feb878ff32f654c462b66f4c26653b427076504265cb3062670d6b130ac751da

Analysis

user interaction
yes
max time kernel
1049s
max time network
927s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uoqnpn554yl0.html
Size 5KB
Sample260712-xd97eahv61
SHA256 feb878ff32f654c462b66f4c26653b427076504265cb3062670d6b130ac751da
MD5 132160028fbbb75388afb7f830e43996
SHA1 1b9555de94cac00083a739f6e3212e9578617ee2
SHA512 ce77c9e1f084a2f40a7be4f5b90f7c9750343667010d19cd1d896750b54009e5a715ea0a8467eb96ac521bc64d3ddaa33084331e3a90115c0f4079e5ca69a866
SSDEEP 96:PNyXtoXZzIEb0EaW879yh/oVuR6/IfkN8fIYyoYkQIKhYl+JWhYBxyYzueh8wKmw:PNitkCBMGVuo/IsVoQYl/hoxfy2Nw
TLSH
T1B7C13CF79E7220278BF257AA14F6B35C5171B258BF0150C4E692CA2C55EDF4EC06A1A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3416	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283555731991418"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{A40D7610-DE9B-4868-AA7B-35B552C0C010}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6156	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	SecHealthUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2772	1036	msedge.exe	87
PID 1036 wrote to memory of 3416	1036	msedge.exe	88
PID 1036 wrote to memory of 4504	1036	msedge.exe	89
PID 1036 wrote to memory of 1948	1036	msedge.exe	90
PID 1036 wrote to memory of 4504	1036	msedge.exe	89
PID 1036 wrote to memory of 4504	1036	msedge.exe	89
PID 1036 wrote to memory of 1948	1036	msedge.exe	90
PID 1036 wrote to memory of 256	1036	msedge.exe	92
PID 1036 wrote to memory of 256	1036	msedge.exe	92
PID 1036 wrote to memory of 256	1036	msedge.exe	92
PID 1036 wrote to memory of 2040	1036	msedge.exe	93
PID 1036 wrote to memory of 2040	1036	msedge.exe	93
PID 1036 wrote to memory of 2040	1036	msedge.exe	93
PID 1036 wrote to memory of 1924	1036	msedge.exe	94
PID 1036 wrote to memory of 3680	1036	msedge.exe	95
PID 1036 wrote to memory of 1924	1036	msedge.exe	94
PID 1036 wrote to memory of 1924	1036	msedge.exe	94
PID 1036 wrote to memory of 3680	1036	msedge.exe	95
PID 1036 wrote to memory of 3680	1036	msedge.exe	95
PID 1036 wrote to memory of 696	1036	msedge.exe	97
PID 1036 wrote to memory of 4264	1036	msedge.exe	98
PID 1036 wrote to memory of 696	1036	msedge.exe	97
PID 1036 wrote to memory of 4264	1036	msedge.exe	98
PID 1036 wrote to memory of 1172	1036	msedge.exe	100
PID 1036 wrote to memory of 2584	1036	msedge.exe	104
PID 1036 wrote to memory of 5832	1036	msedge.exe	105
PID 1036 wrote to memory of 2148	1036	msedge.exe	106
PID 1036 wrote to memory of 5604	1036	msedge.exe	107
PID 1036 wrote to memory of 5604	1036	msedge.exe	107
PID 1036 wrote to memory of 5084	1036	msedge.exe	109
PID 1036 wrote to memory of 5084	1036	msedge.exe	109
PID 1036 wrote to memory of 5084	1036	msedge.exe	109
PID 1036 wrote to memory of 4068	1036	msedge.exe	110
PID 1036 wrote to memory of 4068	1036	msedge.exe	110
PID 1036 wrote to memory of 2928	1036	msedge.exe	111
PID 1036 wrote to memory of 2928	1036	msedge.exe	111
PID 1036 wrote to memory of 2928	1036	msedge.exe	111
PID 1036 wrote to memory of 1944	1036	msedge.exe	113
PID 1036 wrote to memory of 1944	1036	msedge.exe	113
PID 1036 wrote to memory of 1944	1036	msedge.exe	113
PID 1036 wrote to memory of 4480	1036	msedge.exe	114
PID 1036 wrote to memory of 4100	1036	msedge.exe	115
PID 1036 wrote to memory of 4100	1036	msedge.exe	115
PID 1036 wrote to memory of 4100	1036	msedge.exe	115
PID 1036 wrote to memory of 6080	1036	msedge.exe	116
PID 1036 wrote to memory of 6080	1036	msedge.exe	116
PID 1036 wrote to memory of 6080	1036	msedge.exe	116
PID 1036 wrote to memory of 3508	1036	msedge.exe	117
PID 1036 wrote to memory of 3508	1036	msedge.exe	117
PID 1036 wrote to memory of 3508	1036	msedge.exe	117
PID 1036 wrote to memory of 2016	1036	msedge.exe	118
PID 1036 wrote to memory of 2016	1036	msedge.exe	118
PID 1036 wrote to memory of 2016	1036	msedge.exe	118
PID 1036 wrote to memory of 4484	1036	msedge.exe	119
PID 1036 wrote to memory of 4484	1036	msedge.exe	119
PID 1036 wrote to memory of 4484	1036	msedge.exe	119
PID 1036 wrote to memory of 5940	1036	msedge.exe	120
PID 1036 wrote to memory of 5940	1036	msedge.exe	120
PID 1036 wrote to memory of 5940	1036	msedge.exe	120
PID 1036 wrote to memory of 1228	1036	msedge.exe	121
PID 1036 wrote to memory of 1228	1036	msedge.exe	121
PID 1036 wrote to memory of 4800	1036	msedge.exe	122
PID 1036 wrote to memory of 4800	1036	msedge.exe	122
PID 1036 wrote to memory of 4800	1036	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\uoqnpn554yl0.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffab298c188,0x7ffab298c194,0x7ffab298c1a0
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,3891621614297422244,3800243407768152904,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,6794848739456170896,6154001798616511162,262144 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,4511908390259334642,16629803228486282382,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3688,i,8662612091447292033,17875058920828391952,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3712,i,16177610962231885304,11146669746812774959,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,17220742218937873649,5294252133273743583,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,2627354665338325034,12242026066665376658,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:9
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,6864524891312233008,359099993951290063,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11257934061899033953,11298900440008348004,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11034296605414410829,16662578444513492474,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11034296605414410829,16662578444513492474,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,14699996599023845283,1312618946577952201,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,3383112155991842175,15003478467282233425,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,16906233142851621353,9369288404372274603,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,10163442278167596414,4710816093376627566,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6256,i,13093975163936133763,7938290811194778523,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,6767764223767262190,6729864970385509156,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5636,i,13733665473278934285,13757468289103070762,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6944,i,15254541553689150888,7212387761138484746,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5620,i,1577422939865141315,14835930968354390059,262144 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6784,i,18211994779539533186,8792105988695613043,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6896,i,13491080652068654906,17464044402294497589,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5596,i,10289913522204545639,15270932849837748436,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7544,i,6181726512015523124,5036694206947263727,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6060,i,13929932593533314178,10476422304947217484,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7900,i,15080061029135448904,7053722182911106858,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7628,i,5196069976888776646,7547071129271694133,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7604,i,5388286514625844160,4160790457551979482,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7784,i,3857237212855594873,14432257703059432894,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8640,i,14874403246993526076,10493415643047297704,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:14
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8656,i,7006986475938195320,4049173705292242544,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,9749269381395058437,15373151103212963214,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:14
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7112,i,9598932139085588976,10348399951559989712,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7808,i,7191909743653035891,12155870666012117487,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8568,i,16750390765360008198,7871499334740425608,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,9943005947586516023,15276844991518236536,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:14
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=3400,i,15421634948099817363,3505023765153514557,2097152 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,8997229311533180329,3809869369819752849,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,3796020151781703448,10351735657858562606,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,16447210358358534122,7703735426570673825,524288 --field-trial-handle=2232,i,3875407615284251983,4371425295019715496,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
  2⤵
  PID:2820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5372

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4932

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\86e4be3f-4010-4b42-b4aa-6154ac67bdf9_MECCHA.CHAMELEON-SteamRIP.com.rar.df9\Read_Me_Instructions.txt
1⤵
PID:1728

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cfc2e38a-6d6a-4a0e-8810-f53430fe4989_MECCHA.CHAMELEON-SteamRIP.com.rar.989\Read_Me_Instructions.txt
1⤵
PID:1660

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3164

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6212

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:6912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

642badc0-861e-4fce-a9ed-8d3f16ccb8cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\642badc0-861e-4fce-a9ed-8d3f16ccb8cc.tmp
Size 38KB
SHA256 a950eee5697a06c1d2d977371c561aaf583fd89f32c3f46ec2e926eb9c03b27c
MD5 6b8ccec7c763aabfb0e5129331398abf
SHA1 ebb8e14714c35e73f6a08b4e1ac0b14ac42a0927
SHA512 a64f5fb32ac8c5daf7889825cbd361db9e2b4a9e7c9bdace7daacb50a932bac2b2112ce5a2ce53dfebbcbc5d0688c96be0ec4677fe423e5c9335f5667024faba
SSDEEP 768:rrv+4UNbdS3qmi0nLrEnjN3Gac1ZDeVH1SCz:rbsbg3hLQnjMaIEH1V
TLSH
T1E103CF3269B88AB39CEBA38571837A037EF4525385940BA4C6CD6B0D029B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

50c344a6-669a-4d98-8f34-8d9c4e73ca53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50c344a6-669a-4d98-8f34-8d9c4e73ca53.tmp
Size 19KB
SHA256 b96381fd5288f5a480756f841b9c9ed99513c00ea4f656d0eb8ca153ba36824a
MD5 117548712acd170db612c880f92c690e
SHA1 a67e16b0c901bcd200daa4dfc5c1a2592dae0bdb
SHA512 444296ede2879d189d2692839c82c4a106cb903f7f5cf4551fcf765cc39a1dc7a6cf673a727eae32df2d3ca60e040022394f0976a6f7afa5a50a053cabfac94e
SSDEEP 384:sxRWnICqem1D/f/setRZ8RjJ0/5M6dhQSX1SQ2/sQvC:s8INem1D/ffRZYK/5bB1Sd/a
TLSH
T18592D91755248D77DCD7D619F922BF93D6F81063DA944E48A6FCDA0C00EA6FE2212C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b8d355730a4627d1d8a1e5c61fb6d7f19960abae3570c04ee51afdb61e578eeb
MD5 bfe95cffa536b683d0b9d3f6d577eda3
SHA1 0ac1aeeea8db3302b720d61c257ff179bb6d1bfd
SHA512 2175ba960e840eb4fcb8b8bd90859cbec7384974240e1215a567c8e6c48b8a18aa5183970db3d128684d25ea9213155cb1b81b01a6557b668bbc94b0645c4636
TLSH
T188E0D8757F85C5AC2541A696834BA27DC552F00FD6CC8B75764F76B4154584083D1294
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 18e2fc990e866a993e9b768a0285591340bf7b7352ab2b40d40b4a0dc821318a
MD5 3d5b5c06810897ab3db4c518a9f5fb8e
SHA1 23b21ae498a1e971394cb7247df2b61a4fd1433a
SHA512 a64bae346a5b3aff09980fa05f9512aa81492b37ed35f42f16863d20132a03e7c11ceb5f7ffc7d11e4c91b9e4512ad17fd5ee7a4932a078dc8f056407fa390c4
TLSH
T1ABE07DE815C8C2AEA2C074978268576CC3813A0FE2C8AB8A1708C5F57205844F3C2F90
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000047
Size 161KB
SHA256 24a92e27013bef1968edfb3fc6eac9dcba6f7932c0ef6861eb669e17c481138c
MD5 457cb57f4bc39f4a45e5e44d9a7e8d86
SHA1 531e19c3a286f027ffda630464b89d795c09011d
SHA512 72a771981d5c0ba62862b6484fe6aad6788aaa7d94d2f8e7b6a94b82e877f5eb2c78c1eb3546b3e290827781eb0b05f12b03db3ac93078494675a51c09474ec9
SSDEEP 3072:0Q4u1wUMQEMbVAWtO1I6NjAphqeQkH8xDmqoh+Av+p5L5TYIWMYDNbZs7PC:0h8wUMQECiNvkHcDmvEA2bFTBWRyq
TLSH
T12EF3124D434E5A12B4C4E3E56178CA7DDB5B1A442DDD3AF4538FC238899E682C2D2F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 19KB
SHA256 27b38334127d248f760ded14a3441b6ce3972eb110f73e50e1ae76dd16b73861
MD5 6a63dd3b4bdd8e27df920cbb7df0142b
SHA1 888febdc97e6e27e637e14b0017ce8c3c1b2ea09
SHA512 d691a06e50557c66496178460c13628b215b0616759788a8386c2bbec15d6be681104db6616a0840aa4941bfbb297d6cc345724957cba12752e1c2db675a8603
SSDEEP 384:dWANsy+GeX7PyAJGEXH5K5ldwQ88WAtM99LrUIra4dPTPxfNcUpxvRKY:dLNsdGeXbjJGEXH5K7di89tMXLrjaaLD
TLSH
T12192D128BC2F1F4A57A2B2A1EB2C51825CDB9853A9D5502CCD8E25C3706F1A46B47DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 62KB
SHA256 776d11a6631830e72bcc3d67787288bec1d3ae8b1dd247f3218b1b4f0c7ae242
MD5 2103f53cb2c0093d81c5d3f6c3fd8369
SHA1 b95786a0bcae71c66db9d60b5ee4cc5f7521a14f
SHA512 d1f95a105f6be171e789e23c16f8aa991aa396e0e6d91d57b3b80635c3dc64ed43b94d8d517fea2172d99dabc638bea0ebf0987ba799f93057628c8fc9292716
SSDEEP 1536:ZpmalUicTlh2imdEmBSThliyO2/xLyDMaIcJNGbwJeJrpnrXwky:zmaGXjNL/xuQuedJNkr
TLSH
T1A153023018F18DC9F22AC6BD0FE94E02D91956774E1FB2F26219719DDB5D46E3F88222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 71d4b8fc543ef23420fe4489bafd5a12cbbb235227a84fec0004398130faead8
MD5 749ab388ffb4f6679075ee25da696028
SHA1 1a467e7541429ed780717d5e0afd893c85a1367b
SHA512 c9cb2f7c622e03d75e861ea244701f7f62f9349dd74c8963856ff4c66d1ec2b477aeee289bcbffe2c8459218ffc8392f452adcee396a1a9f9bc7aa9c181632f2
TLSH
T17041A894C37268DBFBB0B9B123D2D59936F8A2584247EE51CD512C7AC907FB658C006B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b78c01fce65ec0340ec4ad71bca87d7c478f0100d70bc45e70cdadbfa523858b
MD5 6c7bc4816bafac8b16c0d25b020af21c
SHA1 0d907282a4b4762ed8bf985f65b3ad38d2cd733b
SHA512 31548fd686fda54ef5ccef9f9ec721a8829cc3478d442ef6b463872c307d99f5dc47105ca764c94696d79ab6c7dad8b2c0a179b33739d50aa0250d85713bb61f
SSDEEP 96:kmG4kPhPQvcE85upQd15iUTytUT+SQcdXvYwN1xgRY:aKtAukxyGT+SlhAwD5
TLSH
T16DC10A164E9614C2FF6240709AD06CA776F076E36E93DF9B98C2DE30D423BEE02C5426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f31d70fb11d8b452bdede6f5955a2f1d54b47e9cb45c6cddd3136038eae12976
MD5 78b1e1576308a4779013d1adc5fd753a
SHA1 004b73f6957552bf1c89b0c6b8e2f852cd272b89
SHA512 3fc2d4ea4463d244b17e68ad07a29803df4e4d3225cd924b13a072419bb965d19eba2645d0b19dbb947797c1a837983ab0cad51016aaffa4682b152a2dac4545
TLSH
T17641ABF3C3E4866E891146F4AA186E1FCE2D0915432C3D5AC9E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 e0bf30a565895c85964ca4aeb233afd4a22c1e560e0fb67c036f6d3fdda23dc7
MD5 26757726cf21d116d51a36adc5579cb0
SHA1 75bb5345e5e106554d7ec5f3c4081f56c4afbaec
SHA512 bef0203021c035a14e625841749f7fcad1a0145c205aadc54f0bd8dce04610bf1c365d2775cc23f5935d1c083e6d62ddcaf7b3b5f078dbdd1b1ab490aa094b3e
SSDEEP 192:DW2NtS/Jt7FneRLya4la9kFXiZV1vgqRC57wSTHct/GKq1Uddgm6DaZkUnp1bQ28:DW2NtS/Jt7Fn+Lya4la9kFXiZV1vgqRS
TLSH
T11512BCFB43F4A62DDE2191F0EA156E2FCE5D0411436C38BA89D86F17A3E2471E141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 73dcc80278cb9b7bf08b192612b5219a2782808cc3f4c93073640fc85e64f9a5
MD5 6d8a91e8e4237fd1ba0c463e6ef28234
SHA1 dc9bee341d078279850d18b3db9550daa6649074
SHA512 ce087cc2cb37e65fb0bc319c85fb2b9b59a262050db608275bbe0ce513507a639fcc7aea1338a776ee914a59670ba488bf8d99cf6976286dcea7f65b2997cb8b
SSDEEP 192:DEbN8GnA+FgWOROujNBwFXiZb1kj6c5vgqReG5fwSTH7foPGKq1U8bgm6paZkUnC:DEbN8GnA+FgWOOujNBwFXiZb1kGc5vgJ
TLSH
T1C832BFF7C7E8A62DDE2195F0AA152E1FCE1D0855436C3C6B85D8AF4BA3E1470E201B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 62516779ea0f363b1fc7f8c3cf8cd82076e12727710bc98b3a422a45afc01ded
MD5 d2a446816ebf54e22edc361c5239a93b
SHA1 de21ac0a637782047806822e487b2ef97d2080a7
SHA512 33fe51a988e51d26c5444618eff9abcf17cda460962f628f0968e544dc80aee44891baa6c9a2a479b51a6752797ca60f97161620271b0ea41a6810814fed0720
SSDEEP 384:DEbN8GnA+FgWOOujNBsvuFXiZb85vgqRC5fnTH7foPGKq1U8bgm6paZkUnCv19ws:W5xcCl8
TLSH
T15142BFF7C7E8A62DDD2155F0AA152E1FCE1D0855436C3C6B89D8AF4BA3E1470E201B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 82b49413d4da7457977aedc5dfad6fa909ba0d470a05855856fa0efabdc45394
MD5 f45a134ae19ecee208edc93c269e69be
SHA1 9a3c8ed89ad5f1e51b360acce9e6fdc1466d3c6f
SHA512 1ba4847fbeb22458d7c0b8c57c71226d10d5eabd7fbc43bb854e30f422384340d3ae443a57bdf5b5cf345ce9d1bdc6673b7b5b6be8a879b4adcc474e220722b5
TLSH
T101D022A3370570B4E6ACBEDBC46AAC8FCF2A30280A22ADD610D06A9D093646C1A07151
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 98186a5d59d9e5c2ca8ee3207384ed0e1bdaa29244859084155b942cedeba9dc
MD5 3a8babe587d41489728aabdb8aa607be
SHA1 248f99cb65d51104de6d550c92aafb035481ed7c
SHA512 cd42acc7f5326659715038da220dc1049d8916ed4772c23bd529beef5f3e6f241100102f826b302730daa562995c2b704ef20c2d55b17285276f9fee0006397e
SSDEEP 192:sxRWRsyM/jK1Ml8wbD/f/svfVWKCA94/0zoA8p42/g6+WNIYD986SoGcrIgIJ:sxRWqlD/f/svtWZ80f/5ISSQs
TLSH
T1A352C81666385937DCDBD20DFA55BF93D6F81563A2901E44AAFCDA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 afeada0c7b1ec491b9d16853a562ed98347381c40ef69e3dcf1dc41b7c3c38df
MD5 a638c394bf1e6ff917ada89165b6f143
SHA1 3fc60a8a311b3767693e76095ddd229eee6e315f
SHA512 711d0a9338e398ddf64d5a5a7a46e947aed0178cb4aec29cb992f3e66816e031fc4151bcd8dc34432962957170f6f14a0b71b4840a9c5d14edade035f377945b
SSDEEP 192:sxRdRsyM/jK1Ml8wbD/f/sefVWKCA94/0zoA8p42/g6+WNIYD986SoGcrIgDsJ:sxRdqlD/f/setWZ80f/5ISSQ8
TLSH
T18352C81666385D7B9CDBD209FA51BF93D6F81563A2901E44AAFCDA0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 780f0aa4357b935eb4b462034a2c765a0dc682fd01abe2b2e8035fc23d2541ad
MD5 a7534e3978858f90cb3074018537ff34
SHA1 5e7bf614e1adcd94231f4b7c0f3a3d6001d3027b
SHA512 55dfc533e6068a8dd6faee3f55eab415a7442d24bac76573ead618b213c88eea4eea65f94ae54713b414ecf58b95e5e85bbc423517a7c814556a40bb41ae9de4
SSDEEP 384:sxRWnLCqem1D/f/setRZ8fx0j/5MhQSX0aSQ2/sQvC:s8LNem1D/ffRZqI/5mpSd/a
TLSH
T16092EA1665248D7BDCD7D619F921BF93D6F81063DA944E4CA6FCDA0C00EA6FD221281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 cb5041a9f4d05305e000071ae4d55c434fa1166e372ebe0f8733fc6922de1bee
MD5 2ba7e702278b283ed3102399af30aac5
SHA1 6adc19835f492aa8dc0cc2ed9344716fd51a3874
SHA512 98da474c2cf13d489497e88016890c80ebdd8014aa444c665d29ad84984b2b01e12e0e6e33f97cbfdf7a577a8f7fcceceb27b188a4bef6a28655fc348adde349
SSDEEP 384:sxRWnLCZm1D/f/setRZ8fx0j/5MM/eSQ2/sQvC:s8Lum1D/ffRZqI/5TeSd/a
TLSH
T18B92EA1666248D7BDCD7D618F921BF93D6F81163DA904E4CA7FCD60C00EA6FD221282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 906d99f5eea5c361e9c6305ac4ad53a3e3e03f4e8e345d327b5beda05c34f1c2
MD5 a5c4f2521c31be9092dfacad3414348d
SHA1 13375bc9e6feca78be6e2c1528bfb9ff404a7148
SHA512 b7140bbb03183d5847e5111b03da3ea2c27d66547b6acc7f62a76c11f4cf29351f749b5d3f4749a7023ff8f559069179c12d9275aa10ad8c93c4120566923c89
SSDEEP 384:sxRWnItqFm4D/f/setRZ85FjJf/5+v6FAOQSXrSQ2/sQvC:s8IcFm4D/ffRZsd/5+yqOrSd/a
TLSH
T1B8A2D81365248D77DDE7D619F921BF93D6F81063DA905E48A7FCDA0C00EA6FE221281B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 216552282cb64aa2e63b5d8ea29dbcb4f215cc27421f4f2ce39aca62eb865513
MD5 5ab40321d87d7a29389510b317188a85
SHA1 9ce5e9e42290751230d61523cb90bd4836c63d53
SHA512 ad0039890fc99e73397ecf9eb87c6af239db62b41900bbfc449c4203fb82c887a8099e57a9b0eced650d5702a4e9007e4cf000967463c3cbbc027d3a40aff84a
SSDEEP 768:aW5WP0Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyc1stro/0Dixc:aW5WP0Wg/XfCfu1jazysG/0d
TLSH
T1B4C2FC2B240CCB7E4F844E6DED25AED76DD801CB9B988D5447EA890C03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\505c8469-1e81-49e3-ad50-450584dd30bc\index-dir\the-real-index
Size 72B
SHA256 2e5e1ff47384b874136bdf02abda66195f81dda83cebbf4108ee55b62ce515f2
MD5 da79bad6951c93beacdd35df488083bf
SHA1 41666538d2a7efb1def71e4396ba18828a575c38
SHA512 680f2298e1915042fba464d8275e472f3953a7bb974d29e50888665305102d5077d74262f75d4f457c634f6a417d4f9f25d470510338cc6625395c3140eef055
TLSH
T115A0021005413031D00003FC90A3E24172704D5A5D06060B42F1F069DDA82C84A5B8A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b9ba0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\505c8469-1e81-49e3-ad50-450584dd30bc\index-dir\the-real-index~RFe5b9ba0.TMP
Size 48B
SHA256 3ba74e1867351747f8413f8c3b3c9e0e86d0e2d42d4ca63b7933f43852bb2c2a
MD5 84d99ffc6919e5077fd19ab4baa4205e
SHA1 fb8a202bd83d2d959a53fc94d7fa8d0bb425dd53
SHA512 051a8c245dd213d3d4327ba794a41b96212ddbaec2fe582bd8e74542733b484be4629eec8b1905e2094ccda40c0ed30f284c46c306b0dd528b6fce7eb480aeaa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af7afd3a-2a01-471e-986e-2c900ab96b35\index-dir\the-real-index
Size 72B
SHA256 7569abb21578c8fe4c99a156d08e86685b4c8465691b027b106b9be9a7232a14
MD5 75b97bf0c73f51318e3c39bdf857f6ba
SHA1 5fe6bc247334954963f399026b8a077b34252278
SHA512 485c64b3456bbb6c644449b455df51ff0bff9b6c584b8e010d047e65c91aad643619ceacec0bb0f2755f260f36ce3a87dcc37daa088e5c4d2987e75e2e78cd9d
TLSH
T1EAA0026242550489C09206B059820352B79BFC1D01014316A1D88469D9911985D2D185
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\623cd082b6202da0_0
Size 61KB
SHA256 debe98ea966b57b1e52b9924ef3e15be5a72c750018520d6df724f45ebbd5a4f
MD5 36da5a4fa01866ba2f6925968d6c9385
SHA1 c2b2787b64ecd51d1831e98529e47a7ffd276de8
SHA512 024fca1596e726f08f6b158ced8b15a92db6a496b3a5dc57d86634f02a4160d80cf8b1d0f206b8b16a08ad071778a39451c1f18d41fc45de52197ad187181d7a
SSDEEP 1536:WENYjzz6x+BHKut3JHjvGEs7RONVIqtNemVyC4SHHPwqpzG4/k:AA+0ghGEEROfFZl/k
TLSH
T1605318A7A2626135C7AD21D1A4967F01F12B13461444CAECF0BD66953F18E8B63B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 f14f34f29b9561b31e9d6016b8f12904eeea66e3a5e63017a7baf8e3b7c73cd4
MD5 69673497e30eb71674ba84e88f32ceaa
SHA1 81c6b6aff4804d684db8dd2e3a96a9599947582c
SHA512 5797e8ce19863a7a776c9a2100439f049a9ac10c7275eb0cd8ba1b6433362b95adf4ecbc5e6b7c1877a65a071d36085b4b7e7faf9281c1d1b9b46a6e53e57dcd
TLSH
T126A0021406813805E40B52B237DE15B336104D91461113278590C4CCC8D8B85864104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
Size 72B
SHA256 3e65c279e18d5c7d1be659289ec1272210944c23fd3b6574d0b0a4f11e6ded9d
MD5 8818c610b04dedee08b340df41f02f9c
SHA1 0c2b249a4354239a8df60e241a467fcf8b6f8fa0
SHA512 528b83ae62d1dfdf7a025c9ee07f5cc17af0b9d099410d8df9071ffd1cbdc2b9e53cead3b51930d445b9e84e4d8ccb2985297b0ece0f35cf9bb7985756b21795
TLSH
T1C6A002D406C1B401C0065BB225D6116532506AA00621537751E0108CCED5B4545410CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f1fa1ed9-52d1-404e-8999-131f17701967\index-dir\the-real-index
Size 2KB
SHA256 1870a8c95423973812136c90119113e662c19b97d9870e43753be8943e1853b8
MD5 907c6e21bcd5bb5a46236b826757a7e3
SHA1 2534d1c8ab3337ca5506160c60eb8bb6bdaae9c3
SHA512 65d717813c79f3afaaca9f908b08c94b72de59318ec382d55c4776b5f2b11cd69a4955c6cb611587cde27cb0768bd250fb4fd45fb87b9b1c9345193c6b33733f
TLSH
T135511A4E4C872A5BCC7E217235F60494373829DD16384F1724AC963CFE8752C29E9B59
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4ae0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f1fa1ed9-52d1-404e-8999-131f17701967\index-dir\the-real-index~RFe5b4ae0.TMP
Size 48B
SHA256 c5ae0f50c010a5c06f8ebc9563afb54ddc275fec0865ab1d47d02fff0e9a6949
MD5 945b837a077ca57ffdda1d593f37e07b
SHA1 9d3a02fc484189c1f09e0f616843a8b72dc8f0a1
SHA512 1316453211a4b3fceff7bfb2aca9dd47cdf0faa23bd4c503a24a880d8eb25af562ebd929a800fc294857516cf7059e02a1c443238e89ea4b4b4e777a7635d359
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 5cb70a049c274e5e77c3afe67e455ea9c206362e680e6820a603ddec82eb875e
MD5 3f0ae5b7cabe51fdf024d2dc8502439a
SHA1 fa4943f3b6d0b4b7af1f66af54e8765eee7f82fb
SHA512 23fa23703f8742a62af42d0ec091ee30658d9124fa3c7e66b2109c04e740565ffe30cc2af7208dbd294219038b75d87da4d14f46e5fb639d8e24825e4ca55257
TLSH
T134F0E2B22FB71851FDAFD3E6243144A10514BC48885AFE4F1066B686C4B2315261AC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 957671dd3e316f977fe74b36317050881135681c160075babac7566c0ff5371d
MD5 c5d6f4d8d1fe75615a6d55508da2bf05
SHA1 7a5623ecd4718c8d1a663b99bd1a30c526d10a98
SHA512 b68586ac1305477e840447c80c076b42cf36884c629d8aa4aaab8dd2f398dd381c386aa1571b09b5a1db6138d03481e1547e49c28acc0854d097a3334835715d
TLSH
T16EE0D8762EA71861EDAF93E6247248A50515BC188D4AFD4F502BB68794F23112516C36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ec54288327184c4c97869b72c18c2b4846d0bbd746a966b659a9679a8c2e1860
MD5 b583be54d7c420b59572485c7c625b49
SHA1 4f6f99e738befdcd42dba395ad4d21a7688e47a4
SHA512 7bb471cdacf65195178329fd72728eb351ca642460c7112f944bd545f4164dd4d99175524d34a545152bf1a282087a4e8e6e9d50a503047b978a88292f2af7ba
TLSH
T1A8F027B32FF71851FCFFD3E6247144710515B848886AFE4F1067A68684F2325265AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 53c22edcda6b06f4c9a8e49f7e1287924a92b3758a0fcd7c957e723237b96597
MD5 829c0de55b4b829daa994cda1492e725
SHA1 94699614b871a6a85bf4397e98927416afb937d2
SHA512 28726fb2587d04c5010fcca29cffaecc21cdf13b2382d3264de209c284e984b3b9ba5fee7a60953e8171e24a09d9a03a90d06f79fc131cecb4bf9e32d5cb663d
TLSH
T1E5A002928E49D483C805467570A7528133E5499E0225633284D8F5988DA715491C1541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b219e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b219e.TMP
Size 48B
SHA256 1d71452423174ed25d367c1414b9d42097c6147a0177710a5250046881c8b040
MD5 9ddbdf247ff510c90e17344e70263d2f
SHA1 6144c07d41dadc432e7fd7ac750212834aa2b2fd
SHA512 a405e399f41ae71dac10aa5e7f91eb38268a0377a9d7c8f79b0fc5a26298001ed5dc20e27a32a599e574c15859465321bc4d5152a3ab64444898155cc25ccc06
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f6952f0145f883457f6fed2c1562d10577cea45b127fae5f019630cfb30f416
MD5 62b1b0b0a1f9b3f454aa0e0ed188675a
SHA1 e375e9a480edf8970aaaebc958214b4e6e9e1282
SHA512 feda58be8c4d72bb8383d5979acd3bf97a9dd469f7eee86725d357ffe983ddb2691fae9d174369ebac94a8b256a0190e2f98aa5165314996e6a4d52445dd55a1
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3yYgKxKE:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7z
TLSH
T1B1912705313742803DBD7A4980E48D1B93C278A37219B52B7BE8469A8F67E535EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1203.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6572009bda5d24a53173c248cc701dece10b65318a53ee531d1a95c9f84de357
MD5 f680e6bd82acc913dd9eec2e2cfd705f
SHA1 a276e7933bf436b98a6e80bb930c58da752cb04b
SHA512 998ef646a433e7fe1ed4cbfe663ee9f9fed3051f1c72a1bb2a4743ae4b8988c5381a0e8aed07fd70951e6a25a61b71a2a6a22b9600f7cfd47af2dc66f9f97e08
SSDEEP 384:utNn/s3n9St38NdbEdvt3pVon3WZlf8hyEG7OMFAy2rEoajo4cdR8eHhVODjYPNt:uj+9i3zonUi0norEnjN3Gac1FCb9Mdl
TLSH
T1CFF2BF366DA98EB34CD6D395B1433A42EEE1579381C80AD48ACDBB0D06DB5FC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bc277fd502ffbef4605d081a3ab26ff73bce968cd6cce8c95def1e2769332b75
MD5 3f69d20da3755478a19a8a414459fc27
SHA1 24cc09a0699d776d945ee244b3f901d683235c86
SHA512 5638abb4991b69a6c7b5ce2e4650b8f23364197cd5ab5d6ccc6fee6409acc59668b675f40970d918b5f41c9842aa2c8b466a02239deb61222a4f3e8e17efbf5e
SSDEEP 384:vtNn/s3n9St38Nd2Edvt3pYon3WZlf8hyEG7OMFAy2rEoajo4cdR8eHhVODjYPNt:vj+9i3a7nUi0norEnjN3Gac1FCb9Mdl
TLSH
T1FEF2BF366DA58EB34CD6D395B1433A42AEE1539781C80AD48ADDBB0D06DB6FC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2040c09896576ff24e071c3adc0b40fecae6d41f53a00d4ce8eeaabfdb1747b0
MD5 4d9e5133659cb9c0278008747207b999
SHA1 f2a34521680bbb0d4ee4ec5103c8541ebcdb5860
SHA512 8595bb49306c76afa7d1e6dfe8cbf125ec53563dcaead80b152d70a54ae782a41dcbacec5959ae9be71fdc0745eb87cfdcf7eca903665a6b537bfc358270c9c3
SSDEEP 768:TF1j+9l3AwgB7nUi0nFrEnjN3Gac1FCb9Mdl:C9l3gWFQnjMaJb+P
TLSH
T19903AF336D94CEB79DEACB85B6473642EEF142A3C5D40AA497CDAA0C02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 afca07f51f440c41119a6427f75271990d31826bf13c15c5e54ad8c58ae6ea4d
MD5 e57e94b52d81cb12a60a92377674dd57
SHA1 2269e82a4786635f484ea7cb317cd7b3a29a881a
SHA512 8b57b78aeb8acf020eac5724742b8c31e0005ba924b58025d149aaab6ed1dc7c7a53209ade6409f5f99e7a793a26ad3c323ee3ab003e7c48c94111e9a00c5ed6
SSDEEP 768:TFpj+9J3Kwg+FC0i0n/rEnjN3Gac1FCb9Mdl:m9J3Fx/QnjMaJb+P
TLSH
T174039E376D94CEB79CEACB85B5477642EFE142A3C5C40AA497CDAA0C02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6b6920396b826f5ff6de2f6cdb0a40837daa742aa6066bd82731b1ee92e35609
MD5 321b14396ca38ec65629cea26b8358e2
SHA1 6f78a85c3e74214d395c24b6feb040474650dbda
SHA512 78653529523dabf7d9ef5b18ef9f569e53d416816820b89099564f37f8df1c7c947eab670b2f66526fd10eb6fc13a39506987cb192e2cb18c7b01738084610b6
SSDEEP 768:TFKj+903Kwg+sC0i0nirEnjN3Gac1FCb9Mdl:D903FuiQnjMaJb+P
TLSH
T191039E376D98CEB79DEACB85B5477642EFE142A3C5C40AA497CDAA0C02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d44a6f318f0d7e7e52e7bbe1d3d7aaf03ec587366c997a9ea6c97d62e7c12f1a
MD5 d6bbde399130cc56213829ba24b24fef
SHA1 6d7424b3f2df2f9bf0b7c3dfa35919f915d4093d
SHA512 29dc8cf5c784186b38f2323d89536fe641c9acc40b30c8353f3e3ec48a485df131790fc8037f16f85c2f7a2e8173bdacf0185c551639ccb90ad6eeb35536d51c
SSDEEP 768:TFQj+903Kwg+EC0i0nTrEnjN3Gac1FCb9Mdl:1903FmTQnjMaJb+P
TLSH
T188039E376D98CEB79DEACB85B1477642EFF142A3C5840AA497CDAA0C02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 69664c32d5c2710a561bd5853cbe381265453a6e3c8fc05e472743a793a8b5d6
MD5 bbf38576f78bd0cfdf2e89bf7ac972ef
SHA1 9c806d961ef6cb434fb2cbb843dd58de8cea8ec0
SHA512 0eb8de390172666c6be0f9887a6ece21cac7e800da6c5c3e7e78abc54847e1308240f02260160e3365978af492038301b2f23a5c14ba205bbeca7de24993b992
SSDEEP 768:TFDj+9y3Kwg+sC0i0nirEnjN3Gac1FCb9Mdl:M9y3FuiQnjMaJb+P
TLSH
T145039E376DA4CEB79DEACB85B5473642EFE142A3C5C40AA497CDAA0D02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 732cd057232da6ea7490414eaea5de055b8f8272d13cf125465ab18faf83a4df
MD5 9e71cd1e4b955280ce86cee3cafd39b8
SHA1 181856affa6a49cc1eeccca8326a982a63129b7a
SHA512 792f788e59f6f808dfacbfdc6a29d4d228d3560f94afdc10aef1b251730a6150d2f86275d6c94fd9e0347e2180f27fb1dd7f3560e1978feb806422fa8c1f4494
SSDEEP 768:TFWj+9v3Kwg+zC0i0nFrEnjN3Gac1FCb9Mdl:n9v3FDFQnjMaJb+P
TLSH
T15F039E376DA4CEB79DEA8B95B1473642EFF142A3C5C40AA497CDAA0C02D75EC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b230f0f05d74475558cb66694493cc545a1b673f54c0f9b9c9b77186632ad0d7
MD5 f496be93e86d28661ebc09ea958e3e10
SHA1 9a4d3c5f2d40de49f2ddd76b5a35116b6fc5d7b2
SHA512 67624cdef7e087d1b314c16884a3531f20ae78d274f28c105d847498fb7b41279a31ef9785181ffbc60dcf05032b3a1837cf4810ea817b581cc22e84fd1f2dd3
TLSH
T1AAE00213670004FDC07D4B3415832B905AD3C03492F10206AFB011A4ACE73102D34FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f80fc41b3177778021fee32c105a5fc72f9740b2e15004ab06825347468bc844
MD5 c6ba09a47ed68dc27017e46aa5352cf1
SHA1 c5c911248229d0ce816070be597d8e422da08a3c
SHA512 bdf5fd27395963899053c3f880842fc6d117358d35de448c7ad54bf0c659148c90b23e8723c8e855e86a9b20f6f476eb971eba4068f2c23615add30a3567d4fc
TLSH
T194E00112A76504FEC07E4B7911832BA49AD3822492F1020AAFB011A86CA73162E74FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 763a1527b8443119ec155adaee738a1127b5841e3f576a2e389a9ab65b50bc6b
MD5 193a26ffef38d632c1988c8939bce987
SHA1 dcb7bb3dc96bc9cf53e083d2f5cbfdebeba2ee5f
SHA512 abe8e06f2e1940b023d5bb13382f80c80476815f068be5caf05ce49b452c9a60d920f0f24058edc74c3f6a1baf2ccc29242180e243b953523500ab6de6ec5972
TLSH
T199E01213531000FDC03D0B3400832B905BD3C11041F0030B9E7000682C633012E30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c405e57e401c2bfb2ef8db7c313db227d6beb4d47d2a144f92d1dae11f037df8
MD5 020d5320aba9f71de1bced3183733430
SHA1 ef70a0b5b17f4f6d93f76e5fd9a344cc932174be
SHA512 2b8b315d7fa974c6bba0064fd67b8474f96e9928c25dc8419c8e5c77fd2e2f702aa57d49c7ccb03fae1c8daf4bbc9638ed30653a6ed16a2ed18490904504d9e0
TLSH
T155E00213570000FCC07D473404432B401AD3C03051F00205AEB01194ACE33102C34F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ee12bcf09a4b143f8896a6d8e737716d43d2e2b1ceff6c3081cabab07e851828
MD5 9e11920978eb8ce691aa990e84ff70c1
SHA1 1d7ca4f48a6e4977d15b1aae533b027fd4d5e56a
SHA512 a54c5049a21117fc274da2f9e0450dd36d036d2d9d834bfa8f54fcf19a3699e00a520b1b1103273f2923aac3c7b0d92363d2e2f52a4cb2f485d5bb0e0d589e96
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 204d82f4acfdc2bf826d5d87e6d39fb2f1dfa6d4c7c2e79f4854d71d6665803f
MD5 acaa5a4f0cf709a46f91d78dc3602f33
SHA1 b079719f889f602568f6dbec29aef75a75117e91
SHA512 049612bf88c7292304208bc4c22ce4b3f36443764fa3fb873b8358270fa17a41ab8ae6f9d9890adde9073675e9fccf46f0a70421f50b6046a6f8eedb9f8de59b
TLSH
T12AE04822935000EDC03D0B3400872FA1AFD3C12051B1030B9E7015682CB37153F74F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d3c74e6156ba8d704b76b516b0b3b3f96b721ca73d479f643c7365901e2a01d
MD5 fce200c7c32314a058c1077ae1999b9c
SHA1 8a47223a97ab17e5a75a793c821d28947f19718a
SHA512 eb209207f80ce84df9ee104c2241869661f7c7bd00719ff9de4092ac04e8db8a47a7310911e37f84092370e92b7acab13f09a44a40ba00e6fc5f801fa2b64a0b
TLSH
T1E9E04812935000FDC03D0B3400832BA09BD2C12041B0030B9E7015682CA33152E70F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5afdf9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5afdf9.TMP
Size 392B
SHA256 2caa7ad5705f756a0534d26de7ff0a95abb666d818fa1c0cb93842a2752e8704
MD5 d335fd842e1bde856a9b51d329c11d58
SHA1 4dd1b0adc38b4a217c28e790d48f26a82856746f
SHA512 c42a568057ac0a429e0ed1ff6985c5a758b6a9782a56216c24b35e2f16f9f181813e86922f1c95d42f4016789a21f8ca77337535784cd320b63808f4ce2e6ff8
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/1172-175-0x0000028101210000-0x00000281015CB000-memory.dmp

Download

memory/1172-176-0x0000028101210000-0x00000281015CB000-memory.dmp

Download