hxxps://gofile[.]io/d/X35SCG

Analysis

user interaction
yes
max time kernel
868s
max time network
851s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/07/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/X35SCG
Sample260714-r344sshv6v

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
27	api.gofile.io
31	api.gofile.io
24	api.gofile.io
25	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4116	msedge.exe
5448	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285138552405129"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{D7D43264-C4B5-4A02-925C-2FB023278E1C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "9"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{FC4C74D1-387D-43E3-BA4A-3CD16B408005}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c00310000000000ae5cac01110050524f4752417e310000740009000400efbec5525961ee5c87752e0000003f0000000000010000000000000000004a0000000000b4d5f200500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Cravex External.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5436	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3036	7zG.exe
Token: 35	3036	7zG.exe
Token: SeSecurityPrivilege	3036	7zG.exe
Token: SeSecurityPrivilege	3036	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
3036	7zG.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5436	OpenWith.exe
5284	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2104	2220	msedge.exe	80
PID 2220 wrote to memory of 4116	2220	msedge.exe	81
PID 2220 wrote to memory of 2716	2220	msedge.exe	82
PID 2220 wrote to memory of 2716	2220	msedge.exe	82
PID 2220 wrote to memory of 2716	2220	msedge.exe	82
PID 2220 wrote to memory of 3116	2220	msedge.exe	83
PID 2220 wrote to memory of 3116	2220	msedge.exe	83
PID 2220 wrote to memory of 2556	2220	msedge.exe	85
PID 2220 wrote to memory of 2556	2220	msedge.exe	85
PID 2220 wrote to memory of 2556	2220	msedge.exe	85
PID 2220 wrote to memory of 2080	2220	msedge.exe	86
PID 2220 wrote to memory of 2080	2220	msedge.exe	86
PID 2220 wrote to memory of 2080	2220	msedge.exe	86
PID 2220 wrote to memory of 736	2220	msedge.exe	88
PID 2220 wrote to memory of 736	2220	msedge.exe	88
PID 2220 wrote to memory of 736	2220	msedge.exe	88
PID 2220 wrote to memory of 1328	2220	msedge.exe	89
PID 2220 wrote to memory of 2144	2220	msedge.exe	90
PID 2220 wrote to memory of 2200	2220	msedge.exe	91
PID 2220 wrote to memory of 1328	2220	msedge.exe	89
PID 2220 wrote to memory of 1328	2220	msedge.exe	89
PID 2220 wrote to memory of 2144	2220	msedge.exe	90
PID 2220 wrote to memory of 2144	2220	msedge.exe	90
PID 2220 wrote to memory of 2200	2220	msedge.exe	91
PID 2220 wrote to memory of 2200	2220	msedge.exe	91
PID 2220 wrote to memory of 1272	2220	msedge.exe	92
PID 2220 wrote to memory of 1272	2220	msedge.exe	92
PID 2220 wrote to memory of 1272	2220	msedge.exe	92
PID 2220 wrote to memory of 1456	2220	msedge.exe	94
PID 2220 wrote to memory of 1456	2220	msedge.exe	94
PID 2220 wrote to memory of 4060	2220	msedge.exe	95
PID 2220 wrote to memory of 4060	2220	msedge.exe	95
PID 2220 wrote to memory of 4764	2220	msedge.exe	96
PID 2220 wrote to memory of 6120	2220	msedge.exe	98
PID 4764 wrote to memory of 5004	4764	msedge.exe	99
PID 2220 wrote to memory of 6084	2220	msedge.exe	100
PID 2220 wrote to memory of 6084	2220	msedge.exe	100
PID 2220 wrote to memory of 6084	2220	msedge.exe	100
PID 2220 wrote to memory of 3724	2220	msedge.exe	101
PID 2220 wrote to memory of 5176	2220	msedge.exe	102
PID 2220 wrote to memory of 3724	2220	msedge.exe	101
PID 2220 wrote to memory of 5176	2220	msedge.exe	102
PID 2220 wrote to memory of 5176	2220	msedge.exe	102
PID 2220 wrote to memory of 2196	2220	msedge.exe	103
PID 2220 wrote to memory of 1664	2220	msedge.exe	104
PID 2220 wrote to memory of 2620	2220	msedge.exe	105
PID 2220 wrote to memory of 5540	2220	msedge.exe	106
PID 2220 wrote to memory of 660	2220	msedge.exe	109
PID 2220 wrote to memory of 660	2220	msedge.exe	109
PID 2220 wrote to memory of 5784	2220	msedge.exe	113
PID 2220 wrote to memory of 5784	2220	msedge.exe	113
PID 2220 wrote to memory of 5784	2220	msedge.exe	113
PID 2220 wrote to memory of 804	2220	msedge.exe	114
PID 2220 wrote to memory of 804	2220	msedge.exe	114
PID 2220 wrote to memory of 5668	2220	msedge.exe	115
PID 2220 wrote to memory of 5668	2220	msedge.exe	115
PID 2220 wrote to memory of 5668	2220	msedge.exe	115
PID 2220 wrote to memory of 2320	2220	msedge.exe	116
PID 2220 wrote to memory of 2320	2220	msedge.exe	116
PID 2220 wrote to memory of 2320	2220	msedge.exe	116
PID 2220 wrote to memory of 4108	2220	msedge.exe	117
PID 2220 wrote to memory of 4108	2220	msedge.exe	117
PID 2220 wrote to memory of 4108	2220	msedge.exe	117
PID 2220 wrote to memory of 3260	2220	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/X35SCG
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff9a39cc188,0x7ff9a39cc194,0x7ff9a39cc1a0
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,10445752838877362873,5343422543721101039,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,14457695533802858803,909365371558797782,262144 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,5829173652182363699,11769840220738964192,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:13
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,7279938855794759271,14907707657609376212,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,8643070885882512437,17196219646143985058,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1616,i,1181217186679244557,13382114596536110266,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,14336526671318396675,16969938732800264884,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4184,i,15239748547903122607,3298195556956454266,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,8923325928809123137,8715170842294393231,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5332,i,6433879976814197684,6512507995365354836,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,4902078303798800158,18066857020267272579,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,234353376338710643,9883144900058957889,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,17830935654994084638,8373716342835386146,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3216745343097294223,13939142316649108385,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3216745343097294223,13939142316649108385,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6568,i,16698396458033348085,18404106310773278428,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,12034472370307760932,7155879990424673897,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5388,i,5671814293345640923,16917613537321523847,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13519358021918375128,4058564166683359866,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6486680122874681968,701308930940826447,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,16014331832512745468,6233825786223660148,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1534924983997191595,3628508714148853191,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,17591482803903011167,6030355272500840315,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2192,i,8265842132997913910,12460097844646976954,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14684601597193328235,17003974151022523186,524288 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7156,i,11472690082673253367,4426732121083095230,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7384,i,8124041550796607513,1596627658761281286,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7588,i,10828689758237056156,16068200163509388972,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7592,i,2377485512773096441,4282495159764098722,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7872,i,16100943682034780972,12390428178426786104,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8024,i,16593776947749028928,18126115936518197597,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7856,i,1942619339792302886,5135652690277647902,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3620,i,17192838477976543417,4852919943436726396,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8172,i,3329952352030971309,2097898798230595238,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6872,i,6822989238871628846,8440862892844361100,262144 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8376,i,10539502220968750276,14829793213764593111,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6076,i,1254127769506019610,10666050321706766183,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=3196,i,2566499517951345500,15855218932037537987,2097152 --field-trial-handle=1884,i,8155043030203275166,3372595078899802373,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1284

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19736:92:7zEvent6876
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:6052

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff9a39cc188,0x7ff9a39cc194,0x7ff9a39cc1a0
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,483311914192004403,6068644068311599949,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11061236610062105650,16790915546286752619,262144 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,3920638570406014480,11770547344340916100,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3711543492038445076,6925838726639767192,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4677033193915136500,1655320772054903996,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,12090457116473926400,14050547637850817207,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,14371390796100304518,3376973685672056242,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16113941920643719729,10768414136385120233,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,1866570961510704820,3763259003474956053,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18027214139717380064,7141471401765590503,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,18027214139717380064,7141471401765590503,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6283832810410719922,11948765204422627146,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,17828442800563842418,7586309586644532426,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,3208842455724278658,8974634134125263958,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6056,i,5410509500966097989,3078991635556375046,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7004,i,1714179638542352678,2328946836358656166,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,6608207628664447196,4091280853159703268,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,9221489025253113218,10813137273259962970,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,2050768641795742663,7599304201983332031,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5488,i,8044793539076974762,4210472215556898671,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7032,i,6215938249844804390,8084473556517730604,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12706784317785050261,7307561431390664373,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5400,i,427121865121433648,9038320027797140550,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,1636892345749971305,1215886325517727115,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7392,i,13615689372150794501,17313101482137967600,262144 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:10
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3292,i,15099659599670046559,2765553442643252078,2097152 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,5654693788863372471,1774783347906694054,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5483066100210864019,4334212192961402589,524288 --field-trial-handle=2136,i,4154919915093654785,16859976252951485813,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:14
  2⤵
  PID:724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ff688ddae8dd102528ea9c9a6499ee1e52644752083b0333e68019b42473be9
MD5 b793393c9802c1457c83946fe99789f3
SHA1 2727d64260bc38f6ab676786b2503535a02937b4
SHA512 5cbc4af1bc977c9b339dfa56cd0aa9ee3943869c20d9c4590b08f8f5fa953c6349b2adb65381a123714657a15124234777adc9e7ecdb9d090583b387e67887da
TLSH
T1F4D0A730F66568E2D1242435D8614F00B6654552256B86816360480C9C790C197C3691
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05c23be787c847751fd22e618e52622fc6814a47663bed7e301a736e7b10f5ef
MD5 0f9c89eb92723dbb25a23cf0d0ffd4dc
SHA1 874f805d96000b31c076cfc4f5f6dc82aa3003e6
SHA512 cf022f7eb2515317e73de1cba6853f8a78b5c8921bd800d1bb6af33b3ce8f20cf59f179fe22a021c3ea08e6658d506db87330a5de65a60be09069105af3656f3
TLSH
T1B5D0A770F7641852C7063430A851CF1177D15651295FC9D15360440CAC790D1978B141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2c3408dcb36a7050789b8cb20466a31bf296acf42f591c1343ef5012494ef64
MD5 2b92a2fa5be72220ca65c0fa2c4a2b8c
SHA1 4a8e42be8334ef50e2c9a2b308f9145572847adb
SHA512 a9e4782f4d559c5e7d7c970f6dbe951b13ebad3c1c9d2c8a95dee0d1cc02fc3e10aaf75bd77cbf8469b3061e6bd678725e302e52e68448124a9fcfa15a05b3bd
TLSH
T15ED0A770FB645852C7063430EC60CF1177D15695295FC9D15360440C9C790D197CB141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 78KB
SHA256 ef68c66c7c756f218535eafdbea892f76d9dc7661c7aa67bad1a5d5c208b7b04
MD5 6f561ad738b0c00886b4831e0bed9c7e
SHA1 3de61cdcca88b0979a64137bd0b86445f3068ad3
SHA512 7d2c16440cff2ed01ac6d901ba63a43a2cc66f3ce8ec9df6e68c5355970e3694cbb11449bbb3df450e217484b57c0074332adc3c11ef6ba6db8413f81051245d
SSDEEP 1536:i3/GXD/r20Q2vg5CvIBg7B9XM9YLThr1/2XgEjY1RgNYVG9QGtqw:i3g3rg5KbKYL1p/Us1oYVGKGtqw
TLSH
T1927302163CCF0EE4928ABF61CA26C5E681F2D7317538FB83BD036478E57A885A45415F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 19KB
SHA256 b9e910102d058a696ccfcc1af565d3844c952c7e2127915ee2953f66839a9555
MD5 9f98b25682d26512e43c53b3ab379849
SHA1 241687b6aba85f978728113da6a9831378bd6320
SHA512 9cdd2d1b0d782879d8e089292d6b7e44efc176ae733e0cd223a1815636eb7776afdfef1d46a63121a1cddf261aa1af5741138e5026d8abaa1586f32507068e80
SSDEEP 384:720rn9jqnI9cpR2kDPi+Ck9Zl+jog912SHX6Xr6V3FFBH/nRLQ5wDhxCmH4I1:nrclta+Ck9DoogP36XmZXBZPDbBH4Y
TLSH
T16892C0A09992C88ECD36F4271E5EE9C3595CE4917E3A0BBB07D26D5B084164A7CB21CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 59KB
SHA256 ab6ce8ff54d1f01c22dddf7dc492329d8ee36fda895288fcf5d111847f95b6fb
MD5 aa060b8f7eac87b383d031c5e0fcf85a
SHA1 622b5c4479702b776c879b4e837e45c1aba0bb2f
SHA512 13a7ae181bc7a20d8bcd0749af9283099ec4e203185fe226bc349b7ea8f60a35d7c6dc52c75bea86a94468c4f3677c89b48472a3ed0f4764a6f899b44163d84a
SSDEEP 1536:Cku8cjkJcFRVdtrDBg/IMAlV1W4609HlHxtk6v3LVV+4:CpxTtrDBwAlHW46CP207X+4
TLSH
T1D853F20BE27CC9639D18546797146BFF3972B2221A1BB46ACCB877DC0C451E14FDAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 35KB
SHA256 b506390b6b804b7c6b3d39fb820aa66eea97f219f3494a7c120c5bc8981607c3
MD5 98f98e1f6575155780d3af4622357e31
SHA1 57443bea9b429a5b87370c05a6503d1868299852
SHA512 3846de124e1230e434c5d27107b1ad35b60e17609169450bf5c5275c0bd1b5930cd15961b0890084b15479493a772c8b4f72df1012c4859605b8f17bd6b81fcd
SSDEEP 768:ZdT/yZX+8FbWLC9AAcwvtAcybB5EKViTwSrGGIRzDzJ/:ZdTkugb4C9A975E8iUSrKz/J/
TLSH
T192F2F2F62872C463CC0141AE3553359F15FBC2DABDE966D63AEC6717DBAE021B530600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000105

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000105
Size 47KB
SHA256 d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
MD5 dcf31ebe107435bd68e0164d59e19b87
SHA1 b68160c9333af833fe483928b3ef7128c07a56a0
SHA512 130cd52c3cccc36a7029bf92b2ddb363b8b36d206454aacc246739919552fccec5cacbad615ba4ac3817da3e83239371fe51324bdadd08357e3495087f62cb08
SSDEEP 768:Jzqdwl5YV7FVmpudK5a8dF8D8Z7J78VGnNFZEKh02dmSTPe9UiallHcOEi2c0NC1:9q+SYuMaVwZ7oGRNh02dd6UialBcOEpE
TLSH
T11623F218F29471F7EDECD4D500A18C72BAA528D442F116ED07B8D53CA36CA817A729FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010e
Size 161KB
SHA256 d6ed5df986f6876d6cad399afaaaa1ba93e2da2e693bb52e5b5f36048360f463
MD5 499c666dfae11130a79d183d905d2f7d
SHA1 a6e5c27c3faa60c66480fb607d67cbf5eff47ff1
SHA512 9519f1fb428af4a540924ee4376df629ede84d30a90d7c9e6654641467c02afa7ab4478172eb9dfc6b8d98693ab47eb61ba299d778fe7e8274e5a7499189da2e
SSDEEP 3072:0Q4u1wUMQnIkrWgLN1834LFy0RzS3MVbbF/Lq00vFJ7fMJRRvQNq310:0h8wUMQlavCySkuNfU0x6q3m
TLSH
T137F3127DC8A4AAFA2E1029D245C3C19CFB7E0EF151AC05E642487A39C93657B25712FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011d
Size 39KB
SHA256 689de8b3abed60402ce46f054550080d0337b9a115a72cc7187b316c5a79d9d8
MD5 ac614ad24ed3ef24621cf1c3339ec402
SHA1 5166d08664ee84096205cc0c5272a48981d66b66
SHA512 8decbac5ca88b90def409968aff40aa5f5a9b89bceeb5699676cf07301c49b46583777e3f8e48d65900e42c710fcad3001b55f78e41e9d023a9351de5bb6aa31
SSDEEP 768:emsndE6KiOARxAIEKQjVwphmlghxrZQlK1Ojs30IzITg7mXrJNVw:TgzlEKeJPKWs30IzgymXrJNO
TLSH
T10F03F15918B8894304EDE0D887E82F029E33C13F3611119DB3A9496FDA0E75F12BFA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 0cb7becd937934a81fc6e0aea0c6c7f06c4be50ed5df0f5b5124bc23ad825bcb
MD5 1dc25f787b77c5e15bbab444168ead0e
SHA1 62a026c6022a41639fff4bc347846d01e27d9294
SHA512 844445d50d46e18c248f411cf3ff18685c5971b171c2219a9790fae6d8b4942caaa03499b06c9b529547d4d459f08e1db8be1f6fc24718ad76d52e4e9f30a7c2
SSDEEP 192:xLl/Y1lHoFA/xh6r1OYVlpMHCvn66x+b69Hj:xLlQ1lHkAZhqOAnZxm6Hj
TLSH
T19F12A56672DA1093DFC58A339AC5289E3A76A8E7033B7E1A5514ED7E14923C7C2CD138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 9b6a6283f4b5f519cdc7990a8eb751cc88216f01e5cd15338fe2b8f9f295bc21
MD5 e7fe1e8a4d85c0063098eae0c074c7d6
SHA1 8fe7fec711cb6756cac693118dfaab16ab9cf1fa
SHA512 66369ffe1e90788c9263dbb29379417bd99da94e6ec2c3a29297959eaa5334bf61d3e13751ca357b4001b578cd52135403661bc6d0a3c94650e3d1b78276384e
SSDEEP 96:nvVNAbgS11936m/W/YYsR/PUMTYXn9E2zk5Az8mYLVpkxr352tnb+:nvVSf11936EW/hsR/MM8Rzk60poc9b+
TLSH
T10A22D821B2D64093DFC58933A8C528AE3A76A9E3433B3E0A5504E97E24D77C7C2D9038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c5243ef04da129a34f024bdec567ed9c5c200634120d948816a877675c5981a7
MD5 96b41964fb9a9e8dabbb9950e6887a81
SHA1 5f387ba59adc64a38f78eabec2fd3640db4ebc37
SHA512 1b3aa3b75bef388af34a32c7d01a2bce87eef329c7e7750ec22fcd487e2c5d04654279b9590e26d8f278c7613c1e615a867b89848e2f3837017c263e6184450d
SSDEEP 48:pDBZjO1ZtWULtgsSz/3Czxrj7lTEiS1Qu3ru2MqSP8jWrk4gRpyz8:v9YZjJKQNTpS1H6//2Wr0Hp
TLSH
T1AD81E43A259B8923EF914F30C0C102DE397BB9B7073B3D422A2478B755647D6C3EA128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 06601e219e04fe6ddb7fd8e81d5a48a80bcbe368bead5c58d7a1381b7aba7e03
MD5 8e447102045d08bdaeea77a43e9f9fa7
SHA1 96c8023e598361f597d152a720c598449ab264f2
SHA512 656e2c13ab2b0da23453e50361e00390ad1e39c0d5203cd3f9f2d607b977f3164184c14ba798258aa8f42624168d85958e591dcdc470c350d6840560967f44df
SSDEEP 192:60Ll/Y1lHoFA/xh6r1OYVlpMHAvq6gb+b64j:ZLlQ1lHkAZhqOmqDbmVj
TLSH
T13212B66572DA1093DFC58A339AC5289E3A76A8E3033B7E1A5514FD7E14923C7C2CD138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 dfb0245bcfef80377b873d1377c0595fd88b4e92fc231ba83b8763fad642ec9e
MD5 6cc5c6c0f19740fd4ad1bfeee208eb48
SHA1 4e4eacdb41854dfd663002716f4a3ee4e74dce1f
SHA512 ebe0dde486ffc3f17daadcce1659269433fe98567eadca3625023a7d718d58842ecb1b7eb74b574e4b74226eae4c73fdf8e6a0bf5051b337c6e75e41fa0f9c79
SSDEEP 192:FLl/Q1lHoFA/xh6r1OYVlpMHAvq6gb+b64j:FLlY1lHkAZhqOmqDbmVj
TLSH
T16912B56672DA1093DFC58A338AC5289E3A76A8E3033B7E1A5514FD7E14923C7C2CD138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 b6bf1431cd49cbdd22943e2514d257a2e8300082f96ea79049c5f0a8790a3221
MD5 b422b6b79076b803d0ac16577e3d6b15
SHA1 fa99ce95ad6cf6ab8027e96291727a8b4ac800aa
SHA512 c6663c5fd0d816adf422e50af96ece5f916645dda22104abe01e982f9c2ffa2e5ba5dada9c91e4a1ad8b8857ecd9c46ca01427d1d89c834b96596020e15ef190
SSDEEP 192:QLBN1lHoFA/r6r1OYVlp960mvh64qb6LW:QLv1lHkADqO4KhbaqW
TLSH
T1DE12C56672D61093DFC58A338AC5289E3976ADE3033B3E1A5514FD7A14923C7C2CD038
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e79c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e79c.TMP
Size 3KB
SHA256 675279fe05e73063f7877e49ff348bdcdb5ad42718e70a9ca5de52cca3140fdf
MD5 cb8e0282221e6a6b364154c3d06a54e7
SHA1 6bfac5939d3cf4877147f3d43192b2082d115e50
SHA512 0c022aa85457c51eba5153ab71f7fba15ec4875ec94eb5d2eef6464bbfebd1fbbc3bb1ace66ce5650c86adfb5b1bcd62c0efdae720bab676abcef6b7705507bb
TLSH
T10161F939025F4963EF914F7194D102DC3D71B89B0B7B3E826E6479BB1985BE9C3E9008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 ab9d3078cfe8d63853f588a4a80f50e844649c3eedcb289e1393724e0296e84a
MD5 5fc6b7382f312ceb81d426c450d1dc8d
SHA1 876d131e8b303f20d308925c8d84fbd7b08890d2
SHA512 c1498529907de8dc66577d07e485c8efa5b70ca5337a4d71cb574873367eefc811605322a27564e680bc6fba5c199f8b2243b5404bf97ee76d77715c7f4ac7e6
SSDEEP 192:3aLV5N099B5dhN09SrXKLX9cKtM1QWacXea/yZ:qLnN0nbN0Fr9k1Vaau
TLSH
T1E7D23B6BEE357802CB453DF72996147AEE33D09C5FB68D98382000610CB84EF58759FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 a821b5a3da1980de196b6a579f2c02403e32580c497ea41a3b9559e3b01d3a43
MD5 5dcd66a450cf96fb10974f9c794d66ec
SHA1 23c8d9eea13f6d3a2b0f565e015e20561001f51d
SHA512 69016c8ff72e6602f12ce718a7e1c61ab75405bc530517a2904913588397ca9d6ee6506b22e9f3ed60ff51003c4272b61ab2aa77f42628119418d03c0edc21a2
SSDEEP 384:dN0iuQpN02N00+a83uFBBQ1GkS4VQN0z4QN0nN0PN0qN0r7DNspUy:YwkT0nFBBlmHz4FqCHMUy
TLSH
T1D114D86F2E313202CE2C507628E758976D6EB47F8B6679CAB4701071CDE2666944C8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 32KB
SHA256 4a1397bd43efe6d0867475b91ecbe29786874f4aebb0599411979c091afd89fa
MD5 87fc6493f5b2a1af0a7a860e04f951aa
SHA1 e2b4e7752477d2af5db5c9ceb3e34bf80fa322bf
SHA512 cfbf249bbdcd83a496216c1c7b8fb43dc5e12450b045326d8d646d771fdb1f6cba116cfb7f00a4cfc1591e967d468459ba49418c849ccda4d6a3fd63b9fa4441
SSDEEP 768:JuCd2FoL+yYyyJvZtpyaDJp5pgi/GEmm+0x57707kMRmGAJ8:cFj9yVEb+0eAJ8
TLSH
T17EE28852B5F91209F27B5FBBA8B257A15CBABE962D04DC2D5860210D4D31F40CD73B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 affc67966277e84edab6b6e65c169f03e467c4fc26b6fb08d78793815a0082e5
MD5 67463719d556f1ff6899fe7d5b20d0bb
SHA1 3878a726bdf5a82a1936c6d81ee56e944e9a9b24
SHA512 6f7649a8bfe390096eaa963bb354de90c418b37b6b7f0b1522a82cfd3bec199b9f773662f7909fa84ffc38ff55c320a98688664d4c86be2f7080075535c0b68e
TLSH
T109E0D87888C9C12F525460E60524BB0DD6B3261F96C8AE854F4DC854B487044BA7E191
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1a174c2851d8f3ab8218a0ac537e22a989626845655050c5a1fcd943c567b341
MD5 5442dc88230f987d179777e1f69dd2e4
SHA1 4a9c699bc81e6829e4ed05d7d8e0e8ed3574c720
SHA512 7c77556b649152d1d9d812fc8807d5ab75b92261b58514660cd710950b6db2e9b128a0fefc80ba9acc40b4927b82d1c317402404bbcfa676159c88bb8bf4bbc9
TLSH
T1AA31CDF783E4856ECE2156F0AE14AE2BCE1C0112832C7D298AD0AF17E3E3471E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 e5135e95fe0a198d9c27e3bfaf55d3856c3aaf31802a193ba0275a3e5e05917d
MD5 1bfbb974e30749d07101786963c03f48
SHA1 72e787c7af5966b0af1118c99210444700bb04ea
SHA512 d8fc1395c62996e0818c93b833120af2b8aef63bff0950aea02fcfba335cc140c361f598d65a594dbcd4a3092c55583320b6430a1df6353ddb1459bf6f6e22f7
SSDEEP 384:DG7X6krby9t5wzeIJClik3hBerTWbegJgJIz1SPhxkGV75cUtBWz7mBMx8MtvkQO:cI/+fRIQLl7Z
TLSH
T11A727CF3C2E4866EC92156F5AA247E2BDE1D0464436D3C1AC5D8AF4FE7F14B0E24264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 bcc04cc6b87dcf17e907ba2cabee31cf4c6a24e8bf3f6892a9d61f626398905f
MD5 ab6d0f31c34c594b4f50946fdb6e464e
SHA1 2fc9da7aff0509aff0b3e1b800a6187270dce550
SHA512 4873eb8dadf6c1cb61c5ca9673e75dc2bd103c8d4de2a19e1c9c549a6926ba411e2e6479e01773b28354649f31b4afe95c09a58de121a64b646fb06fe76d3613
SSDEEP 384:DW+XLZnu2ZY9ceoJZhyEnBBeefNseaJXJ81i81ShxGVz72Bp9ctqk6mGRH1GsRgW:1J+1YWYxUVR7
TLSH
T154427BF743B4816EDA2156F1AA24BF2BDE5C0424036C3865C6D89F5BE7F20A1E24275F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 ce1d54934cd00033df853fd2f974a159873fd22f1e2bbb49a5d18b86af844552
MD5 575f079854691c872aba2b6f06122b5e
SHA1 7070c944f3cf164250c92fd04831bbd050e3084c
SHA512 a20efc9a8d3f3f34c14bf7709c218ee4ca02d51cf85fc62f7c7aa8d9191fc3561f0f5bdad97a9b1368d878e746c5bed6963216b0a24590e28d73b5a11b431a87
SSDEEP 384:DfmE1p4uXauEq6efJJ2XlwSBeK8ZAeXJxJH+1ShxGFz7mBMxctvkQuGqIuRsLsph:RkiruyhQLl7D
TLSH
T193728CF7C3E4862ED92156F5AA247E2BCE1D0464436D3C1AC5E8AF4BE7F14B0E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 0da464c211db13322baf076836608c33a8e2c6db1e6646bf68c4d122206bd3f2
MD5 16532344dcc2ec738771a500ccd6fa6e
SHA1 b978906605b90cae9c1943061889b70ac80233bd
SHA512 4b8fda0b24e27b11c5d119c480ff24e2ace5fd0a3b44adfef3c55a0d98e424379a35d2ee160da4008cdbc4c957a63d238af4d4648914297c3e6ef0e297e18ad2
SSDEEP 384:DWmE1p4uXauEq6efJJ2XlwSBeK8ZAeXJxJHpa1ShxGFz7mBMxctvkQuGqIuRsLsH:0kirsyhQLl7j
TLSH
T1B3728BF7C3E4862EC92156F5AA247E2BCE1D0464436D3C1AC5D8AF4BE7F14B0E24264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1d4e7aac89e161806cc6885159238428f92aec094bbb78d3edaa68f1d8868a88
MD5 59fcda9f3ef666c465ed22be9c0b69ca
SHA1 9ac861917fe9ecaf19ccdc30abf1eb64469edcca
SHA512 34586dcd567d77812030db874ae58e67cd684208404b8ef10fd3a5d185654104366ab06350ea35e3d74eb375978aefefd07137348b5b4451255a812b96dc8075
TLSH
T14AD022A32214B2F5B6BC7FC6906AFC8FC76700250D83DDD820D0B9AC0639DAC4627240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5014493b5508128a8223370be3df6a08616a4ee3e30dc5d33f90ceefd9e9ab96
MD5 4941d9cc3d0823772341313cb4a93f97
SHA1 980dbccc99cb3a71027bda4d2fc75c1cb2277e6c
SHA512 49d1bca8dabba2e9c6bc90609eebed80e734e840459be9d2fa8c5c0550ea60dafcfd538466bef9bfc6d909a075cbfe9ec66ec35ec9e78d3f8af37fcb594a2044
TLSH
T106D022632210B0B4B6BC3EE6906AFC9FC72A00344C83DDDC20E0AD9C0636CAC4A27544
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 59ee8dfbde18fe198778652e2c69bec262cfbff96261a0472e7043935893d2dd
MD5 e020ebd7be343ad28c1ce8f65d2a3b3a
SHA1 ec3ce2ae5eecf9dec874c8a7cbdc88de3fd519ce
SHA512 3a38925e3d00e0597d5d7b05717ef4e83057a8ceb9b81b6adc816bb3ef0830c2849353757fc82b83cb72155361017558228200da8a54d5f698a55cb0cbfb57d5
TLSH
T1AFD022331310B0F9BBBC7ED9906AFD8ECB2600200C83DDD820D07EAD1635CAC066B185
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5a5063.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5a5063.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 f262909c8581f4a933fe1e44a7234dfa8edb2fa4cbcb2eaec592a2f76da6655e
MD5 31537f88eee9443c4151e1c121bbcfea
SHA1 006ec5a22bfccb5d35420cef526b7d4afff896af
SHA512 e9ca9ff20994aeb7ad264f366299fc27dbf8dffd57b0d6af22b4b57dfae72968ff475fe8bcd645697765e2cf685b1e5b4101159e0bd416c2c4a3b0c0639511ee
TLSH
T19051ADA3867EF46B203C5C7B1E48BC065ABAE83151D2A8F4DA56866CF0958F74B17036
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2c90f332ec2b6750bd43c5737c4ab4bbebfa1f2cb678d8d5d69e0d56fd7bbf50
MD5 ef07c98620768748daab3823e3fe68cc
SHA1 1769b5257ddc30ff5cd23873ab2f82a9fc038f33
SHA512 b355fd74a25b4d6170f4a3359a1da68086ce2475fdb999dd59cd461228df37cf2375905872f20c2b400197a1ab4b63659152256b74b927af606b01be21767645
SSDEEP 384:sxZznWkq4m4R/fus6biks4/bD33NV/5r4N0/kz:sLWz4m4R/fIbiO/bL5J/kz
TLSH
T15392E8536520897BDCDBD619BD317F62D6F814639E904E4CAAFCCA1C00EA6ED2613C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ea86dd5487b5512a587caf47c2889ceba27a2a6af5a19eef293775141d8826ea
MD5 1e6a7437c915c839f88f2a1635a34df0
SHA1 f92c3c20e3e66a1797ddc6dc2b63146b7e690342
SHA512 03d34bb090f987be2dd4ef367f7c0d16bf1feeaa266c8a46e2d6633613d76b66551b5eb1d632d8ae0142aa2c29926c0dc780a97dfd6df753310e6702c564fe0f
SSDEEP 384:sxZznWkqHm4R/fus3WvTbYksk/b4l3LNV/5p2N0/kz:sLWzHm4R/fFYTbYS/bU5J/kz
TLSH
T1E892C8526530497BDCDBD619B921BF62D6F814639E904E48AAFCCA1C00EA7ED2612C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b82028483336f453a265eaf2ef3362043bcb4bad92a528ec922725f146f70ae9
MD5 da8921a9b33612edc6a7130c2aaebf60
SHA1 b9e2a4d1ad976386848c1a5213033ba53e8d9e12
SHA512 9439de2821661a150853bbd9d5501c4c20a2d287b4f968f5be133d8e670d5967a032d94806ae7a2b28b8850bca2c4bbe459fd279b4540a02d853a6959a5a5756
SSDEEP 192:sxZ7RiyM/jK1Ml8MoR/fusLxrIdpKl9/W6+WNexf/Y0o1jAgIgrJ:sxZ7kQR/fusLx0u/b8/589
TLSH
T16D52D7126A34997BCCCBD309FA55BF93D6F5156292904E44AAFC8A1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 65743c86d63446182ce01df1858b435f0990572cf80931b7c6aa5f26c24ee079
MD5 4e699149c692751f8641517d595dd7d0
SHA1 a0d98e69b76561cb119070e977ffd2e0f82803c6
SHA512 833035e7b35df75c4f7ed751172cc634fc5bc711536a8dfcc6125f5087ce9e84742167a53ca99ad8d0eb125e9eff9705df3a57e6635576aa5df1ebc4bdfc9463
SSDEEP 384:sxZzn25qG2m4R/fuseWvLbKhHl/b4l3Lm1/2lTN0/kz:sL2g9m4R/fgYLbKv/bV2I/kz
TLSH
T1DEA2D8536530897BDCD7D619B921BF62D6F81462DE904E48AAFCCA1C00EB7ED2603C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 4d35d9ef85ca17476937065d96f75b3dae2e6b13e8831c070bea33611a16f7f2
MD5 8539cdc1d77d9c4997a44e8a20fb367f
SHA1 b0afecb3ef3a935a1f44e44b673ea8151e1a2d23
SHA512 4e4e253c27ea21dd533085fa21852a63001da6720d0afda752be40f20950460b67742e1c75ec8c901a7a09748c5842407091b95a7a7e31b016741d5b57b16dad
SSDEEP 384:sxZznWkBm4R/fus6biks4/bD33NV/5r4N0/kz:sLWgm4R/fIbiO/bL5J/kz
TLSH
T1CA92E8536520497BDCDBD619BD317F62D6F814639E904E4CAAFCCA1C04EA6ED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a1ad2db640f0372c2ca39c0317e9dd65760e4dc47284ab6d0d67fac37f678a47
MD5 4543711213dad06ef706c0b5165646fe
SHA1 66645c718ef9bde28aae76bb9bc32df0f51824a9
SHA512 4d9f5aa9c505c8a7884ecfae9e116ff9e0a61031b66c84b1214737839c31c1dbcecf2c2e2b070881941898905efc3d3d9dced06dc26a840ab35880f12e45c1d9
SSDEEP 384:sxZzn65qP2m4R/fuseWvLblDnZl/b4hm1/2lTN0/kz:sL6gem4R/fgYLblL/bF2I/kz
TLSH
T18DA2D8536530897BDCD7D619B921BF62D6F81463CE904E48AAFCCA1C00EA7ED261381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 5605927d14f794a3f7d433df45ad8797dba7b9011164bd9796c7c0dd6a84fc71
MD5 8901dd6d941338007d0957b1b7ed6931
SHA1 4a3c3f2494e30040b59595195e137310d2008157
SHA512 ec86250c64d7bb484d1adce152f4e454e8e48026bfefca202e9a5c9186962cba7aefe5ee5e5f5c531e102fcc67ac8c49ab204510efe0d67a451c608a70bc4491
SSDEEP 384:sxZzn45qG2m4R/fuseWvLbII+n/b4hm1/2lTN0/kz:sL4g9m4R/fgYLbIR/bF2I/kz
TLSH
T1BEA2D8536530497BDCD7D619F921BF62D6F91462CE904E48AAFCCA1C00EABED2613C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 81490815738b460086bc1ab0551bfd8af23f7c3a76cf752f82d954bca624cbe6
MD5 4ceb57dd9336bdecc0547bb7eaf7dfa7
SHA1 77ee7b0e4702bfcbe3b770011c4ea549da140ec5
SHA512 643c2997f489540215dab4eccf4b643a2cd8657e6b6716915b9ffca9e95327184e8c6f1f9fff5066efd10590049b8a4128e65e70d30d4f4c6bc54714112649a6
SSDEEP 384:sxZznr5qG2m4R/fuseWvLbKhHl/b4l3Lm1/2lTN0/kz:sLrg9m4R/fgYLbKv/bV2I/kz
TLSH
T15EA2D8536530897BDCD7D619B921BF62D6F81462DE904E48AAFCCA1C00EB7ED2603C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 7e0d1a37c392de65fee6277ac04e1cf6d96a38079e9c8a9d594ba318d50ad25a
MD5 842e06a4560b50c50325c9d3b925273a
SHA1 2251bcefed86e1546bd164dcefde53e0f131a010
SHA512 6dd94a041ae5ca85e865d0641574b12b788e92807c0335d35940b415df294855662e0f9fc4e87e714edf4cd372c6a82ab3eba2994d8e0c2bbed4ee365bbc6ba2
SSDEEP 768:93c0s8Ww2YfWRm/JQy18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OnKrobp:93c0s8Ww2YfWRm/JQy1u1jaKBOLpTuOL
TLSH
T149E21B3B284CCB7E4F840E9DEC26AF966ED802CB66584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 96e6eafe2fd6efb84ccb0114574f1eef9256fd77bae2b751e61d1e693846f923
MD5 fe6fdcba19e7e2ded4f7be90916f7ce9
SHA1 79bc0a92e3e8f89a5ef3807df00ae46a2a776dc7
SHA512 91aaf9ba23d78e77fb87914b8aa008a2d20b4091894cadb89e753dbd73214c9d924c09ec7b383210100ea5a66b601ba145aed67b63b41f1ddc5c0c4d79d974e8
SSDEEP 768:93c0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OnKroba:93c0s8Ww2YfWRm/JQg1u1jaKBOLpTuOg
TLSH
T17DE20A3B284CCB7E4F840E9DEC26AF966ED801CB66584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\623cd082b6202da0_0
Size 63KB
SHA256 12ce24ebef2d80419d8029c06d0f1654f516ed392fe52ca3f73c988fee4a0efd
MD5 40ad1c0c8b7ef5943191090eaabb22a3
SHA1 2abbc73eca92be7e436d46d46cf5a64e4043b907
SHA512 e27cd686b4956698f5a60d94243a0c3ef790a1a920cdbc8992d2cc0b85f52cc55037aec84e70e1a855575999aeeafdc797d92535abd7338446492e559d9356b3
SSDEEP 1536:rGDsdBcx+BHKut3JHjvGEs7RONVIqtNeNChNydt4HHPwqpzGS/d:rndw+0ghGEEROfFAWn/d
TLSH
T1305328E7B2226135C7AD21D1949A7F01F11B27522544C9ECF0AC76913F18ECB66B3BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 5817ff1e9ae3407612e7ec95e77a167fb1fce0e7dbf362cf713e412789847c48
MD5 891533d34d9224bf2b7d14db271d6f96
SHA1 24d9a6c1ad804311d12602fd6efcb3e391838b2e
SHA512 e2bb2615142c449cab8a58af76266737c41bf46629977520545fc018b256bd0e8f376aaadfc59555df28e665b07fb183e6398034273f530f85ebca2467896479
TLSH
T1EFA002160BC54009C42613F125D60A457212CA591602675941A5C448C864546CDB701C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 06c219ee8bc0acb206813dca92ef8440a0715460f0909c8f1b85a8af713f5cf4
MD5 083b1291ec191bf8a9e76bca2fd9e223
SHA1 f4c4fbda1854d59581c12156d5f3be557b8354d8
SHA512 7df431e82ab39c0e92b39fe70ee2f96470e2c7c0e396f19aa857f10941f8955ebb266450bdb6d26f1cb22284a741f527ce6eb3b2ecd8d18ace22dba8be4c8210
TLSH
T1D8A0022602D40109C44B13F066E6018A7662D95CC202635D81D1C444DD605898D7102D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 b1d72363182426d67c407b27ce015762aff9d5122e462f7e8976ef36da5a8313
MD5 5a8ee397d26fb3313b4e341327c078f5
SHA1 7b90d4fd3622f3406008c5896e98614297defcff
SHA512 efaefaa63a74b276fb6c558ec7eb6b91ccd79c58e26e11dc042bad6f17526df5703bdc0f675643b3f76b98654038ce5d4fabdebca35b8447a93e6ef89dc37265
TLSH
T190A002148B840006C52A11F1156317A2131DD8941A00130744914046CC544944DA100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 59cbd3b39e442b3184e9ca0d098df0a7a4d0e995dc35d7a09637eea40d4804c8
MD5 68cf5bf48f292219a9fd7241966074de
SHA1 9a95c1966d1834965b7d6853f7e231964588154d
SHA512 45f0e57d642e4b7d5c768924e07665e5a68344f64db1bbed61116b29c05887d997b19d5963e84f760945ffcb9f87759c9383f7beccfd7c481788009b984934e9
TLSH
T152A002D06BC15105C00396BC25E38555F2326CA003011305B2D1094AC850940516291D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 b79e871139994eace5b01f0c77071dd7b717571ea2f2541e042f19e0c556f9ce
MD5 e01667f3dde05a2d0c9dcbd4dc7b8b16
SHA1 8d60870a4567fec6e33b019098c845a53430f185
SHA512 be95d24d0be29348bb96fd7a0b4bce9d07b6eda14e2aee0b4c78ce424999935ea2374ec8ad644fd541a12b40abb2ef62bec00f55c0c0f8584905fc178e4c73b3
TLSH
T11BA00291A2800005DC4712F035E29942B3616D50030123096AD208A6D8559984E4212D
MD5 SHA1 SHA512 TLSH

Submit Download

todelete_623cd082b6202da0_0_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\todelete_623cd082b6202da0_0_1
Size 62KB
SHA256 4d4e471f12d965fbae56b53ec4f371cdc31c9f45484cabbfb8f7b50aabc6a637
MD5 4617feb218ac0bf3bd441631c9d80fc8
SHA1 ff643fb68e73343ca6b379a6b4c9eddbf801f2f8
SHA512 8ab137d747bb23f34ce778917e9ed9b5331660d75d999a7915488baf0e19bd68ca7a03e672d498aa7ceaae974a04b97200cacfca5e264502abf99019abb8aba6
SSDEEP 1536:8lcFBkv+BHKut3JHjvGEs7RONVIqtNMBcZ0PnZHHPwqpzGK/2:VF++0ghGEEROfFq7b/2
TLSH
T1E35318A7B2626136C7AD21D294967F00F12B13561404C9ECF0BD66953F18ECB66B3BF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 2KB
SHA256 c27d7bff195dd17c9bc0d76f3a7eb47105cba9910593cc6022c285e8ee53c1ed
MD5 d9a2c592eb52b29ba2c39eeb55bfea7a
SHA1 bef5b978ef9fee7530a4a1b056816f2d3499fb74
SHA512 191d9a9b01c1d08b3179cd73c6299059d0104da47f943fc81f2f5fad1db34325254f4466e514207a340a3015ae3dc626da85dadca5daae2d42d4d37e8014797e
TLSH
T18E51F84D6C47291ADC3C217329B60884333838DC26A84B07749CA27CFDC7A1869FDB6D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 1KB
SHA256 150acaaaae4fd322260506156b9158838987cf51f9044eceaa0e50866bf4c1c5
MD5 d202f7b2d22d814e0532edc66838731b
SHA1 7859e238ae172725c31dab0a147e93a0c2253528
SHA512 0c9c6f88f099ee11b668045adb77732a16773abe06b9ccce35f160fe77f719b09ab02d449dbb8f19649cffec69097d043f0d14e8eac2e54615576819033cb223
TLSH
T1852110898ED06D1FF955457B1573B8E4B3708ECC9721A723293D22721E1178D1A9B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f93b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe59f93b.TMP
Size 1KB
SHA256 cf75e532f5a88e1cf6ed285e3712563e1363755756072dc342a2df928f3ddc13
MD5 4732bbf2fd7d6b7a68b82518bfc3a43c
SHA1 bd84055c672e16643441a469084a9b1ae3218f2c
SHA512 e3131fe2531b1b7e0e6a957ba21955ff14d20ff11c165d3db30e55aac24b778a9a483887d4592b64c43c8f707fa27dd3293d28b4e09d5c636f79000985b6412b
TLSH
T1D421049546D54D0BF985517B1963B8F4B3308D009322B393693D21798D25B8D1A4B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5336361c-b355-430c-80e8-dcc378b64936\index-dir\the-real-index
Size 72B
SHA256 d0cbae31f5641fbdff187b39271b71d1cd27f3ff11a4e52a2fadf4358c7c2e1f
MD5 ed46cd69c46c21346aee43352ade605c
SHA1 7e12397f5bfe3cf02f0a4cfb9e698029065de920
SHA512 6745ba58cc3ef22ea18bc26ae9e97e8ae87359011873283b61d10260146e79d5247a7ff478f2f1c699c5ceebdffe0f5ddcff54ca3b2c3686de858d11c0dec0c9
TLSH
T132A002114241A141E54013B439A70B4833249E51094A521347D4B07698D4740A101161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5336361c-b355-430c-80e8-dcc378b64936\index-dir\the-real-index
Size 72B
SHA256 0ab4d23ebf2ab15a007fcd232ddc9e27054b5a5e95fcabf44351b22a31b6272a
MD5 edaf127f88e75bb46fa789f1d551e881
SHA1 d76f89e76063dfa9f0d0061a0a3c0dd825c8611e
SHA512 a0a66e60d38f71375ba4beda7bc06a702fc2bd973d24611ebf517f629e6274b252bccad86c4e6d1f13e3e9db4106dfa585d29a3abd301f5eba8b1deb28c74d53
TLSH
T1C8A002AC43648301E300037D306187813A29C8502142570F45FD10C4CC903948103039
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5336361c-b355-430c-80e8-dcc378b64936\index-dir\the-real-index
Size 72B
SHA256 f1445a54b9f717f491474c4ab28e670fe65fabffa012b731215cc18353ffa744
MD5 78644f38ef7522c813f34d3f5a4dfe79
SHA1 30df84e251dcb8b9bed11fb045afe9229a4309d2
SHA512 f32e380e8ed60f915b1bc72b612dce9a263c04704b52e4de5c983f1938e7f461ec38206871840ab579964582df483470ff006d031243e319337d0dd849908864
TLSH
T1C5A0022652C981C2C5058FBB37536F44726789540943520647D4B17D8ED56418113263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bdfcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5336361c-b355-430c-80e8-dcc378b64936\index-dir\the-real-index~RFe5bdfcd.TMP
Size 48B
SHA256 07de836f5c6600c70eb5fd065d6087fcbc810b336401b66326b1baf91d599632
MD5 03b007c6703b8c088fdd755326f5b2c3
SHA1 169fb4ad1909a6ded9034ccc3f374379e5fc6fb2
SHA512 9daeac85943567d311eb1e3912a81312aebd67d0bc6a780bdd9dac2e0350015cbb49e2be29f2b631a3f3bb5661b15ca0eb623d61171e181f2e8449f77b9a7657
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea296b60-5595-449d-99c6-42362a704d49\4f2277ea2139c475_0
Size 63KB
SHA256 4cae0a78774acacca661691f77f177940a027ccb1ab9d7dccf0887cbb2c54705
MD5 d28eb85ef79e67abfb965d1ceb35b6c9
SHA1 e99027dc6a8d59af4ca34d57666cfe780374e70c
SHA512 b17edb80d9d3974d1237ffc48a4b52497e7127dc122b9be5a875693b8f78ba6b3e8627c1e73cc6880b469dc1b1d9d264694d64f7e78a6f20261f98bfe1ed9201
SSDEEP 1536:cPGDsdBcx+BHKut3JHjvGEs7RONVIqtNeNChNydt4HHPwqpzGS/n:cPndw+0ghGEEROfFAWn/n
TLSH
T1265328E7B2226135C7AD21D1949A7F01F11B27521544C9ECF0AC75913F18ECB66B3BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea296b60-5595-449d-99c6-42362a704d49\index-dir\the-real-index
Size 72B
SHA256 93d93ef9b85e33ceb1c865cfce255760c9bb32ffd11d71713fd56f71a0a6d05e
MD5 28561716ac030e9a323974820cb47f86
SHA1 a5801f83bdfd69b6ce58aaef1b460544660235d4
SHA512 e5f44a819dae9c442810725f2d8f77c9e1b8503f615edffd38820c060bef0400536f09ffd9bdcd3a51fa2b9e4fd8ffbf03d3210035746a47c5ddb5dbb1fad3b2
TLSH
T13DA0023131940451C0010BF09356915833647DE50602972560D10DA7DA661984615497
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea296b60-5595-449d-99c6-42362a704d49\index-dir\the-real-index
Size 72B
SHA256 bb8413abdec193aaa8305cc8cea966fe244aeb23e3b84a2cf02fa17decb8652d
MD5 3b8aec2ddb4f9f4d11d6c21a9fe5bb83
SHA1 eaa61b221037b15231023ab6410707d94850c44a
SHA512 30557e8b49de059f02e516ce233c67d66a1e4393805e76d389f47a291312105a270989e27655e2aff068a89b6617a496fca18ff3bcee9785561ef164d3358197
TLSH
T1E0A0022522648051C0010AB2A19685607399FD991501472D61D00CD7CD9615D47210A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea296b60-5595-449d-99c6-42362a704d49\index-dir\the-real-index
Size 72B
SHA256 694aaa5a80efdf78109822eac73ad5de1b812b59ae32344bc8e67ef0a19fa2fd
MD5 d405592ca7fb1d099b98278b72e78f16
SHA1 47007ec052b22f740e98450b7176af37e6f8464f
SHA512 3e2936bd8c5ab3d3b3b63f4790e9537a8b809c0e823e922f045113130ed2121b656c4d7ae87477340c4daa3d0a2d2287c369b04c2d1e40ea4e4324cde233316e
TLSH
T149A0023422541045C40186F6759692907326BC950111670561D40C57887616A9931094
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 20a08e403f584d1c25fe3bea930c4b5c64e1cff8d35a45af11b44890fb9d94db
MD5 9e4bd6f8d05e5b4409f99b14a09d3945
SHA1 809d944e8ddd2498fa2476de19af305d542cddc9
SHA512 32745ee601272553e4499c702978e8a298cc394b13d0dac4b7442f12e6360e1bc8e29c8626254cd4642c775fc9a9b39b93f1d06f112dcc3e0d24d0f4f21d8620
TLSH
T160F05CB72FF31899FCBFE3EA10B194B109017858D4A5EE5F152AB19760B126514CEC92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5831317fda32dc61a60b13177cf46dcc9a879c9fcbef5880f36c348ded8450b3
MD5 15dad7e1039682a69468032391bd5f0d
SHA1 11feeeacdcfb8362a8af69cba1e64c2d384d16cb
SHA512 3a175f7c1588ccd6d0a687822345bdf444d42f2ebc4f9268429267fe35610eda26b0fd49ba08ca9209a0ada76c3c2dd4ee91b56e2170e28c7dc4d5ab399a8a25
TLSH
T18EE0C0F72FF31864E8AFE3CA14F184F40900785CD090FE1F502A91C720B13A5288BC52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 a3e8587f5728c47300388eca70e7eefdc8402bc2dd48a651e3f62c48e3ee2538
MD5 de696b9a18f2c236bd103f2b56deedda
SHA1 bffb2ec0dbf889cda8b9ef12bb5f2a31332ac13f
SHA512 694f28de8eeba4eabdea495044a4adf6d2941a1664f870267f44c09035d95c2b4e3390589f4b8bb18e917bc86a1ea934f177deaf925fdb5f671e0f42df65d4d9
TLSH
T17BF05CB72FF31899FCAFE3DA10B194F109007858D4A5EE6F116AB19760B226514CEC92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 54fd83e3a73064e160e6151713beafe0b982a121d335cb1be3a3da3ce795f47b
MD5 b7c42ab9d7b3fa7e2272eca482284664
SHA1 ec6c33a95394c9a2bb5b814c19ef36a394b63eac
SHA512 6c72a02d25ae48a72ef1dd4d807a8b62e980fc8edc9e64b2245daa1bbe72e6699e47518f0740e2ada4a0bb70b4d29c151e88729e58d2b0a42b0a28fe202bac07
TLSH
T150F0DCB32FF31898FCAFE3DA10B150B109007C18C0A1EE1F142AB18720B126914CEC92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 199c8b4e0e2c4a24bfed789b52b80f9390b950615d28a9c23292d152c7455ca5
MD5 e1580a56476a6f3255eeed253ccd74a1
SHA1 1eab9546b8e0b0f8a169036cf83688dd333bf665
SHA512 fd9c7ab6a97bbd633739d48e0026ac8fe830ae926bf56286327409c702712e66012cb1bc80fb50f2c081550b8d44203e88f30fccf81e454e49b9b7ea8ce85af0
TLSH
T12BF0DCF32FF31858FCAFE2DA20B190B109007C18C492EE5F102AB18760B1365148EC92
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 a582325e17584d3c89f82793444cd5d86e96332bad09f3077f1265af1851e54d
MD5 b75ae0f66fb353f5af37abd0c1e4d0b3
SHA1 fe3bcb4e5d9f422a5d3679950dce755fa1c68006
SHA512 dc85a3b8bfe5a23e397518790490c849ce71d81da613240786f7eaff70cedee5e8d7b81b58b1cad741e44d85e0e32eea2840799c9402e5df1724b2978ce21d76
SSDEEP 48:F2em5HdYlvSqJp6gf5UOHoXphFWwp6L5UOVbpl5UOV:F1m5HehJp6g2XpnRp6XpR
TLSH
T10091BCE3DA145053C9C966FB2039F6D9552DCA066FFF87A610BD8FAE52402D63328B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 d328c3dea74bc84f82391c4b3e4604fb751ea4054378079fe46cfc25a283fa9f
MD5 41e4048b08bc1a5bb5d0d2a56811aaa2
SHA1 ffdbee0495e902b916412bc20d48a318267239db
SHA512 bdfd60caf984f1099f37227100f1130f090bed66d3356a69e7045b6ac5dca204f63a4fb7a7f0f86bb44501d2a97401e7a64ff78c6de6da4391c5251d4cf5cbac
TLSH
T1CDE0261805CCC1BD70A560D30236A70D82F5B88FD3CCBE822F85D840664A605F3DA1C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9d3c847c6d7a0ad5eb8307bd42369509db831e3ed46383302959a125d720fa65
MD5 00a0979e1a12f8d10010a094e931bdab
SHA1 74ef9f2b0757e9d4151e3a81846802d4ce52212c
SHA512 3c27b89b47e731d7e23e6b8f5b1b3673587b77dd01997ad8ac7528f6d4a8199435777285771136b9d0a1e79b6765c2af61296238353db9d40afdf10de1d0d076
TLSH
T113A00271AED7A27DC40012F590B1D298321288DC660D265940AE485CC8621C0D1E2416
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4fb7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4fb7.TMP
Size 48B
SHA256 3479f6e9dc2ded8cbe44d56eac261cf253221109d1140f6a6d0689c4851e9d88
MD5 0eeeee04639413354d6ebffc800ec817
SHA1 a3829e882bc4892dffe9c8b6f99e5e013f880a74
SHA512 5be5a25c72847350cbf9368b5987e2fc8cbbb49ac305acc28bedd1b19fad57e905751f4b529eee56652ef88250192c92c12df3334e2f59794cb4ac34a34efb15
MD5 SHA1 SHA512

Submit Download

Tabs_13428514025419409

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13428514025419409
Size 14KB
SHA256 3472bd3a1c68b7631731da4bc20c37923b9b5c76df4ac1345f94f4c31bf7bbec
MD5 d71e1a02c4e2e7342ce6c35a187c86ba
SHA1 5685a90b7eed8345df42372b5bfed84e67e33776
SHA512 760e9f62386198064bcb93c0088d69118305911a5ad8cc85169b960012c2f43fbc705365f4cf190c6092461820095a37d8211dcc5b994765f10dcdd12e9f3d05
SSDEEP 384:a580N0/n4QBn41n4QrcQN09N02n4Tn49N0wwM7Ya:68ZgVOQIF4r04oV
TLSH
T14362632A9AE6153EF23F4AB88BF614F6BA35F59134918D1E016002000D33B165FB1DBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 328B
SHA256 4138df6039a0d8b5881dfe0bd62d33dd1507ff8336eabdcb8042fd06e2b8ed23
MD5 5668b88a91b1861936098f36543ec2f5
SHA1 2af8d90c1691fd1e2df4e48c7b95737b4b42ca7d
SHA512 77ddcbb1b84bb289c7dc2f7b1c09c8c01474ffc7a9e14f6c22de6d41c5475a3948c471509c2163809acfcf24e166a4eb22e3e6ecfc77c965d06c03328ca82a95
TLSH
T173E0C20CB7101E51C98B52FC0FA6BF2947ACE4464906C0E7984CBE671E127D96D575F1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 344B
SHA256 81c7799e85b79e5e166de1bee609b18414a858d33bbe4d33e4afeed339d84e81
MD5 f98984d128ff3233bbd6d0dd1f964d1c
SHA1 fbd2ee630bac69ee591b6da2c563857fe1b949a2
SHA512 d22f240f9addc9b9f3c31b7bcdb6e071096c6948845ceb5610463bbfc5e50feff027d5b0e673bd0529fb10c00912ea7cbbc245935253685b4d5b4f54fc6f2884
TLSH
T1ABE0487825DDC63E61D520974378E31C82B3B44BD7C8AB923F09A950A30E184739B581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 60316731a0242ccb1ab301d63b861454bb2c8bb32700a29f19f5abf6b4d9c1c2
MD5 02076ecd308d29ed51ff075989682bcd
SHA1 3287a6ee621981b7e5b7ebac2f0f425615efa660
SHA512 82f5e73564b3b2a37f0adcc0469bf0b3be0e3bc91aafaf68b417fde79d38ec9156234e25e1fce3a5abe2c0f83c767c91e6328c8f4ba8ebf27122e1f2e66406db
TLSH
T114E086B485DDD639519460D34278A71ED2F1B84F97C97BC65B0C6461A209184B3FE5C0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b27b182ce8d0a6b8e68018318af4574cb690ee007c4e89754aff067a4d0b3cf0
MD5 5357e4a8703f1db3a8df90b29b587f9f
SHA1 82342c315558db1e9cafe0b5116519230d925c08
SHA512 bb40831e9fc9ad189c102884d6759060fb4fbe59051673462040aef40f2a03523202d154e2c5815eebc37ca0125ae7f3323e7dcfc6779884179c565b8d2ad99a
SSDEEP 48:KMAIjKB6AALvl5tk95WPIW3kKDBrNknP0Q2lP5ypOI3K7aEftIhKQ:KMAwKB6YwgK9+iqOwK7aEtaKQ
TLSH
T13591145230BB46023C7E780892E49F1A4692B1A37069A46B7FE944724F6BF115FFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecbcf277-2858-41d1-b9db-195a5769b91a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecbcf277-2858-41d1-b9db-195a5769b91a.tmp
Size 414B
SHA256 5071608d88d7ba786a36a8595d5696a8019a059777b6209741921cf1ad12c096
MD5 f42fddddbf63f94ccc134d56fc9f52f8
SHA1 2509aa5207d78f87d2082ba24ac63a0b598c18cf
SHA512 f36ddabaf1ddecf1892cb2251818815eb3bfc8271d3f85d195e20ca632eecf66445bee134b3452123955ecdcebca41a24c6c9ceb5f843b1fb3d8d5177879df50
TLSH
T17FE02BAAC9219C3B2EFD0B1C60600A46E78413572A404D5F3B7C810C4FB067645C682C
MD5 SHA1 SHA512 TLSH

Submit Download

c38459e0-66ef-4b46-a206-e16fc75d2f0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c38459e0-66ef-4b46-a206-e16fc75d2f0b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9f7338d3cfe675e936058ab5f4a1a63c6f269403717014c6ef21d7cede9176b7
MD5 9b9e9b081c2909bb90c8a023def9e8a4
SHA1 b41f2548c06736758316d4a8321007490b79183a
SHA512 f67dd555ecec0f35a512f2f8e324755744215df82120278b27ae014c52128e1fa0e3bc4559b6bcbb0a2513462be38c454c5ee552ef702285b90e5139fbbda63b
SSDEEP 768:9Fbj+9ORwggSwXCQ1oNcVV8rP9auE29MW:a9OwSvj4GYuE2+W
TLSH
T1D2F239E98CD6493ED9AE6B0BA73D2D2649BCC13BB5A05958F7940B0DCD664BFE301810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1aa1971645b8a9f1eb05f63ae8b2a818f44d1d6fe348ce712ca1908198292bcb
MD5 2cc39634edb40f762e83aea30d0e7f02
SHA1 600ad2a82fdedfe1b3a8c7436771b69fb5124dcb
SHA512 b77e97353c3d73b7c768d12378da5bcb91d8c29a78119abe7e1f8189e0b2daca0855b27cf957eb6952af155064211769e5f1a33b2a2f33ca21dcd123f11214f8
SSDEEP 768:9Fbj+9ORwggStXCQ1oNcVV8rP9auE29MW:a9OwSwj4GYuE2+W
TLSH
T123F239E98CD6493ED9AE6B0BA73D2D2649BCC13BB5A05958F7940B0DCD664BFE301810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 35f8bb8456675ad5e92cc488ad3720d836eb9259504c29f521953a303bc0c098
MD5 c0bcce099e3dcb53540f7a9fd441cb07
SHA1 8b290de8232fbeb63884449ffa0595a005494cfe
SHA512 7d4720cecb86292648bc68e7b1c6a2e151e7f04afa60dfbb3da77052ad88dfc59bac8042e3e3cef19458e8d7dc551c36fcb1c264d062fc91570d2c3ec1ea232c
SSDEEP 384:WiF7tNn/s3n9Su8NU8TUNTUlIl0JS8qy3VOUu8YQusOdJNulQAOObjI9G6w7Kb:9F7j+9j9wgYSYHCQ1oNmQA29MW
TLSH
T1D5C228F248D78836ED9E4B57B77E2D168EBCC067B9856A44B7D85A0CCC9B1BFC205810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 afc61b97be7a4a40e3047b95f5cec6f230aa2604736ef090e032f3f85e6a4c18
MD5 afc39a3c28da71d21229a4f8cba572be
SHA1 13438b10ae8abd8987ba489edbae6c57286292c0
SHA512 58a388e47110d5a021bd34f666593ab5f4e35a5c912561489c88d5f2a27c56a5982a6460f9cf9006bdcbff6d6775fefc52a7a17e2df78b2a9d60c433ef781b8b
SSDEEP 384:WiFYtNn/s3n9Sf8NH8TUNTUlIl5TgS8qySXSUu8YQusOdJNuRAOObjI9G6w7Kb:9FYj+9OswggSx7CQ1oNCA29MW
TLSH
T1BFD228F248D78836ED9E4B57B77E2D168EBCD067B9856A44B7D85A0CCC970BFC206810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a78bc0d8a58b0b6dd936510132731a64dd192f019a7dc35966594d1f60655f9b
MD5 0eafc3954ef36a11209f2e571891e0e4
SHA1 06d5b3b271b3cb7257b58731125ae372ea0ab64d
SHA512 67cf062e5b20a2974c8e8ba4b2d9cad5b240fdf99726c2094cead7b7eeb05a996ead3edae86be8710fbeda5d43c3e8c209d0b0c48dc51d2557e34939309257d4
SSDEEP 384:/tNn/s3n9So8NcYJS8qy3ZOUu8YQusOdJNunAOObjI9G6w7Kb:/j+9D2SoHCQ1oNMA29MW
TLSH
T1BD928D315C299C379D934668FA573A178FB0A13B9BC92F48DAEC6F0C01DB5EC9306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7b0f08244e303ce246343c98ffa4c89225360ea4eec511b608d5e06dd6190591
MD5 059b5eacf0429ee12ffefa5133b95685
SHA1 131d92961b4400f280a33e0eda2fc7adedf59db4
SHA512 ea8d29db5698b78c2b771cbf747c987a33e7475491e68be3a0b0f68b7bc9efa6a9639b1cb6021a2b275bbbcb33967364e37d5133499c5ef6e03f570b63bd7b85
SSDEEP 384:WiFKtNn/s3n9Su8NH8TUNTUlIl5TgS8qy9WCUu8YQusOdJNuwAOObjI9G6w7Kb:9FKj+9jswggSfLCQ1oNDA29MW
TLSH
T1A0D228F248D78836ED9E4B57B77E2D168EBCC067B9856A44B7D85A0CCC970BFD206810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 282c76b43b98c7c15cbd48c5420da9068bdb6aa603db39c6c94288e580cbb961
MD5 ab8f0ef81a9dd1b7f6ec77dd318059e3
SHA1 11fe6fb2072dc3ad1109268525c172811ab0646f
SHA512 3fafc6a83941ab0d3d542b4c3102be13da946d04fa62aeaa9ee9867bbed0fdde3c70cc3107b734994f334f3ba87eff463201cf6d797f1f215f39e43d2f12a3df
SSDEEP 384:itNn/s3n9Sf8NczJS8qy6ZOUu8YQusOdJNunAOObjI9G6w7Kb:ij+9UhSnHCQ1oNMA29MW
TLSH
T10D928D319C299C37AD934668FA5739178FB0613B9BC52E48DAEC6F0C01DF5AC9301915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 79b26088a781cf4d7f8dafdb01a3296d7c07f251c8e8dbb6171eed521846ab5b
MD5 8cc6fe8bdc0ee1551fd891362c33a704
SHA1 b09f8e368e79206f98ede5363a507d00771d0a63
SHA512 42ac096e9b8aece34e604348e59507de10247b14d13564cfb32d527918e33872969c47fa4eca1c4f2d9ea92d967195ac4d3a9d5f920d871228e2a52578695ba0
SSDEEP 384:nXiFKtNn/s3n9SV8Nc8TUNTUlIlbTgS8qy0N+Uu8YQusOdJNuYMoOObjI9G6w7Kq:SFKj+9U5wgCSNXCQ1oNTX29MN
TLSH
T13AD206F158D78876DD9E4B47B77E2E169EBCD06BB9802944B7D84A0DCC821BFD302820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 642ad8a0b6976f4dca2048763f1593faf7a2256f5709856d5409d20fc0d4a899
MD5 e4d95c0a76a2e21b8ea27f2b6ec21512
SHA1 cc72688653313e4b5a2f947a28d38960526e6c3a
SHA512 923a992c611e6bb35d5fbbd367edb15e69ff7ef598f77d38af875d4a17b5ae0b2463e3eebc128b98d81b2427464fef23e53c4e1a85e69609372e6925cf990b3a
SSDEEP 384:FtNn/s3n9So8Nc0JS8qy3ZOUu8YQusOdJNunAOObjI9G6w7Kb:Fj+9DCSoHCQ1oNMA29MW
TLSH
T1E9928D315C299C379D934668FA5739178FB0513B9BC92F48DAEC6F0C01DB5EC9306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 139101e60b03477e5edd4ad94715fc8ab197c6e2cc60968b781a17410a19fa38
MD5 17f919e553b15f035239b701c6c5bc99
SHA1 7f0a49ea4d560db4b67b0bf30c7a8a54052b8b66
SHA512 d99a991bd990b6cfdcc15bb9dd65ed0ef7655d9055b4f8a9a6223dc0336d8e2b5b593f5bf021a587628e56dbaf4d537eeb5a9f09a71327ea698e127863fd2f8f
SSDEEP 192:XGNd6jCQmiUypI8f4SufoPxzYpTSus6zPFJ0SnOK7U6:XGNd6q+Pfju8YQusOdJBF7U6
TLSH
T12F02D974AC686C7B9EE36E45F98737135FA5212BE9912F44DAF81F0C00D768C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 99b1443fcef14b409d26dbbd17de9ff9fce471863f5d0676b8b6b4b88a49a44d
MD5 7a8ca6e23f29302c0a100f5e4cbc424e
SHA1 531988831978af9e1e590d8657918d218b84f451
SHA512 9fdc24914808a8ec6c42b700a5fa280b7844ae9fa9780645f0ef358460e0a575c7fabcc196a9e1fdb5413e9cbcdd4f2b631f56289fda89702fe00c5080156215
SSDEEP 192:7GNF6jeQmiUyf8q4SufoPxzYpTSus6zPFJySuUOM1qlU6:7GNF6exqju8YQusOdJNueAU6
TLSH
T12B121A75A868A83BBD936594F98735038F71512BEE453F44DAFC2F0C00EF1986306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 c6fbe86774ce2906c6873eb158cef89240d69ac10b2a512e767a06fdfe20f6ab
MD5 99878bdbc72142032f774f0ea79d8d5c
SHA1 3255dc3c815088ebbbb6e6b903d4d9182a527219
SHA512 2928f7ebd74c73fbbf8f73ba969d0287333b26d9ba0c4e31bb24f00b868bb75f97cb51f46c77ad45945649d718aa736fc180e662d51c6077baff3e43605c143d
SSDEEP 384:n7iFKtNn/s3n9S+38Nc8TUNTUlIlbTgS8qyE7+qDf4/u8YQusOdJNuMMoOObjI9c:WFKj+9V35wgCSbq/CQ1oN5X29MN
TLSH
T1F0E2B3F598D78977E99E4787A73E2E469EBCC167B5881984BBD81D0CCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 5c7ff810dae73a399970c80e440b5feb6cc31756863c0c5d9a60bbaf38d48b34
MD5 0fd179d3ec621eb88984359a9484c81f
SHA1 b6b4651e6b328a0205d6f1899c5a882201d74e10
SHA512 d5607ebd0be745d93ed2723fc64d88515093c78e821c68b11171cdc0b24aa5fd0830e3cfcf440f7f5fdf084370058b73af4bd5ca1e590e2065f4d361dc57535b
SSDEEP 24:TL85UOl0afDdWec9sJZwwHXjS1xVTGDB5fc:Tg5UUDbg3FwHXuxV6jc
TLSH
T19092E122B9202027E99B1B76F9474C900DFC12EF8EA77404DAE00DA15862AC67B954FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ac2b2b70bef738dba78b943dd2e4a9d21645095ffefff9a493f17fb493d0e781
MD5 7a2459c0e32986ef99c33f35ff5cde93
SHA1 1af404d150a299c21afce6591d094bd9e6c83f55
SHA512 3409bacd0b286f08c4b359b36ecdee2cd2513fe43669891a8da0b2abee514326fbf7cf5dd4637a964e3b3228b559af05efba3bbfb0d7a53b6c2510dd5d43fafd
TLSH
T1E4E00103A30021EAC429073000831B7406E3C03112F21346892412642C232041F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9966be0d6a7d89cfedfc0e0dcffbf679a3860b4bd8a006e20941306d36144a66
MD5 62875df7a02ddf1ec7e237e88a63e246
SHA1 7aecb47324c921c5bd78e8ca0b969e1ce89c3edb
SHA512 63476f2eabd878a020963e7f15a5b54769071c6ecb31713a117161e231d011f8c7431e7e4f264e1e7a6e2388065f82d3cb792bed7fc63bde2cdb602e2f502ba0
TLSH
T194E00906E30021EAC42D073000931B6827E2C02222A21347892412642C223041F28AC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c22c8c328906186ea22be2808a47f8772408225fe4776e172c2d2943c9a4dde
MD5 298cb720ce5e25c000fed41bec6f455d
SHA1 901e18fe999242d699118127225c8520d54f7a48
SHA512 231e73b8b3db0d0e35b52b8f0ffd54aed190a0a337dbc497ff2e138108566fc5f5c65a94438f648275c5d0031bc8c648ee9065662a99275def205aa724e9018a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1b7f23d5b2f42bc91e8c2bf2838b5bd70e67e9cc12b2e0d0f318bea9410ee6f2
MD5 8775633f8b4d463fc1ff740485bcb753
SHA1 ab440208bafffa3fdc4f4056522881c7b1576590
SHA512 4903314fcc81c5c9be31836483c79e5911ccef8138a926c632a0e15043c6fe42b3889694181687d52fd248ee23b75948555b890fb719436c38cbd3955fb3bf60
TLSH
T159E00947E30061EEC43D073000931B7827E3C03222F21347892412643C233041F38EC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f666ae12125f68d0367b3169ecbb71f0e8dbb9238c322fd57ddb855ffd457cd8
MD5 d5226893f01447791cc9883c5ae6789f
SHA1 26f9a14074a21c482bdcf250f22a2e7dae9de2c5
SHA512 5616bfa26ddc9dfe768b769dd04ccff16b8d3e3f244869b76c3efa49909350b1190c5d561092457eaf070cb24f85b60eb99eb939dcf22df2043df10187a9f198
TLSH
T1B6E00957E71061EEC43D0B3800932B6967E7C07222F213879E2562642C233041F39EC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e8361a112975fb64748398d16e9127d22e376f124372aaa01a424e5a6386ef7
MD5 3862b8d0186d271c1a6434d52cf620e5
SHA1 e47d0b89521871809b6004f0b95d9bac4620fa72
SHA512 72a30d7dd3fcc7a6ddd965d9a3c8a9b8667fce5dfab668ade57ca9f6198e2be0f81874462368fd5d664d31d27cdbb02500eb3316d1bf0c5d9c576e45bf27d84f
TLSH
T1BDE00107E30021EEC429073000C31B7817E3C03212F21347892412643C233041F38FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a1d0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1d0f.TMP
Size 392B
SHA256 5bdbc8d26eea37cbc3edc8e34cb72b133354ed08b1ce208d3947842279fcd7b2
MD5 3b54d782d86cdeea8e539452ac7795fe
SHA1 9beb8021875fd834df6f2ee8b9bc34bb80539697
SHA512 78103dcd561f2411ddced7c1a34d08cf517a41464395fc2d456aca4a43a1d62ef25c5c4accd9cc268d99b661a281d7889f1da1df69e4d9c68e443c5e0ccabd84
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fc7d5c731f6a4415a3bd0cac3e3b98c5e90bb70fdf2a6538bea666aa27ab2d31
MD5 d3e2e1e124b7d03eb4d6382151344d8a
SHA1 30e4a6090bc2e757f1ed15e95a811791bd6a037d
SHA512 b8acd4754ed48536bb899ef85a6ee31b992a98a344f7bc1e6677f13150bb89c68695cbc9357221cd20d3fa83b87269bb7ea2036ac967ed7c6f7a734833c0ef5f
SSDEEP 3:MsEllllkEthXllkl2zEgltHR1:/M/xT02zjr1
TLSH
T1D2440205BF905805D5101030D431C35023A0D4A415136783246608229C855410C40420
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

23c8bf85-519a-4d9d-8e8d-663196c83584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23c8bf85-519a-4d9d-8e8d-663196c83584.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 3fdfee57ea6cee3b1bc8b20e34b4d7900c9ec1b2144e1f557d39f166083fe311
MD5 5dabfdf47b1f337e2d56f2cf041877f2
SHA1 b6be98e16aca1fbfbd0fbc39ca059840cb9d5fa2
SHA512 22a1e925ffb431a304d0ed0ab15cdf69168ea73b574f003da26a4e1db461b8d487794cbc906633c19d120232c56d62165ae7263be7528fef16b5f1b199cc0382
SSDEEP 384:nJWJiVca12krtuVm+GglBOVjeQ8RJoz4ghnjUKHWk5PUm5k+GDa50VUGYAVYc63A:J+iVcWr7l8RJ04g9jUKHlBk+GDa50VUe
TLSH
T14FA23C743AF51319F3F69F749AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 f223d29714ca17fdf6de261fb82e6c440015b1c0cab62b6b2c22ef0a14410cf2
MD5 7da94da55d70579cc9e540bb4159e3cf
SHA1 5a708b41ee7b9244ebfd100babcc7bc608325206
SHA512 ac1248b31e66fae6c4b1cf8c7d1ced726a0b23f145fdb7d19e54f4795af6af467c2f09972a9af6326a5610e29dc560bbb6471c685caf13426f00360ef1861032
SSDEEP 384:wJWJiVca12krtuVm+GglBOVjeQ8RJoB4ghnjUKHWk5PUm5k+GDa50VUGYAVYc63A:s+iVcWr7l8RJK4g9jUKHlBk+GDa50VUe
TLSH
T1C4A24C743AF51319F3F69F749AF1A95A643AB866AC00DB4D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20ae9b7b-e6f1-4f02-912a-e0703487a97b.tmp

Path C:\Users\Admin\AppData\Local\Temp\20ae9b7b-e6f1-4f02-912a-e0703487a97b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37979b06-dc95-4883-92a0-35d838bd462b.tmp

Path C:\Users\Admin\AppData\Local\Temp\37979b06-dc95-4883-92a0-35d838bd462b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2738748f-b9cb-4339-857c-c6f61199c1a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2812_720489694\2738748f-b9cb-4339-857c-c6f61199c1a6.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cravex External.rar:Zone.Identifier

Path C:\Users\Admin\Downloads\Cravex External.rar:Zone.Identifier
Size 163B
SHA256 9ad798704f6914fbe4d6e63c64b52664c50ebbb21620986a47777446b6034a43
MD5 a5d390efb6d38fc5e4719e0554eeb82f
SHA1 b7d0b598992404d3cf68a1a59ad38acd6d164092
SHA512 debb7a9eafc35355bc7fd4529f2d6e46d9c116cdadcf94d2d43777e1b44e1882348a33d3e10ef644dfa2f64ea063be6f0917e107f377748a0d30a89f372cde8e
TLSH
T1B2C08CAF804884620B4636D425AC648EB94E5A5A4DEA8E5CE540418F6C5552CDCC42AF
MD5 SHA1 SHA512 TLSH

Submit Download

Masm.read.1u.tlog

Path C:\Users\Admin\Downloads\Cravex External\Cravex External\Cravex External\x64\Release\Cravex External.tlog\Masm.read.1u.tlog
Size 168B
SHA256 5a322e02630697a60f1d9efb44af693737509692637561b1481297048907a2bd
MD5 00eabbaada514072d9ac3fdf3158f030
SHA1 d31f653de32ad28e48c4066a922a7eca0bd2de8b
SHA512 f6f6bb7c5c990f63ec3bf77dbf6b03ceb151abe99bd65d510b062f6598c29f42ee8a60fd0499f297932a598415e8d60fcfba1a0686365a4ffd1cd365e7760bcc
TLSH
T149C048BA10D63908F312B2F1AFC8F2C8C317E3B18421031B1000422F92FE8021B20239
MD5 SHA1 SHA512 TLSH

Submit Download

link.write.1.tlog

Path C:\Users\Admin\Downloads\Cravex External\Cravex External\Cravex External\x64\Release\Cravex External.tlog\link.write.1.tlog
Size 4KB
SHA256 ec09b2b8c9d20b401113fa8f471a9caf2095787da658f54a1deb056203780db6
MD5 db8cda354d181618b3b0ed2d7efcfd21
SHA1 400f02e82b7d080121285f517de7c466805c988b
SHA512 5b269a246138ef315169febeccc95d793d9b43aff2e3d70a83db49469782b8919790c1c2343c67c415ec797b4a39130b00d789da0d9aac8bb811fd76b5d3161d
SSDEEP 48:U111I111S111t111h111t111h11191110111l1112111MQ111VT111/111d1111d:Xa3H
TLSH
T1B2910EBA24E6290AF74332F9AFD5F2D9D727E7F495A1132F0440422F82FE4065B61638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aimbot.cpp

Path C:\Users\Admin\Downloads\Cravex External\Cravex External\crvx\features\aimbot\aimbot.cpp
Size 10KB
SHA256 516856122f8e0c21abedfcc9ddc497223f3de2f686418fa8557ac0008e1ec405
MD5 10f26fadf690368ae4e3a06247a6dc70
SHA1 cebe8dcc8efe954e7738ee338e64fdbd27e69bec
SHA512 b26bdd78644be1e9126fb08e26baf278572d3615e4be34f007fb360ab64bad80213aecb4a1d4ce3036bbac6f25427a7b0fa7425cd964cf8bb1575731dc336553
SSDEEP 192:vVYB1mMjCFkh7MkuEgMuZ5AKiRpl0CHyw:vWNCFkh7V2b5dibl0CHyw
TLSH
T15F22ED4D018A204A09B76BBDDF57710AF720407302AA67247C5CC1E46F7989A4FFAFDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crvx.hpp

Path C:\Users\Admin\Downloads\Cravex External\Cravex External\deps\obfuscator\crvx.hpp
Size 45KB
SHA256 4ea2e930014811b67dd7bb4677e680c49f2606cc7d8518dff26a2af06df2ce52
MD5 5e38ec213e543168c1424f8fb4d66875
SHA1 19e948d4a71be255f5b817aa1553f0814807049b
SHA512 50cc66dffc3577067d78af7a77814a6c9282be37ad0bbeee57b06698998bbe75c027890f70d4f4999365652207360fe18aa6b98f3f31871a6efbda0ae1e115b9
SSDEEP 384:f5dAj9nd5n6+izqOTHO07bdNrpcFjnHmWkYcelsY4Wour2pbEjFr+k4+wGp4XMXK:RdMjv2HO07bdPcFQ/GlQiw
TLSH
T12223C70D386058025970637BDB26D020EA2B9433179447AABA1FCA954FB54E6D3FCFED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crvx_stub.hpp

Path C:\Users\Admin\Downloads\Cravex External\Cravex External\deps\obfuscator\crvx_stub.hpp
Size 4KB
SHA256 b902ff4c8349b00786757c0a44910fc617e0a5b43a2b37b76062a6696e304ff2
MD5 66f50472d3f5e84d44fdedbf99506a65
SHA1 34ded02b228bddf6c31f9ab0748c9e3d9449810b
SHA512 19148936661f1deffab6a7bdeba237c8f1974bc7c00127fa775ebdea9172f8cab712296f6a22f52998297e2298e5bb5ac581a63de0fb2a59288d500bbe0d517d
SSDEEP 96:ReO/6ZTzt/GVFzR/k06q2wnlerbMDYFdqlzDDXsizsr6kReLbLE5Jm1V:cOGt/knsqrAroDYFduzDDXsojkRePcA
TLSH
T181A19B6CDE0A1408F935316A1E52E438DA03300738909B49B4AF8DC45FB58E59E8FAEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download