6e7f99c31e1c3aa17372596fbbcfffb08e7ad8b5075a755031ec175b7f110095

Analysis

user interaction
yes
max time kernel
197s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d30a212e25af6dfa8ef0d19d2b7fb9a7.png
Size 110KB
Sample260718-srev7set9m
SHA256 6e7f99c31e1c3aa17372596fbbcfffb08e7ad8b5075a755031ec175b7f110095
MD5 88c5a1d906cf775309e3e4e97936ce29
SHA1 7a5e87dd8374ec10076472dd7bac8fbba0a046a7
SHA512 a535930e88a9a9732b3314ad2e4f8f5239c1eafbdabe68da393821a5f39b0a14edc0725fc0ec334ccb39b4d676c3d0feaa9bcde28c6e75283599ab4e77e5836d
SSDEEP 3072:Fjge4d8mSStGDUdigonLMApZ19WO2+5QsTH+:FjHYSSgDUdHongOJk+be
TLSH
T176B312654ABC9CD0E716E4337C455FA92870E61CF9B39C382AF7C55AEAB90D84BCE140
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5568	vlc-3.0.23-win64.exe

Loads dropped DLL 2 IoCs

pid	Process
5568	vlc-3.0.23-win64.exe
5568	vlc-3.0.23-win64.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1143671403\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_2101851321\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_2101851321\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1600482630\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_471548286\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_471548286\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1462671614\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1143671403\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1143671403\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_2101851321\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_2101851321\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1462671614\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1143671403\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc-3.0.23-win64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4580	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288616964432633"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{8E04A5C1-9F4F-420F-A8B0-1A12CE5A576A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
7088	vlc.exe
1928	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1908	mspaint.exe
1908	mspaint.exe
6196	msedge.exe
6196	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
6876	OpenWith.exe
7088	vlc.exe
1928	vlc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	5472	svchost.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
7088	vlc.exe
7088	vlc.exe
7088	vlc.exe
7088	vlc.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
1928	vlc.exe
1928	vlc.exe
1928	vlc.exe
1928	vlc.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
7088	vlc.exe
7088	vlc.exe
7088	vlc.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
1928	vlc.exe
1928	vlc.exe
1928	vlc.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1908	mspaint.exe
1908	mspaint.exe
1908	mspaint.exe
1908	mspaint.exe
6876	OpenWith.exe
6876	OpenWith.exe
6876	OpenWith.exe
6876	OpenWith.exe
6876	OpenWith.exe
6876	OpenWith.exe
6876	OpenWith.exe
7088	vlc.exe
1928	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5024	4812	msedge.exe	93
PID 5024 wrote to memory of 2564	5024	msedge.exe	94
PID 5024 wrote to memory of 4580	5024	msedge.exe	95
PID 5024 wrote to memory of 2868	5024	msedge.exe	96
PID 5024 wrote to memory of 2868	5024	msedge.exe	96
PID 5024 wrote to memory of 752	5024	msedge.exe	97
PID 5024 wrote to memory of 752	5024	msedge.exe	97
PID 5024 wrote to memory of 752	5024	msedge.exe	97
PID 5024 wrote to memory of 1748	5024	msedge.exe	99
PID 5024 wrote to memory of 1748	5024	msedge.exe	99
PID 5024 wrote to memory of 1748	5024	msedge.exe	99
PID 5024 wrote to memory of 1608	5024	msedge.exe	100
PID 5024 wrote to memory of 1608	5024	msedge.exe	100
PID 5024 wrote to memory of 1608	5024	msedge.exe	100
PID 5024 wrote to memory of 3400	5024	msedge.exe	101
PID 5024 wrote to memory of 3400	5024	msedge.exe	101
PID 5024 wrote to memory of 3656	5024	msedge.exe	102
PID 5024 wrote to memory of 3400	5024	msedge.exe	101
PID 5024 wrote to memory of 3656	5024	msedge.exe	102
PID 5024 wrote to memory of 3656	5024	msedge.exe	102
PID 5024 wrote to memory of 3396	5024	msedge.exe	105
PID 5024 wrote to memory of 3488	5024	msedge.exe	106
PID 5024 wrote to memory of 3396	5024	msedge.exe	105
PID 5024 wrote to memory of 3488	5024	msedge.exe	106
PID 5024 wrote to memory of 3904	5024	msedge.exe	107
PID 5024 wrote to memory of 3904	5024	msedge.exe	107
PID 5024 wrote to memory of 1732	5024	msedge.exe	109
PID 5024 wrote to memory of 5196	5024	msedge.exe	117
PID 5024 wrote to memory of 5196	5024	msedge.exe	117
PID 5024 wrote to memory of 5736	5024	msedge.exe	119
PID 5024 wrote to memory of 5736	5024	msedge.exe	119
PID 5024 wrote to memory of 6124	5024	msedge.exe	120
PID 5024 wrote to memory of 6124	5024	msedge.exe	120
PID 5024 wrote to memory of 5508	5024	msedge.exe	129
PID 5024 wrote to memory of 5508	5024	msedge.exe	129
PID 5024 wrote to memory of 5812	5024	msedge.exe	131
PID 5024 wrote to memory of 3656	5024	msedge.exe	132
PID 5024 wrote to memory of 5140	5024	msedge.exe	133
PID 5024 wrote to memory of 6228	5024	msedge.exe	134
PID 5024 wrote to memory of 6228	5024	msedge.exe	134
PID 5024 wrote to memory of 6228	5024	msedge.exe	134
PID 5024 wrote to memory of 6308	5024	msedge.exe	135
PID 5024 wrote to memory of 6308	5024	msedge.exe	135
PID 5024 wrote to memory of 6308	5024	msedge.exe	135
PID 5024 wrote to memory of 6608	5024	msedge.exe	139
PID 5024 wrote to memory of 6608	5024	msedge.exe	139
PID 5024 wrote to memory of 6616	5024	msedge.exe	140
PID 5024 wrote to memory of 6616	5024	msedge.exe	140
PID 5024 wrote to memory of 6616	5024	msedge.exe	140
PID 5024 wrote to memory of 6712	5024	msedge.exe	141
PID 6876 wrote to memory of 7088	6876	OpenWith.exe	143
PID 5024 wrote to memory of 6980	5024	msedge.exe	146
PID 5024 wrote to memory of 6980	5024	msedge.exe	146
PID 5024 wrote to memory of 2520	5024	msedge.exe	149
PID 5024 wrote to memory of 2520	5024	msedge.exe	149
PID 5024 wrote to memory of 2520	5024	msedge.exe	149
PID 5024 wrote to memory of 6096	5024	msedge.exe	151
PID 5024 wrote to memory of 6096	5024	msedge.exe	151
PID 5024 wrote to memory of 6096	5024	msedge.exe	151
PID 5024 wrote to memory of 2204	5024	msedge.exe	152
PID 5024 wrote to memory of 2204	5024	msedge.exe	152
PID 5024 wrote to memory of 980	5024	msedge.exe	153
PID 5024 wrote to memory of 980	5024	msedge.exe	153
PID 5024 wrote to memory of 980	5024	msedge.exe	153

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\d30a212e25af6dfa8ef0d19d2b7fb9a7.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff92e04c188,0x7ff92e04c194,0x7ff92e04c1a0
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,5365981265432094878,16854613543000981188,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,6739544653027403748,7778053809074501454,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,15832065993165281174,2645427205855454183,262144 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,5754196640090165530,10236638519089471037,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,8134973249399580540,4427859419775249961,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4356352121502350242,2022069107500687299,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,18091521512148289837,17432941703830534718,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,11946568492818817944,8904799037396026089,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,6978400590126709889,13398461188255920764,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12147479785252177241,3912259382763849983,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14071922724455818490,11471256776040187036,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14071922724455818490,11471256776040187036,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4616154936808341118,1374721382434591412,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,669468470112389321,5321370837485456492,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,11805310556468167845,16068783653309545514,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,2177287505077648776,843331248641375277,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,9237806404146410071,9537593642650953180,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,14819132789774301948,15312117112577467205,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,15901149199823940565,3466523104954354065,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6764,i,14463393504797192505,2536218530378109707,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5156,i,11685873183771591457,11012199613826986194,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
    3⤵
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12048836679843026435,2974318984992802553,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6508,i,1590999585233690771,13262051049826403435,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
    3⤵
    PID:6616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,13102251954824240013,11152275460073675163,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,9518677527875792089,7467642377609728179,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7420,i,7065963661659851396,8887840436092903413,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7740,i,13016326103776435122,13963148116601282986,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,17763535553867360356,11998876269392810652,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2156,i,13935079576903972917,7878450277493965540,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7716,i,16797542101461647876,4507724301316096021,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:1
    3⤵
    PID:6336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7444,i,2144871716849182082,9464613869532723989,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6352,i,7972679672838106974,7792258356236092389,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7452,i,18236115699038154004,1055098149714205947,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8092,i,4750902299693289806,2141345850362624975,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:8
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7884,i,6831630433042859309,12964454865365125723,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7932,i,18024824509969047242,3530757991836677074,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8068,i,2560131064171764862,6439093736885894719,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:6676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8324,i,2034171384667147358,12147516632350233469,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8332,i,15020859660334290368,7003834877165230582,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8236,i,5173463271697298344,8372476949461122019,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7020,i,12929476594883889671,8901926856316055583,262144 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,11376868928766191430,2950348455403177657,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:8
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8380,i,5905145471662845076,4399637148669420320,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7948,i,16692936827780732857,3257550856948558100,2097152 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
    3⤵
    PID:180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8316,i,8954373698956937138,10486085481984238492,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=8364 /prefetch:8
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,2575269126260155760,15309058936671881356,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,6219237562843279717,7996837790047478382,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,12284805608614785010,13942435517622640047,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17856510689805321509,12606702671930394955,524288 --field-trial-handle=2332,i,16480163737387621293,1247462244653020331,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6876
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Killers.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:7088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6832

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Killers.rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1928
- C:\Users\Admin\AppData\Local\Temp\vlc-3.0.23-win64.exe
  "C:\Users\Admin\AppData\Local\Temp\vlc-3.0.23-win64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1143671403\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1462671614\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_1600482630\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_2101851321\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5024_471548286\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 17KB
SHA256 57c6927d73a5e2b55201b4e9270037b13c02d87a358342f63ce43daef96ad057
MD5 24b6957e1169e8137845276c684ab390
SHA1 a16a33ebafe82219248d2d48b4942733419ae26e
SHA512 bc261a84652a9ca80c5e574b25cd2eef8e009f8980f95f06c1b9fffd52bba9598dd5cd585cd95cbc19c186f688a16ec0645ca5e4002e500ec063044b01ec6a21
SSDEEP 384:0BwD25Q/tAFF2U1bc8cqqUzJahurvQd2MeXaZUXM:JIV4VqqIQuRlid
TLSH
T1B882D00523DBFC4E90D9F6B832E921B1BFA81F1F90711D1BD8582497A53CD0B3A3464A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 39KB
SHA256 689de8b3abed60402ce46f054550080d0337b9a115a72cc7187b316c5a79d9d8
MD5 ac614ad24ed3ef24621cf1c3339ec402
SHA1 5166d08664ee84096205cc0c5272a48981d66b66
SHA512 8decbac5ca88b90def409968aff40aa5f5a9b89bceeb5699676cf07301c49b46583777e3f8e48d65900e42c710fcad3001b55f78e41e9d023a9351de5bb6aa31
SSDEEP 768:emsndE6KiOARxAIEKQjVwphmlghxrZQlK1Ojs30IzITg7mXrJNVw:TgzlEKeJPKWs30IzgymXrJNO
TLSH
T10F03F15918B8894304EDE0D887E82F029E33C13F3611119DB3A9496FDA0E75F12BFA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 19KB
SHA256 27b38334127d248f760ded14a3441b6ce3972eb110f73e50e1ae76dd16b73861
MD5 6a63dd3b4bdd8e27df920cbb7df0142b
SHA1 888febdc97e6e27e637e14b0017ce8c3c1b2ea09
SHA512 d691a06e50557c66496178460c13628b215b0616759788a8386c2bbec15d6be681104db6616a0840aa4941bfbb297d6cc345724957cba12752e1c2db675a8603
SSDEEP 384:dWANsy+GeX7PyAJGEXH5K5ldwQ88WAtM99LrUIra4dPTPxfNcUpxvRKY:dLNsdGeXbjJGEXH5K7di89tMXLrjaaLD
TLSH
T12192D128BC2F1F4A57A2B2A1EB2C51825CDB9853A9D5502CCD8E25C3706F1A46B47DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 31KB
SHA256 e1b567123fe97947a7b6d40a9d4301c026e5c247b5f38b7da455527317dbc054
MD5 ad8cbdf1e460cc84a6ddac4bb443727b
SHA1 b0b7dbff113e103cb5b62daa9aeaf4f46ed520d8
SHA512 7167146055f24e047a0d06224e0c29838c26f87f4f14b9aaa8cb8ea3bd4d115fdbd9d201c15ffd5e3107c9c108d22dc6c5f29410e1a126cd9cf956bbe8a813ec
SSDEEP 768:5qxFPr93UES25y05s/sBB9pCOll7UnqRIxfJarH2BFoN:sFPr9tS25yYsq9bll7UqWhJMWDq
TLSH
T11FE2E1052FD15AD4DCC452A69BC00EEACD869799A78D493F03A3C30D7F79E48A92D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 21KB
SHA256 59c2a51b29d4210fd25c579c6aa07b6079f2833785acb0674ff826b1ee02a790
MD5 9404a26b8623a820607875211c96dcf6
SHA1 2e11f83c1f9829383c37971316ca4a8e8f871e33
SHA512 ad0c800b9dedf04518dc3658ad1169aefc16fb5f077f37296ffcdc6c77328899dd7b93e5d373cb9c34a9433a3bf9d827f99dae34f2c6fcdaa888b9545fa954c9
SSDEEP 384:ZN30LtMbDAA1QKbQbQaauotbHkyXsA6FNpGT9tGdv2AoS7x61coMldYn:Zw88ARKQa9owyXKFvGT9tqNIMDYn
TLSH
T10DA2D0B295B6D0B3A154199280433752F44B11232BEC3FDEB563A6FCBAA7C6044FCA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 31KB
SHA256 84724d04bb0e760516cad8479cb7c24e25378bb8b0652eddeaa948e8b938a151
MD5 19c29bd4a574123818450ed95c116eec
SHA1 4e2394c385352993554b4300eba8e0e268e96873
SHA512 016df59cb4ead7e1889affa7543348721b07acd09af934032a45036c489d0d74a099e4e68f8c52d9897b7a9df3ff06cf1c473c4a4d611b1cbfefa6d471b882bf
SSDEEP 768:OovC9msn4ksytp1ernU9+l8vXJtVgUoKUBeYB6xQ83vT90zhx8:kmANss8rhGv5AUTGeg+/TKFx8
TLSH
T1FEE2F1A2AE00A9CCD4104BCFB514D7DD2AB61556A0B77CD0F2FA049B2A0B919E0CF937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 60KB
SHA256 6da362a3339b35dec1306493baf7e28b22ff7a71bb5b0afb21f7fd3839c2192d
MD5 9cbb27ee595c7402dbad26fe4f4cdb6a
SHA1 4c55f27e27efacb2a615d6a96f8e5882dd3e28dd
SHA512 513f56bd16cae3e5864edb98a4a1440ed6d950fd77ef165cab27fe8823c4018d6d744e2b9fc8dc842e960a5d316a3572828faa619a68997a7299c05785b5413a
SSDEEP 1536:m/G9x4edvBHOXW6QVJWdEf1st3Nh9eiuRn:39x4QupQ+JN3uJ
TLSH
T1D1530195047B2DAB15B2542EBBD325744ABA046020EAF0AFBCD54118A0FE4DCEDD76E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 21KB
SHA256 e3303ee002a36703e837577e4a0aeeee399471dfa3636acb0bdfe4b7a6c8154b
MD5 cb95807b5b590b32cebfa45057752ccc
SHA1 c04f56be668bd1c046c18e9b91eeb109eae9370d
SHA512 96022dc8db79ee95b2446ff08866602537b2fd9be76f1385e17b3bcf5c3886329533c5c63a96cf0a7e34cba01656127022cff4ec51426f443fed5f6f507ae2e5
SSDEEP 384:izNxbdpS7J+UZTCgL8MeooKFfdCOMd6OW7ClOYbYaQmAQ1aw6pxr/J:izNpg+cegL8MbdCZvWWl0vmACCN
TLSH
T10BA2D07E235DAC5B100BBC2D49FCB4A06C5B21B3AA057EF634148AB156077DE2FC59C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 18KB
SHA256 d7ef9aab773cf480f0ca085413f029018000875397dbd7a09c8ebad7cb20b484
MD5 b4f3b4952950c80c8662f2e4bf6288a2
SHA1 a6d2ada379a6e978e61901e7e5edc837286b0ae0
SHA512 536f628b4c69f0734654e4b819f470c50fa8c1c513ec682c4472288bb25ad1220c39ebe0cc85a14ba441b14902a3859a7f2440d8b6fd3344b5a5199fa5d24c4a
SSDEEP 384:IBfFDHChBod0OrjOj+aes0qSA5kX86g88b7PPaigc31Cf92JY6TeVs6qSq8QP:KbkBo6CjOaaehqSA5k0SigclCQCg60
TLSH
T1C182D0D318BBB9AE68549646FF4147058B3353E8B28DBC788E4931431F94618686FEE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
Size 203KB
SHA256 c2cac3bdd9939b9691fc3617e5e467440d8d11904846b7d4c9a539ee2b4bef96
MD5 d6adb6448cc4c32b86ac121889879567
SHA1 2b886cab8f735dd8b3c88bea822ec2701644860b
SHA512 8626066bb0a615ae55055df08f5691ca920e22733e1c41b10d590a0e88a505c16420f7fa4ab9b37b0b65d3547694ecab0deb4db8df1f45c91413cda1541ba26f
SSDEEP 3072:7Qf6wsx5fLr6ZnI8KAhkcd61gAGH3OlY0j1jD+1mTaoJqe7maUUiLhCw7/:7Rwidak2g+3sjc1kfqeYUit7/
TLSH
T1391422784C6A3A2423E812C969EE294FECCC40BDE4B3467AB605BD1788C4521DFB5DD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 437181f4da6c077a8ea39cdc0801caa0e54cc0e530a3222cbd9c5ec3af6b867a
MD5 7ec1caf4ab70a206ba1929d1cb2799f0
SHA1 a0d50905c9d64a642bb7deca9a17c37a6c6a7ce3
SHA512 06f910a2c36c38beffb58774c7390ddfe0ab9f778c6c571a044c6ebec78824164bb34af3b45a8c3c97b55f234ceb0037eac4bb1d2141bd5e962994a80e613419
SSDEEP 96:kir+PHLbjlz90oMB+sMNE8LqTbmQq8diMWpSy7aDm3S:kir+fr990/RMm8ymQ5nWpSaaDj
TLSH
T137F10970BAF91152EF29207295F66D91B1B2D0FAFB7F1F4E91835A3918323D7504823A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 662e25e1dc912541a769ecf437571524d8c2ed9b3531284b2b12d621631eede8
MD5 5d9de737c3d964d2988a7707f3c052ee
SHA1 49d1654860e4f88fd5761c8a5f2fa20ac0cad238
SHA512 6b4724b0bf40105240f125d0ed54f9d736d40a2757305b12334cd36bb6989fc94261c268f6e61ee0e75fcebdf08fa96c762eb046b9d736a85267d5006a3da232
TLSH
T1638119B6225242A4FB9001B1E9FB9AD2F071E8FEF5BF0F5E8150987E4D30393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d27e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d27e.TMP
Size 3KB
SHA256 66255da30326fd1aaa46d815b06d4ad476e30ce582c1ad27ab70d442ec0228e9
MD5 d525faf4ad0bb95e54f205a1c11b76d1
SHA1 e8ed57789a4b72dd8ca0cf36a175a18cf8e622fd
SHA512 6fa0fe814289d8f92941aad5f6485937eacbc49b385b2a7447791d387bc026ab6104ebdeec872a571399543ad84fe314fb50570c0259c703a1fc9fd15acd899e
TLSH
T1238108B6225242A4FB9001B1A9FB9AD2F071E8FEF5BF0F5E8150487E4D70393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 13a2d1e529cf3a1e69d892fcfbb206a2854fcd992934d5a8f5e5a999dfb6301e
MD5 83d8c11efed554f4c843cc096022b428
SHA1 a8372ed10ae2ddef001766518e98d4ddce0f4786
SHA512 d06af8263d796352d2f0cbb5376c8448874d974e3f45ce54dca997375d30261c0636a2933ca93310776dcb2f6dd168390883414bc441801dea9136197ab38fb9
SSDEEP 192:Dc2UGTz2i8wDd4GwFwOiNsIlajx9kx257Tzo2B/tcpxlx:Dc2UGTz2i8wDd4GwFwOiNsIlajx+x25q
TLSH
T16AE1ABF7C3EA862DD91152F0AA143E1FCE1C0956436C3D5A89E4AF5BA3F2471E141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c5fbbef4bcc8045945797ab04d2453999cdbbfb2db1237767dbdcff76af1e63d
MD5 1e979e99205d1e2a867d59e61972aa1f
SHA1 9a0ac082b1bf44ded82e8314cc03636998d4d332
SHA512 2e31804c0ba8d1a3e7ea16037298abfbb190cfd9c29415fbf89a601df23971da6bb683cc3c132e2761d7430bf7f34997ce4035ba18aa9ab751a8aa7e6ea4f9d4
SSDEEP 96:DcfOUGTz2DT8u0znewOiwBuAsuFu+uBcGOsGHPEGttO:Dc2UGTz2DT81bewOikNsIlac7sGvEGtM
TLSH
T1F3B1CBF7C3EA822DD91192F0AA147E1BCF1D0956436C3D5A89E4AF5B93F2471E101B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 004b258db15a5b70e32c3f451989a917d22feacdd58c6a230be29156eca829b5
MD5 7b3f65a467bc05c2b4fdd574f83bde26
SHA1 72044a7523a957fbcad5c387373d7182b72fb4ec
SHA512 195355ceebb980b316912be08531545ebc0b5c28a05aa291c564d9285e3e59a3b6ac91aa3ca6cb9262ec0968ce51e04742f23133b51a6dd6120b3e2401d89938
TLSH
T16ED022631A1230B6AEBC7E8180AEBC8FC33710208C42DDD410D4A99E193ACAC5507180
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59bb67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59bb67.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 292785e5dcac320486e08295b5d59995b0c9f7ec1dfdf673a000d40f669bb820
MD5 f468da0518a44706cb255abd04fd5314
SHA1 74b729f6dab2514c26cc84ae38fdbc81fd75ac03
SHA512 018c19e135cf0c76559cd67b00177c052fe3b29f44e7557ff868b4f8dfbd62540d162cf743cfe9e1567a7b49cce28cc3849d5ff08935c30baba0c43b7855bd78
SSDEEP 192:sxZmRKyM/jK1Ml8M3p/fhsBNLr5CVLUdpJHW6+WNGYvxbjHVnIg4um:sxZmg/p/fhsBNLr5HJHbGEHJRm
TLSH
T18A52E756AA249577CCCBD209BE657F53C6F504629A500E4CAAFCC60C04EAAFD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 823d7f56faef52d4910bc90cdbb7620809573f65bfa27cf8726aad1dc862b540
MD5 dcfad1af06a659cf946b4393b3f5e2a4
SHA1 4099e3ef50059edbae065952ef0d894a2f36cbd7
SHA512 4387a61342702a2603a0ebbc2b9c4f7e27842f6526db571c844820ad5f5b6dac32a54166ce5bb23a25dd483b79f65d52336c347678b82241f9da906a1fdfa56f
SSDEEP 192:sxZOQUnVRKyM/jK1Ml8M3p/fhs72NLduFaCV9bWTdpmXHW6+WNBn0/YvsMjHVnIz:sxZQnVQ/p/fhsKNLdQapfwHbm/KHJfm
TLSH
T15882E956A62459779CDBD618FD227F53D6F804639A500E48EAFCCA0C04EB6ED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c3c0284b8902d7dacdc4362f89615caeee864f184979e074cb23208720c66742
MD5 1545e5d52920742dab7a870f7322efed
SHA1 49b83471f1ae902b97438fc49338b92a1df5758f
SHA512 ef8598da7819fc4157b1693e8c107b52872ad05e94cbcb8720490393d1a79a4c4daee2008748cb7e6c7570ed0362693ca549af47b77ac8d8070c419ee294b14e
SSDEEP 192:sxZOQUnmRKyM/jK1Ml8Mmp/fhs72NLduFa6V9bWtQdpmAIHW6+WNC4WGqn0/YPzV:sxZQnmQup/fhsKNLdQahuWHbJV/zHJfm
TLSH
T16582FA56A5245977DCDBD218FD227F53D6F804639A900E48EAFCCA0C04EB6ED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 581678ee3f32d502c35284947ed53a0e8f1499ab4c26b30f0e1424bd41ee63dc
MD5 499c61b3f6a15497a2eb41b27a3f77a4
SHA1 7b0a9652e32b608547bc6457a72683551f70c9d6
SHA512 8e3fa4ddcd4cf9f3ab07f7f6791c6f2c81f2836cc687d691ceaf868ae71bba5968a6a50bb15f58b6b62b5a6504095887084a4749fd27798e258234c30d780b7d
SSDEEP 384:sxZQnpQqHmvp/fhsKNLdQaWAeuHbDm1I5/YHJf2mBv:sipXHmvp/fZdkIHbDvY52mv
TLSH
T1A0A2D857A52089778DDBD518BD217F66D6F50462DE900E8CAAFCCA0C04EE6FD2612C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 611f947222387edcd45357ae4f6edc047cdab9ac21530235781ed52f5a07dd92
MD5 0cc2c4ce7bedbe28255a04aa17cfe340
SHA1 4ab44338a6f10cc43ca769c235a234e286eae75e
SHA512 6574d0ec630390ffd00dc434f4123972fb745d5e2869c7040ff13040f3119367a8cd818db22f9fe408b57e0d0ced1c3451c3b215a5e4b7055a9c71d386f2a670
SSDEEP 384:sxZQnpQnmvp/fhsKNLdQapAeBHbDm1D/aHJf2mBv:sipymvp/fZdPLHbDCa52mv
TLSH
T12192E857A52085778DDBD618FD217F62D6F904639E510E8CAAFCCA0C04EE6FD2216C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fc502cba43896187a70bf2a65b7cd24dabef6fc7d141690ddd29bbb5592bf4fd
MD5 86f92507f8c7c28d2f3b8405ddd0964c
SHA1 551c5a5a8fd84203b21b2f9092eb5bf0ad612ae2
SHA512 7cb9ea47397ec08fdab8da2bc563e8b7cfaeeda8bf592df7c68c3b251e346dab0615ac6d5c6c295ccdd65ed588981e6ac5e6e7af080e66511b0de712eee11e57
SSDEEP 768:T3seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppQroZL1:T3seJ3xWvhfynu1jaVcL88p7Z5
TLSH
T16AD20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\623cd082b6202da0_0
Size 62KB
SHA256 7d8954b58d6172c86669ef37b42dec0ecd5127bcbb98707d18861e01edf38740
MD5 a9ba5008a0982811e43cc573a0f6e59c
SHA1 2baa92ee2ed7957cef15ced4204575c7b155f415
SHA512 344614eb0adfd1618b887f03b909f2ae7acff17640537fb3541b159f0c1954cd77871130d7835ae0fce64544dddccf74d23aeea44036f85499585221e687e093
SSDEEP 1536:+zZqYQj+BHKut3JHjvGEs7RONVIqtNPF3sJduDHHPwqpzGB/h:TZ+0ghGEEROfFD1w/h
TLSH
T1495317E7A2626036CBAD21D5949A7F00E11B13561444CDECF0BD76953B18ECB63B3BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 c5449d92a4028318f8c0c3e0e4d28a19ef28ec0d3fbd96d6de4a785c49881793
MD5 46e4762dad86d0108da9e0ea0cca7471
SHA1 0de3e27a97cb4ccf1fe61dfbf6ec26eb13548ec6
SHA512 237df42a128f7a8bfb961e164836721959850274113f5aacf6429414fe2a0134833ca4ee84ccd2d93c87c1bbcd8be2127fdb439150145a2731bfb5a4ee338aad
TLSH
T131A0021612D84089D40226F225D619457622D9182706330543A38444C9616458D7140D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 9b3e91e243a35796a38fa7cc363d31e57ce5feca2043a6f604cc33fca1e79879
MD5 d8eb76e5845d725a4f4f829e150e927c
SHA1 1d1593a87f6c5b3f959d7646ef79d8a9a8cde631
SHA512 00ddf6cf485236d02eb67aa492673dbcfb9d016d1580fae03d98be23e03fac72f020e1fee4e5fec3adf511bdea719af38c2e39f45bc508de8b4d4bb85d85e1b8
TLSH
T1ACA0025A52C04009C00312F225E68282B222CD5833551B9581928484C8546458E7602C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 c68b74e38b952612c356b557a73449c33cf20879379f1f4b58817f74231b4005
MD5 cea26f02ba27ad53f5cab8483fcbe4c9
SHA1 640fd490aaac4904a831e932d46c43ee4fc1f41c
SHA512 dcbc0e1a5f42af22a46833b2f4b2724bc0297f98b4696f1590fea0109e8c97bf91a354ac6246de6f0f2b91d9c84ce4024e1beb13efc5a4314b2e7fcc8bd00328
TLSH
T156A00434DFC00105C45331F11F5347455300CCDD3110530FC0D14054DD705444F4310C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45dcec6f-aa01-4d60-b08c-c87ce78d75a5\index-dir\the-real-index
Size 72B
SHA256 21715ec18a5e60e6b706bda7941d0fa2f600d6247dc00b937664c8f3aecd89a2
MD5 5162e8d249f0c2c16c3d6c42b5a7d381
SHA1 343232f1ad5438b97f7485a0eb4bd8668a46f4da
SHA512 f9a3ad8c464af8991612c167eb33e9a90d6fb0314e344422e932bda77f731496a20cd0d36a4c9e7abf9abf999f47b60b5183c03fd2463803e3aede7737444cc3
TLSH
T196A0022405A400C1E001DFB0D196219033145C592203671A41914897CA923584F610E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a621b724-b389-489a-b6ec-b5a609906aa0\index-dir\the-real-index
Size 72B
SHA256 fbc8931994f1fa80af09a7a836c9e481576d7efd5e2761d8c2335b34cb418937
MD5 e2347905cae20028fa428285d633666e
SHA1 3026b977f6fdf45e2f291227774ffdcd3cb930c2
SHA512 6a11eb70a1bdae0e1ccffa3eb67f499be131938b78a79114b95350aec68acdbc7f8f1b4fb94f0aff1c6194a0e0d6906a24290de24ff20d86947fe1851cb9803f
TLSH
T146A00210119087DDCD04037150875DF977528D78CF03179968931844CC541884309010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d661.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a621b724-b389-489a-b6ec-b5a609906aa0\index-dir\the-real-index~RFe59d661.TMP
Size 48B
SHA256 d5ab0ee7c99413033ae26cb7389d207d64cb0e5c8a287eb4e4bc8f27bf32bdc8
MD5 bba2db993835a273a88f47542be01dcf
SHA1 0c11535ce42df0cdff8fcde0640c64cf0baff28a
SHA512 cdc9092bdb6ca2afc9206ac8e5a61ec3bb7923379868036eb6a2ce922be8fce2dbab34c1002dcabdcbd61a18d7315e48c258bc8b9eac0dfbc779b1e7b481f149
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 5adb27189a9a1d67a3f7217d667cd8b4703a6ccefc258f0120ab514e663aa0aa
MD5 c3ec76bcee8f7abb9aa3de9172120074
SHA1 dfcc484920a448af846a58a226cddd55f92bdef5
SHA512 da181e1fd4c1093892cb6e1419c9f1c81312d6c3e731db9e88a07400eb03d767b87b02f31645239c7f2daafe7896a778347c5e837e46c4ad6dd83a3483d427e8
TLSH
T1D551BA8E8C8A1997DD7C107368B719C1373628DD55848B075DEC5434BCC332C3D5A658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 01b4670db5526343938d5ff1f1830d009daba6c778e572ef76051e1319ad97da
MD5 563aaeda576205b34bc2713a62e45374
SHA1 373265176d194d76eee206dcd08834d30deb4d73
SHA512 d82888793d3b85eab4c1655038d10e3ea1de476b3ac4a353afcf1ee163c2c00ff9bb5992b51e992503b2ea6c85a895c4238ebae9b08dba5c22da5bc68c1290e1
TLSH
T14131638C8E90595BE85944B611F2B4E03370C9DC0B2163635C3C36352D273492A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58db48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe58db48.TMP
Size 1KB
SHA256 bb5b52a4400726a01902dd6f1ca55c83d3c4bf10e19ef2a3feb66d32aa698900
MD5 26983ed8dcc1ec4313cadcca417e7227
SHA1 4fd30c2b8e7ec2d3bc95528ab10f5ea2eb35c375
SHA512 98d885cb2dae2052b662a283afcb3155ec9d3b0208ad245705bd9afba06cf261a5e165760053a22a9245e49c5ee5b8059d15ef82bf4efde8ae2892935c43fbd0
TLSH
T14A31058946915A0BF89451B70A93B4F87334C8005722B7D7A97C66395D3178E5F4F1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cbe5e16102bc4ec11c97c79fe6e6c1a41453c872c1f8871a8814be9d3c0300be
MD5 17c4000d0d97faac85049f73b80c1e58
SHA1 ac32a95061ca6ec27da3a7736b5df12a1f82caee
SHA512 82ed3d18623d7eb9cc4d9530145e8d17b9fa46259dbbfcab12cd82057c4f650f9882df767ffe903fe7be6973e5d4fa9b9e738e126df3526dd4d9653876473715
TLSH
T175E068B62DD32414BDABC3D124308090060A74A8E902FC0E941AF6831072315309AC35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 a9afd248235dea040da8494e905d1492fb6506ed352620736226e927c3877323
MD5 c0a4f4bee507846264834debdab9a7c4
SHA1 142ea8d118757193ce0e71693a0e3957d5bacafb
SHA512 6a1a2e862eb4f954849b3be99926ed5c91cfbace10b1428fcfb9471c1e98cdf59d96dd1a4f81b3d05f879a134947265deb7d484e9cbc5f423ab15c3d57623940
TLSH
T1A1F027722EE71818FE9BC3D56430809006497C59D442ED1E991BB59350B231930EEC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 38ed2b758cf6166269f9fb2c285b803cc23e1b4f08ebb3134a0169d348e9303c
MD5 95df57d738df8263d78c4ea90ba294cf
SHA1 4c80bbbcd0c0a8244f0ff99a4468bcf1fb373c12
SHA512 7d73f8235a2dbac1e3b77ce079f95a4fbd574ecdfb2e816a8131fa8157de73871ae36bfb7fa413a7e90bbd86756a50841491435c05144522b4e753dda781899d
TLSH
T107F027722EEB1818FD9BC3D53430806006497859D452ED5E991AB59350B231930EEC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 61bd22574c97b62dec26b3526ad871e09711c226de5799e9d786bcb4799fbddb
MD5 ae0220b5740d3b35660b0a9c076f672b
SHA1 f084f235934ac90e30e188bd90bd8402f63ae52d
SHA512 2f75e4d42fd19efe5d462657e4685fa45385f8c28230e7bacb39733def2b4c92f407766850c80cc8ce8f03ac2e2935ba9db39ebacc9f52bd64d4c3db08e66e94
TLSH
T16FA0022D99599085C0180270B0A5058576E19CEC8B4E36B5CCAE109898A874047F3628
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592f05.TMP
Size 48B
SHA256 5d14dad7f36b5c59292a58529a1da5cfa7de4c2a9916932cba9cce0e147e37c3
MD5 84dd96151d24a517ca2c9d0c1447298c
SHA1 a3679b82c7ff5aa1be78cc970c3b5c84c59fef9e
SHA512 74498736e31ab2ca85bb6800f794931ba1d1a1df87dfa8bd67440cc99e9050cd35fdabfc067fc7fdc0f136acd3891050c5138cd3a8b1800ff557bcc5c22f61d8
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b2c8375c7c48e2944df2ca200b74d7259418aceddd6b043b5ec0a14be50d599a
MD5 74d655f1fa1c89c5861dc45f4db62cef
SHA1 ebe7e570694c6f5eb4ad59f8160f2e518352b68e
SHA512 66c1cf1ae229a0e9a886f1f182d27bc2465cde7e54e48e1c625b1e053afc5543f4df4931672a67665df5137bdf5664e7a696f16ca6f26b0cba7b9bbce5d63306
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EC:KYHIhKggkXyBOIHKnq0jy9TINK4UI8
TLSH
T1EA910F46343F130329BD284CA7A19A364E4271A37468A5FF7BB844A24E27E160DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596dd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596dd3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3712bc11d3fd22232bea66da9c241d4ecd410ab4543469660f46346cd0c60dab
MD5 f82e29a407ad306c903b3c1c8e054407
SHA1 9409b9d16d938a868886593ccd1936864d3dbaeb
SHA512 a1bd04504babf61cacad8bb9d181028da626c25f9c24d3b7e8e07689d28ad2fc6129f3b6cc63f4270ad9fe93614452e31f777995052ee33ef391643995195054
SSDEEP 192:uuE0sNMk+QeUiM73SrQmiU1HO44MTKcCOxkV8z1fcq9UMZ:nhsNMk+Uf7CdgHxOxXfvUMZ
TLSH
T1D0420A76AC749D3B99E7A151F48A33135FB08167A6845F90EADC6F1C01DB2AC130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5980a5eab33f3beaaeaa8573a7cc63a27da929dd0acc75d5402dc7539079f1e7
MD5 16fa4260cbf8b5985c785d3dc9ff7e48
SHA1 a8ee828a45eb5efae04b257129728e2ad7435636
SHA512 d40ff7215f59cb07a01bf966a37d02b5d4a2637408662943a1babc51b7e52551cafc0940da4db88c6ce9a17739778aa430b045bf2570651164ffd08c5ae07c50
SSDEEP 384:n5tNn/s3n9SOsNMkFTff7CCFHxOxofvgF:5j+9hglRnfvgF
TLSH
T148725C76EC25AD2BADE7A045F54A33075FF48167A6C42F90EADC6F0D01DB26C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d21503a390213c5bbadb609dc27f9684a437aadb7fc70846074a49ba6b96cf8
MD5 a036290ad2bd80ab3f033c8799204364
SHA1 68f0a7c5a71c30d4cd18f8eebe9ab26aa2af0f4f
SHA512 877560e464ac132cf614020d7517307c9c0635f7819247cbe994838f9d65d65640dbb7c63ba50e8f218cba21f8f988c1aa2079036275a8aebb402b7f0d2c4a09
SSDEEP 192:lONx6vMtPQmiUyYDThTKcCOxV84717U/u:lONx6UtRTTSOx1hU/u
TLSH
T187020935FC786C7BEAA3AD46F4CA23171FB011ABA5905B50EAE82F1C00D724C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ffc7c76a6a30e2a7117e6c715f61a0545e2fb1e376cbd394ffff728499d0d850
MD5 15c3c580f36d2df53550135e6084a9bd
SHA1 98e69f9c3155c11812cbd7ee4a9ebfa2ab96098c
SHA512 5a6f68b3c7b05bfd16c18a645fabaad32e854a3dcfdd5646784e9180772824eff3d38dc9c37bb086ba0528083f2fe972b75cafa10fe6feb4f6c078f4ad6b606c
SSDEEP 384:n5tNn/s3n9SpsNMkFTff7C82HxOxofvgF:5j+9GgsRnfvgF
TLSH
T14D725C76EC65AD2BADE7A045F14A33075FF48167A6C42F90E6DC6F0D01DB26C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ec31e56aa4e19b7ebd612da6d60d80885f23ae4ee689a9c2febafb8742901fbb
MD5 0a000a32551cda504bcc0910bb2b41a2
SHA1 2d8d948f92f61d587c6433d70f88134d4549cb7b
SHA512 861f8d15179be5c0cbb5902d2f55f269d25675a543f0081565729f10c382910c41b6ca260e5d4aba9e5fb7779069e9b2bfbe69f6a9522f7fb14a2925213ef289
SSDEEP 384:nAiFKtNn/s3n9SrysNMs8TUNTUlIlFTff7C78+ohI25DfwNOxufvgF:bFKj+9RGwgr7+ohI9N3fvgF
TLSH
T1BBC262F6D8D3993BE8AE5783A73E2E469ABCC15375845980B7C85E0CCC861BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 50cd78aef1a6fb5f81b6dbc062ff12cd1289d91f187bfeccc491ca1119e349ad
MD5 3071baabe5ce4ca4962a278064b78a65
SHA1 20fe287bf2e6fd0166410a5663eef654a51c2bf5
SHA512 c26a90110101bf02bca2be11a6a6150854fd1de8f0c7332e28897fbe94b765cbfd0f9049cd48e7fa47dc13cac78403c0c7ba53f9274365ef45f53e6d32a6f020
SSDEEP 384:nltNn/s3n9SOsNMkFTff7CCFHxOxofvgF:lj+9hglRnfvgF
TLSH
T18F725C76EC25AD2BADE7A045F54A33075FF48167A6C42F90E6DC6F0D01DB26C130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1b4132b63961cabf928b9fa25f520afe231f179a2d3a3c45c3b8dfb187d9a186
MD5 dc4371bcb167dbb712309182211bc265
SHA1 756546589c6a83138d8eeeaecb9581175ae9b90a
SHA512 424938d18d555750e23a3dac42a88a68dd388a9dc51d1a42b4996b8c0bdf1453c2678c9150ba64c6550772019720b75d3927fc27660b5abdf9985334de766c0e
SSDEEP 384:nAiFytNn/s3n9SrdsNTs8TUNTUlIlFTff7Ca8+opn5xf+NOxdfvgF:bFyj+9q3wgrs+opiNGfvgF
TLSH
T1EAC272F6D8D79A37E8AE4783A73E2E469ABCC15375885980B7C85D4CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fdbfdda77ce17b8f9e3e3902a084d202b3f274da4181ffdb0fdd401ea8634952
MD5 2629a0ea9c9796ca978e3a6ce4c43642
SHA1 172bd19fa9591fcad9fb2bcc52923ee6750ad6be
SHA512 a2e19a9e5b5223bc0061639771815d0b6f79d1abf9ae64ff7ae719fb026e7eca7d5f4ce520341f2072dbad2e2ec8e2d4e73825371be76e389530b932b9fc75f4
SSDEEP 192:ZONgx6vMIPQmiUy6D1hTKcCOxkc80Ifcq9U/u:ZONgx6UIRL1SOxafvU/u
TLSH
T15E12FB76FC659C6BADA3B451F48A33171EB4826BEA845B50EADC3F1C01DB15C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f59d814db9f2e5358ffb7e5386086d3920bee7097e6d0b336bae685d31416019
MD5 c6ae16a6b81b0bdcf49462017a493d81
SHA1 26200939a1e1fa6dcc2fecb8b12c5903841a8651
SHA512 95c41c9a2dce0fa599730b9785b848cdd394b7d1b2594d6b706a8c007fb0fb9aa005a30765566ce2ca157fd8bdc3998dcfee8804c1808be78b3e44861b5cb4ff
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 55b487a0825348f638ff68b7a29049b20ecc3cfb474e32279d562f3113ff12fa
MD5 c6854cf192b6b7469664ae70290ddc43
SHA1 0105c290047e87c39268b381da3fa619f3362930
SHA512 ca98c4cddc49f825f77cb497e498fc2e51808c699488b093fcceb3b032ce1875a5f10c6ff0b008f91bfd6260cefdfa6f8574cee2b4ba2490a016d6cc2eb0b390
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5979ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5979ab.TMP
Size 392B
SHA256 2d2ec94da92eef0e541685badbfb85007ae093a7e4574158d90d47db4401b944
MD5 b5662552c5c3afa514a25fa8f54a949e
SHA1 ca430211b1fc009fad030ba2ae7699d3689ea77e
SHA512 d6780bc06cd050c7466c08954ac7027589d09dc429903d488709d7327fccafe4ffbac2ba456b8caef1eda928bf491007e8309ea4f26d4c242a3d1f8381322950
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 304fc9e6331e6105f6ce324c812d06a0f45cdc27dc58ed17744f9d4d4613210b
MD5 fd643d921114416022834a2f4b6199a1
SHA1 3267b3b32c16e1e0f9dfac10875ac4e03f4beb8a
SHA512 257bb995994304a65c8be2c3f5ce1327f2bcd2b5d71f9d365bd1690e7f2d00946d2dd060729d0d376bf9bab3ae760683a256de4213f1c9da190e987e7fc50233
TLSH
T10B51296626A243BF8E652EB6DF04A6607DC8DEB416575050C2221AA18CDB0770C173FE
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8952cfea13df7a5867c6eaee630bc9d89eee2a8ba297390158627283524e7d7f
MD5 6c826de0ba5247a063706688795bc92b
SHA1 fa17416aa931399c55cd542e76ba663cfd9fca0c
SHA512 b7fa220ccd0b979c189d0f81efc0917dc5655e79c49bec4d18f0b7e1a824070e7aab817375ad8df2117d28f6629558d0e7bdf7d1595ab481106c35d351d32750
TLSH
T109411A69B6E90148B3B77F1A9BF6A86D487F7D772F0AD45D00110E4F0A23A41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

5da9eb07-7f45-40a5-a5d2-524e71a8df64.tmp

Path C:\Users\Admin\AppData\Local\Temp\5da9eb07-7f45-40a5-a5d2-524e71a8df64.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6f2a4ac2-7162-4a50-a00d-c9737a43038e.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f2a4ac2-7162-4a50-a00d-c9737a43038e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqE56.tmp\LangDLL.dll
Size 8KB
SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
MD5 313661ec12ed5ce1fd0b3292bf02cb69
SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
TLSH
T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqE56.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1416428024\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0658ba4d-9a1a-479f-9dd1-9fd54cdd853e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1437210517\0658ba4d-9a1a-479f-9dd1-9fd54cdd853e.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc-3.0.23-win64.exe

Path C:\Users\Admin\AppData\Local\Temp\vlc-3.0.23-win64.exe
Size 43.8MB
SHA256 20ad191348684b470ddc4e05204316f3d8e39655f412b3e392a0eef97639daaf
MD5 f711b3aee7c805d52ab28fe53440e35f
SHA1 ee04a6c1317bba9c60369a586379ff245abb286c
SHA512 fe7aa76985fe90e13a47ddd255bcaafa2bfbc6ece4b998a8031a8e0b6042e3d904b9db03f669cd9580914f050b558bc6541fcaaf1be176993eb847cf739c6f45
SSDEEP 786432:Gn0FVwAvmLqmA88sH1xD8vMdvI7BBx7p4AMvIPtEg6k5JaA/ATqmIQOMJxVPkW:JVwAuidsVF8viItDpTfEo56qmIQOQxVv
TLSH
T128A7332E76ADCC65C0DDAC391923ECBEF145AFA38A500767F8653EC0A93B5552C2D063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml.xspf

Path C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
Size 304B
SHA256 81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d
MD5 781602441469750c3219c8c38b515ed4
SHA1 e885acd1cbd0b897ebcedbb145bef1c330f80595
SHA512 2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461
TLSH
T135E0CDAC3084DC1147D1E513BBFAC0447775A0495AE95985E7E326B385411F4B631254
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 519B
SHA256 7b9b65aaa15d4a799b636be2c0cd17bb952f0706d693c74c567f3bc55fefd0ed
MD5 d5c16120e2a7952632af6f9e82d8a89f
SHA1 1fb694080f4e583af256973a2b4c0583344a4d2e
SHA512 ff0127e56ba178c95f1666b7819324753c6e5070476cbf20bdcf909aee9296d015a0b540e1da2a57c51ed674189f8c5577a23b946b0cfdc982314637ebd4617f
TLSH
T1BDF09752042850BC8198AF8E39FFD352FAFBA741FA323305B0182111700D6D669DBD8C
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Killers.rar.crdownload

Path C:\Users\Admin\Downloads\Killers.rar.crdownload
Size 1.8MB
SHA256 2d809651e9333afd9cfcf97225c95805b4c2c3531c711d9f44c9a8744554f943
MD5 df7576a316d263e70b5a21cc5b49025b
SHA1 f3be3afa321f3ff210005b0546f73869f44ccbc7
SHA512 d5c67394e9a074eb2fdc484d4be372241cded9caafaa64401e65ff762acaa22f48eb5814892fdb3d6d5dfc7d1c166823829dbb5ce037459ec75079b2508d11a2
SSDEEP 49152:3cTu9Tf8AVvq4AniYfWiD48Uos1BETk/LjshOprhLNbD5tyjQvnn:3c6xdqJiYfTpqvQcjBrhLvtMQP
TLSH
T11C853360D9D9AA974923232C9DA44533B394CFC4C923DD386CBBE0F14B752AA2817F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1928-2632-0x00007FF93B580000-0x00007FF93B5AB000-memory.dmp

Download

memory/1928-2639-0x00007FF92E9F0000-0x00007FF92EAD3000-memory.dmp

Download

memory/1928-2626-0x00007FF766010000-0x00007FF766108000-memory.dmp

Download

memory/1928-2627-0x00007FF93BB00000-0x00007FF93BB34000-memory.dmp

Download

memory/1928-2633-0x00007FF92AD00000-0x00007FF92B090000-memory.dmp

Download

memory/1928-2630-0x00007FF93B8F0000-0x00007FF93B909000-memory.dmp

Download

memory/1928-2628-0x00007FF92B090000-0x00007FF92B346000-memory.dmp

Download

memory/1928-2629-0x00007FF93C840000-0x00007FF93C851000-memory.dmp

Download

memory/1928-2631-0x00007FF93B5B0000-0x00007FF93B5D2000-memory.dmp

Download

memory/1928-2650-0x00007FF934E30000-0x00007FF934E7F000-memory.dmp

Download

memory/1928-2634-0x00007FF93B500000-0x00007FF93B514000-memory.dmp

Download

memory/1928-2635-0x00007FF93B4E0000-0x00007FF93B4F1000-memory.dmp

Download

memory/1928-2636-0x00007FF93AD60000-0x00007FF93AE32000-memory.dmp

Download

memory/1928-2637-0x00000275E87C0000-0x00000275E8A56000-memory.dmp

Download

memory/1928-2638-0x00007FF92EDE0000-0x00007FF92EEC8000-memory.dmp

Download

memory/1928-2648-0x00007FF929870000-0x00007FF929A7B000-memory.dmp

Download

memory/1928-2640-0x00007FF93B360000-0x00007FF93B3A1000-memory.dmp

Download

memory/1928-2641-0x00007FF93B3E0000-0x00007FF93B40F000-memory.dmp

Download

memory/1928-2643-0x00007FF93AF20000-0x00007FF93AF46000-memory.dmp

Download

memory/1928-2649-0x00007FF92ED40000-0x00007FF92EDD8000-memory.dmp

Download

memory/1928-2642-0x00007FF93B4C0000-0x00007FF93B4D8000-memory.dmp

Download

memory/1928-2644-0x00007FF93AD30000-0x00007FF93AD5D000-memory.dmp

Download

memory/1928-2645-0x00007FF93B150000-0x00007FF93B16A000-memory.dmp

Download

memory/1928-2646-0x00007FF93AD10000-0x00007FF93AD21000-memory.dmp

Download

memory/1928-2647-0x00007FF93ACF0000-0x00007FF93AD01000-memory.dmp

Download

memory/5472-595-0x00000277EB190000-0x00000277EB191000-memory.dmp

Download

memory/5472-593-0x00000277EB160000-0x00000277EB161000-memory.dmp

Download

memory/5472-575-0x00000277DAE40000-0x00000277DAE50000-memory.dmp

Download

memory/5472-559-0x00000277DAD40000-0x00000277DAD50000-memory.dmp

Download

memory/5472-597-0x00000277EB2A0000-0x00000277EB2A1000-memory.dmp

Download

memory/5472-596-0x00000277EB190000-0x00000277EB191000-memory.dmp

Download

memory/7088-1816-0x00007FF93AD20000-0x00007FF93AD4F000-memory.dmp

Download

memory/7088-1804-0x00007FF93B390000-0x00007FF93B3A1000-memory.dmp

Download

memory/7088-1803-0x00007FF927BF0000-0x00007FF927EA6000-memory.dmp

Download

memory/7088-1802-0x00007FF93B3D0000-0x00007FF93B404000-memory.dmp

Download

memory/7088-1809-0x00007FF93B500000-0x00007FF93B514000-memory.dmp

Download

memory/7088-1811-0x00007FF92EDC0000-0x00007FF92EE92000-memory.dmp

Download

memory/7088-1822-0x00007FF92ED50000-0x00007FF92ED61000-memory.dmp

Download

memory/7088-1821-0x00007FF92ED70000-0x00007FF92ED81000-memory.dmp

Download

memory/7088-1830-0x00007FF91BB00000-0x00007FF91BD45000-memory.dmp

Download

memory/7088-1829-0x00007FF92E610000-0x00007FF92E622000-memory.dmp

Download

memory/7088-1828-0x00007FF92E630000-0x00007FF92E64B000-memory.dmp

Download

memory/7088-1827-0x00007FF928380000-0x00007FF92842B000-memory.dmp

Download

memory/7088-1826-0x00007FF92E650000-0x00007FF92E675000-memory.dmp

Download

memory/7088-1825-0x00007FF92E9A0000-0x00007FF92E9EF000-memory.dmp

Download

memory/7088-1824-0x00007FF92E680000-0x00007FF92E718000-memory.dmp

Download

memory/7088-1823-0x00007FF927580000-0x00007FF92778B000-memory.dmp

Download

memory/7088-1820-0x00007FF93B280000-0x00007FF93B29A000-memory.dmp

Download

memory/7088-1819-0x00007FF92ED90000-0x00007FF92EDBD000-memory.dmp

Download

memory/7088-1818-0x00007FF93ACF0000-0x00007FF93AD16000-memory.dmp

Download

memory/7088-2413-0x00007FF927BF0000-0x00007FF927EA6000-memory.dmp

Download

memory/7088-2412-0x00007FF93B3D0000-0x00007FF93B404000-memory.dmp

Download

memory/7088-2411-0x00007FF766010000-0x00007FF766108000-memory.dmp

Download

memory/7088-1817-0x00007FF93B4C0000-0x00007FF93B4D8000-memory.dmp

Download

memory/7088-1805-0x00007FF93B370000-0x00007FF93B389000-memory.dmp

Download

memory/7088-1815-0x00007FF93AD50000-0x00007FF93AD91000-memory.dmp

Download

memory/7088-1814-0x00007FF92E720000-0x00007FF92E803000-memory.dmp

Download

memory/7088-1813-0x00007FF92E9F0000-0x00007FF92EAD8000-memory.dmp

Download

memory/7088-1812-0x00007FF924600000-0x00007FF924896000-memory.dmp

Download

memory/7088-1810-0x00007FF93B4E0000-0x00007FF93B4F1000-memory.dmp

Download

memory/7088-1808-0x00007FF9248A0000-0x00007FF924C30000-memory.dmp

Download

memory/7088-1807-0x00007FF92EEA0000-0x00007FF92EECB000-memory.dmp

Download

memory/7088-1806-0x00007FF93B2A0000-0x00007FF93B2C2000-memory.dmp

Download

memory/7088-1801-0x00007FF766010000-0x00007FF766108000-memory.dmp

Download