hxxps://www[.]mediafire[.]com/file/q1pcfiniu93mzb3/FortniteHack[.]zip/file

Analysis

user interaction
yes
max time kernel
143s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/q1pcfiniu93mzb3/FortniteHack.zip/file
Sample260719-rn77xaft21

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1172	FortniteHack.exe
5076	FortniteHack.exe
1984	FortniteHack.exe
3068	FortniteHack.exe

Loads dropped DLL 25 IoCs

pid	Process
1172	FortniteHack.exe
1172	FortniteHack.exe
1172	FortniteHack.exe
1172	FortniteHack.exe
1172	FortniteHack.exe
1172	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
5076	FortniteHack.exe
1984	FortniteHack.exe
1984	FortniteHack.exe
1984	FortniteHack.exe
1984	FortniteHack.exe
1984	FortniteHack.exe
1984	FortniteHack.exe
3068	FortniteHack.exe
3068	FortniteHack.exe
3068	FortniteHack.exe
3068	FortniteHack.exe
3068	FortniteHack.exe
3068	FortniteHack.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 5488	1172	FortniteHack.exe	148
PID 5076 set thread context of 2400	5076	FortniteHack.exe	151
PID 1984 set thread context of 5600	1984	FortniteHack.exe	166
PID 3068 set thread context of 1648	3068	FortniteHack.exe	169

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_861241532\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_756911721\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4600_756911721\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5696	msedge.exe
2960	msedge.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289445020628937"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{3EEE6546-8992-418B-80FF-FE9765CFAAF6}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{54CEA34A-0DEE-433C-9C48-6F3174F548B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
6016	mspaint.exe
6016	mspaint.exe
5216	mspaint.exe
5216	mspaint.exe
3284	mspaint.exe
3284	mspaint.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4972	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	7zFM.exe
Token: 35	4972	7zFM.exe
Token: SeRestorePrivilege	2092	7zG.exe
Token: 35	2092	7zG.exe
Token: SeSecurityPrivilege	4972	7zFM.exe
Token: SeDebugPrivilege	5140	taskmgr.exe
Token: SeSystemProfilePrivilege	5140	taskmgr.exe
Token: SeCreateGlobalPrivilege	5140	taskmgr.exe
Token: 33	5140	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5140	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
4972	7zFM.exe
4972	7zFM.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
6016	mspaint.exe
6016	mspaint.exe
6016	mspaint.exe
6016	mspaint.exe
5216	mspaint.exe
5216	mspaint.exe
5216	mspaint.exe
5216	mspaint.exe
3284	mspaint.exe
3284	mspaint.exe
3284	mspaint.exe
3284	mspaint.exe
5140	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 5024	8	msedge.exe	89
PID 8 wrote to memory of 4180	8	msedge.exe	91
PID 8 wrote to memory of 2960	8	msedge.exe	92
PID 8 wrote to memory of 4180	8	msedge.exe	91
PID 8 wrote to memory of 4180	8	msedge.exe	91
PID 8 wrote to memory of 2788	8	msedge.exe	93
PID 8 wrote to memory of 2788	8	msedge.exe	93
PID 8 wrote to memory of 2476	8	msedge.exe	95
PID 8 wrote to memory of 628	8	msedge.exe	94
PID 8 wrote to memory of 2476	8	msedge.exe	95
PID 8 wrote to memory of 2476	8	msedge.exe	95
PID 8 wrote to memory of 628	8	msedge.exe	94
PID 8 wrote to memory of 628	8	msedge.exe	94
PID 8 wrote to memory of 2444	8	msedge.exe	97
PID 8 wrote to memory of 5752	8	msedge.exe	96
PID 8 wrote to memory of 2444	8	msedge.exe	97
PID 8 wrote to memory of 2444	8	msedge.exe	97
PID 8 wrote to memory of 5752	8	msedge.exe	96
PID 8 wrote to memory of 5752	8	msedge.exe	96
PID 8 wrote to memory of 2972	8	msedge.exe	99
PID 8 wrote to memory of 2972	8	msedge.exe	99
PID 8 wrote to memory of 2972	8	msedge.exe	99
PID 8 wrote to memory of 4640	8	msedge.exe	100
PID 8 wrote to memory of 4640	8	msedge.exe	100
PID 8 wrote to memory of 4640	8	msedge.exe	100
PID 8 wrote to memory of 2672	8	msedge.exe	101
PID 8 wrote to memory of 984	8	msedge.exe	102
PID 8 wrote to memory of 2672	8	msedge.exe	101
PID 8 wrote to memory of 984	8	msedge.exe	102
PID 8 wrote to memory of 3852	8	msedge.exe	104
PID 8 wrote to memory of 5540	8	msedge.exe	107
PID 8 wrote to memory of 5540	8	msedge.exe	107
PID 8 wrote to memory of 5540	8	msedge.exe	107
PID 8 wrote to memory of 1756	8	msedge.exe	108
PID 8 wrote to memory of 1756	8	msedge.exe	108
PID 8 wrote to memory of 1756	8	msedge.exe	108
PID 8 wrote to memory of 1448	8	msedge.exe	109
PID 8 wrote to memory of 1448	8	msedge.exe	109
PID 8 wrote to memory of 1448	8	msedge.exe	109
PID 8 wrote to memory of 4316	8	msedge.exe	110
PID 8 wrote to memory of 4316	8	msedge.exe	110
PID 8 wrote to memory of 1888	8	msedge.exe	111
PID 8 wrote to memory of 1888	8	msedge.exe	111
PID 8 wrote to memory of 1888	8	msedge.exe	111
PID 8 wrote to memory of 4200	8	msedge.exe	112
PID 8 wrote to memory of 4200	8	msedge.exe	112
PID 8 wrote to memory of 4200	8	msedge.exe	112
PID 8 wrote to memory of 6100	8	msedge.exe	113
PID 8 wrote to memory of 6100	8	msedge.exe	113
PID 8 wrote to memory of 6100	8	msedge.exe	113
PID 8 wrote to memory of 4516	8	msedge.exe	114
PID 8 wrote to memory of 4516	8	msedge.exe	114
PID 8 wrote to memory of 4516	8	msedge.exe	114
PID 8 wrote to memory of 2388	8	msedge.exe	115
PID 8 wrote to memory of 2952	8	msedge.exe	116
PID 8 wrote to memory of 2952	8	msedge.exe	116
PID 8 wrote to memory of 2952	8	msedge.exe	116
PID 8 wrote to memory of 4696	8	msedge.exe	118
PID 8 wrote to memory of 1076	8	msedge.exe	119
PID 8 wrote to memory of 1456	8	msedge.exe	120
PID 8 wrote to memory of 2744	8	msedge.exe	121
PID 8 wrote to memory of 2744	8	msedge.exe	121
PID 8 wrote to memory of 2744	8	msedge.exe	121
PID 8 wrote to memory of 4600	8	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/q1pcfiniu93mzb3/FortniteHack.zip/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffcf5dac188,0x7ffcf5dac194,0x7ffcf5dac1a0
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,17315829894135949095,1389361762387982289,262144 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,9012914736988044119,3726625669839325333,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,15289819526590638137,6290212288060558624,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,2955592199477069083,4839448903315950387,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5383503426485722816,13521119597596583175,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,14851251537782580915,4131738594967139573,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12748521423830492115,2560273033398849502,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3736,i,12433687591949487730,14109864864296397319,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5544,i,5371395808669324921,7325120066101238775,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,12950675487115969988,11764934712398403927,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,14685577326109544398,15402093962910598517,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5917222696954409167,5749019217081896543,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5917222696954409167,5749019217081896543,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5472,i,15662173073686372906,17061126124558405947,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6812,i,15444595220336501972,12388950216958147204,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7320,i,13343205018741425982,7619398892712822869,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,1397593437007037029,17954660047733130366,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7196,i,14589058423829610745,9692208143461171204,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7840,i,5527197638834356929,13509624826896091863,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7892,i,3925098380847543048,1416528162238760101,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7908,i,16547127533677639097,12373205379966885520,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,17380041885359708621,18264940669470816206,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6448,i,401542477905200624,16838686758068932752,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7916,i,9766037386830645913,320962192882041294,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,9835071037147715165,11969506079149715725,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8236,i,15272773040190258913,11415812469503046923,524288 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3156,i,3000787124578533069,12824451138563059881,2097152 --field-trial-handle=3052,i,4649367248724901208,5823374562386253768,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x284,0x7ffcf5dac188,0x7ffcf5dac194,0x7ffcf5dac1a0
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,1787320319741579346,17951904708024457019,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,18218548298634761866,4540921620899212252,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:13
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14549351100413970883,16230903167876002472,262144 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,17837465023887999703,7720848490023658559,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,9721146218155649631,1347525655961612042,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,11247553616408022896,14359724246745082031,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,11247553616408022896,14359724246745082031,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,1877721026062448261,6918264281380595506,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8405244555009796549,10478955657442073426,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,235972592006491266,17676051217604599984,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,7918955775182608047,5133001516517068806,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,1815038502962767990,2813215083182426860,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,16747296959333669884,17408936959734612627,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,10571197466472783775,10975262270229336990,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,18238581510466707024,7756403837842136793,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,16652950208894440812,12779196878059207685,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,12991951680635773532,6046785626601770486,524288 --field-trial-handle=2232,i,4610468234054148882,18145255827548833234,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:14
    3⤵
    PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2272

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4972
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap11632:86:7zEvent31299 -ad -saa -- "C:\Users\Admin\Downloads\FortniteHack_2"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2092

C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe
"C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5488

C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe
"C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:2400

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\FortniteHack\modules\thumbnails_lib\Wallpaper.bmp"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:4572

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\FortniteHack\modules\thumbnails_lib\splash_433.bmp"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5216

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\FortniteHack\modules\thumbnails_lib\card-edition.bmp"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3284

C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe
"C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:5600

C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe
"C:\Users\Admin\Desktop\FortniteHack\FortniteHack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:1648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef94efdf6027521acc556f2ddc78c9ae9771420d47bdc17f3e93e564de51efa9
MD5 8cc1c744acb7d6f6a3048aebcdafdf0c
SHA1 fc48daa243ee2e1095e27d2c32ab51aa8030d248
SHA512 0b811e61cc2574ddd6f5e02762eea5f73c9cdd08acb47f113120f380d0a488c8e70d4d6dbc1811f9ad0aac02954bc7af209c067f094752fb9ace3354caea5db4
TLSH
T185D023707775B9E2D62C2535D5204310B5656963776B53077340840D9E3E4C39ACF5A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e37476aef1c1a85633c137c733ab5e39f14caf53c20b84031db74eac9d451074
MD5 3a1d485389a159109ea38b448ccc25fe
SHA1 b532ffc27e50de47c5c6155a858f24208e3dea93
SHA512 b58016cac0241ddd168dcc9991e8e81d65a8af22ed742429889fc3db48040e93958d2f9988add3f3013d710df328cde6a2ac511dd38aa6d5f94df90b1bb299dd
TLSH
T172D023B077B56C22C70B3531A510C321B7D27B517A1EE5275260400D6D3E1D34ACF056
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d8439a0ce164b287cdf06f4e7d629e3c6d275558c35504200fe042e7cc7ce997
MD5 fcebead46e8f84320a6265b31e5044fd
SHA1 f87010d937ebb53efaf86959b4444f390e23d0ac
SHA512 9d4a8e8bfeea0c0fbd01bef62a3f1f5296d5beed0f7b55e5bae4f83c35e9cfc0c2e1dfb6542796ea8b7ff5a4bcf8f64404ae038edd294a509bc757eb976b7321
TLSH
T10CE0ABAACD21DC3708FD0B59B0000349EB40032B1B80496F3A3C510D8FB013B4241C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f2c101ea623243008897fad20f8fdf7aa7739f9c2fe900a4b86e663606960e7c
MD5 76657d48281e68f95f27926fb7fef607
SHA1 4bc6e33b517ee2679e0aaffdbc9e6ecffe82a1f7
SHA512 b530c9dcfefa16076e1380f07f5ed9826919662263797c541862cf074a69a6c5807bcf86a1fae318ff185d8ac8c2e3f44eb1a40d24b42087bc71b7b9be21b3be
SSDEEP 192:/n2A/WGvHn4PyJmY3xem2ughV8bLDQciEcwgbEth2o7gQwV9b6NjAYY8STrv0rIH:P2A1/n4PsxmV8PXkW23VR6NjEOotNwO
TLSH
T1B9135C7C7A901EAFEAC2027D668B4E35B376DD34C1C2150F66B430096A0AF6799DE447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b0cf7121382b35b9600531c3d1212cb820dd78626308dc44af757d20fb66cd2c
MD5 475525875134b67e6b7d9d57a3c7d0bf
SHA1 102fdb88b0d909648d347f272dbdbe89cf5154e1
SHA512 8ef3307e6be589dc8bef626de7685ea297f566d48a1e9dc9b502939ca4f64a9a1d9ff7d470f4abcec0749d41c65a0c981522d7902d1466936b18092842d3b2e1
SSDEEP 1536:xqmL/juL/D2FTMonJhtizgWMltCs9UulHmDxW5jaQx8tsDWgqsI5VO:0mL/aL/kT5Odsi5w
TLSH
T1C4443FF748816CFBCE6902F4D613392DB17F487B6C81E9BAE4F84C865820B3165A5E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 726cb9bc8dc786fb010b3c1fbd62e22d5d7b29724f93bf95b94d662b40a26f2d
MD5 2691394c0dc909bab93446f94ffd8ac7
SHA1 478ea81980236196309783693cb6344e09851b0f
SHA512 071c70e25faad1d5e2e03d73a1c8f6847c8dd6301836528744556cde1e3a8e6221744cdc2f739eb0ccf3baaaabb59a36fa5485beab1a9c766386b453a276d817
SSDEEP 6144:PQ8u2FBF1L5pxNUjV3K8NgucziYJjnUP9kqop:PQ6FLv3
TLSH
T1FF257CDA9B682D83CBABDE70B8D1DC1E7D7421C2FAC8E0C3A401C59956C1BC636E525D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f5c11e56e7c8fd230deebedad6ea49a427d78987259dfe15265e487ecc642be7
MD5 36d0d2b7f83400df4c04302480df8c4a
SHA1 77a91e0d8c220ef6f28a5a63b5aba746488f46f4
SHA512 57ecb2827a3e6afa31006a404699a83bfaf88d1e9fea86578147ccc5a3ebb726f8b58c1b1596adf39ed2359d65682560497220eb0e5b3b0d60e1196957849c4c
SSDEEP 24576:GHAIZYfNbAojX3W7lB6KXxHeZtsTRJrdMBmYixFTptmKv1ce1Rmc:GgIyFb1jWD3XxjTRuF4
TLSH
T1C5168EEECA786883CD63DA30B5E0ED573C7013C3F994C1D68858C59402A77C5BBAA65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9fa737db2ccb58e8b00e53b0d3a41db13f15037e1773794a9558fb0c4005a0d3
MD5 8f111f5af1d680dacbb8d76d1dfb3125
SHA1 0493cbcfa4cba8d8c6ee85f7da47806a44b2c62f
SHA512 e419102088f3e61548b14a705ffddd8119458eec9813e8ef0c8a97181a8c92b1bcc13d555ecf97e1d668ae41803d3ce34e20e695e98b89b8b70e792586374d5e
TLSH
T1BD71B86447D516CFCB6A037906E54CB936F17E7F820B9EBE02A0AC7C0442F5320E544B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 bb7a92dfc09d49f2a41dad05290047dfffb835429dc584446dc6154dc1130e7a
MD5 79369c1163d311892e9113368da0b534
SHA1 ed41241dff5d06301cee50554276844aab118bc1
SHA512 bd700b36e31745f869634da0cecaa5225c440560ef7e68da70cba90b4c9ab3cb7b1b982c2f3038c60fb9d870b1a9baa8afdef127a6af6550cff2c78d909ebd32
SSDEEP 3:MsEllllkEthXllkl2zEklpQKt/:/M/xT02zn11
TLSH
T1FB4404457FC00407C50034304111C7501370D411151157F33C7114137CDFF400C01400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 69fdf3dd88a4a7fac8eec4ffd935a7223dfe5e331e05b1aac63ebe15ea87e3e4
MD5 acbd0ca058f3957c39fb2a2ac9fc307a
SHA1 f37928ccb3c8ec60ba951da13fa5b3bb65b3c499
SHA512 898c2d3b79ea71a8cea4d90b5033f8c2d7baae678904d673e862d1e8f6820732124aaa3f0110b997c71532dcf03dd9092504712ddb8b535fda5a062e0077b2b4
TLSH
T108E0268C09C8CA69E5566897C278674CA6E0388BB2CC3A435748C8606203242F3F6295
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 98df7070b843c9085e73444890bcb135eb388684d112b9e28c803cd81a2f06c3
MD5 d1a4638ddbcdb9e8029efa89502a0238
SHA1 15a2553df9bb54863bbcb0b24c04dfe21c3f9329
SHA512 dff86e9dd15368c9fad26c43bb4fd8fd93046e7229fba791df35ee13c8195a933f1d322ed57223c69390196ca090a5483c9bbbecec76685015dfcdc1c44991ff
SSDEEP 384:GaMfoKySFTXhIkUI3ijVoWN3qL/PSpSlM9SAAIo:2Xyn4i93qDPSx9l
TLSH
T19324E85F9F602336CC7D547664DB51A31C7DF02FCB22AA89682200A0CFD6A85609FCAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 9KB
SHA256 8e6123db93669d7a1f63748e4cd7b2558223399a439914b43048c7e0b5d502c9
MD5 52eae32f0b62effd5928c57da1da6638
SHA1 1ae250b0d3832e105044a509a1a76f557dc767c0
SHA512 269f201293eb706289cb8517b25900feb7b21c0cf2866253519d678bd0f86ab9fd7aa682e899a26445990221486fb273039a86650c6093f69a67229654761403
SSDEEP 192:l1bWaXqP0Ug1uTHbtiS7bZ1uTHbtiS7b10duCwbfwbv5DWAJdyXCwbfwbv5DWAJi:l1bWa6x9oqYoq1FGv5DWgCGv5DWgE
TLSH
T17612967BE9F0CCF94E2BBCD2D87FBABCA04F4C67D984F9E8D488A40542191715280D5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 bf989d761853068b14e1055f9adf090aaa3cacedd14ea5efe506fe2c437d1e61
MD5 6aeee9582886752c8313ded640464a63
SHA1 8e49ad02b97f8492ce8e81e1010605834e3e5fff
SHA512 2e5ac0798d2bf597d5aaa63284744eaaec9d61a99f91eed7047f612be7ce75b7ad5f709c5038df3bd81de3741265548fb64f93505dcc1332c8c1861079b8e0df
TLSH
T198E020A848CDC11D9244619B833D771CD7B0380FD68C7F435B08D850B606004F3D15C6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 40KB
SHA256 4eaf4daec76c0750c7509dff245d422e116ab04ec73d2876b77b9e3840e8ae36
MD5 4b23278edd6ce79b7e24f5706c2ea3a5
SHA1 5aaa2087ba815dfebae18fb34b9e883b653579c4
SHA512 20ce73b95acaa5965d7357c17a12b6c649b24e5ad46d3917b8df62215a9bd77c7ea48959eeb3bea58ad8df80fd9e19d0a52e7ed04eeeeb80ae5c4a265fd7bd4c
SSDEEP 384:giB1e5ufjJTgWD4mXfyJE0ww2OU4rRR046bJV71BAhnVY:dY5OMkfw504sJV71B3
TLSH
T17303C56F9ED0048BCFEF2639C7B30428664719E8511EEADF3D55C8B284B17543AE1A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 632e521b53431676c086c189aeb7e6c613f7e6768fb709c94ece50464b517b97
MD5 30e02c83fa06562635ddc6c62dcd5066
SHA1 03738849f3077ee2456987a3648822acad3e4640
SHA512 418fe7f80cdcd5c1371bbb947df7225b575432181c595a99e23b3edd22bce3d9ece146fa7f730f7a7235b6623332d190b6949acc44901841a6156e3a398451f3
SSDEEP 384:DpmgP0+FFQV4go6upYeEKRUkRednRjfZivXRA4Wr4RY+lST4VB5j0YfQvQGowAn0:oq3hxUuwt2fgyw
TLSH
T12E9279F382E5D92E891157F89A146E1BCF1D0615432C3C6688E5FE87E3E3432E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 ab5638cd84180b1480d68b9cddd83e297f398d211e1b5329fba6bd606b8d6cbb
MD5 0ab3cf5691c450982028db7a08ef3e10
SHA1 bcc8adc1a9a069fd77458bd7e69f292464d5b3a2
SHA512 59688d9421d5af10828f90a5bfda04d97999e587069c82f07f34680c7ef6f7a559cfabc88e954687ff521088887c9ad0faf5c7d83bba50181bad47bab6d509d3
TLSH
T1545180E3C27EFC1F10381DAF0D44B88979BBA832554294F4DAA7C1AD7295CF34A26457
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8a261f0aa4537323c446b09a994a8b3075f24f0623e2a7724dd6c0d9be281292
MD5 31c483674e4abb6ba1d0a54068d7d3f8
SHA1 5009361fad00298a1dfdaeaec75a933c6a8c6918
SHA512 b19b11526932e387ff5ab54d74deebbe54daa420919209e176a37f705ea8f3c5c0a491baced2d350faaa4aa2f2f8a505fe636f84045948c687f7eea21176374a
SSDEEP 192:sxR+RxGx/fDscY86wGgzoA8pGmLf/g6+WNEN1R/YoSCYRGAIgDSJ:sxR+Kx/fDscY86pZP/5w/BwK
TLSH
T14142A6176938597B5CD6D21EBA66BF93D6F95032A1D42E48B7FC870C00E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 554f8451ec8b4b3500a27384f79f5e6653eacafd563f7a3389de00c541bbaa50
MD5 bfa106a946276c475dac4f98f663e5ad
SHA1 94405a306a78f8ec4523335730ab0f4c103a82b1
SHA512 3198a72fd6457f81eee0074d4766139fc9ab6a722842f3899db2055f1a0f0cff67ef7f984f6a4c5b013d4bb57a2e30fffde2be3882952b182181888383b80ae5
SSDEEP 192:sxR+RAGx/fDsJWpVC8x5Z8c84CzoA8pGmLf/g6+WNEaC1R/YgoCYWGAIgDtJ:sxR+rx/fDsJWvC8xXvTP/5m/PBL
TLSH
T16E52A616A9385D7B9CD7D21EFA66BF53E6F91033A1945E44A7FC8A0C00E76DD220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bfcd77550409f935b7306013a5996318564191d39218fad9278a2bf5830f29d6
MD5 0ea6ef7d10d856e1c6d788931c74ff7a
SHA1 a874f8967c1b03c8c72eb5e5d7f297e9204ed096
SHA512 8e75f324c98e6db39bbfa3b6b7bf12538dcdaa9b08b46cb3bc650250c9c8ab8091e86cd2363dfadc01735fbcf5ea08839f10b5fee0dff409956ddae07aa921d8
SSDEEP 192:sxRFRxKx/fDsLY86wGgzoA8pGjff/g6+WN81R/YoSCYRGAIgIJ:sxRFWx/fDsLY86pZW/5o/Bws
TLSH
T1124296166938597B5CC7D21EBA66BF93D6F91032A1D42E48B7FC870C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 02e43c886a6b1244276f4132956265d7cf51b22ae48cfd822ba3496d26aedae5
MD5 e94d225d79d7dc5b1ed6af3059a2dfed
SHA1 355a4e610268e007f2b09fc5d0899aca345a1331
SHA512 b7fd33282fb7306208c2c8aa3ce205ebfee1c146d4151b6e98ce01d41efade6bd6d77685354cd3876dfee69471022cc45ef0b9794712449ebaed4ca3b3e041d5
SSDEEP 192:sxR+RAGx/fDsgWpVmY8xwGazoA8pGmLf/g6+WNEaC1R/YgoCY3gAIgDIJ:sxR+rx/fDsgWvmY8xpXP/5m/P0I
TLSH
T1AB5296166938597B9CD6D21EFA66BF53D6F95033A1D41E48A7FC860C00E76DD220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 afec65201798b8642c213c8359786d2c16919fbc108e0b9cac7ad474ed8240fa
MD5 9d22055173cba1298c57ffbf683ea2d4
SHA1 42f0736b0c39b202ab6a9c6346b86d2e3385420e
SHA512 e300a8c0c2a3f13fcc52b2948c1a2ad200b9094bfa70003e3a2ec2c1e97a1a6ddd0afc2a80c0cbe58b8d0811a59a24a008196df2f1feacda5133419b1214e04a
SSDEEP 384:jzK6H0dfCtgsqFfw2KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXvro9yK:j26H0RWgs2fw28F1+UoAYDCx9Tuqh0Vx
TLSH
T15AB2EC2B600DCBBE5F800A9DDC19AFDB6D9802C79B588D4447FE994C03C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 3f8ca2867cca28985b0cb592218fc2251f83efbe1f4ef8f5d1d58579303e526a
MD5 1df81e2089e8081ca6580dd6d6f4c83a
SHA1 5e1d78451a1b3ac01e1510883794b94537f06fe0
SHA512 741b831f880b483754e49d0c13a24c35cfa43dfb1b9d2825ad8b161811bc13ac7e6b53b49fe5f99f1ef9374ef567dac4d3019f2abe8d0061f978c46d4ab3eaf5
TLSH
T11CE0869C05CDC67EF2A521830675A35CA2F47C2BD7C87E436F84DD606647545B2F32A1
MD5 SHA1 SHA512 TLSH

Submit Download

e17b1d5f88ea8eed_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\e17b1d5f88ea8eed_0
Size 63KB
SHA256 e772e3e24d64422bf7376f72e5eb3dd9ecd8e8631f229faf0965d516003067ba
MD5 2c90fede18e2fb545f201f3e8d6e8aa2
SHA1 466f82e30587fb621a447f4c19a1f2a72f8e27b1
SHA512 10170429e55609019f7f82d6004a26ca5f5843c9df44f11a15b76c4f1f18e29026f03a08042e405dc320933aeda60532a2db46420083fd2b9b750f97b5a4efc4
SSDEEP 768:IeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:IDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T1E3535CA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 946ad3b4a5d5a4c009cff8d6c939ee33649395d772afa639314d13066250d0ae
MD5 6cec00dd68fc9d64d4dfada1d0064b4f
SHA1 be0547f0fe18c23833642cd5ac45b939ca308f46
SHA512 a5cbc2ab1bc6b95153ef613a567ebaf233cce90bcd59e1465e416b210fa6f8674e4f58af1f1ef1ac2042bd920855a5390737968cb1c40739df07bd1b2b050c56
TLSH
T182A00253325D6005C0104A7256AA854333116D210541125E70E05CA7DCA43455D41180
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 69c30ec1d4e777b62c0aa8421d3e61cfa596af16da410d630fab8457fc5d78c2
MD5 238aefba7c4d862ce34396cd050bfc4e
SHA1 53998a545b56ffa2c2ad26d89bcca982d15d98a7
SHA512 1b39c69cd38bc41c45bde73c02be102f3165fae00e6707460a415a28cd81e6613a11ee47940488f0d32915b4bac4478f591fd9f857feaec6fa75256e01199d33
SSDEEP 24:TL2//9JhPaWMuz62ZeL1b3IeNSllviteteX4TDQeU6UwP8IPq8yzGT3eue/rtJrI:TMZa31b3fEvTFUKXqJzJHlRGd
TLSH
T14113209F1F54748AD1B94139E8AB4F7F093F244C4F83B8C465B445B34C91028696F93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 5bd1516992412fa41b8a6a40e1bbdd9d9cb20c8703297d00de5a6cd1700f0766
MD5 77e77f3aeb82b325ad763ac89efc5317
SHA1 c80d9f4baacca6338857b40f8274efc95e0c62bf
SHA512 34d620155cae4a13aec945ff4b11549f8a842ee5b415a6725383f8e295d8991e80559bd705e2ae41e9d4a4172d1e4725e25765b5ef9a62df9ca08bf47ad070cb
TLSH
T1FBE0DFAC16CDC62B71C520CB4275F30C92B27C0BE6C86A92AB08D480B30B250B3E7A80
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 1cb7f0d8e50128d9b6fbc8f27864cdbe0336c71acf1216ed7d79a218b7e067ba
MD5 962ed0443b05e72f0e4731d08d55ad21
SHA1 3406d6d9959ed988a926720b00cdf3fc4a4d5bd7
SHA512 ff481fec6d060b97cab03b08427cc197c708654e30976d0adba2bbe4e37a68cb8cd534112880cb302f9f556e2971717b91f31e2a5f473a23ad2df190bc9bd665
TLSH
T14EE086BC45CDC63AF09461C34275A71D96F47C5B97C87B87DB088460B20614AB3F66D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c1076af0094f3880e2d52511a7738d7fb91fb785b1f18fff4faf33dafde7bb3
MD5 d6fc616d70daa77638f7515f6f78c0d3
SHA1 ccff94ec6921a677a41412ab67d012a264432ddd
SHA512 9e36680bc932da8d7784ffad2a93baa28c9414cdccf6fdb9ddb2f841acbc7a98edd3291b1cf92bb16117ab994af77a2cef4472e60c1b114188da0f03e762158b
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUniOkKDil:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpL+
TLSH
T113910154703F538038BEA94990F9891A82C1B4AB7519A52B7FE805E78F27E135DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 10af8b863cb5bf68a246be6a1feb42ee149d403e2ba6779a9dc07950493050be
MD5 782d714b34a0f56b0e563cc7d8b21ffe
SHA1 6a52703fa2568f103b8bd2b6fc95f79851e5ccc5
SHA512 dc4e2b4096282ff442f26ce505bdd660eb87a4eeb0e705a689bf57e20aba0b3f964da242d1e661f13d0aaae8f590b2d28f8beca4877d7ea3e7ac06a60b75dee9
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUniOkKDig:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpL5
TLSH
T1A2B14F54703F538438BE694890F9C92A82C2B4AB3519A56B7BE805E64F27E135DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2fdcdfab84dad151a3267191dbc6d38b9241d07fecfae17d9b918e9fc44d5397
MD5 c3ef474be71705d050674ca7dd2b2a66
SHA1 fd523dc6e295a5644cbf5202cca6b7354414d957
SHA512 43bfb69f8dbbd32fa05e593b26a466f5c68ca28940bfa8df017c653b3869768efab62c7a161cee9c1b802d0fa70d96de16873d12852fbddc51b854da6988ae86
SSDEEP 384:DNrRZyCSDnxTICmMEhIKyll7svbFKfk7:xFZJSDniuyI1l7svbF9
TLSH
T1D744840A7B747001EDE6DD725CB080771E3C716E8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a78bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a78bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 148a69e4b1d6178243e7b70f9532a87587346a8ec047189ece297cc33a7e69a2
MD5 f29896e510dffdb8ef2bd6b8b9fd924c
SHA1 5ba63148a2c40b76943b0f43e8089847ab3327cc
SHA512 3313c4450573783570997b83181b35c425948ea70ff6edb99d175bb98db6762bb3e400032316a7a33ed17bd3e49205fcf56328d06449e3d76b4fb84a81a18028
SSDEEP 3:MsEllllkEthXllkl2zEelXZN+ll/:/M/xT02zNpNat
TLSH
T1FF44044D7FC41405DD1510715031CF5113F0DC1107115F5F347154135CC77400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 eec9d06a6e84e825b1f0d1c3840d75c67f0d8073a1eeabcb9588c5bc3068a3bc
MD5 66737f3f5fe4eccc289f350ad465da56
SHA1 f87de49e04e4e53a82c49ffa893070dc32c7621d
SHA512 b4132bb2d924e6e5ede44b0b757bb501793683b85c0d2bb04d75ea7e34d1608055f729021e39350f662475d4c3ead2bdef06c6d4805b536f37fc70b94b519797
SSDEEP 3:MsEllllkEthXllkl2zEely3pIll/:/M/xT02zNyZYt
TLSH
T1BC4404CDFFCC5405D51410745033C7501370DC111511775F3C714D175CC77400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 476806949b6a3d718a20bfddfced44f63740a524fa456ee9db1b9e4c33f5f6c6
MD5 84856938397295f28c9683ab62d5e120
SHA1 94dbc1434c5a8d7415d8d88752d871f257f81044
SHA512 6b1aac003a49546d6a5d038cf90daaaf28c0a0bd397a8be96a54e941a4df91673b456baa566bc6c5a13e67576ab6803a95640dec8859dd1111a33a0f34c644b7
SSDEEP 768:Nj+9M38t/TBOWMUtm0StYONXyer1IRCzni9tb9MW:o9M3ebSIqnCb+W
TLSH
T1CEF2BF32A9559E334CA193E7B1077797BFF45077C2C81A84AADE6F4D0AD796D030B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3907bee7ed419ec922afa74751a9428c0ec083d9ca6f001613238a4fb71e445c
MD5 f709b11086460eb4ba8a5134865a21a5
SHA1 8fe8b0cd5d30cad5c7750458d3861a99107c2d63
SHA512 c3a839350be0acc341b811c499a9714f3eb7d4afbbab5a00ba14fee9748db5b652d9573f7b45e634e8e6ed19b9555260026b932c1ebc056770c5b5f44d9a3b8c
SSDEEP 768:Nj+9e3Cr/TBOWMUtm0StYONXyer1IRCzni9tb9MW:o9e3KbSIqnCb+W
TLSH
T136F2B032A9558E338CA193E7B1077787BFF45077C2C41A84AADE6F4E06D7A6D130B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 927ff9a91ff00e4e124b284494fdb9d69db7539c25664c55fa9e42cd21bde916
MD5 ea6888fb16c235f38cf5b111d369fadb
SHA1 b38b2d5777caaa1acada416a4a980a4038800632
SHA512 6db2bcbe12a95ab088479ce2b75f5a4b2cd635302b4bb7925fda1c4d2738bef30f2a29c4563b8c14b8d1a55c3ad4fab5ca9c387517e1260baa8a9f5293202ff3
SSDEEP 768:Nj+9F3+r/TBOWMUtm0StYONXyer1IRCzni9tb9MW:o9F3ubSIqnCb+W
TLSH
T166F2B032A9559E334CA193E7B1077787BFF45077C2C41A84AADE6F4E06D796D0307806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 04e6ea3e5a6224a301b7eab52edec701baec78c56952b5ba096306b3acddc15c
MD5 23647fbc488108183f78fba425004490
SHA1 502035c9b9031a0761ce1326d5c2e9a9b1609f94
SHA512 bdc175a2e22dbe4dc162e5ac613cbf5e58232d8e427e561a9fb3d586cd854c8faf09629cc22541e93c366a7e31d973593a0005a39a08368e504720b5bd04a7e3
SSDEEP 768:zj+9F3fr/TBOWMUtm0StYONXyer1IRCzni9WR9Nxb9MW:W9F3TbSIqnrxxb+W
TLSH
T109039D3D9D115E3F8CAEBB96710E666AAEA8107BC1F40858DBDA1F4DC5B395CF302805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a528dac483e7b66f6dd371634fefa08bd58c18631f6217e3ca7c1c2b5fa231aa
MD5 c06ae1abf22930403d689b382248e44e
SHA1 af7920609c0843e4427d4cdc21cdc40a7bcb017d
SHA512 725d932b4a543c6b9b7d75550939945ee0a8f68031f41cb7b0e910291ec4f75c50d6b57c7e13578c70b58c04340bfc4608f7e9de551641260144000c5690059a
SSDEEP 768:hrv+4UNbdz3xc/TBOWMUtm2ONXyer1IRCzniBDeVH1SK7:hbsbV3+5SIqnYEH1l
TLSH
T1C303C032A4A49E338DE2A3D6B047B6437FB86067C6840790E9DE2F4E06DB59D130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 571374a99ec60253c21331946f0579daf5cd75f7c4faea167bd45c9b9727921e
MD5 c83ce1140a4b91b0d61a0f445b982c16
SHA1 3eb99d4e893b7e7326bd7898215326194d8a310d
SHA512 1a8eb4524b1d8135b2bf628e212f05655b25b163f632a379151e58aa2d843c22c0fd44fd2528128827a13a0cb5af13ad9e14c5609898ea3e3bc87e50dda1d3ad
SSDEEP 768:nj+9F3Lr/TBOWMUtm0St7ONXyer1IRCznie2b9M7:K9F3XySIqnsb+7
TLSH
T187F2AF31A9559E338CA293A7B24777D7BFF420B7C5C40D84EAEA5F4E0983A5D130B806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a37c1fdaaea9a4fe2e7aee47be999b60529334be054a920ce4bed865f2291a27
MD5 b15a8d23fc4e1c8295bf297ad4287418
SHA1 3cd8c121c8b3c63ef943507ba85fb097b962e5b6
SHA512 165e24fc6dfff4dfd30328199004f203f37848ee83c27a2b32c3bb783ab1ba5ce8a2be97832a2a5a2ead6f3f5e09c1831670abf680b8f1cae9186cb7e1cc05db
SSDEEP 768:Nj+9F3LrmTX3OWMUtmqsONXyer1IRCznieXPbnjhNP9M7:o9F3X6sSIqnlznNNP+7
TLSH
T14703BE3AEC558E3B8CA6B3D6720B3657BEF45177C2980A44EBDD1F4D06A396CA307805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 61KB
SHA256 732d97fcec3d91f13b2eed69ce8fa621a9e97997dac0346bdbc7a0bb05262587
MD5 a915213d075bf56de84c6d3b413c89a3
SHA1 089c37ebe3ff31ab2218ebab4bc93eef35898d27
SHA512 d5c22268dc70e8a53838efe4ecd85689cfd2f0c07e7c6def5608dc7799ae547484dbc9b470b84a1467790e33d04f450846bc17a64ef74e8a3bbe51c9d66e74a6
SSDEEP 768:YFCj+9F31wgT++QMpWONXyer1IRCznisE0fFHSjspqS9v6Qx04k6XPbnjhNH9M7:i9F338SIqnltHQsI+6QBkeznNNH+7
TLSH
T11D536BF998D38A3BC89E5787633D2E0659BDC167B1884894FBD91E0DCCA25BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 bdcd4ce26a9eda09aef16081dbcaa3d4ba986ef26d65488699071644efad5e3a
MD5 85a975791e220693415f87493e656178
SHA1 091abd6ad3db0acc002c7f8e837278f600d110ac
SHA512 4916b377259c08d7c283687f43b72030b1f2418e20a60b2353c6156c5b8fdb9e9c1aeb114d0b27be3a85b900f1ecab2d1286bafb6cfc84beafd41bb71f79c266
SSDEEP 3:MsEllllkEthXllkl2zEelBGQ+ll/:/M/xT02zNBGNlt
TLSH
T1D744044D7FC41415C51510344131C7D05370DC3705115F53347114537CF7FC00C00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

9d12b406-34e9-4479-a312-3553cfd1431c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9d12b406-34e9-4479-a312-3553cfd1431c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

085e9a8a-1dd4-4125-991a-6e9d47f87947.tmp

Path C:\Users\Admin\AppData\Local\Temp\085e9a8a-1dd4-4125-991a-6e9d47f87947.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4600_1872345058\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-1150-0x00007FFCF3160000-0x00007FFCF327E000-memory.dmp

Download

memory/1172-1149-0x00007FFCF5590000-0x00007FFCF55E2000-memory.dmp

Download

memory/1172-1151-0x00007FFD01330000-0x00007FFD01354000-memory.dmp

Download

memory/1172-1147-0x00007FF6C9DE0000-0x00007FF6CA074000-memory.dmp

Download

memory/1172-1148-0x00007FFCF3B20000-0x00007FFCF3BD6000-memory.dmp

Download

memory/1984-1232-0x00007FFD121F0000-0x00007FFD12214000-memory.dmp

Download

memory/1984-1228-0x00007FF6C9DE0000-0x00007FF6CA074000-memory.dmp

Download

memory/1984-1230-0x00007FFD10560000-0x00007FFD105B2000-memory.dmp

Download

memory/1984-1231-0x00007FFD10460000-0x00007FFD10516000-memory.dmp

Download

memory/1984-1229-0x00007FFD10250000-0x00007FFD1036E000-memory.dmp

Download

memory/3068-1244-0x00007FFD10560000-0x00007FFD105B2000-memory.dmp

Download

memory/3068-1242-0x00007FF6C9DE0000-0x00007FF6CA074000-memory.dmp

Download

memory/3068-1243-0x00007FFD10250000-0x00007FFD1036E000-memory.dmp

Download

memory/3068-1245-0x00007FFD10460000-0x00007FFD10516000-memory.dmp

Download

memory/3068-1246-0x00007FFD121F0000-0x00007FFD12214000-memory.dmp

Download

memory/5076-1157-0x00007FFD121A0000-0x00007FFD121C4000-memory.dmp

Download

memory/5076-1153-0x00007FF6C9DE0000-0x00007FF6CA074000-memory.dmp

Download

memory/5076-1156-0x00007FFCF3AC0000-0x00007FFCF3BDE000-memory.dmp

Download

memory/5076-1155-0x00007FFCF31C0000-0x00007FFCF3276000-memory.dmp

Download

memory/5076-1154-0x00007FFD0C760000-0x00007FFD0C7B2000-memory.dmp

Download

memory/5140-1258-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1247-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1249-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1256-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1257-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1255-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1254-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5140-1253-0x0000021C3D210000-0x0000021C3D211000-memory.dmp

Download

memory/5488-1146-0x0000000360000000-0x0000000360228000-memory.dmp

Download