hxxps://www[.]mediafire[.]com/file_premium/ndn4okzx7hevrio/Adobe_After_Effects_2025_Windows%28lofix%29[.]zip/fil

Analysis

user interaction
yes
max time kernel
659s
max time network
654s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file_premium/ndn4okzx7hevrio/Adobe_After_Effects_2025_Windows%28lofix%29.zip/fil
Sample260710-e5axhsc12p

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{187A6233-18C1-455C-B0FA-68B36880734A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4116	4072	msedge.exe	86
PID 4072 wrote to memory of 2904	4072	msedge.exe	87
PID 4072 wrote to memory of 5408	4072	msedge.exe	88
PID 4072 wrote to memory of 5408	4072	msedge.exe	88
PID 4072 wrote to memory of 5408	4072	msedge.exe	88
PID 4072 wrote to memory of 5808	4072	msedge.exe	89
PID 4072 wrote to memory of 5808	4072	msedge.exe	89
PID 4072 wrote to memory of 5024	4072	msedge.exe	91
PID 4072 wrote to memory of 5024	4072	msedge.exe	91
PID 4072 wrote to memory of 5024	4072	msedge.exe	91
PID 4072 wrote to memory of 2096	4072	msedge.exe	92
PID 4072 wrote to memory of 2096	4072	msedge.exe	92
PID 4072 wrote to memory of 2096	4072	msedge.exe	92
PID 4072 wrote to memory of 1020	4072	msedge.exe	93
PID 4072 wrote to memory of 5020	4072	msedge.exe	94
PID 4072 wrote to memory of 1020	4072	msedge.exe	93
PID 4072 wrote to memory of 1020	4072	msedge.exe	93
PID 4072 wrote to memory of 5020	4072	msedge.exe	94
PID 4072 wrote to memory of 5020	4072	msedge.exe	94
PID 4072 wrote to memory of 4884	4072	msedge.exe	96
PID 4072 wrote to memory of 4884	4072	msedge.exe	96
PID 4072 wrote to memory of 4884	4072	msedge.exe	96
PID 4072 wrote to memory of 6128	4072	msedge.exe	97
PID 4072 wrote to memory of 6128	4072	msedge.exe	97
PID 4072 wrote to memory of 6128	4072	msedge.exe	97
PID 4072 wrote to memory of 6132	4072	msedge.exe	98
PID 4072 wrote to memory of 6132	4072	msedge.exe	98
PID 4072 wrote to memory of 2088	4072	msedge.exe	99
PID 4072 wrote to memory of 2088	4072	msedge.exe	99
PID 4072 wrote to memory of 3404	4072	msedge.exe	101
PID 4072 wrote to memory of 5888	4072	msedge.exe	104
PID 4072 wrote to memory of 5888	4072	msedge.exe	104
PID 4072 wrote to memory of 5888	4072	msedge.exe	104
PID 4072 wrote to memory of 3772	4072	msedge.exe	105
PID 4072 wrote to memory of 3772	4072	msedge.exe	105
PID 4072 wrote to memory of 3772	4072	msedge.exe	105
PID 4072 wrote to memory of 4944	4072	msedge.exe	106
PID 4072 wrote to memory of 4944	4072	msedge.exe	106
PID 4072 wrote to memory of 4944	4072	msedge.exe	106
PID 4072 wrote to memory of 3624	4072	msedge.exe	107
PID 4072 wrote to memory of 3624	4072	msedge.exe	107
PID 4072 wrote to memory of 3624	4072	msedge.exe	107
PID 4072 wrote to memory of 5124	4072	msedge.exe	108
PID 4072 wrote to memory of 5124	4072	msedge.exe	108
PID 4072 wrote to memory of 5124	4072	msedge.exe	108
PID 4072 wrote to memory of 5532	4072	msedge.exe	109
PID 4072 wrote to memory of 5532	4072	msedge.exe	109
PID 4072 wrote to memory of 5532	4072	msedge.exe	109
PID 4072 wrote to memory of 4368	4072	msedge.exe	110
PID 4072 wrote to memory of 4368	4072	msedge.exe	110
PID 4072 wrote to memory of 4368	4072	msedge.exe	110
PID 4072 wrote to memory of 2136	4072	msedge.exe	111
PID 4072 wrote to memory of 2136	4072	msedge.exe	111
PID 4072 wrote to memory of 2136	4072	msedge.exe	111
PID 4072 wrote to memory of 2568	4072	msedge.exe	112
PID 4072 wrote to memory of 2568	4072	msedge.exe	112
PID 4072 wrote to memory of 2568	4072	msedge.exe	112
PID 4072 wrote to memory of 2688	4072	msedge.exe	113
PID 4072 wrote to memory of 2688	4072	msedge.exe	113
PID 4072 wrote to memory of 4372	4072	msedge.exe	114
PID 4072 wrote to memory of 4372	4072	msedge.exe	114
PID 4072 wrote to memory of 4372	4072	msedge.exe	114
PID 4072 wrote to memory of 4784	4072	msedge.exe	115
PID 4072 wrote to memory of 4784	4072	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file_premium/ndn4okzx7hevrio/Adobe_After_Effects_2025_Windows%28lofix%29.zip/fil
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff9cabac188,0x7ff9cabac194,0x7ff9cabac1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,13671331579363269841,12585088635166310059,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,18041532566650476941,7615419748897566881,262144 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,9236238175282492988,14840120805403734484,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,5618734839858070302,10311407551214975844,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,3781191400994716360,5581005834091555936,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,5775994638843272062,1587949994046607882,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,12525909763858875944,2240874328958607929,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:9
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3720,i,8760158696254110272,9655178717182818382,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5564,i,8441693847527199129,11139733616291206551,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15055624307249169316,13678769636866510248,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11230569681569783123,3129531655042323789,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12908377062545165609,9638095714328069967,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,12908377062545165609,9638095714328069967,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6660,i,15502575338447672395,11037955354840430991,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7056,i,15394826101438115203,1350592948550805509,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7208,i,15060686509505250583,17250354972392431763,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7392,i,6708772698925221655,521528693461637753,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7572,i,11720398586334743079,4009909927884255234,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7544,i,4267065552521001819,15274830512831364476,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5344,i,18419669609196075758,12422218345525479100,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7072,i,13325263875873805183,9380285627306535644,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5680,i,15407977745348934752,12221963117023553550,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7184,i,14255974326340173528,14924369550888287889,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8188,i,8171869652487052664,5022863442606117936,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8504,i,9557436180967548147,18269833886512710521,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7140,i,17478679377709249,6713608354208843246,2097152 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,8237455188204446606,1310730263276160273,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:14
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,9701598302686852906,10876635959879534089,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,4679210492379990088,6947793424768015058,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:14
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8324,i,12853413891976288347,707946262928274357,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,9868947706520654595,9120166285633591779,262144 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3400,i,11436975933591722052,10745351703974066846,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,1873792907859653553,9420920688545971713,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7291644811654274597,7093786433048319230,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,10322139679108854537,13373230102261543743,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,8128767827939372714,4190991029549356130,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,2212997216705078568,4670086472334762774,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8700,i,8846258389293040806,15882884431956385090,524288 --field-trial-handle=2716,i,16652382017915986034,14899404972494267367,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2084

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9fc9902c5fca8b8b925b4837acdd09e2581be76b0c25c597dff75c90ec4194b5
MD5 ab3dd540371470bd4aa4115ef9f7cff3
SHA1 28bfb23c788a40ffe593fc11f3645c03548fa94e
SHA512 0bd50cd7bca382fa66ff41cc4771060fbaf48cc85612bd86cac915785360a0ee551081129a95ecdd1b7475a3c47a7f3e47acbd288047032d41cdaf5c1d0d1a0a
TLSH
T111D02328335A7846F736107364214303F716C8123696C602D156D10F4F7F49967D7AC1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 4c0cf0ceb66ec83638c9806ef351b4d34772fc39cad2aea0cd29b07906fbbe98
MD5 d91919ece6c06a623f2ae929e648ff6b
SHA1 72ec255332f246c5346f68bc241a4d5a63320556
SHA512 5ea82180d6d41775affb919908e50517969b406967f204e10dc744c33b7e2b1d45dd21102e5469c8fe3b1d6f66cc87e1fe74427d9e7ac13d3428074c596b3a58
TLSH
T1DBE0683403B0C9E4819283A3C424DA1E9814228996CCCA07B3DEB0DC2C40008ABE9E80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6402fd8d10b9ccecc889ffcc0d3ffcce254cf73acf3107aca1e9b8ec4d6dfe2b
MD5 0ff6c5c204dadc81b212bd5fdebb39cd
SHA1 de2442c8a80fb5400322ba9687be6540d9b8a930
SHA512 9cdf612976bf33b311b60a54964b971278e8845a06faacf6ecad466c67b3b84d50da347a091bacb65ddcde29047e56983d10b448ad97f15f651e50dc3c512afc
TLSH
T188E026A405C8C22ED650B7874268834CD291B74BF7C8AA1A2B5889D83441880FBC2ED4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 e0e32643e3ed3174e8e43bc53b875d10113fc6157861e82f0609aacc4f32546d
MD5 32e323aa21078e1f6fa05e758e903486
SHA1 8856e25458237ae9bfbe6266021e7045c6d38a4b
SHA512 7c7e88e8efca612c3b1af9716fa4362d386e4ec0fbede6f3ec530dc3bc3cbd062ad9cf5455d04db812c5cb09e3fa02f2812435b3be720aa331709d96497a4111
TLSH
T160E0D87443B4C5F9BB43970B8454871C584422C5B7DCDE6A3BDA6AFDA80401AB796884
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 b704bba9ce9c134e5040db4f442a92b06760a5d0318c70b61f686532e817c817
MD5 d99c8d9440d955444c2cf1c2a9724277
SHA1 83aff119632e6feeb99721101b364f44442fca0c
SHA512 dffc5e5db8adee127ac3b4cee531af6faa36e1a4c65c2e6be2538397830993d53aaad5275188eb1a1e648f26ac83823424eda0dcf7639e3a0976381a5c769d79
TLSH
T1BFC0809CBD4C845DD2D1197F5717F01007646651941796170750BDD031409B01E29130
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3d533c7154ce9738acb88a2ff3c1e57e4906c2b7c1fdd7382526cfc4a208833d
MD5 6563cde6c0ace064353240e3c280bd4a
SHA1 169f5955923af3775499d891cf8266b605b5667b
SHA512 9eb481470fe46679abaa477f6c917279f9ea192115993d8751f818d1c6b1e193197bac3c3cf618bf2856ad1efc03287b301fb707295e2183ddb846fa25f69e11
TLSH
T1E57161005BB215CDFBA4C6F36FEA3E657374D9FC861B2FC548C4A5F43A0A7A81016625
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a07e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a07e1.TMP
Size 2KB
SHA256 118214c59466681829603a1391211d851bc2463b13d2ce94f185e645254cf255
MD5 3bbd83d42b42b2f7d87b1f8a1d6b106d
SHA1 e2644ecd1de39b22b4c39631a0f5a1f0888f5ada
SHA512 68c0e20ce371ddce9f1dfb7c7de59b82b5c03ef246bf4b8903cc452941afec8e1c555b12cf63569539f932d9f871fd8db36c1ed29a96390369aab8635bdfb5d6
TLSH
T1E941F85413B60ACDFBA4D5F36FE67E9932B8D8F9080F2F9048D5A2F13E057241562361
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 9e68bb6d44dbba130a652a766a16a42b6711a6c37f9a9847ad5207487e97eb66
MD5 0790bc9ddc26a21423d3917f86c4015b
SHA1 a4bd72a3f14acce7eeb8181d731044de5afb12f4
SHA512 1a8a7a482b4a5527eea4da8b8a17e4149b14d298d61b10d7ca61934c9c7f32891b08cd973d7bbfa150764640b5fe273561280798f3215f558ed13339eaf9bf7a
SSDEEP 384:DWdQSZlke/5WD74etceytLh+hJxeOiwvMWe+RJjaDeiZ1fyK64qrYmYKLA3kY+9y:bfszRsORCkFtOXVI33OMA8
TLSH
T1CD9267F793A1D56E8A115BF89604AE1B8F1C1716432C3C2589D1FE87E3A3033E16E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 5863e6ad9da87f5c86f544d5a76a218f087f5c6d7d05caa779d3499fd8462040
MD5 b506137e6403420cd395f3d08fe7e35e
SHA1 b6cf98578a84892b621072e76c9113db0618db72
SHA512 213458f08dc4d394003e863425fb9708d99f1e914d04f861492d6ce49dfc51dd40e54e827dd4aea6bcc13dce71f12cf5f6e292f63254ec8048b95059d8b64ef9
SSDEEP 384:Dzg5SzV0WXU3FppeTmeFuXdj2J0yXxovede3pIaDeihl/yHz4qrYLYKLA3kYj5Sg:parzEsOTDkOthMpMPi36
TLSH
T1CEB289F393E5D62E891157F896146E1BCE1C1715432C3C2A89D5EE8BE3E3032E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2d5d5cece14c07fcc34cedec266ffadfb8d4da4f94010550f648005a24a733c3
MD5 caea5420d962273ad478d4f83a1a4301
SHA1 066c4b00708037c8ba8cf24bda16c793834be7f4
SHA512 e4f6bdfe9061050c793db7bd57670e9ac1449eedc3634623ac354a3a4946d23c547c3fee624f6454c60d8ff030a0027820361ee00b914dfa3c238ec233b3c061
SSDEEP 192:sxRGRHyM/jK1Ml8wKS/fnsKwDYCbVzoA8pGd4py5J/g6+WN75lNH7A/YEW30GLhJ:sxRGLMS/fnsbDP4Y/5u/qhJ
TLSH
T1FB62D916A5345D7B9DDBD219FA417B93D6F85473A2901E44ABFC8A0C00E7BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a82ea2fd5b46d897aa88567603e2aefe911f939904cb45067b66be00a253068
MD5 e86c85b3b384bb432d2f52891d6d921a
SHA1 f0b1ebda84b94b01972f260c1c00ee53c39999a3
SHA512 709f5d7d6624751a8bf1915524a459e4339f7590b3527927ef99c19c662f35e4950eb4d8c0d87249978fa8e28717eab75231f3b6c63e0c9c6e25377052267d1a
SSDEEP 192:sxR5RHyM/jK1Ml8wKS/fnsywDYCbVzoA8pGd4py5J/g6+WN75k7A/YEW30GLhIgs:sxR5LMS/fnsTDP4Y/5B/qhs
TLSH
T17762D816A6345D7B8DDBD209FA517B93D6F81573A2901E44ABFC8A0C00E7AED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 02682937159ba194a41b52ca5bc5673a5f959970871722d5ca6910fcce54f359
MD5 5a4b66355eff7e34e8c32ae717f66de9
SHA1 e14c91093c778e7a1817129821c3aa346c5cef57
SHA512 ee6a68c41fbc8f9fafc58ff6a39dc3daeb11e6583f0d1d82402f741c5d8adc57753101aba975bd46b085d3487d4a0679e8571c71ae70c90c2a01516ea92e8071
SSDEEP 384:sxRGEq1S/fnsb666s8qMpRiYnazAW8pZS15posJWeT+YP4y/5u/QhJ:saT1S/fa64Mnc7WeT+YPf/5UQf
TLSH
T1BFD219069524C8779BC35E18B47D7E73DAEC50526284DEDA5AECCE0C019E1FCAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6cefd3195bd1bf1d776dc4853632acb7df7cd8729ce9c940f5accaf24ee44c6f
MD5 1cd5f1dcbd1fd2e274eea36954f06c76
SHA1 5edb29f305c068ec48191cfe4f80a0c42c0294f8
SHA512 0b4efeac4972ec3b3e9951b9184aafdc4bea04172c5ae749364fd22525dc6ffe892611361b0a8c38dd402c3cf8aa15bf7abce501c3f8aba0801cb430a861b26b
SSDEEP 192:sxRGRHyM/jK1Ml8UQgKS/fnsKwDYCbVzoA8pAd4py5J/g6+WN75lNH7A/YEw30GP:sxRGLq1S/fnsbDP4y/5u/QhJ
TLSH
T14762D816A534597B9DDBD219FA41BB93D6F85473A2901E44ABFC8A0C00E7BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 09307f73e5b1440c47bce2050b2075dcea177bdc3e68e4d6882fe6e84b7eb41c
MD5 c06e2e5515d170a7ecda07155543ead2
SHA1 2b5a803a54717125fc9a5c1c8f608a9aa25d23e1
SHA512 20deb8ef611cf347ed3e6bfbbf5ac12248a9473b700c31a3fad7fe8add968a0b57e2f209c6851af63214c622f25fea553b0cfc44050a514333c24cb751210084
SSDEEP 768:40D76DrQD8f0DbWgQ6DjfdQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw0DjGQDL6+:40D76DrQD8f0DbWgQ6DjfdQDFu1jaj0x
TLSH
T11EC21B2F540CCB7E4F804AADAC29AEC66DD801CB97984D9447EA8D0C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 1a678462fccfad467422a958c398d6bcca128f20d355e1cb0ae61052dbdb4dca
MD5 157bd88e36a42dff43539a6c72cc495d
SHA1 9dedf0ab483679f805e13ecf7c82ea506a7b32d5
SHA512 cbd6f785fd3a1e979fb6d3adf21fc5bf4d45ea65edd58d8c89b32e78cceb93ac5a46f144f93b020eb5089128ad42067e874f8d410ab1f1fbbe1635ea350c4fbc
TLSH
T176E0C0FB2DE71C18EC7F83C22571C6710101B838D148EC4E111692C340B5369984AD32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 4462f36c78735ea671a718b668cdf754881da7b811927d8f7c5f8867844f6cc7
MD5 5ff7786afa2ba5bfff780b07011311a0
SHA1 26a7108a79dfe41cccb9f4116d55dc1f3db1322e
SHA512 e38514beba6c453ec8efd96fdd75bcae44a77e14c22bd74cb6d724a1b12d029135aa6c9399cd840bf4dad25c7a7a98bf9012c9f495037bcb7d120095c590c57d
TLSH
T170A0021435B11106C41003B010C2C6452212BE255153424160D01A8ACC5519681E3405
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5ac8fe4bd5078c9775b15196b9540395ab9fa5c4799f72c9235db9bfd58f30c6
MD5 932f3fccd0a2d5b5eb912f121fa52e29
SHA1 ad547c73fbbbb3fdcaeb9334e524fe8e581227a0
SHA512 25d9efa5aed4b16785f2a67f064bc45e307571ea56630a40b520229027e57b71056c1b54f16494b86236b8deea1ee75d21a305daada3366696b3654ba1f59da9
SSDEEP 96:KRWLa2Q44eWIdFgWeK4rgEec+W10m/HFSr/VPTXWbAOgHXK42gZXc9lYrm+MKLCo:CWLa2Q445IdGWWrgEN+W10m/HFSr/VP3
TLSH
T1869112C4323B4291387D699881B5951F82C271677218E93B3FAC45A28F6BE03DDFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

3db41316-6ab8-441f-8f32-3de6f63f5f37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3db41316-6ab8-441f-8f32-3de6f63f5f37.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 76ac8ccc7a8f445baec7037bef00d14a8fcd10f4fe5d172831e17196c5f70b60
MD5 61f57ec4663d8f542ff61019e606dd85
SHA1 287813faff4f3ba8e04679d78ecc07ab39893076
SHA512 2bd258ec607c38cda1c72ea611df56956971eb1feb0d1190097835c7aa148a7c544c98588ece27dbdb5be88034fdebdae805da4dc53e66e3be639303f946c1d1
SSDEEP 768:EF3j+9z3zwg3L++WEDTd+ZN21freX6+qTko0u229a4vsTSMVcLCO7w/v:N9z3sIxavVTVKa4nHCt/v
TLSH
T1FB135BF298D38977C9AD8787A33E2D469EBDC163B6841950B7CD690CCD4B27FC206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 87554884a7ecfc1e1ea981b57188ef69e4884d8127f8d2d8e02d44c2546a1707
MD5 a87b73eefdb8d7fa8bdeb7f489a367a8
SHA1 99712831cf299170a543367cf66b1c909c02b2c0
SHA512 3a358f3dcb4dcca1a5e8bec747badc8e3d03731e80075172fd4a2d9d9007ac25234d025d16bd5266fc4234277afea18481235fbda08a053d31ec313b7f0c916e
SSDEEP 768:Rrv+4UNbdG3Y9+DTd+ZN21fceX6+qTko0u229a4vsTSMVcLCO7w/i:RbsbU3wIxrvVTVKa4nHCt/i
TLSH
T10113BF32F86A9D778DA2D688B10B71877FB86163C7C80B54DADD6A0C024F66D170B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cc70ba8f08493a829f793f704609b5be3df7ed2cb61abd572c1318b9b4d1383d
MD5 24a096c8418e99ebbe31dcf034e59f8e
SHA1 df4700cbf5e697101bfc912cde721f13f16444e6
SHA512 3ca02e53662d0f01817dfeb7be290ee3a89cb4fde6d82add43ccc2854b248615a8ead0fa3c0e369cd55b92a05001805d87790091d94185fadde989273c5ceece
SSDEEP 768:Kj+9f3HxEDTd+ZN21fceX6+qTko0u229a4vsTSMVcLCO7w/v:p9f3jIxrvVTVKa4nHCt/v
TLSH
T1FFF2BF32E8639D778DA6D7C8B217318BAEB59123C7C81E54DADD7E0D018F62C570682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1d7abc3dd873a0a553db261b102f38bb092dcfef4ef11d51ea8c6334a9cdef79
MD5 54371a21a55a85c4a72a3e77e52233ef
SHA1 ddf5323c4534dbeb9a2dee70020410c13f1357c0
SHA512 559b64b5c70d3cdf8cdaafb3626cb57da16e394615341fe069dd59b956d4d8804f1d8b97065e240fb2b2e982daf527216e6f87519361947071b9669553fedf61
SSDEEP 768:EF1j+9f3hwgkL++WEDTd+ZN21fgeX6+qTko0u229a4vsTSMVcLCO7w/v:J9f3tIxPvVTVKa4nHCt/v
TLSH
T14E135AF298D38977C9AD8787A33E2D469EBDD163B6841950B7CC690CCD4B27FC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3f3a07ac185ca3b9e4994e5f635ab41170c7ab23904a3f7737444ffccf24438a
MD5 a1d04309dee3423d5d650694f7d79db6
SHA1 562fc19eb5414d8fcb44e9ddcbf0be1e2ab7eb53
SHA512 5de6188f04a8e4c19f76062fff0953f9b7089fbcb32023cfb16486dd19a44270165816c7969f1735340cd7574a8608d6ad45a548b29640deb2726dadbd2e48e8
SSDEEP 768:prv+4UNbdG3Qh8DTd+ZN2reX6+qTko0u229a4vsD9eVH1SdW:pbsbU3KIavVTVKa40EH1h
TLSH
T1A203CF32E8B589778DE69788724B71472EB95163C7C80B80D9ED6B0D068B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa93c8b3-77d8-48cb-b2f9-67d64bd0f6eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa93c8b3-77d8-48cb-b2f9-67d64bd0f6eb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/3404-395-0x000001863C830000-0x000001863C98F000-memory.dmp

Download

memory/3404-339-0x000001863C830000-0x000001863C98F000-memory.dmp

Download