maze | hxxps://download[.]cyberlearn[.]academy/download/download?url=hxxps://files-ld[.]s3[.]us-east-2[.]amazonaws[.]com/f83fb9ce6a83da58b20685c1d7e1e546[.]zip

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download.cyberlearn.academy/download/download?url=https://files-ld.s3.us-east-2.amazonaws.com/f83fb9ce6a83da58b20685c1d7e1e546.zip
Sample260709-s8jwgsdy21

Score

10^/10

credential_access defense_evasion discovery execution maze impact ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\DECRYPT-FILES.html

Ransom Note

<html> <head> <script> function CopyToClipboard(containerid) { if (document.selection) { var range = document.body.createTextRange(); range.moveToElementText(document.getElementById(containerid)); range.select().createTextRange(); document.execCommand("copy"); } else if (window.getSelection) { var range = document.createRange(); range.selectNode(document.getElementById(containerid)); window.getSelection().addRange(range); document.execCommand("copy"); alert("Base64 copied into the clipboard!") } } </script> <style> html{ margin:0; padding:0; width:100%; height:100%; } body { background: #000000; color: #ececec; font-family: Consolas }; .tooltip { position: relative; display: inline-block; border-bottom: 1px dotted black; } .tooltip .tooltiptext { visibility: hidden; width: 120px; background-color: #555; color: #fff; text-align: center; border-radius: 6px; padding: 5 px 0; position: absolute; z-index: 1; bottom: 125%; left: 50%; margin-left: -60px; opacity: 0; transition: opacity 0.3s; } .tooltip .tooltiptext::after { content: ""; position: absolute; top: 100%; left: 50%; margin-left: -5px; border-width: 5px; border-style: solid; border-color: #555 transparent transparent transparent; } .tooltip:hover .tooltiptext { visibility: visible; opacity: 1; } p#base64{ -ms-word-break: break-all; word-break: break-all; -webkit-hyphens: auto; -moz-hyphens: auto; -ms-hyphens: auto; hyphens: auto; } p#base64:hover{ cursor: hand; } </style> </head> <body> <table style="position: absolute;" width="100%"> <tr> <td style="width: 25%;"> <td style="width: 50%;"> <div style="text-align: center; font-size: 20px;"> <p><b>Maze ransomware</b></p> <p>*********************************************************************************************************************</p> <p>Attention! Your documents, photos, databases, and other important files have been encrypted!</p> <p>*********************************************************************************************************************</p> </div> <div style="text-align: center; font-size: 18px;"> <p><b>What is going on?</b><br>Your files have been encrypted using strong reliable algorithms RSA-2048 and ChaCha20 with an unique private key for your system</p> <p>You can read more about this cryptosystem here: <a href=https://en.wikipedia.org/wiki/RSA_(cryptosystem)>https://en.wikipedia.org/wiki/RSA_(cryptosystem)</a></p> <p>The only way to recover (decrypt) your files is to buy decryptor with the unique private key</p> <p><u>Attention! Only we can recover your files! If someone tell you that he can do this, kindly ask him to proof!</u></p> <p>By us you can decrypt one of your files for free as a proof of work that we have the method to decrypt the rest of your data.</p> <p>In order to either buy the private key or make test decryption contact us via email: <br> <u><b>Main e-mail: [email protected]<br>Reserve e-mail: [email protected]</b></u> <p>Remember to hurry up as email address may not be available for very long as soon as law enforcements of different countries always trying to seize emails used in ransom companies <p>If you are willing to pay but you are not sure knock us and we will save your e-mail address. In case the listed addresses are seized we will write you from the new one</p> <p>Below you will see a big base64 blob, you will need to email us and copy this blob to us.<br>you can click on it, and it will be copied into the clipboard.</p> <p>If you have troubles copying it, just send us the file you are currently reading, as an attachment.</p> <p>Base64: </p> </div><div style="text-align: center; font-size: 12px;"><p id="base64" onclick="return CopyToClipboard('base64')" class="tooltip">ObhICGGKbvi/URYBvym2vDaoqasscWUlMuyfyHrCvmBfw/NgV0lFiojSI7i35mcgmZJ4r3USUhC/weCjyVTF7/TvX1WVMZRniGttM04G+6b6YSlNGLl7RDO3trvJbKyTuKpFCJRoUfzxSzBubeW9OIy4hoG4+o9ASifLID7ix5MYKkYFnQXvYj5McL82VQCxx6zG9+eVr3lVfBTDZ1y/M8krDNlDpMIAL8V+8NsyqkzrkXsJKZyW7lMofCAyQEWsOeXTPKjkB/xdMDmtHP4ukBClPHKNoWgTRwMEYJnhg2iETluU88ianwjbqh5VBVhUi20K/NAth1qYM649oicnytpdT4XX3KTNpnmjqO0CeqPdoXuPq5F7BYsAZnG+YhY2UYhrgwC+Tjs7JUWQXreJNiQttqbZ4nX7+sdY5/O7kgvovYkNMNRyG2IVqPI88UupcEbndzkeOaDOmj/RHUaV1ylcNHIdzkZ22W8wRzoZLXq2rKdWlOwewsZOTNfkL7dBAqbrVMDK5vlCWnnm1rbPOOxsXgFOWRjL2U8iDAGR/IPNaNXJ3ovLqeKyKb/wWe3/FibW943IOJKicaWzLQDz53/kEfmg0eeXKsLitJcIjrq8s33SfUi5QAkoaALSRQpiO4vRm4kPQV1WsXn8mdUBfPP/4iHDvH9uILa5iREPo0teHhFOPJugmStcRPMMwjgMKSyckpU/ui7iXlmB2/6aFRVdj7gWJ8KpQsuIlN4bET31SlmgEI3l718Oa/GQYV9mOo4unLCvXBM6a/WgpIjd/fRAcGBOUy3sY/t98cO8C4m0rdIRMiKZl9sjlUat5ozTQqmNVeTL7787xzawYhNXIIL3GXFuBalwPcCuRfW56Vq08kHv5k84QGmhCaqoSZbJNOoJjyCyLupo6qb81ArPNiVZLUU8zyuCyVnMtSSccC9bRzzAfDu/I4YY4jOGXck7TOhAiYQE89am40/qok3/Ac8JugUg0kvz3BDW+opz1boFwwrxeAwwP7lx4TFaFcTUhCJ9OLUH54EV6dV9L+Rxkgs5jB/+U8FTy3btpqe0xqLNDRLZRNYLbRil8mTbP2vBB1YbwhreV+peHl4FHs2jTvB2uHw6OyhGWQKBnSakbW6Mg0YNGJ5udu/armRzJbyv+B1PgV4V7BpKcDa9sTwJd7IYK8q0spc0b5f3sctlIKdlHeLmqY2P9s9OmMVUnY8NGO/FPYUn6ktkgLTKSl8QhQUbfmhFeKjEP0EYrdyCi9u5PsWjNx9zEWLUBPStaE8WCPbVXshCvuNz5px+kKnksZvZoiEmtkH+5gSPpbF4AW77xrYwTOlxL1TimM1LHxLH6BKocT6t/1EwwsmslfTWMw53wsub6T+7vQMRdpJokFJxT37dlvG3Qa4cZiy109KcuTuYPItfp0Z5uMsZUJ6cIGwqHsjwVPt+9BjEs/gL9cW7L6uOwQzAoAdv8/TlyObeKzgLclnR3g1dmV5YfOwiQI9NBd6Dq2tH5WqdHmqlh2VUpP9YTI++4p/N1BZraPgcmmklXhO72zkxqdtVjZPjB+3UQaDia5jG3lj4A5zq3N0pv/aDbRvLIzFMhTrX5UIHf43fyG5yk1RG1RhcB8FMPSYURpZFa0jxsc3NSD2/0gDYDuM+qFqHW6dnj/QBDiMXOoW1COmmogCfBsqEy/uwcDuASd59Gze8s9I8JIKrGpq7aAulPudapfEnOqdFdapNxCyrAoCbKi9s9ErqeuP0caRUs0K7zrR9E6R8IPyiU8BUBgZrksEtn9Oox/A857hCo86AGsWgwTCFmXXMmmiQh5eAxYqLXW4djLl+UcHS2Py8VH5FhtGsuqj1OKJ/f0hhLdK/6KU2BpwAUrcN+qZ3VC5rz3HQ1Iuj2KMgjaMAeECu+5ptceLg9nt+/P6sPm+or8VilMzNe03MTs7M02aW1pIJag+0S5ufEtE8nska19MAAkf0SVI0HSp5hpuUQok6P3SD3GfreqHNCr3oZslKONxouAI1s3O17wOw0MSJ8ACA5a+cvNbkG908eVY4s61khCrEXfJKFxh2aErxIMNZhpVYNhlfSXLghpI0r4cyM+e5SDXG7q4bHZnd7Z+wUZeNFJUsZTgejSZ0vjb5aXRpYTxz8FtyAFgRoOfnvgFs+sjmfjgpwQ85rh/lPaf4Xo7Dxf30LGgO6aiiqmrZFA13+rVfAUovg9LlnwIxUxf/ODb9qSe3A9rWaOygwl/BL3BAB0uOggogOAA5ADYAOAAwADkAYgAxAGIAMgA0AGEANwA0ADAAAAAQgGAaDEEAZABtAGkAbgAAACISUgBZAFMAQgBWAFgAWgBFAAAAKgxuAG8AbgBlAHwAAAAyLFcAaQBuAGQAbwB3AHMAIAAxADAAIABFAG4AdABlAHIAcAByAGkAcwBlAAAAQlZ8AEMAXwBGAF8AMgAwADQAOAAxAC8AMgAyADAAOAA4ADEAfABEAF8AVQBfADAALwAwAHwARgBfAEYAXwAyADAANAAyADEALwAyADAANAA3ADkAfAAAAEgAUEBYiQhgiQhoiQhwhLbncngDgAECigEFMS4wLjI=<span class="tooltiptext">Click here to copy</span></p></div></td><td style="width: 25%; text-align: right;"></tr></table></body></html>

Emails

[email protected]<br>Reserve
[email protected]</b></u>

Signatures

Family: Maze
Ransomware family also known as ChaCha.
trojan ransomware maze
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x3zk11j3t.dat	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\x3zk11j3t.dat	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Executes dropped EXE 3 IoCs

pid	Process
1740	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
1876	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
3304	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp"	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280856710633602"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{664BD4F9-7D9D-48A8-A54B-332206FCCD8C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1740	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
1740	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
1876	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
1876	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
2620	msedge.exe
2620	msedge.exe
3304	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
3304	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3048	svchost.exe
Token: SeRestorePrivilege	4440	7zG.exe
Token: 35	4440	7zG.exe
Token: SeSecurityPrivilege	4440	7zG.exe
Token: SeSecurityPrivilege	4440	7zG.exe
Token: SeIncreaseQuotaPrivilege	536	wmic.exe
Token: SeSecurityPrivilege	536	wmic.exe
Token: SeTakeOwnershipPrivilege	536	wmic.exe
Token: SeLoadDriverPrivilege	536	wmic.exe
Token: SeSystemProfilePrivilege	536	wmic.exe
Token: SeSystemtimePrivilege	536	wmic.exe
Token: SeProfSingleProcessPrivilege	536	wmic.exe
Token: SeIncBasePriorityPrivilege	536	wmic.exe
Token: SeCreatePagefilePrivilege	536	wmic.exe
Token: SeBackupPrivilege	536	wmic.exe
Token: SeRestorePrivilege	536	wmic.exe
Token: SeShutdownPrivilege	536	wmic.exe
Token: SeDebugPrivilege	536	wmic.exe
Token: SeSystemEnvironmentPrivilege	536	wmic.exe
Token: SeRemoteShutdownPrivilege	536	wmic.exe
Token: SeUndockPrivilege	536	wmic.exe
Token: SeManageVolumePrivilege	536	wmic.exe
Token: 33	536	wmic.exe
Token: 34	536	wmic.exe
Token: 35	536	wmic.exe
Token: 36	536	wmic.exe
Token: SeIncreaseQuotaPrivilege	536	wmic.exe
Token: SeSecurityPrivilege	536	wmic.exe
Token: SeTakeOwnershipPrivilege	536	wmic.exe
Token: SeLoadDriverPrivilege	536	wmic.exe
Token: SeSystemProfilePrivilege	536	wmic.exe
Token: SeSystemtimePrivilege	536	wmic.exe
Token: SeProfSingleProcessPrivilege	536	wmic.exe
Token: SeIncBasePriorityPrivilege	536	wmic.exe
Token: SeCreatePagefilePrivilege	536	wmic.exe
Token: SeBackupPrivilege	536	wmic.exe
Token: SeRestorePrivilege	536	wmic.exe
Token: SeShutdownPrivilege	536	wmic.exe
Token: SeDebugPrivilege	536	wmic.exe
Token: SeSystemEnvironmentPrivilege	536	wmic.exe
Token: SeRemoteShutdownPrivilege	536	wmic.exe
Token: SeUndockPrivilege	536	wmic.exe
Token: SeManageVolumePrivilege	536	wmic.exe
Token: 33	536	wmic.exe
Token: 34	536	wmic.exe
Token: 35	536	wmic.exe
Token: 36	536	wmic.exe
Token: SeBackupPrivilege	752	vssvc.exe
Token: SeRestorePrivilege	752	vssvc.exe
Token: SeAuditPrivilege	752	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5660	wmic.exe
Token: SeSecurityPrivilege	5660	wmic.exe
Token: SeTakeOwnershipPrivilege	5660	wmic.exe
Token: SeLoadDriverPrivilege	5660	wmic.exe
Token: SeSystemProfilePrivilege	5660	wmic.exe
Token: SeSystemtimePrivilege	5660	wmic.exe
Token: SeProfSingleProcessPrivilege	5660	wmic.exe
Token: SeIncBasePriorityPrivilege	5660	wmic.exe
Token: SeCreatePagefilePrivilege	5660	wmic.exe
Token: SeBackupPrivilege	5660	wmic.exe
Token: SeRestorePrivilege	5660	wmic.exe
Token: SeShutdownPrivilege	5660	wmic.exe
Token: SeDebugPrivilege	5660	wmic.exe
Token: SeSystemEnvironmentPrivilege	5660	wmic.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4440	7zG.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4436	4188	msedge.exe	83
PID 4188 wrote to memory of 4984	4188	msedge.exe	84
PID 4188 wrote to memory of 3956	4188	msedge.exe	85
PID 4188 wrote to memory of 3956	4188	msedge.exe	85
PID 4188 wrote to memory of 3956	4188	msedge.exe	85
PID 4188 wrote to memory of 3076	4188	msedge.exe	86
PID 4188 wrote to memory of 3076	4188	msedge.exe	86
PID 4188 wrote to memory of 3488	4188	msedge.exe	89
PID 4188 wrote to memory of 4904	4188	msedge.exe	88
PID 4188 wrote to memory of 3488	4188	msedge.exe	89
PID 4188 wrote to memory of 3488	4188	msedge.exe	89
PID 4188 wrote to memory of 4904	4188	msedge.exe	88
PID 4188 wrote to memory of 4904	4188	msedge.exe	88
PID 4188 wrote to memory of 2324	4188	msedge.exe	90
PID 4188 wrote to memory of 2324	4188	msedge.exe	90
PID 4188 wrote to memory of 2324	4188	msedge.exe	90
PID 4188 wrote to memory of 3120	4188	msedge.exe	91
PID 4188 wrote to memory of 3120	4188	msedge.exe	91
PID 4188 wrote to memory of 3120	4188	msedge.exe	91
PID 4188 wrote to memory of 3364	4188	msedge.exe	95
PID 4188 wrote to memory of 3364	4188	msedge.exe	95
PID 4188 wrote to memory of 4476	4188	msedge.exe	96
PID 4188 wrote to memory of 4476	4188	msedge.exe	96
PID 4188 wrote to memory of 1640	4188	msedge.exe	98
PID 4188 wrote to memory of 3976	4188	msedge.exe	106
PID 4188 wrote to memory of 3976	4188	msedge.exe	106
PID 4188 wrote to memory of 3976	4188	msedge.exe	106
PID 4188 wrote to memory of 1636	4188	msedge.exe	107
PID 4188 wrote to memory of 1544	4188	msedge.exe	108
PID 4188 wrote to memory of 1636	4188	msedge.exe	107
PID 4188 wrote to memory of 1544	4188	msedge.exe	108
PID 4188 wrote to memory of 1544	4188	msedge.exe	108
PID 4188 wrote to memory of 5036	4188	msedge.exe	109
PID 4188 wrote to memory of 708	4188	msedge.exe	117
PID 4188 wrote to memory of 3384	4188	msedge.exe	118
PID 4188 wrote to memory of 4648	4188	msedge.exe	119
PID 4188 wrote to memory of 3484	4188	msedge.exe	128
PID 4188 wrote to memory of 3484	4188	msedge.exe	128
PID 1740 wrote to memory of 536	1740	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	137
PID 4188 wrote to memory of 2620	4188	msedge.exe	141
PID 5476 wrote to memory of 5508	5476	msedge.exe	145
PID 4188 wrote to memory of 5552	4188	msedge.exe	146
PID 4188 wrote to memory of 5552	4188	msedge.exe	146
PID 4188 wrote to memory of 5552	4188	msedge.exe	146
PID 1740 wrote to memory of 5660	1740	e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe	147

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download.cyberlearn.academy/download/download?url=https://files-ld.s3.us-east-2.amazonaws.com/f83fb9ce6a83da58b20685c1d7e1e546.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,5372675257491141363,881705571901773750,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,11907295645377438702,735175795928424271,262144 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,3388064325962347804,10563240071438229306,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14090513727734561105,11405010749720396209,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,17703731755886363044,16467343310376287035,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14208529012035267926,7832377723606054040,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,11957661007407214202,12748223274433145682,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11205495603902378000,11787573308489294643,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8762763533809296854,1286331688754630188,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13311078417616599209,9783043052714543974,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13311078417616599209,9783043052714543974,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,2178012348684584809,16583395550533396811,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10265932745297713648,12332626187810787885,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4600,i,13676592256842035697,12360591816232958648,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,8745836236631389555,2694312420642510812,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,15743977221427585529,18048352855263180544,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,6980031218800442428,4069104636705024370,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,5372263570708431354,7815787730417287404,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17639716254868891432,4631305342627135221,524288 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6192,i,9680351964885016604,2587626041722988323,262144 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6508,i,1637142273820432426,16174031695698653148,2097152 --field-trial-handle=2292,i,253886807419557166,4678632646881314738,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Virus\" -an -ai#7zMap7205:134:7zEvent28198
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4440

C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
"C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\wbem\wmic.exe
  "C:\ldqu\..\Windows\kta\tweai\ofufg\..\..\..\system32\jtl\qd\w\..\..\..\wbem\ac\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\wbem\wmic.exe
  "C:\j\voekf\yo\..\..\..\Windows\bltf\kgal\grp\..\..\..\system32\y\..\wbem\tmpbk\..\wmic.exe" shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5660

C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
"C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
"C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\Virus\DECRYPT-FILES.html
1⤵
- Suspicious use of WriteProcessMemory
PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\Virus\DECRYPT-FILES.html
  2⤵
  PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

DECRYPT-FILES.html

Path C:\$Recycle.Bin\DECRYPT-FILES.html
Size 6KB
SHA256 816f3752577dbcc798d2d2fa5627a8f4479d7a1a6fa270886ebb7d9fb884cfe3
MD5 35493df65893b9f9056c4ad5696c238b
SHA1 3fa736ae73ff370a0b91fe3d1870e034c0cd1fc0
SHA512 ea2eca907de3748a7278bb83177363594135841616ec48c9666a4cbc588a56f38335c0519578b395fb9fc1766c9d2c7bc4ed6255c1631252df295af82f25c183
SSDEEP 96:z2dMHJdgHOMEHl9xnGfGN94ma1anl9jS4GTKutscbOF2v9KRTF6lMX24FM:sGY4HlquN9Xal46KuZNGTFeb4m
TLSH
T1B4D12A3AAE462D2691F3537033A023DDFE154009534367B1765D789AF77C92263778D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AggregateCache.uca

Path C:\Users\Admin\AppData\Local\Comms\Unistore\data\AggregateCache.uca
Size 268B
SHA256 f68aa78d76ebb01f328142c3c7d2aec0bd359c71d79329923751e74daecb022c
MD5 4262764532aa8343ce8ff033707ec3e8
SHA1 d4808f1eab08a38786ad769ee4d2ecd5887822d3
SHA512 4188f68dcea945929ed30682d25c466e606f4aaef91f73aeb117f2de057e1e7b220abd74c2543cf5f89be003021403c4509233feeeb5db61881d22a0842ff2dd
TLSH
T1E5D02B055968425C215150D5E072C92F40A6CE660CE8B941143B88E94835049962A896
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 9b7f93d40ebd9c8faa3cc3a8a4d96d0297c3a83a58a6b286081a39256ae55328
MD5 72b9f775289ba129c7f2298339698443
SHA1 b49ea3f63cc178ed53a96f25c7d67d5f5fa37004
SHA512 9901051bc8869393e649c115eb06db5f2488d0f3c64227975ae0da366e95041843565ac6328ee9092712055d28f25c579e5f45928f2be07abdc07e312494a73a
SSDEEP 1536:OkaparaekfsZj2zKdXTeCPeMTTWiuGlrTE3BC1GFw:OparaeCSlZPN/lU3BC1Yw
TLSH
T18B53028C06ED59EC8554956610B1FDF8AA08C63BC3497DFE12789391C1EAE1C27A938F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 268B
SHA256 ff032b7f088f66befbc89f663d6a9c9ab7c0386860cf11c52db790ab6a7ee327
MD5 86a56a0a05c9649b486ade9b2a90b1a9
SHA1 91d0bcc6e60290130605816a3e8509d77bfbbc0f
SHA512 a7f15abbce75161273f5c1afd50da95b571209913220b74a46fd16b5975ea9744a129d74455f06ce999285d69a319eaf397febd00ceb2c4ea0059d49318c0472
TLSH
T1E7D02B9C7DA0A19C07CA74D8179A1C142226C1D909E2124AEBDF6DD049DEDE07CA3D78
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 36f86f0f7d5b257438c0fbb0c1e855f827f4d189b74c5b088566175299554c1f
MD5 05ca892117d157bb27c5914a23b38fbd
SHA1 ac0dd0fb9255419d355d8d6a87e46f4852270efc
SHA512 ac54b3de9c898e64c4fea2e2f17985943968863df50e8bf98f4460159869ac268d9dee49cb98f7344982c57278151910d141c4e97dd7972e24b2a5e66f4afebc
TLSH
T14321C822F23A9F2967334624985356F4E46A856199392847D02648DDAF5341B0E15F9C
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e264cf04639e897d286ee98ff9fc049e3e38d9c2c77d873933f3a7b6ae60f4be
MD5 2235e5f7eadef9f9a106c5fce01b51a4
SHA1 f6bf6dc07e2ed1b31585ceacd0c338beb8c9f7c6
SHA512 56ff13f502c18b7b17b1389ffc03faa863d4d7a8c6a82b88106bfdfb148ccd39cbccdbdaf41cdb9b36c87e7785614a1bf456422eb2ce3e75df9fb4b1656d07be
SSDEEP 3072:HUQscgp6JLQlCwgbvSxusFurD9yufDUrlerEr2uOe16:HUBlCw4g6UucA
TLSH
T14FB312DB2A1C1A837B47079B8CF18B2704FCB998174F27E42D146BA79AD694BD0416F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 544B
SHA256 0f15ff7e214e55a42780b9cee6d5494d494ce858dbd7e0fe8705a0a0d9cb110e
MD5 efa8a45a4d1eb16183295800b3c15ea5
SHA1 0ad4137a525ffdbd6f52037b1f181d28ecbe507f
SHA512 6e194fe19c5622a0d07ba2786ff4f9581967968954c3736065374cbf70c57dcb9843a7db8e8ae787ad82fe7b6910daa58fd4f3ff480c1fd7af310ec877b27191
TLSH
T1E7F020ECA4ADBD68AAAFA3864D2103D84595E3308B1CA28A00E6BD921E15CB108B10E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 1013KB
SHA256 3b86e06a3e30891c0bfcc6ddad59c184a2179da840f47c39aa5f6b5d55662de4
MD5 c1f753e896967ad748dfa45be9093b91
SHA1 36a90d13e0faa1a178e63a805b2919c098f90465
SHA512 764820ec9572b9aa8b2968b897fbb8510b00967e4707b32a2aa42032568105c4af7290de1964585e4ca19f0871e6a900293eae0f413dc01da3247cdad91d847d
SSDEEP 24576:Onup+c3BASk6bQiFrf8elx+HJxIXOWi7k1VsICVZdaMWmVD:Gc3xnd8elEp6XOD7fZX5D
TLSH
T18E2533824D892A398761BCACB11014DF696D55BC94FA7ECD8BBB18C3C74E0CEB5E611C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 595B
SHA256 ef7107ad81b8201567510c70bfd7a4ea977a8c657cfcc9198933e8405c18f475
MD5 0996dd3cc71385c527de92de05d012ad
SHA1 82a85887d5216171b70083cefa93ed92e92b02c9
SHA512 c3b1e74f1011c9057bef31c868b28fb2a21d513ae5bf4e3ef7e313ff8d3f294c4471cbe5d2d59efb5f12654fcf6de64f621d584e335558d44d836936d5fccb52
TLSH
T127F00C966AD220D641BE2E005BE10125139D67A36731A1B2D52280DA81A0CEB6DDA2E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 270B
SHA256 78d113dd5af852932ff320c3d6d7764595ca213bb20b966315ce317b1bc9a158
MD5 540d61742cca7009547a928e17a40dd1
SHA1 a939981e1206f80e72aec78c398a696f2cc098e0
SHA512 5548eddebda213912fc048d18e2a87ad7fbf5787838a1e6a73f817c652547532e2ad7fe3598756c57b9fcb37fdc3524ea969bd360d887a82ab5c01d5b80e0c98
TLSH
T181D02BA8647D804B986D386AA02E77862358421C366634BDA542D8C928D6DAC554486A
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 678B
SHA256 75fb67ea42c07dc71b237be84b5210365a00f14c2b28534e485d4b2d61f484ed
MD5 ec5d0938f16c1f3aef3aec2407d1fc42
SHA1 ed1165862a53ce6dadac8ba458327a2f3f0b412f
SHA512 b3d61f59960072de8870dc11d733afe79e3a71f5010174667f01ea68549ee819d5b421c5cd17ba3a69b76e76607de918f3077656c087fde28b32643dbcaca907
TLSH
T1AF01833699868180F234430BB0745DDEDD1A43F21F4829D04499220C03D95AF8DB5BF1
MD5 SHA1 SHA512 TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 417KB
SHA256 77b2731ff3c7a14b8b962ea387c41293415b3478e73973888851991105777560
MD5 a024e1d53d75eaefc4aa74131ff16fd8
SHA1 cfd053a7e793ec84ec78679f224b417c760e0a5e
SHA512 f1418a512f8603bf99b40e61e7fe61c7228f814544da3b00adf24ab93b246e522a3c6a6a74476df8419fa54fa3a78f62ebcaaa539daa0de0e111a0beeb129c42
SSDEEP 12288:6Zr2Dvm+2LDF+jgcz5jCDiIuexi3FBUzvASSB7d:6ZCDvmRLDwjPrIuekUz4SS5
TLSH
T107942318871196992C1FB0F63FC72A790FC486555CF3979C48AA42832E3409FA7F7E66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1dcda1851b1f71fcde131a5da179b72418ad9f266539981cc76d61db71830d2
MD5 47931389e50037df570e9aa618a07de4
SHA1 7535c47490aaefe62125005e665b3da0f5c7b03f
SHA512 f40556328cf58c3934a5b9bad7233e9cb88aeb0e5fff48ff4401b1633de25a12b0aa82dbdf3db90b4461f41fa62ee0ee936cba846969b82eaeabc44b0a3c93a1
TLSH
T1EE717DBD1387C86990C82DC00C984A6FC54C992E97487C63C5E7C1286D785DA2FBCAE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 23c2c8c663bf867dfd6e0dbdf4c0039eec01260654b43638ed0d9c3b3060fc5b
MD5 b34be3d1b15045b818e97f76ce144a78
SHA1 a36ea1686f7a51c187366d78a99e4af8abce4994
SHA512 5ad8487f04fb7988c3de673e07af861aa19d299320ea555af66e4b73c792e8c7e7daccb883b757a0a9e6015bab1911296e0b83e99bf4aef3a667a1f7ed15713a
TLSH
T1D771707803010061EBF11171B7E121D9B475A8ECFE579D89302C44F96AB936DD41DD6F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Consumer.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Consumer.json
Size 266B
SHA256 2211bc0beb946cccea45701f63d031b04fc031604a92c43669491b58bc8e3b1e
MD5 005b40a3852374601b61473eafeffabf
SHA1 ca22e5004b4f2c3ffb3d5942e1f0e1b4a8c06b35
SHA512 6789ebabd2007cf06f18d02c9a8a1d878a5c6cfd7040f4360d100e74eff87ac86e8d64f6a70897d43727ed3bef22db51d15888b8f94b57118beb68eb3ced9685
TLSH
T154D0750593335884FA02FBD11840CCADD038046835319074CCBB396398FD60F08F0E1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 266B
SHA256 e12e46a147417f19615f85cde7a477aed20549bcb458c888c5b2bc24d52775eb
MD5 31fc3f624e20994a8c55e6c8bcc64848
SHA1 2de47d873a7efd59e3dc5f1911aae8d97f94e5e6
SHA512 df136bca50ebf6881fe6db6ef31c357e3efc294d4cb37f1f3b45d2de59b57314c3cdc7e44692c9f78594b0d158b69cc843fd1edae1b7a05823bffc20f10d0d3e
TLSH
T146D0EB794923C388C8BAAA224004783432623F0E02C05C04E43E342CF1C134D7B8AE29
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 f811c23dfcb93049515f1639a10a6e6d49f35b3269d1e4f91ed2e7a47014cb5d
MD5 622b6c8289922fcafa5cc40f3e48590c
SHA1 c6280615a8e81e1eb50cd9196bb0c4c2f2394905
SHA512 39cce5fac8859dd5ecf8f5413839ab2d2d1a74cd3ecba8271553ffa7c7cc17d4741735e86642ad043478a39a20d078f0a1cfc418e30062b3732f0508d566fa21
SSDEEP 1536:H2HuwMjq/jyTTYUyNN9ZKrQ5h4CC1b87MuGBx7Hwdv0r7nKFe08ASGbDR:HAd8q/hNNHKKTEA7AjecnKIl41
TLSH
T1BB63122723885B6838E6EA3CB9BA4633D8BE252D03353966E4623F977E4D4F61D70011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log
Size 149KB
SHA256 ccc431cee10fe433e9433534613522a54f54a7e59cc8ad69c769734f696c71ad
MD5 1891c4b81572aeafb780220d97fc2696
SHA1 a5a7cf7aa95eca6d116d82d022d5d0db9203f3a9
SHA512 3286928c18f648e1dc8886d4e32553d8cf2f4608145f2e9109a87cab9e96e779c6432f46dda90535054956dfc1e7993a18e7d56ac7c751c95705cb17e9b1abb5
SSDEEP 3072:H6dt2tMu7m1Nef5LDSLM4mDm+VXTwCXys03N2Uu/xZ8/bknVXsmWJXg1:Hm2tMuOefSYXsCb03NS/8wV8mWpg1
TLSH
T18FE313CDAD57F6FE0E1AA49851D3B41AC72E03258419DE40A028872B3D7FC76E1D9747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG
Size 611B
SHA256 89d181e311405dc1dbd9284df376b87e0bb1f08f3e71e4dea012377e67bab5b0
MD5 6732da24c23c6ce7468ee0f0d8b046b5
SHA1 cf582f84572e6384aad9a02bb957db791a478155
SHA512 b24fc9b70cf793c261118404afb4f2e46b43b5d03de49200ba42ccd625cbe4bbc1246f124250ca9e9f511437217e1753a83e66016d994166c5a67940954be215
TLSH
T14BF0B72C4AC3BEBED958BFD4B940EAFB3E17F7064517D70D30D52030912208016790B5
MD5 SHA1 SHA512 TLSH

Submit Download

domains_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json
Size 128KB
SHA256 7beec7bb64993dec3adbc4e47d3dc3868d0ba680872349bc7b8ec3f771e2d6c9
MD5 9b63b1bc2293836ae43acb037c4c0506
SHA1 fb47171efefdf99c9ed00c72bb67329614bd134d
SHA512 c29789d34fa03a2b9dd852a1fdfa2d3d2bbe78dd13c210e47b2d867ddc3aabb0b32d91a6c4435ce771f955f52b66c7bac3e35c7b5a6d9061773d25685c355558
SSDEEP 3072:rXMyOSlOY+mem47VGVrCUGK1kc2f+NkjJJ8rNe:r8yOSlOY+o47Vg7kc2f0kjJ2Y
TLSH
T143D312DD37072C61F245CF547276EFEA3D3C8022A2B42B79AD30537A4098BAE58591B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 b5ad7366bed4bbb994d56ec96f7433e5ea82ce543f5b2f6b9845122c5046ba2e
MD5 b931f9759c771beda03738d846814d69
SHA1 0b53f50c1934ae4189b82a39bf4454112b3173da
SHA512 1357dbc83a71fbf7b2879c92b7dc95da2df1826c6ea928997a5286b358a4034bf5f2e85e61ed42fe7419f719e26da6569646e3b6c46ee07c03f245ad44399e94
SSDEEP 1536:4iBRBf/KeCzIzC3bwVqCb8NHVZmKiUgiw8SUVYZfnwqpnXfLtGO7l9faH9MyfUc7:D3KeCzIuLMqCogF8SpfnweLt19iH7b4K
TLSH
T112B3120E5D061084A7E4BBCDE8980635DA40365C5F2D0339E25EC6EA8FFACB5F99617C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d51c509e699abc2da2b665fdd6de8675f27ba389c3fc6ee890f7da783ca72f91
MD5 fdc2e62ff2ab8a791c716679cdbd0359
SHA1 3960311de0f8cbb8c44f7c2b16c9d4d68313058d
SHA512 91268f1694d50527b45ba8f9f9f5c62de7174b60cd145b9afee3e7df196d7696a18ea6673c29a9f76d0742a1e5ae53ac5290fa4a32b6dc92e269c4ee52e1b9fb
TLSH
T1DD514B81281E95D345A9A82085644EA93AC2B0F0EA1557BE28CD84EDFC2A7F310EAB00
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9571c5b5f437ab617f31731f615f9917f3ce0c88e32fb8a55f8d785cce03d51f
MD5 29604d752cf63c320175302a7b7a799a
SHA1 d0dc1bc8dfdee61545a65a37cc3afb145ea85088
SHA512 ec23cc14ad19897c39a89914765fe7e55cb57beddfd24d0a75275a4b8b282037f92a39631e50beb49a6d6cc32e55b4bee01e26c393351577e5a5232ff447bc71
TLSH
T17A417BB7C3E48AAD8A115AF06A186E2BDE1D0515436C3D5EC9D4AF4BE3F3570E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 266B
SHA256 c6ab64ed95555f6c2baf250cc8f1d6a1e9c312ec43c77b0d546e432bf7a1b16a
MD5 9f103dd1977fa7c0c542725c2c00db44
SHA1 e1806253b5b8f43b35ca7aac823b4ddfaac98b71
SHA512 562df1c69fb7088d01d8d7ae11aceb8418951cfd81da42facdec78e8e4ea4ec015447947a9dc2bc259e4e33b69fa7dfd81b6741bc8d2958eab04076bf5fad73a
TLSH
T13DD0EBB44D842A24F1B4A632C23504600F03260E1C01420082BC140CAB0F0C20E15405
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 304B
SHA256 74b7e5740b236b6685aa59e7911b121a6345d7a2030a8179cffc21ecb792c717
MD5 e3e001c72798ff952c45a4d65c46a247
SHA1 f5295c9ba12c59757048ae35940a4d56e43d78b0
SHA512 996c73c127f4103b03df01c6f23daf7728dd6c2dfa95f2db67690c55b7d3324533ea3e464a4109423a803cb2a7d4e138a5a5a8818cd781781c8b22138831b9c8
TLSH
T185E07D358C108BE41C666BC5716C52055056E6A234A9D4D298FA656877399C025AC270
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 651d4926ede8bf2b81056272e5e49f62ee1e9c50d4b3b71ea644e6da12cc26ba
MD5 11bd537e3b559f48187f1e027d7260b5
SHA1 cf13d6ea96f5bda9d2088bca8e34011a376b166e
SHA512 6bdcd22c8b6b433238f7093e70bd86937ba80a1620646cadbcf8f0ae355ae164ba2108e76ee823f440f8e5ddd486137b946cd867cd59a0fb4a4ab7c2d711f168
SSDEEP 192:sxZaRGyM/jK1Ml8M9yW/fLsPQ0iQV1IdpqbHW6+WNTY3/YvdByoOIgrJ:sxZas1yW/fLsPQVN8HbY/zd9
TLSH
T18552F9126A345977CCDBD30DFA55BF93D6F50562A2901E48AAFCCA0C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 52b88eb3dfa1658f0514f9c75535c6631827aab62bfe5fec37464d9410c7a8e8
MD5 1adfe92748ce56225cd9711e17010d21
SHA1 09627289494fece842bbf9a13b2c3c5240c16131
SHA512 2e6226c7f00239057d6757dc9462dca95411d7d9e1881850110c22da32c21177c36221b5aebd64c9cb139b4af79bc514b14ee072c2887173d386d0e549457df9
SSDEEP 384:uZ28+tfFANBKyETVw3AYSJ3kWdgD0AuuitsN:U2QIy3AYSDdgApO
TLSH
T15352DFD80E492121B4CC9B329E58855E4EA63EB2C3A60F5F213E600A195BF9C93B2592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 76b0bf76301a5562a97c4e6ad94e425b5de3ffbf1bd50ae6632f034f5214a65e
MD5 47a72af2cb9ca27c38ff9a4a9d11723c
SHA1 e5eae37b013735ad9c223c4a0902cff972b3589c
SHA512 abfa4f853c129fe40a3dca4a098bbf5f0b7185b9dfeee0ebfbe951bd06f79f60128b1387f8362a37e4533aa3b75fad15655abb06cb6aa1128191d137495834e3
SSDEEP 192:sxZaRGyM/jK1Ml8MjyW/fLsHQ0NQV1IdpqbHW6+WNTY3/YvRTyoOIg5KJ:sxZasbyW/fLsHQGN8HbY/xdQ
TLSH
T1BA52E8126A345D77CCDBD20DFA517B93E6F54562A2901E48AAFCCA1C00E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09abe31869536ae1e8540c873cb396581b5de64af37638bca96d16a56c570938
MD5 8a95915b9cc26935a2be0fdfe21e23e9
SHA1 37c81f64e129edc9addb8d844651d464367f23ab
SHA512 ce101cba4a649f38c4597c87c3a88c2c15525f84b6f8c8989d99a0dc8e0efdd0432d78d44d8ba9f918376e3c69cb4526a456c2a541db2ea4cd6297c6cb48a509
SSDEEP 192:sxZaRGyM/jK1Ml8UQD9yW/fLsHQ0NQV1IdpH3bHW6+WNTY3/YvpQ0oOIg5KJ:sxZasqxyW/fLsHQGNrHbY/odQ
TLSH
T14A52E812AA345D77CCDBD20DF951BB93E6F54572A2901E44AAFCCA1C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a469f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe5a469f.TMP
Size 13KB
SHA256 74a8995a15966b4926a5706ada3a0c4dc2d3a70e8e563a4ff79a4238608d9199
MD5 d17d99387d7fad0bdf8d2030a1188b66
SHA1 91a6bd9af4948cf24f0db98fa446b897d920630f
SHA512 b28a41fb24352c8cc8ac2b5eba103c608f1fee29cee715cfc34d89462b6ee6c904d5da8c11f609f21a2aa8ef1711d941e28a7d9edd57914a4dcd30a7e8f70543
SSDEEP 192:sxZaRGyM/jK1Ml8UQDjyW/fLsHQ0NQV1IdpIbHW6+WNTY3/YvpQ0oOIg5KJ:sxZasqnyW/fLsHQGNuHbY/odQ
TLSH
T19D52D812AA345977CCDBD20DF9517B93E6F54572A2901E44AAFCCA1C00E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1a368d2df13708f3b0b077f3999f3851abfa93036ad2b131d9404854acb69e12
MD5 abe5f4577229a15ff30e93779a9dd3ff
SHA1 2f8eb7fdc386f776d5596f55504d1410a7642456
SHA512 51d9e198b1387b62698f26a5b93689da88a5ab6b40922a9839d5510b51f9c002164c1097304c78810ca3696635c7f5fc5e8914cd20da1b15d410c2ef608043ba
SSDEEP 768:vvseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pporont:vvseJ3xWvhfynu1jaVcL88pTt
TLSH
T153D20B2B280CCB7E4F844E6DEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 64adae7342f6820b1b70df3009621f651c07e3bf7195d763a6cab717a3061bb3
MD5 ebd8aaf89f30260b71cd62a01fa358ad
SHA1 04b33f5ed066f46d0045bdfa8a78ff3ce6a0e135
SHA512 50d7f91136c10e837cf28476d6dab5e58753ecbaa35de39b228dcf860050dc36a6eea61c4b37fddbb600c0c1a51cc0c7502297522a67560d4e65ed96bd9d4c7b
SSDEEP 768:+lLg1xE8VJqEd+qFQfa0mm/joxwfyxsQIIFhk88M7/f/N:eLg1xE8vqEdREemLw0nIFhd/N
TLSH
T166E2F13155E23C56BCB58DF18FB9E17C660E7389FC046542DE4D1D8D26C1927C2AA982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9c5a33bccdf88af58f62805218e3eb7ce355953a9789b1fc6d81a82af2829760
MD5 e0c7356ca283ba9dac6b49548e16a23f
SHA1 e54033940e9de773f1b04a48152a5ce2ad369625
SHA512 8f31eb5a1404d374a29fa1159acce3b1707cb43c9f576fb824536fab6da8621ed0e471446e998f7ef7ec2d44b151201f6ea8e37daa3203f80c6fd342199529fd
SSDEEP 192:493vX8nwVRnlV0hOlZzQgXGfXWJVKHJGXThDXinUDbpqgVgZRsPw:4FfwPt
TLSH
T1EFD1BC16313B0641387E795CA2AA893B4F8235773415E8AF7B7804A60F27E125EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 95cf8dd71bdd6b437b5be745a208003f7052b6faa26b99932d33f7d47ce7cce4
MD5 c39327fbb5bdfc58fcdeb7837766dad4
SHA1 3c436ff19c20848b725c21a8f792f07c4f510e93
SHA512 90a9f1f23d8453ed8a7d54a54ea3a3a39bbe507f281dde673a038e9147e0515b4cea42955d8c3833ec7dd2adcaf9737b47961dbcffdbf30c63e87c6e2975d789
SSDEEP 48:KYHIhKggkXyh+IHKnKIXyxmIHKbaMAnwVRnly:KYH+Kggmy+cKnKqimYKbaVnwVRnly
TLSH
T15A917B16363B0642387E3948B6AB95374F4232673454E8AF7F7854A10E27E126DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arbitration_service_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json
Size 19KB
SHA256 95565d3fdaad193c2d875b16353e8e499a5524a4aeaf3e7b4a69d5fded688f5a
MD5 c6db0f52b7d159c5bf65afec71141bce
SHA1 fa358b15743b0afad74b691febda1f52e279af57
SHA512 dfa55885928e9e66db27ca15b43333e8d3c360a119d9c8cf13dca2cf8665fd23de520c6008d7b53aa9d9d13e8dd818a93b5f0f21e33bd23fe0b3b2295edf78c8
SSDEEP 384:N7DqvX/QPXWIc6wGbBuiBe50FzLHL1NF5BxhbDpFZNJVG4r6bk1JydxQWLS:q/QY6RbRg50F3BNLBXD31VTuo1MxQp
TLSH
T18B92DFBBFC33D7E66952E481F4A96BE0189D74B0F8112A54F0F11594AEF8878C5F20B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 ac2fc9cc337167c5c3cee9915f436787fe5941024fd3d7ddd67afc5e5cb82e36
MD5 9cd68e7ea5cd97d6416b396765582bdd
SHA1 4ada43eb8befee914d3d68c2c9db1e3a4cd09879
SHA512 5eadbee0fb4fd20c1f6e1f05492f9d2d149f50624522904659a072a59c17e6a873917fe2b25be129f4f1c21256ef24d9811031bbca1fe2093f9c7e938195137f
SSDEEP 384:CBUorQQmlSa7ZLB53LcZzNDw8zZ6NcMgEWgGagzqZtEvnD+RE:RocQmlXZsDZ6KMgELQPCE
TLSH
T1C452D0D4A0A50314FF7F0E7D80C9386C5E667B67B72349D1E594CA83C639449F54B708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 16e33625349b19adf41d3c161b4fb72804b1f1c0bf07602d43b01c66a99233c5
MD5 de74bdb6eeb48cde06f9b546f9cf859f
SHA1 a10c8a634ad529c3f06dcb9a949aa9626a7835a1
SHA512 547f8c157f41fb8b1150d2d9b93e7719a8a7156b3ef5742de0be8ce0a1394c048fa6a10aca04dfe6aead9e394f911f6d01538a19d47a8f8556b011ea9c3e7fbe
TLSH
T156311A330CBD20DCC5C79D8EC71663821692C2443BE22996AA3593179144EA862BCFD8
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 c8ae0beed8178105c3f21918565a5b7d790ef02ecf73c7829d3eb3647fd76b69
MD5 de4a0dfc851d82766ef46b10ebf4ad4a
SHA1 f8ec8721aac84ca4a5c7e811678c307117debcc0
SHA512 05f3bdf9d5ac23ec1f76e706076e0c03bbf76363b1fe1dccb3c653263445922659afae4dfba0a34dd2d22e6c13fbb39673a4212c57110b9d041bec774429a738
SSDEEP 384:wAKSgXCGYLIwyfr3OrdMwJMBZfMK1ks3IBG4ArlPtL7yrQjaIMPmwaF0VMhYkaye:woqn/wkOrdx3K58ZA37y8+VGGVwxYJ
TLSH
T1A9B2E0C66E73F67FF3F655FC9920F89848C384490F81F9DA629AE488504D23B063BA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f846.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f846.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 384B
SHA256 97aafd794ff703047006bb3db0f211c385e1a2ba56e0a6de8bf43c6d4741927f
MD5 9badfbf21cda73bfcd72ce6f095a4dd4
SHA1 719cb545e6fca434aeb994ee4eae631c1cb46744
SHA512 9c73007cf429875908b9c782ae746d1f2eb83bad830246b7358420c4c0589a19591cc3d4315326c5fe19c21386cff5d8eb87f4990725c9a306c45b858730988f
TLSH
T14BE0F1541EB621C8157C445018E35DF77038B54C13B13CDA0D142306011BC5ADF21272
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 278B
SHA256 2a238cd70e8d1bd16205127fbea40e8bc2584d984c4b47a1a801ce3e934b449e
MD5 13d6c6b23c14369733f48d7d6fa4e9af
SHA1 4ec3d1d0ba862b83ab08069ab1bd39958b001c34
SHA512 ae1a6bd50ccd99cb05a1ef46089a1830a7f0620acfe1f442806a547e670997bfa056d6682b1c33d86f18f32a406a17048233e6d2c2c46e67cbdb2dec54fecdc0
TLSH
T1B7D0EB9E8C6B2952FCC1FC28888D8EB40E80D30D0890111A3D38C4D23CC6B07C822052
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 cd688970ddcf24d6e5b75528cfd22cc5ff73d17173d1648b4f5668c1c07c1256
MD5 349295eb21360e0bd87dbdde629a926e
SHA1 38c23a4286fcdf01376fb3af293395c085d1aab2
SHA512 083b73d987786175f95f64cff956f32d8ebdbbad48afa34105efd863357e586be3b59c99cf9318641562630838037f243cafdcd6327013200cbf4ccf3e394f64
SSDEEP 384:7iF4tNn/s3n9Ss7sNo8TUNTUlIlYo57XJbw520dbJrWadK:WF4j+9ftwgz5W5tVhWadK
TLSH
T1A8B2F8F258D7893BE9AE5787F33E2E068EBCC167B5806950B7985A0CCC8617FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d4048fb81074afd9ed9fa40055b3752b78e56924f428bc5a113b218f31173020
MD5 95a3e8288706c4c99cd6d7259b4e0b71
SHA1 f3b9be43b0e52d61fd258603a0800dfcb614c925
SHA512 ebadb3794fcbd1db83f7dc870ede3823c5d86b8c148fd13203bb0d6ea24ea79de8ccd4507d02a483457b4a09aeafa0c155640a2fb867a0e0ceefb3ac8a36ce0f
SSDEEP 384:EB3Lx/QZY54JPzpJ47HWzCgo8wFcWj1EhZn9G8YaBBBALTDgSwqIfUnYPDvc:EtLx/Q+AQiztRQc8+n9fYabBALTDpMqV
TLSH
T1D6B2E125819D3F02D093F6E06A9E7E96F093018495B0496A101EDE10DF9BA7E7FDE368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d98695790d8620200738a969501a2f0cd31e4bbd6f792b4d7c4c43f38d663a55
MD5 3535b31cf52563548520916b9efe8358
SHA1 2b96924441c5c04e8d20ad8b7e634eb70d5df2f8
SHA512 1924c3ee84884a2cdc6371cb76ff6de852f9dbba855f3e7a54b7ca9658a2029453b1b26f8ae03bbca05a1c153887a78fb9081063a3251b3b7ed4dc900fb702dc
SSDEEP 192:ufhsN4YXQF1SdGIM7P/RdQmiU1ag58BMTwz+FdLD1WSJrJ8z1dqPuX:4sN4Go57XRbR520dbJruauX
TLSH
T1A1423A726C755C3BA9A3A185F04B36539EF4916B9BC02F64E7ED6F1C01DA2AC1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 652f79afe235d71ae1ad7956770646df36598f6e56b1361c9b03a9ed53adf726
MD5 95cc675d2ba7c09691fe1d6a70510ae3
SHA1 ab74d82cfb2be5f632cc6b2cf1d0bf5e4966b91d
SHA512 1523a8ea6eb741fd9f02999ac36ac3970c2200229fde320e0e20a40b9533d569f485277e49a38f05023ee1501cb45b8987314f532fcf19cd9576f06432f0712c
SSDEEP 192:4ONZ6vMNPQmiUyghYhTwz+FdLD1WSJrr80IdqPU/u:4ONZ6UNR3YndbJrcaU/u
TLSH
T1DF122A32AC649C2BAD93B585F48B32575EF4926BEBC16B50EADC2F1C01DE66C1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 051a249bd07394c666d5b758b7b28736fed5c78fb0cc2f5ea950601ab80c909a
MD5 be26f692cacbf4c852d15c002a819c75
SHA1 364d19f17a6ba28245e7f2f0ecfb9359b6cb7bfd
SHA512 828f4ec59adf6efcfb175235948a66cb340724100f3481afcd7f6530b6ea3aa075ade6227552b03174fad06bb986daa240447d88810f4f6474e50ca46bc0d60d
SSDEEP 384:stNn/s3n9SMsN4Yo57XZbR520dbJr1adK:sj+9Xp535tVh1adK
TLSH
T14D625B326C756D2BACB3A185F04B37579EF4916B57C03E94E6ECAF1C00CA26C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 90801e61fe4b968c13d486c36f654e47c22f3550eae5503dea943881903a33ff
MD5 0e274557552230197a98a9c94f597c79
SHA1 98eb7a8441cac08e7540a19d445053ff1403b528
SHA512 d72b3179bf94175bbe184a649760bc1f6b932892ea36e0c19d2c0bf85624b41454a8555c4cdb59e49d295e8a0b2036ecdce0ab92b472632bde0a10b015f1ac9a
SSDEEP 192:ufLsN4CQF1SdGIM7P/8QmiU1ag58BMTwz+FdLD1WSJrJ8z1dqPuX:AsN4Co57XMR520dbJruauX
TLSH
T155422B726C745C37A9A3B185F04B36539EF4916B9BC02E54EBED6F1C01DA2AC1307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3ff9cc8a59db4daf8dc5a0be19b75622da9415a550e269609b624ad7cee3968a
MD5 02ce86a2b4d6821e7ba16cafc0934200
SHA1 d2fa8d073b391307503c43c366a4d34cd969776d
SHA512 a1bb071b5fcc4b4cc10f08411f9c3cf1b7acc8209540d0cde5b409351903e59c4692df47c36a749565ebc766204aaa4bc51aba6064c5c682bf20f651ea710552
SSDEEP 192:lONr6vMtPQmiUyKhThTwz+FdLDf847i6U/u:lONr6UtRXTnd/BU/u
TLSH
T11B020935AC786CABEAA3AD45F48A27175FA4517FA6D15B50EAE82F1C00C765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e9a5e702457dc1fba34917752dc2d50451d6990460beaff539ba317301ee6be8
MD5 4d126b1e102668226dbad4c574476fc7
SHA1 33ef9627bdd76e1ec585ff3a03501639b3529a0d
SHA512 37f4cfe38c51723043960b525575f0f1437c5acf08064669750a151cfdfda92a6026f4f75e0cf127d92b3b6033f83fcb6f8a1faf2b7ccdc31d0afd8c7eb0ddd1
SSDEEP 384:utNn/s3n9SfsN4Yo57XJbR520dbJrOadK:uj+9Up5X5tVhOadK
TLSH
T1BE625C326C756D2BADB3A285F04B37579EF4916B57C03E94E6EDAF1C00CA26C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0708a4766ea435fda96ddd594d1d3684cd9b26651f4e867e5933188702d80be7
MD5 2767a6a3485107275c2ca1330669c4f6
SHA1 a2d916a858defd7d2464c3a7eeb759fee4b381d5
SHA512 7e5617136bc89f14fb3f3d02dedd7daab7a9ed7505a52cdda7228fb300da27b0b64c90996df724fb233198e03fea46cc5d2ec05a5b5590a60f268f922983414d
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 03afabc8775b6501004f38da87768e3095936ac1679b60f1d56eaff323f046cc
MD5 cea06e44e4467402f1ea7906c6c923e9
SHA1 1679c69e631ab634859793b0aea4fbe5b4249eba
SHA512 f4506c5ef57144de356006130a254855bbd084dcda15d32931ab8247bf4ff1cf116f37bd63220fa49fe6fd4d644faa00f0ffe06d439f3ab484becae36c786410
TLSH
T1BB513C757A9247BA8E652E7A9F04CBA47D68CDA41AB70080C36219A5598B1B71C033FE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 277B
SHA256 8caea0ea2a7703e37514bfdaaf02e57eb9cd98e8ee3b31470e106b891690cd00
MD5 ba5aa4c98e1e645997ce9af704a3baa0
SHA1 b5a38bd09431fe1d02216c9f6314f8a81e8a6858
SHA512 f578307998d01e998c24a2fe549aae570599d366c4e39060b02910c7923fcb93791ccfd8a126b736c325fd6c67a295b79840b367d3cdae11caad7e0676e185d0
TLSH
T181D02B96D557107E8F01AEFACED2E65629098FF0797541D11894614C120028424AA598
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 442a5255d11d86c62bf57f330ab6f12fdf602160cedc7997d6455e304cd0f93d
MD5 612fd4948bebbdd3b81f8d43af7ee75b
SHA1 516fc5965b12adfaaf224cdbbe8ad8c6bcec0c38
SHA512 e7f78b293a61420cef6ec270e49a18f49d60a8caef1373156cdca9a9b0296d382cfb2958f748b165a6f95841271a3c95e634e8c6e5ad56dead43472b79f5cf00
TLSH
T1BF511A2996351E852EBC91F080124175E44A6ED3DC13B08BE92449A42B01CCE568EA66
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e75649726594b054231a5f0e27d7e16cb870d0c287e1bd58365e5dcb73c2e2fb
MD5 3481ca692a98bf72a01c8d573579ad6d
SHA1 ea59886e0be27a5ded9db22f8d114af37c641026
SHA512 c668cb669506e07c8a4250c9c3e4ba36698cf1a38d754482081f12deaf072f3fccf00cad0e58fe4cf7acbb8751111ee163d3550f12ef6e7dc5d46edd27f08a40
TLSH
T14F413B58B6E95148B3B37E6A9BF7A86E447FB9732E07D05E10110E4F0A23B00D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 6a99d1823283bef929ff165bc3ee7ed2aa44498ed4985ca16e886e4577dabe03
MD5 f5710f19c6a2210f7614280abefe6755
SHA1 d1ab1616fbf855ce222f449b22cf36345e792c75
SHA512 0494a42f55219393ff0e6572fcd2bf3205dd062ea14dc95708939ffb61acaf56eee6fb3eb148b70f0f498b04bd9fc5f3484ef4cb6205badd725c3a31f00e9f52
TLSH
T1205139F6A91A3D26C4DDD6092852080FC3728A725EEE4876A47386582F69542A14E8CF
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 502B
SHA256 1ec8153a874606e0f41f675287594c6f403cf940ece3ba22a36247663188e2ec
MD5 d0ca231ef8e4f882b2c0697deefa048d
SHA1 84c002796379428dc9d14fe34854def1ddd6072b
SHA512 a8b660fc4c2b2a297bc148ccab32e79b41de2788b1187566dcc640d0921520874202a509556e88ad073e3665fe67f07af7b7ae7f3671faffe3873f8f6f922eea
TLSH
T177F005D8FC03C6611173571D0521880BED5D09B644D124B5A556B4F0C9C1B99EDB24EE
MD5 SHA1 SHA512 TLSH

Submit Download

e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe

Path C:\Users\Admin\Desktop\Virus\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Size 473KB
SHA256 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
MD5 f83fb9ce6a83da58b20685c1d7e1e546
SHA1 01c459b549c1c2a68208d38d4ba5e36d29212a4f
SHA512 934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
SSDEEP 12288:v6l/7FpnaeoQbRLBYdunMCayql4YcQD+AgJbAWgjbgpQ:CDna43YAKl4Yci+AggEpQ
TLSH
T182A4021379E286B1E765183A14BC7C820628FE774FA25EE7B788928C9F701C15975F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1740-377-0x0000000002400000-0x000000000245B000-memory.dmp

Download

memory/1740-359-0x0000000000830000-0x0000000000889000-memory.dmp

Download

memory/1740-360-0x0000000002400000-0x000000000245B000-memory.dmp

Download

memory/1740-364-0x0000000002400000-0x000000000245B000-memory.dmp

Download

memory/1740-381-0x0000000002400000-0x000000000245B000-memory.dmp

Download

memory/1876-373-0x00000000024A0000-0x00000000024FB000-memory.dmp

Download

memory/1876-369-0x00000000024A0000-0x00000000024FB000-memory.dmp

Download

memory/3048-260-0x0000027279390000-0x0000027279391000-memory.dmp

Download

memory/3048-258-0x0000027279360000-0x0000027279361000-memory.dmp

Download

memory/3048-226-0x0000027278F40000-0x0000027278F50000-memory.dmp

Download

memory/3048-262-0x00000272794A0000-0x00000272794A1000-memory.dmp

Download

memory/3048-242-0x0000027279040000-0x0000027279050000-memory.dmp

Download

memory/3048-261-0x0000027279390000-0x0000027279391000-memory.dmp

Download

memory/3304-5637-0x0000000003230000-0x000000000328B000-memory.dmp

Download

memory/3304-5641-0x0000000003230000-0x000000000328B000-memory.dmp

Download