdf0fd1d5d357eb0997d8b095800a65a77e8ca976d0c104e22e5ce8d1af3f
MD5 07b8e7f4140e47b9fed66a76dbbae874
SHA1 60ccff46cf3eba526f4e86d36347517a4f58fd39
SHA512 f3a3a0e5d66c59ba9445bbc4eff8516085ec1005172dd89c08f836a95e5a852a7aa872c16cb1c006fe303a1eb7f571db80c289af30e453d7ff2bc85873671e02
SSDEEP 384:nDiF35q3KI3X0sNLe8TUNTUlI4ka1TiJVey5pqRwfiErOUfolSuol5tsMOiPyn61:uFp2KI0gewgNaub3XrXfbjIMOijxF5T
TLSH
T199E2D4F698D78977E9AE4B87A33D2E029ABCC05774884894F7D81D0DCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7c82ce0d7f3d1d2f7edbf306272175c019893453102b69b3448007d426dbe745
MD5 401711b0bf06d569f11620c698f2ef75
SHA1 36f3c5bacc42be52940043c7876c34300eb1079c
SHA512 076c339937f0681694213f90618499a2fff9966eb35c35a9999582a7cc5bc43e78b6c57b184d540f1407d9e7fd0e802ebac4d5b459d97bc58f4c1aedcd8f4d4f
SSDEEP 384:nJiFavqMg3sNV8TUNTUlIm29JLT3RvfEPOUfolSuol5t5MdnS4mtmPAcrNlk+5vd:gFayv36wgxSPXfbjdMdS4smPAUt
TLSH
T1E4C25B75E898C9ABEDE78FC9E7097A03EEF011A7958C49C4CAD82D0E00D759E134B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c69f457e6710f519ea1c453177cdeadae229a8c543804203170867d6ee09c1c3
MD5 be80e48f584cecae6c2b970bb5cf8b4d
SHA1 11442b85ecde8398052dc2ff9323383ac3d9a90a
SHA512 0b218967937ed9def35320edb2433142a7200bcd429eaf9c96f9727e8af67fe5ef16cf4bc51eb08ad5bdf42ada21f79869e47976307a7f88228f561114948f40
SSDEEP 768:uFf2KIfgewgNaPk/rXfbj4GMSFSXKqj6AOijxF5T:3Hg+aPKPSXKy6AOib5T
TLSH
T18A036CE194D78DB6D89D87CB972DAD0269BCC133B4884858B3E46D2DEC8B4BFD302416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 da3d3f1f003880964d87ce717b65db8822a2ca6116d6cd57e5ffcd416e5aed98
MD5 a30ebfc1215b29e3b91ae0cef14f96f8
SHA1 d969055e14e9340bf1bb68acea9c8bcb75f5a964
SHA512 e2a4a7fc56fbc02827018cb29abd643d61a793bbfa8ad2ee3ec7932f0791f69cf2592138c903017a0e9c3a69025a78b93f339196c23a15f54e4d5dd921042c18
SSDEEP 384:nDiFC5q3KI3X6sNLe8TUNTUlI4ka1TiJLy5Bq3FfAZrOUfolSuol5tiMOiPyn67R:uFW2KI6gewgNajj/rXfbjeMOijxF5T
TLSH
T181E2C4F698D78977E9AE4B9BA33D2E429ABCC15774884594F7C80D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d1e76efaf929f74976a2e168034805a7983fd9a89d81164c9fea0080ca5d2554
MD5 f5bf133fba955883145207ea2f02a3e0
SHA1 5994655fc623dd73e95b5dab8ecd7adb7b9757d5
SHA512 0b5bd88cc1b180fc9ac7a417157568a1e282710a115083f77282707350e804ce266ebb25e78af278e5f85762cd490f52825bd517df5cea9e11b09456874652ac
SSDEEP 384:nqiFavqMI3sNp8TUNTUlI4g+Y9JXl2RvfEPOUfolSuol5trM6HyPKJrNlk+5vI+P:hFayj3qwg5+KHPXfbjvM0Nr
TLSH
T1CAB24A76E868CAABEDEB8FD9F7097603EEF0119785884AD8DAD81D0D10C719D130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 da1852de50861f6a46a7cda5ed5acf8c0ddfc272fbd41971fb757f5bb421b96b
MD5 ec719141f861706da20c94f1d0074942
SHA1 8bc1905e49e0584c6113b07839a140b01337dedb
SHA512 b97395c6bf7057a08af92df516de408dbe20e93c2206fab7aaedcd77cecfb3dce493b2c1bf2e85c9d0ec34358f8c8fdd63856d6fce7ed207fd067f0ef155eff7
TLSH
T114E00951A25046BFC03C077101CB9F313AA2916A07E3432A0B25497C2D627902B30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 671355b479ee0157638e7f658bee289b46385e744868acdbbc38efa8d652c9ef
MD5 e19e50ce39abd06e913a7e3ed3c304f1
SHA1 9b29d8dc838bc30fa3dc11ac3ca8e01d9f1bd047
SHA512 1286deeba77c9369c86e2fefab2b992f19abc2a7b66f8e585173b4c4335cda0108c60a7fd5a071e89c6809b1f9207ec4c34c53bd307ae50e52e5a82659886bda
TLSH
T1A9E00496E35046BFC03C077501DB2F213EA291AA17E2426A0B24497C7E723503B31EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 222b829b462b925cfdabb82aa61a28dc1898f072fdfe773a10167e8f46722625
MD5 93df75d70a3d327d0058aed0283db8fb
SHA1 7d41c12c1dfd1cf877be8a2e79add49fe9788f8c
SHA512 ce60439d87093d77ec55fd71fe7df2106e67d229a46760e68091dd00cb91b4679435092dafe36725515e3f69204f58a365cf1a4d073b4abf7f3703be1be53bd6
TLSH
T164E00151A24041BBC02C037100CB9F213AE2806507F3431A0B25097C2C727502B30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 634ef886afe65a872587f00180652155429aff80dd8c10e7d45fb2476a1189db
MD5 f9c49ff1d1ca75c8fb2862ae34d7cbb0
SHA1 70ab98c8700a5fb2fba6cdd30267b81a59038483
SHA512 a3f3639d26d69da6804373346a02a681492743539864bddb7c5fe3642705efb24e57155bcdda2deb2e3368dcbb4514b1d8db589fdc41ae4fd963d60be2b1526a
TLSH
T17EE00455A25046BFC03C077101CB5E313AA2916A17E3422A0B24497C6D623502B31E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d32d334369e873284ef8e9c66774fcc9b953c6218875c8e434f7903799dd51b9
MD5 175fd29681940528b4bbaa62f0333285
SHA1 a86b0a424fe3675ca2e0a1e2dd9a6f2d2631ce10
SHA512 6c4ca0354cf71d9be4c27f318b662814e56c80e284a7289eaef9cd0722ff74c55fc97facf5cf3507a41d7d4c935b88f2bc7de302e2c2157f057071c46be0989b
TLSH
T1CDE00142D30001BFC03C033000CB1B202AA2816903F203550B200A283D263402B30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 23203d2e3917a90e7a4c5e83db1d03ff8dfe3de3605e93528e529c4b8e2745b7
MD5 8cf9346540260c73ed47268a4bc77ab6
SHA1 07a437f23e7e20cd210e866f25906ddf2a20009a
SHA512 65f9232138c47dab7d54eb95b856aef2d41662ee548c8ebf3da3afaf0b82f62e86f82388b55a277324f42c48844ca0f5ae844f3f09b5c9e1d7df04a0b5fc0243
TLSH
T1CDE04482E30002BFC03C033000CB2F203EA282AA03F202AA0B200A3C3E2A3002B30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593b69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593b69.TMP
Size 392B
SHA256 2a08a761882f6601406412e9605e5ec9929a4a21faf3bd959a36ffbef31307df
MD5 0b8db8de62bbdfbdc67b7dd371a4a313
SHA1 9fb9db67c6f4f05931daf25af36ddb159ef72b0a
SHA512 19474f4868169622b0fbd1ca6b9921e26c8c9383c566f21e7f270cb8716d4943a42b4ddb821c47e65080777a13885661ce3acb8fe79305e4eb3ef5cd2c7da11c
TLSH
T194E00250A10051BFC03C037100CB9E3139E1401107F343180725097C2C227401730FC0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 0cf55a28242d7f3bbe9f0a3d057b31b0cd2b2e6455658a84c3a64550242a48cb
MD5 def9ef8029be77a9484faf3853965b50
SHA1 63f948f3fcb7ce293eb632274f894ac9a8ce721b
SHA512 3c70e371d1ac8e6eaa916565094d5becf8ae5f648c679e1eae1658da92983ad0524925b1c6efba10f189fb7710c4f8f7467c81bff08e013d693ff6ddb30ab102
SSDEEP 3:MsEllllkEthXllkl2zEHKl/:/M/xT02zXt
TLSH
T1B84404447FD0141DC7055134D013D7500370F43505F15753345504135DD55400C40140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b3f3b59a78d4be59320576002e9ffc365e0640604b1744dcf429edafa5f8dc18
MD5 533499d4e11b2ac9930b0e4424dfa19b
SHA1 de567530b7b03f41bb8b452d628352c775efca5e
SHA512 bfbd1cb65c4df0b18ad70c797561c46409e87e88bf72269bcd0b7fc496aea64a185f2df03c1502baa8b8f1a23ae79a0779856eb0ee41721186ef7868540faeee
TLSH
T1A0310FE1593D1AD0C4FD0AAEB4A778FC85D8D62AF5B4307D6864D9980B3AA0E644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ef297772e2e336689049a653ac0a11c5f51b3e0cc5ed4a0df3d4d7878d4a6e6e
MD5 4ff937bc6433e7c4df38d2b6dc676e95
SHA1 32888f2e0b311a68d0af549d35f8502d2a287c8b
SHA512 c2ed87f74f6706aa05659c39a3681c9a5ddaa8697a086e392cdf8af8a44ed01346cb0d1bf926f4d0148f109625ba5a0739d4c4c225a77f4d293f394ed07d4df7
TLSH
T193411EE1597D1AD0C4FD0A6FB49778FC81D8D72AF5B4307D2864D9980B3960D644043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf0f136ab202a82eb61bf164ec905e5a5badb6eec842a10da1debfdcd122594c
MD5 ecc60b02b65f7df6206d2384393ee772
SHA1 e3903aa3c346b3145ab99c7279998ce8c1322427
SHA512 73e74c77101c921acac512e9be64c65d215f7ca39569a266c6aef7bb913c3b9219cbbde13f17006a968323be94237bee89201cbeb024f616a24ec52d8e84dd2c
TLSH
T1074142E1593D1ED0D4BD0AAFB49738FC95DCD72AF5A4307D2864E9980B3A60D254043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fa8fb6f9b421505d29c6631d8122cc71af37d500543454e3890017d6b58a9694
MD5 8c4cc47fda79d61de3aa730f27ee640a
SHA1 212289526d94dcea240dc159f30322b69a78c354
SHA512 953b3a573b86dece1fc969262311d2b63cb75a1878a188c434b474a67ab78f033f5a3cd36e3c8d9bb19b1ca62747802bf810dadd5aa845df97f330b3d7d43074
TLSH
T14D4120E1593D1AD0D4BD0AAFB89738FC95DCD729F5A4347D28A4E9A8073A60D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1f8308b3a5a820436ff36c5a7a52b42de08eba5abcafe548b1b329c4004501fe
MD5 01c0e9abcb13b12337e8dde63e29826b
SHA1 7ea362786579c8c257375150e5e33af8cc0b4798
SHA512 03d9623da6c83423f6e6a47b4136c65eb301be36d05aca31d29eca8959add77dc597ba4f0f5ef13ad57d6921e6d70b66ea1097f86bc77a6fde4f303aba11036e
TLSH
T142412EE1593D2AD0D0BD0AAFB49B78FC95DCC72AF5A4307D2864D998073A60E654043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2daffb9cf19107a014d8be9f37844d82e1a5e76b15d7ce579c465a00c7f0cb4b
MD5 f8ad1e4b02c69839b14c6b06a559d13a
SHA1 b347f0dc1d5197b7f822473a2dbbc22547cd5981
SHA512 cb3045ca4a32df255496c4421be318d8f9d647523e198e3aa3a6aa122c9bc5ed3c61e7f9260d91577034320227b98d1a509646ee53ecc49ef34d7a1d138aee42
TLSH
T1804120E1587C1AD0D4BD0ABF749B38FC95E8D729F1A4307D2894E9A8072960D658483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 beadce0745f7a3b51b62590b7022b71ed120838e0be51d2f40165175089b93bd
MD5 34787eedf450e32951b738a61e047599
SHA1 37c3a085e0f0ae4091c4e4e694af0d06cd3e18cb
SHA512 6a5e8cb109c0fba2392128c03e0fe186f4b4857a32cb466aba9c25a7055d26bf57526745f3c703cb7af0f4762c328ab3ba3fa2f6bc6967949985009df36c75b3
TLSH
T13E413DE05C3C1AD0D0BD0EAFB49B38FC81D8D725F1A4347D6854EA980A2D60E648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bed80471533b381c11d1280eaa8009eae71317620cddd44eb8ff64bd311f3f28
MD5 4c1d4c5f1d2c56c5a89c5ea1b78ee268
SHA1 051da927909c4b7d0ec7c9123b4ed0a77fe3faeb
SHA512 27e5ef9bc098eb917fcdfdb88271b86d512200bcd09250c0120ec67c97aafa504fa130f58270e363a3173764d8ac481e44660ed675d7325f88d69d0c76a107cc
TLSH
T15C412EE15C3C1AD0D0BD0AAFB49B38FC81D8D325F1A4747D2894E998072960D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 332bb5cd823833f0342c4a90061bff624fcc2678dbcb1cf57a9b05461c6ea960
MD5 746055c77e2f4bea18125a110356fedc
SHA1 cb046b505806f4f588e6af539edf867736e876c4
SHA512 81a67373f1a8a1042766a90e6fb13164ebe8a3c247f8d841f7d9a13c190b07284fb6df5a8f33af9dd0e0afdb5f154c605638d31d720829f8a9225cd9bc5340bf
TLSH
T114412DE05C385AD0D5BD0ABFB49B38FC82E8D725F5A0357D6C54EA980A2E60D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9197648cb8cdebae1c9da004510cac8c7e12a9c7042cd0676723dc2c7a444881
MD5 b77c14661226a8328936fde52351c53d
SHA1 a517c8c839ca31926f6c735c13a132249533378e
SHA512 2c2a9f99416700124c970ce3dd2d1c1dfc418496739c1ebd8891d9afcf2042a35ed0124641ff57f00202dc05d81cf0942a0327b7923fbddd33cbcdb583707066
TLSH
T15C512CE05C7C1AD0C5BD1ABEB48B38FC82E8C725F5A0357D6C54EA980A69A1D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ed9bcaf1010b80ddbef6f9a73d33ee75554df1cf8ec13d8b7a9fd1a2ae17c3d9
MD5 771050f47c3e330bbea86fbe1125b164
SHA1 c090876a6d6a91b76841250bc24cf3946d04e881
SHA512 203e308a8b035b3bb163bcf26f23722f5dd694a021ec96fd3a78fa538ed1fa8564ed2e6f9e8fcd0b4c9ef77f4fc884b60022b1ac97691e6d41f0f5c3b3b8097f
TLSH
T13B411EE1583C1AD0D4BD0EAFB49B38FC85E8D726F1A4717D6894E9A80B2960D658183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bc688b147ecf739d76531b1ff0853bbe184e20c92792b5bed0e7e67e65b284aa
MD5 1620b05247c09a0be58aa813bdfd8720
SHA1 31f57e3a1f897b22e153da0985eeab5b004773c1
SHA512 b4051c85b24f36e159c738df7bb3a24e2bbadb542514ec01a2dcec3c23d0db03ee35be826260025a2af8514c2c4d180da6cfb09326ad28af294954ed738f799f
TLSH
T120413CE05C785AD0C5BD0AAFB48B38FC82ECC735F5A0357D6C54EA980A7A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ed3680d26ed900f94fe4a9851c640e8f24e806b93853fc69baebe39dffa4203
MD5 a125bb771c4ef06e076fd67dfa898e2e
SHA1 cc68bddcfda5aca330787c12df316caacf7ebd00
SHA512 6d375d3c67725a24ecc491a0a176cb92e1b660412d485de033668ea9075d67f4c182d727d32bea38223caf2edf8e540bde90c7d0a4683c77e1fd6478527a791f
TLSH
T1AE41EF58B6FA1048B7B36E5A9BF3A86D447AB8772F0AD49D00110D4F0A37B44C862737
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 ed4efb4caa10b398ba32885063f59776974eac07f64be25d86dbb4d4d2c76b84
MD5 b5260004a4685405a01b290b9bff5470
SHA1 f23982bf9eb9858d47f06a8a2835c6bf747fcdd8
SHA512 0d2a64e8babcae1096a9263348ecc655e650cf07fa590849e1b6b34ad24a350b84ae8e3f3ec3212d024242e48a38a3783b4917c320dc793b63d0f0d8fb105a97
SSDEEP 96:xXTu05JiqeVw0qeOU/TPy05J32wXxtTPy05Jru0hsTPy05JnIu6:lbtanVn5WnBIX
TLSH
T12202FC51AFE52A56F3FB9A72A5B66320EF76F80559289E0D0140810D0C73F089E6EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINRE_BACKUP_PARTITION_MARKER.exe.crdownload

Path C:\Users\Admin\Downloads\WINRE_BACKUP_PARTITION_MARKER.exe.crdownload
Size 12.7MB
SHA256 1474dd480d92ef6a0ebbf0cb72482e4b0f5839bff6604f358a790a16e9fc67fe
MD5 5ea4d25c7bde7667360fa0a8a280a459
SHA1 e7d6f9f08c101051510702c1603981ba2ac89d36
SHA512 66dd2b941153b11ad1283fbb83637dbdf59c5d268e895acf7c0819f3349e79b14f7ebc200aefcc6dbec2259a77bbe4e7f17ec15161603ccf3807439f2d5fa96b
SSDEEP 196608:4rqKLaKPH3ZCYlWiuIiAypI5oGl6RCY0l:41LaKPH3ZCYlW4ZY0
TLSH
T152D6AF7264E640C6E796E53D2D12F84694ABB4825DF3F0C368DE9D87AFAC02807D7247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot_2026-04-20_19-04.zip

Path C:\Users\Admin\Downloads\snapshot_2026-04-20_19-04.zip
Size 30.1MB
SHA256 985561ea9fbd5e3cc557c9b5868ec608fcf450bfc88f0ac4a7279ded2a9ce7ec
MD5 08529cc2bd4634275b37927cb4c57dfb
SHA1 8d14fe92601625c431c3a8d3773e2f90da540603
SHA512 ac3966401367b6cb52c24381d8aad86066eb94d10b0e5553e54a7359c3a910a229e6917495fd4c2f147612a4e9838fa2970a9a58be5fb6918de3b2391fd6d027
SSDEEP 786432:Cb5NDtwhLERLDZiBOfL84jnafEJgNchh7oiJDm67fvvao1nYbp:CbbDiufZiBiDjn6h0C+DmEfvSo1Ybp
TLSH
T1C4673349C149D506CE5FBB725AF2E228C74DE67560FAF33E52B3340858E81F4B92B249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-210-0x00000225DE400000-0x00000225DE4CD000-memory.dmp

Download

memory/1600-1823-0x0000018F25480000-0x0000018F2554D000-memory.dmp

Download

memory/1600-1784-0x0000018F23B20000-0x0000018F23B21000-memory.dmp

Download

memory/2072-1780-0x0000021CB7FF0000-0x0000021CB7FFC000-memory.dmp

Download

memory/2072-2638-0x0000021CB85A0000-0x0000021CB866D000-memory.dmp

Download

memory/2072-1781-0x0000021CB85A0000-0x0000021CB866D000-memory.dmp

Download

memory/2072-1782-0x0000000062260000-0x0000000062275000-memory.dmp

Download

memory/2072-1748-0x00007FFAB9050000-0x00007FFAB95A5000-memory.dmp

Download

memory/2072-2639-0x0000000062260000-0x0000000062275000-memory.dmp

Download

memory/2072-2637-0x0000021CB7FF0000-0x0000021CB7FFC000-memory.dmp

Download

memory/2920-509-0x000001727CEB0000-0x000001727CEB1000-memory.dmp

Download

memory/2920-516-0x000001727E8A0000-0x000001727E96D000-memory.dmp

Download

memory/2920-517-0x000001727E970000-0x000001727E97C000-memory.dmp

Download

memory/2976-232-0x0000028DED9A0000-0x0000028DED9A1000-memory.dmp

Download

memory/2976-246-0x0000028DED9E0000-0x0000028DED9EC000-memory.dmp

Download

memory/2976-482-0x0000028DEDB00000-0x0000028DEDBCD000-memory.dmp

Download

memory/2976-245-0x0000028DEDB00000-0x0000028DEDBCD000-memory.dmp

Download

memory/2976-483-0x0000028DED9E0000-0x0000028DED9EC000-memory.dmp

Download

memory/4324-219-0x0000012377270000-0x000001237733D000-memory.dmp

Download

memory/6084-2633-0x000001AB9F440000-0x000001AB9F441000-memory.dmp

Download

memory/6084-2628-0x000001AB9F490000-0x000001AB9F55D000-memory.dmp

Download

memory/6084-2604-0x000001AB9DB10000-0x000001AB9DB11000-memory.dmp

Download