e36262610eb8032bd715f7fd695181e1a628de182b67f402c7dd28276a02968d

Resubmissions

26/07/2026, 23:34

260726-3klqaasyev9

26/07/2026, 23:33

260726-3jzwhsgd893

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
274s
max time network
276s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/07/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 100KB
Sample260726-3klqaasyev
SHA256 e36262610eb8032bd715f7fd695181e1a628de182b67f402c7dd28276a02968d
MD5 63b4b3c9b2aacb06c4189862c52ad431
SHA1 8312c647da2d63fd85df02691fed7128a8528124
SHA512 71565aae743415904ef5700331ae3a0cd930d5949c3aab29473bbcb134af1d794b8f459445c90f4f85bc2a56b5c957e291a695fdf044a389fd96a943adff2a28
SSDEEP 1536:TlGdvOzQNGpuzSjMRNR7YccQLiwnjor4IIIIIiZRyPUM4ujgkC6dTNFMyPLPI:gvOzQNGpuzSjMRX7Y+GwP05TNtI
TLSH
T16AA3C992D2E304576123503E2E72E2BC3B3D504BC605EFAC766D73941F89B999AB32D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Drift.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Drift.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	Drift.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	Drift.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ronix-Installer.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
693	4792	msedge.exe
693	4792	msedge.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Drift.exe

Checks BIOS information in registry 2 TTPs 7 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Drift.exe

Executes dropped EXE 5 IoCs

pid	Process
4172	Ronix-Installer.exe
2856	Ronix-Installer.exe
5304	Ronix-Installer.exe
5960	DriftBootstrapper.exe
4460	Drift.exe

Themida packer 28 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x001900000002b682-2828.dat	themida
behavioral1/memory/4172-2860-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2869-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2870-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2872-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2874-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2875-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2873-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2871-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2876-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/4172-2893-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2932-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2933-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2930-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2931-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2934-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2935-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2936-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2953-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/2856-2962-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2980-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2981-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2986-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2985-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2984-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2983-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2982-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida
behavioral1/memory/5304-2991-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ronix-Installer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
711	raw.githubusercontent.com
5	raw.githubusercontent.com
697	raw.githubusercontent.com
698	raw.githubusercontent.com
702	raw.githubusercontent.com
704	raw.githubusercontent.com
705	raw.githubusercontent.com
707	raw.githubusercontent.com
696	raw.githubusercontent.com
706	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4460	Drift.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Drift.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ronix-Installer.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DriftBootstrapper.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295824828993850"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{9BCFEE01-9CDD-4048-A9E5-D550FCACF00A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ronix-Installer.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Read-DRIFT.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DriftBootstrapper.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4172	Ronix-Installer.exe
4172	Ronix-Installer.exe
4172	Ronix-Installer.exe
4172	Ronix-Installer.exe
2148	msedge.exe
2148	msedge.exe
2856	Ronix-Installer.exe
2856	Ronix-Installer.exe
2856	Ronix-Installer.exe
2856	Ronix-Installer.exe
5304	Ronix-Installer.exe
5304	Ronix-Installer.exe
5304	Ronix-Installer.exe
5304	Ronix-Installer.exe
4460	Drift.exe
4460	Drift.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	DriftBootstrapper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe
5144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 3984	5144	msedge.exe	81
PID 5144 wrote to memory of 4792	5144	msedge.exe	82
PID 5144 wrote to memory of 232	5144	msedge.exe	83
PID 5144 wrote to memory of 232	5144	msedge.exe	83
PID 5144 wrote to memory of 232	5144	msedge.exe	83
PID 5144 wrote to memory of 340	5144	msedge.exe	84
PID 5144 wrote to memory of 340	5144	msedge.exe	84
PID 5144 wrote to memory of 1224	5144	msedge.exe	86
PID 5144 wrote to memory of 1224	5144	msedge.exe	86
PID 5144 wrote to memory of 1224	5144	msedge.exe	86
PID 5144 wrote to memory of 2944	5144	msedge.exe	87
PID 5144 wrote to memory of 2944	5144	msedge.exe	87
PID 5144 wrote to memory of 2944	5144	msedge.exe	87
PID 5144 wrote to memory of 4812	5144	msedge.exe	88
PID 5144 wrote to memory of 2732	5144	msedge.exe	89
PID 5144 wrote to memory of 104	5144	msedge.exe	90
PID 5144 wrote to memory of 4812	5144	msedge.exe	88
PID 5144 wrote to memory of 4812	5144	msedge.exe	88
PID 5144 wrote to memory of 2732	5144	msedge.exe	89
PID 5144 wrote to memory of 2732	5144	msedge.exe	89
PID 5144 wrote to memory of 104	5144	msedge.exe	90
PID 5144 wrote to memory of 104	5144	msedge.exe	90
PID 5144 wrote to memory of 2208	5144	msedge.exe	91
PID 5144 wrote to memory of 2208	5144	msedge.exe	91
PID 5144 wrote to memory of 2208	5144	msedge.exe	91
PID 5144 wrote to memory of 5516	5144	msedge.exe	94
PID 5144 wrote to memory of 5536	5144	msedge.exe	95
PID 5144 wrote to memory of 5516	5144	msedge.exe	94
PID 5144 wrote to memory of 5536	5144	msedge.exe	95
PID 5144 wrote to memory of 2588	5144	msedge.exe	97
PID 5144 wrote to memory of 3472	5144	msedge.exe	98
PID 2588 wrote to memory of 768	2588	msedge.exe	99
PID 5144 wrote to memory of 5760	5144	msedge.exe	100
PID 5144 wrote to memory of 5760	5144	msedge.exe	100
PID 5144 wrote to memory of 5760	5144	msedge.exe	100
PID 5144 wrote to memory of 5616	5144	msedge.exe	101
PID 5144 wrote to memory of 5616	5144	msedge.exe	101
PID 5144 wrote to memory of 5468	5144	msedge.exe	102
PID 5144 wrote to memory of 5468	5144	msedge.exe	102
PID 5144 wrote to memory of 5468	5144	msedge.exe	102
PID 5144 wrote to memory of 5176	5144	msedge.exe	103
PID 5144 wrote to memory of 5176	5144	msedge.exe	103
PID 5144 wrote to memory of 5176	5144	msedge.exe	103
PID 5144 wrote to memory of 5248	5144	msedge.exe	104
PID 5144 wrote to memory of 5248	5144	msedge.exe	104
PID 5144 wrote to memory of 5248	5144	msedge.exe	104
PID 5144 wrote to memory of 2428	5144	msedge.exe	105
PID 5144 wrote to memory of 2428	5144	msedge.exe	105
PID 5144 wrote to memory of 2428	5144	msedge.exe	105
PID 5144 wrote to memory of 2764	5144	msedge.exe	106
PID 5144 wrote to memory of 2764	5144	msedge.exe	106
PID 5144 wrote to memory of 2764	5144	msedge.exe	106
PID 5144 wrote to memory of 5312	5144	msedge.exe	107
PID 5144 wrote to memory of 5312	5144	msedge.exe	107
PID 5144 wrote to memory of 5312	5144	msedge.exe	107
PID 5144 wrote to memory of 8	5144	msedge.exe	108
PID 5144 wrote to memory of 8	5144	msedge.exe	108
PID 5144 wrote to memory of 8	5144	msedge.exe	108
PID 5144 wrote to memory of 4968	5144	msedge.exe	109
PID 5144 wrote to memory of 4968	5144	msedge.exe	109
PID 5144 wrote to memory of 4968	5144	msedge.exe	109
PID 5144 wrote to memory of 1176	5144	msedge.exe	110
PID 5144 wrote to memory of 1288	5144	msedge.exe	111
PID 5144 wrote to memory of 2484	5144	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ff840dfc188,0x7ff840dfc194,0x7ff840dfc1a0
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,8382261510504596531,14975800535082694330,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,11036152521713815973,2590128774982380196,262144 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,898586458836594870,5251218216879699473,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4033497775638221709,6433941883643620785,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4973016609246809562,7264684523047056687,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8803927576915848828,12884055966843910155,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,4815136210765842523,586106069548828558,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4248,i,8034460381616178593,1706690781893831761,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4236,i,2828860030693006109,2499835917466512289,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,1390380777552098279,4553458112706446636,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16712477536822125104,8442055288685911561,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3479174818158895087,5307678974880395078,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16340636658603495101,12250019037861045072,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3479174818158895087,5307678974880395078,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6516,i,4603357749487006621,238003539218716624,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12916689708581665172,16599014864858370746,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7136,i,14431866859151040957,17707050267703044652,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5216,i,12780062612879592490,8271496844127703564,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5084,i,849445902330948055,5604687958928336618,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3740,i,653079401870003485,15838398836187715434,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6264,i,1426098416565783993,16240535090379509466,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4644,i,12813701837651082549,1414121768270022247,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7456,i,13316446010130316972,12516184611459015183,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7452,i,16608724325200600638,7604399035296966082,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,3489225608915748398,6762301687606668169,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,7502518288012840731,14770328354653315707,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7708,i,4132313865331583815,14299280990602769823,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:14
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7720,i,4522210064038051210,12604510942505929529,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7840,i,9127036803709035408,15775956924756272309,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4388,i,268886434413665620,1272419079651582073,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8012,i,7294036478134642519,7408712403823517187,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7600,i,17232877556594337240,15846110113851622368,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8280,i,15478736718387139649,14096428980701575458,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8532,i,10895193768032468927,17756571509018021276,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8560 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7580,i,7357285539339208433,12684108452224015231,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8608,i,1621017185521545892,17586591880939637216,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=9100,i,16558979837483307499,6820786449831413677,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=9136,i,10564973676918741247,14447133578014439601,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9348,i,8027568384021813731,18334239690111068293,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9360,i,1706223510825957227,1481937664047215505,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9412 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9800,i,14233342160629967218,469305159367988245,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9808 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8500,i,11977518249510353406,129244831588965295,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,7547240250765377190,11750807425867566101,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9364,i,13759645929748249671,4732913827644904796,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9716,i,8365692804096778165,14193614019795094252,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9908,i,3118950724876431822,1751169663568931009,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:14
  2⤵
  PID:5124
- C:\Users\Admin\Downloads\Ronix-Installer.exe
  "C:\Users\Admin\Downloads\Ronix-Installer.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=10432,i,1801421875730895624,4015829407201035539,262144 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=10424 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,14169825187732926770,14023877409749780015,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,14169825187732926770,14023877409749780015,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:5404
- C:\Users\Admin\Downloads\Ronix-Installer.exe
  "C:\Users\Admin\Downloads\Ronix-Installer.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9596,i,3482780647945623133,9939770436496264031,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9288,i,2964666717913887350,7390670360605480298,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9400,i,5321418637321352593,10719869765396171485,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9624 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=10024,i,16973421361199454037,15177472629756739613,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=10212,i,2466545104993823882,431345589170083270,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9724,i,6995592279069222703,690633848808746064,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10188,i,5495410227833381570,16956575431399721437,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=10012 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9940,i,17241687923797992585,16987449791709679241,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=10224 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10508,i,8692444047613000712,9934225936236750076,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10236,i,7087792946614170513,4222381007219700846,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10476,i,6928096863003953971,2905020931002087146,524288 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=10468 /prefetch:14
  2⤵
  PID:5568
- C:\Users\Admin\Downloads\DriftBootstrapper.exe
  "C:\Users\Admin\Downloads\DriftBootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kfcclient.com/terms
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kfcclient.com/privacy
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Local\Drift\Drift.exe
    "C:\Users\Admin\AppData\Local\Drift\Drift.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10396,i,6893364385001730027,4601295138317969981,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9560,i,6212865711098594674,14358167232934602129,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9804 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=10228,i,2686021874579085,305279105965832185,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=9972 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10628,i,17586256902778508048,6697399167292427642,2097152 --field-trial-handle=2544,i,11928210718104434836,6351783513979726460,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5896

C:\Users\Admin\Downloads\Ronix-Installer.exe
"C:\Users\Admin\Downloads\Ronix-Installer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5304

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Read-DRIFT\Read-DRIFT.txt
1⤵
PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 6d813eb7eda09a85fbfeb2cfcff256461b577bf27f77b9acb3f10d1c420de2c2
MD5 b9f7f6de2713aab048247e322b08bf59
SHA1 bdbbe19f0f7af0707798f5330d110b50b3f51ace
SHA512 dc080a46594e1f072bc899b06df5ffea93ad3b6a1c0f514c400e918d7a73dbcd362e15422fedf878490dd146b4718ea3fbb730c64674a58960b6772ca54518bc
SSDEEP 192:6jKVKqC44CClwwxxxueY9nnuxvE77ww3MOMnLO:6jKVKqC44CClwwxxxueY9nnuxvE77wwD
TLSH
T1AAE1861A86DDD39FCB16508A49B4635C0070370EEBECD90C178C8DEE304E69AF6B67A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 67KB
SHA256 e359e51e2e2cb10ff3b77694ef4b2208345bf614d6aaea48bad139c27bfedd22
MD5 0ddb8e62f6a03a0da9e67f4699e2244c
SHA1 402f34abe76322fe4be00d5fb9e151fb75cb99f3
SHA512 08ef65a8a4fcd0d6c38343ee884f897907f436770c78dd787a9d565da024cca11fa64e1799af19c956d0cee4209e49d7f473177a91e18bb1e6eb4664521a78db
SSDEEP 1536:kVTcSfpnXIM9KWSuhU5c4C3Ul8B3UDnnspnotSjw2BfMTO1DSyWN:iTc8n48fxVE7DTtSjzBfMy1D3u
TLSH
T17363022E4F1A45D90BAAEDF1A42D93CEE47612F0ED3936A232D6C50F72931B631406D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 402KB
SHA256 6eef989e45c9c212cc4b61921356602f57072d787e73405ee27f9af787089183
MD5 1bb2c9efb554599a861e5e6cc6305f39
SHA1 ebd2802ff1effd1598ee986516d5642263a0c0fa
SHA512 c07224d384123fcc47990f0d77e1a1347afc9cd4b30ab759e7a368342189b69e40ea2efbd1c7069a30706ebeacb78f77a0135934cdc9202febd0481883125abd
SSDEEP 6144:uqLmFS+6ADtsnXdVBWMncNLB4jvOKUmMtzrlwiIENuaRVPCIA91:7LmhwX7BWMcNLIKNtnl9xb0
TLSH
T1259423CC68DA4CD9EC884EF8F23C23BFC890B557D65D619804877E17A1D8B6D690CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 205KB
SHA256 4a45fc13a931d56718f0a3a418205098d554f688a083a8312ec4a18b8f023597
MD5 b99f4c613cb4e3c6589785462fc3b819
SHA1 5e2a6b643dd9eb1a5f88564eb26b1e966172692f
SHA512 14de7195014d30eab8539c5f2c9b1110b4de7cc3342fa0e68840bebf7ac01cd89fef5dab04ad6718fe2ce1619e4f7149646be96a87f12919f7d7a073f4d951a4
SSDEEP 3072:7wl5ypyZv9TlBGGM6opAPH1wBy6g1N5FM3UJKRJpd6KyH3p2Zlz12YVOr:7w247mfrS1z6aFknr+HZ2FNG
TLSH
T1AE2422BC2A6C2864884A88CB0E68396D75D13EFD80EA175FB7C7E3611FD95D012E4B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 256KB
SHA256 f3fdb11faee00508cfab853c284debb72a6054ce7a437005f271fdaa419c8c9a
MD5 be569398e0e595dd2f72e1bc4cb2e4c7
SHA1 a7a59eddb0ea2dacb98ff03113480327c1805c9c
SHA512 475d255ae27e373971a32efb3c28faaa9aba5e3b6790329c211e038d1258f84b826b88aed8c7451749a608dad9aa433b9454520314c20339fe6527872bb15f61
SSDEEP 6144:oxQsrSL1TgnPaBehiQ0tlOw49YjoCrT3:eQESLNMaBeGyS7
TLSH
T14644BDB4FBC3D782CB132BBDA43D3D374BA852C561D05A0744639D26A598B26E30727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 128KB
SHA256 711ef54e187b69822b2501eeb0f846e51a9a2d9bf9baba98314e10e38561f265
MD5 92fd7b93de08ddefef2c5d7739e61c4c
SHA1 8b9c0b81d673d431e9e13ce55b7b833b9f6cd653
SHA512 fec207ec6cab40244326b1f68e85b393bc0a5f8f81681aa82d2e2d7fb014e359cd9ca0e8e47b1c0d2faf8d66528ea918ccd591952cd4c8c880265902237bc9f2
SSDEEP 3072:9/btzvxU0wvPV9jT49zKz4vJzu0haN19OpbH/D6Y:95zvxUfbvqzx5ubN19QDL6Y
TLSH
T118D3D0A0DE0AA191CE176BF4F81C2E221F7915E565E47A0B4AB25C15B6CC14FE31FB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 78KB
SHA256 87f0d4a53dc62a7f19ce9ad3525738bbec696263f64449899dd8b63d4c315621
MD5 2a813eed090eb1a21a62a841ed91c4aa
SHA1 39cefb1a083dd4413c7d944b34bf59708987298f
SHA512 e804cd9e8557c4d25a80b7c73105d36cabafe670f71bf74599d06496b3f9dc6932ab87388a31a432508c0418861216a6e9c4574078d55b7a9306b8a83696d598
SSDEEP 1536:MvxvqW6SMmN0C8w0X/qUgO3ra14vueEsPLXgr5OqZBl0MIMnk5xA3D+b:ql2CkXcSrA4vHE2LXgr5OqZB+M0IDo
TLSH
T14773124A41BFD161AEA8FD887BDD30A96A27394C8FE2C447AC9D134D4EC5E3D16C3189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 69KB
SHA256 3bcf8b71fd3dfb1c92e73f3414fb84bdab28948dc618e271e0fe01350132159f
MD5 4e8d28e2b7e2e6a44937db6cbe9d2907
SHA1 ce464e5484a1cef93e10221c3705d80f7133018f
SHA512 95734e5ca68d3571be3d386f79d60fc02ed6302304b6a672e7251e0498edf31622dd62783d9d250122e34c157a85bcc5aee834881189a862657ba58a277e76ef
SSDEEP 1536:DRBlzOCfrtwlDzFSnP7rDTzPXUMnzYVaNkKnCpYpZ:tBECfB6zFsDTzfUYzhNkKnCpYH
TLSH
T10A6369DF4FED00B20DD04368FD2590DF9BBA9A29D9E616CA0577163F590812CB6AD83C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 512KB
SHA256 4cd087fa77488d3127bde4400d97d31e70f42f49498b461fce48caa03118abc0
MD5 99a42fff1aefc80d74b8fd19b0fc97ab
SHA1 b768837df854d89cc64763d595e32f13fc4b8df6
SHA512 2105f4092589cb51fb8223427f8096370d6352baf33ac8b478cbf521c7be71da8b5cd9c5693cbca650bf178b582f4fafccbd1da8f53ccb45ec94d280e3cd6e35
SSDEEP 6144:LGzmEh2Os8Eyh6C3yXcviY8NmPmIAOAdaVwge56FTMsvmpjGRPKlWWbWwHQA8qkQ:B8EQoUCmwOrwF6FTM2QqRPL2EY3
TLSH
T131B412E4FA93D2D1CF9B37F8A07C2E635B9A00C564C90C5F85C27C00A2A57A5F66752E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 128KB
SHA256 fe20c4e52c088139acb5d099348090eb0cb010a543872ff364ff5aa41aadede3
MD5 a082b8634c485274ace63b195a1b0f95
SHA1 99fb5fd0bbbb347d58ac2ae7bb05390bf1efe4c0
SHA512 f4e1fbdcf7280ff7f511b7d60d80f3946827f470cc8910bcd3e056756b1c872a93ab07d3b214b2a164a9457d5ebda80d3dbc2221269af131ecbc38e99b0675fd
SSDEEP 3072:0TrPGA9fgDBeXGf8jaNL7t7imgkLxLP7ZuohfUkmrksUNW:0TrOvUGjfFdb9HfUrBUW
TLSH
T19BD39E68FB8397C2CF5B6BB8F43C2E330B4512D635C51E1746665C22A5C832AE60B65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 17KB
SHA256 66f42dcb1309f31499b2372127e0b44e5bf84becd081c361dc140bd991cfe7a6
MD5 a02978a1a3cf9ab5bce84b66d8ba9021
SHA1 6ca5c71831a0bdf5856dc22cb3581cdef038f259
SHA512 22e6a6768f37ff0d61c1b4431ecd7a36b91e0d127237147debdd2ac34439f56fb36d2a62d447371cbfc88e435cbdaefe202bffb7b466b4af3c0fefee75bb1e41
SSDEEP 384:OEftAsIC7HB7/+8xczO9dMrSBHjwzhaDeqjNBE4AJSH74HMIq+:O66shHB7/X3WzJk7CM/+
TLSH
T1A282E0104D7C12F12FC989A4734895E9495C2A6EBF2E03138698A3C48EF9F4B366154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 19KB
SHA256 27b38334127d248f760ded14a3441b6ce3972eb110f73e50e1ae76dd16b73861
MD5 6a63dd3b4bdd8e27df920cbb7df0142b
SHA1 888febdc97e6e27e637e14b0017ce8c3c1b2ea09
SHA512 d691a06e50557c66496178460c13628b215b0616759788a8386c2bbec15d6be681104db6616a0840aa4941bfbb297d6cc345724957cba12752e1c2db675a8603
SSDEEP 384:dWANsy+GeX7PyAJGEXH5K5ldwQ88WAtM99LrUIra4dPTPxfNcUpxvRKY:dLNsdGeXbjJGEXH5K7di89tMXLrjaaLD
TLSH
T12192D128BC2F1F4A57A2B2A1EB2C51825CDB9853A9D5502CCD8E25C3706F1A46B47DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 22KB
SHA256 deee03b883e06fcbcfe81dcb5d8fd225bda7a80598f81d6584983a1cf1a35807
MD5 2c74ecec17d0b3d5857e6fd4419b540e
SHA1 6cfd382daad80de873d05f341ce1c61411ff0f11
SHA512 caaaf694953607ac8d65d738ccc262e5631e54556e867766f163bc0cf6014d191e826442f20e1e12ef65e78e433c65030605dccba3db0e8190992963d710c124
SSDEEP 384:bUHFcxYR4j+Y6voNEitCNqKO6n7/lY6ZRpYt/80eJ0PS2B/4VBf3mUkcm+oyF7Ie:bUHaxYuj+Y6voNEitSjn7u6kUqS2B/4l
TLSH
T196A2E170DC9B27FD61299FE4E8B68FEB323AD06495A5E1960F4DD861343C1E00D28E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 27KB
SHA256 bfecfd1d0bed797f7445c2f893d7b43ea47b0e716c57473fdda7d162227e4af2
MD5 12ce97539cd9b2f2e7ad73f993ff62ba
SHA1 d0770cfdf2510cef546a3b96161da4659d5a6900
SHA512 5e6c5771672ce2b590a29277df6fae8b6975d9c30fa53b3641f4940e8284ddc850a4d4f03436b2e25e387a980f7991b4e7c454997e758c4b80acca11a438cddd
SSDEEP 768:WJGN7ITJFisl2dNjfgjVXB6ImcG71g+/2EBXA:cG1Ari6ElfgjxB6DcaDQ
TLSH
T1A0C2E1718D1FA53D062569EB0312B27E109619887C305B66B2B7CBBBAEA8153803F4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 31KB
SHA256 6fd4c09b46b120a806bc1152a994808484d31c647298ab1757c0ffa7cd002839
MD5 ff7234df21de0f35b6c517109af31c44
SHA1 3ead0e8fab08662148c41d3b808e2a18bf0f241d
SHA512 2f73e3da573ddbeb6ca898c9822acb0ca32a3ec131b6b22bf71ffc472e7758fffb31e8a865fb436c0e1bc0bd4c958765e1a0d0b53912dcc4e656b330dbd2282a
SSDEEP 768:HDGiScysQMsaaJEiCoJ0Nsy6+zxNu72oZiBVxZW:HDGiScHj7aJEiCoON56+zNogU
TLSH
T102E2F24F2A5568AB986642511522CFCB00FCD98D8583F2FC45DE67BB13CF746E00699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 16KB
SHA256 97a5ed97257237fb84f8f5907c917a6df036a68355dc3151a12568d6b951441b
MD5 afe638274085e1fcd7ddc05c24596dc6
SHA1 f86324d5bd2389a1e0c84e1d2ab86ec662a8aa61
SHA512 e5ea1da7533d451f5e26fa5523b93397d38dd1998f72759cd295efae2f9ba2dbe34507f7bd853666703293ea8e3bdda8a356920ad792f18713b56ca94b2c585e
SSDEEP 384:op1LXYwCL4Sn3rvDt4XWwTJlEs1AeMXATHLjQVqCCSGDCT:YlXYbLx3r7tCWwJlVQXkrjoGW
TLSH
T1BE72E1FACEF8594A130FC51BB9F42FEDC9AA27B186CDC20B9309EEDB9594C958440509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 31KB
SHA256 106ea602d86cd4c6951371c42b3089b31a3fba5880a6d16a37859117b3377f99
MD5 f93066001bf26007dc70e34ef2ce4d19
SHA1 cbfd0c48194b042b3c4e3b50122b38994f9894d7
SHA512 617379970d3fd2779faa9af1372f56d3322cb681955227049afb2b7ab80f97dc8bf777001388bdc60ca87ecdc7697fd28075a1d74bfe20e08f159f9cfeafc8c9
SSDEEP 768:0xy0fS1F1smhTunHJPHeyxotOHIL24QR9V:sfSRZunHJPHeGHU24QRD
TLSH
T1B6E2F2881403234D158ED192D612ADA5518FACDF3182BD56B964BDA8CE8FFF905DF30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 153KB
SHA256 91381660cc99fbeff90faf3a76f3bb39a2d3f0c20475d82cbb41cc1f9e850536
MD5 708b77a4ba5a8f45f610e72b3cb636af
SHA1 f7bce7be86de69688018cc3272ac435569336990
SHA512 26aca82e841a4ca8eefcad488578ba087a6816a8705a12a0ebaa8ee0a568f9516046ac15b2eac1be5ccd3cfcc281c1e3728a7fc58009ce9a4e3eaa041f92b590
SSDEEP 3072:YrDWFDqKLNOehM+Ng7p2gZVXzJRlKHvbONJTIM38YBv:hFesXhMD2gvjJGj+IHYBv
TLSH
T120E312981367F9BFD505CB42F9585089FC43BE6089A1BD34308606E68CD71BE17FA39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fd
Size 24KB
SHA256 95b656df304c4c7117da5e1252e6257b1f8e6eac654d429c7136251abdf2068e
MD5 9a0d445b8ad4ddeea41382bfa016b414
SHA1 4f0917d573facf82b4300d40d45654c669890cfd
SHA512 45c97568f60bfdf7bf10cbc4da48d6ef634e74d1fd39c4b63e2b8f5e2be883125bf3923041b7d14f729676277878c82970676935e09b5c587ddf49cf7de7f8af
SSDEEP 768:ZP71+GPSTvUSiAcxp8hMr8C79Hppuggy3sw3l1SDsd:ZD1naUl9UhBMp7cwLSDsd
TLSH
T17AB2F1FF9704DF29A42ACA466A64CABBDDD85D5360DC205D2C63240CFD179C1F650176
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000102

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000102
Size 39KB
SHA256 3d4d2ff540bbe7c4baec7c3ba233decb19f4ab3a0d6aaf95b5b9503589b393d3
MD5 baa94b2a628b07af3c05390571be320e
SHA1 1584a38160b579c09f006b934bdb67a4573a33c8
SHA512 12d386a3bbf4d2d6ed905f1457954ee9570712fae30e01b1ccec448ea535f10c29726448d0c3712d79ec6720c90a65fbb496a8f566abdb4b59a6f19fa15ecbcd
SSDEEP 768:eIz8MTztx5+gpcTJkGEaLklscjejAh2xLHdB2jwKyB:UMTz1cTJkGpfckAh2NdBhH
TLSH
T1B3030273F8D22900B1A00C897575BA4CBF7B04269FECA2E92C9767DECA63C1C257E515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000106

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000106
Size 17KB
SHA256 eabe551ca6794f55c709739ea27a88814e661f399ad76fa816ddb9ba51cffa1b
MD5 22b2c229a678472b8d441464e011043d
SHA1 8998f5d60a4cd4666c65f0cb33c7b206f4258d44
SHA512 fa1350ad2d43509ecc7c71ca0cd59f5515fc112fb4eb47d59fe6909b025837cb2b522d3a9e398202bf624ab43cf69cd4c91ea23aac99f24f454c9c44e72536bd
SSDEEP 384:zwnRwxt7DcNwmF5e8iVhobILFF3C8oZCswLan6/5ca:awt7DcNvF5eQbIXy8ogswLa6/5ca
TLSH
T10B72E1BDD5C1DB23BA655922207C791F0DFB5B6D3098151CAA41B8FC428C7F2CE69874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000108

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000108
Size 19KB
SHA256 055815b559fcae42d09297af4b71aee0ef6b3292dbe91c45a9fe4cae9cf7f8f7
MD5 b8d367687cba2d8a0d611dc8433b31dc
SHA1 6a0e889cd1e50934ef47bb99ef041045bd148806
SHA512 d5893cad3abe53dacc4160e9f6b4c945a0c1262cac0fda945dc043f9529cdf0e42740f072ce1e13f7373d07289ac0627b824f76da2c9c667f4b034e0711730a0
SSDEEP 384:90VMZQ54LZRRaGofJ6yqhMopgjaVluhUJfLZ8RuZ55WUw33ml5anlSy:9nF/WJ6fMpuVluhUJfiR25yflp
TLSH
T11992F10CEC14FF5967A44861840D74B4AB36FA4CD4BD5A21B20A6A93810CFBE6D7F2C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011c
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011d
Size 68KB
SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
MD5 2a1e87320b14aac1134938a0c0bade85
SHA1 3831900aec52ad0da761f20a4fa1069d6434a6fe
SHA512 000744a8dbbc14690245ac7924c7662544bee356b4973075f5e78726fe0848e6aa96b6cf327718217ede7cde98d7874a2a4c934d1c864203a6015df18fac2d68
SSDEEP 1536:6fWZ83jSNyAUf76Z+AGYguWv0KxwhneG/7Qe4rxzhRelJ1Z6EUR+r1:6eK3jS3X9GjuW8KxwhneG/0jJelJX6ET
TLSH
T18C63029CFFA35BB52865C41E9C69A33E48E3E296C97B9721133B01F502116C2E0F461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011e
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011f
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000120

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000120
Size 28KB
SHA256 6672e6a25ff27fb35f4a259d660959bd5581382a5e6d82f386379ebd3f285637
MD5 715fd57ef8cb9e99eb69f5cd370f52d8
SHA1 f407d02c2894e65369410d532b53b251d2917941
SHA512 afe412f57346186e65cd7e89716d0dab59272c040c0b11b9f10e114f76c174da9bf9c6e44e2c7e9c208549309bf21d8b25bd9cb0474deb247dd91178407e0cff
SSDEEP 768:34T6ObSF7Ej76BfxFoFRJ8oKPjuXiQFQZw:34JbP/IFoFPvKP6XdOu
TLSH
T144D2E0F6A188E96BDF34AEE5023E1525F2120AF51467BCB1EB2FD21D17C957352BC820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00016d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00016d
Size 180KB
SHA256 c42654797a76683950e957d9389670c15b4e1e503657ebf00b032ce18f922d89
MD5 b7ab5a24eaf9b9660e5d1bbdfd9a7626
SHA1 d453de5b0d86c99eaa91e20a507f028974bda649
SHA512 d8eaf02eeb0e444244983f7f77029b16e298fb3b98f2edc636d901dd4ea8a20237273a01ed8c953b4c56b776429bb178aaa439578e1fa6f58deab0a7045b4205
SSDEEP 3072:v8uT4o8sZvyC1fy7E5fzXtxdv43lawxFHGOAdw24g8zsoVTDZYOQP:T4i7ZzXtfs/NZswrVzso4hP
TLSH
T1C604220DF1EA42BC81275489C0CCB7DFA7CCA3E56ABD8C438897C067A96E55774E1D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00016e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00016e
Size 55KB
SHA256 83e88631ca56f47b0c2694bdc6466b09ae340c3174a298f75d892bfbb95d268a
MD5 deba2648a56f5d846701159bf5cc0034
SHA1 b9e1f528f587a6b02534531fa729fd5a8eaad294
SHA512 7e4753a1e8611bba3530438fc45a713fa73dfb6fbc19781cfa89f0e85f577fb2fd07e4050008a5a87a19b4b447583f756d26c505bfb476c2abe8d9acffd03bf1
SSDEEP 1536:ux2uRqeBlacsr+z1r86rnas+zqjELK435:uxhRZi+zlnEe435
TLSH
T10C43F16471469F5ACB49FAC63B2C6822648DE5D23C7C25CAEED07A17DB780C1A71F902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0001b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0001b2
Size 166KB
SHA256 5d939aa1c278b1a79eec53f7c269990cffcc00da321e8a9c9b75d1a89da291c6
MD5 73a01109c4611a043895d44cc2d8e506
SHA1 96eab3586b8f089b20fcccf7759f17e78eae28c4
SHA512 ea368ce3cdd70591d17774014072284b060f63fdbe217c9d9e567d7a4b36c317c38c116f9cc8ac836da580920f1f3cc349a20390e6f17311771c9236c9200e2a
SSDEEP 3072:bCwamKlo9U2MGbmnM8hDwVsMzrhbsM++JR0bIqylfeVD67twy2gK:n9USbmnMGYsSRJR0b7ylfeU7tZK
TLSH
T1BFF31354B0315F90BC228B4781C3F865EF0E6FE455F1E156AB631B83862EE67CD18B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 af3ec548c6cb6885e392b911876d4d4c69960dd020cd88e0e812d62266eae304
MD5 9992f7a46d4464ff26ee68c865ea1ee0
SHA1 c84c03ac530c4caaf1ad0a71eacb78373c9c09bf
SHA512 dc0aaac2e315f266428cf5e310823d93d34e6479df61d4546bad2b701558aac775e85005e79b66ebbdf90477e397c2eba5336ceef00954da602b247db5693964
SSDEEP 192:jMGiE1yvZspp3oFYMFCtiGCK++nZtcnuEJlD:AGXyvZmoEt++nZtdyD
TLSH
T12742530C49C52470DB729AB8E8D288DC3675D88E850BFFD69A785CFD384B3531EDA026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 012bf340644dc9210f6cb7b21d7ada216972fc4340e3a2993ff19b35191a704b
MD5 b7489a210a8569c94b4c1c5dd560e324
SHA1 ab904cdb821e94d8cc59fb5fc7140ef5e19c0c83
SHA512 64ed3e8460335e3b84ab96ce42feb0767f228b38bbc89765dba60c2aa588268b585f09cfe0744ff95c8b4e245a36150d36f48353b3362efc525fda2d79f1e101
SSDEEP 192:5Mkf/i15vZsppuoFvMFCEEGC9++nZtSnsEJvi:2kfA5vZHozEX+nZttoi
TLSH
T15642430C49C52470DB729AB8E4D288DC3675D89E840BFFD69A7858FD384F3935EDA026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 19e2254e984e916549e50e803c7e832b28944e9acf8ca09f116ba34b1f5bdd57
MD5 6754830be40e5b575847e0146edf3ab0
SHA1 3d34e7143e26a0febe3da5214b16006bfe75b0e1
SHA512 f1563c1dd4eae5a5341e049a23ec092590c837ebceb610b1c21eadacdceb20b5bd4e92c271df3d19b7db9042f02c7e3560c4f299bee47b68f9194b5d6e113171
SSDEEP 192:at3iPPyyZspdNAJoF0jOFCtJGzS++nZUioy5EJTW:e3uyyZlo67tu+nZDpQW
TLSH
T13B42530C49C524B0DB729AB4E8E289DC3675C88E8507FFD79A7858FD384B3930EDA016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b7730.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b7730.TMP
Size 11KB
SHA256 2608b8cb2d9ef43226c789ef0d131547ea758c4af8f23f4eda1385faddc02dc5
MD5 32b5ed9473d305d9e1b2684f95aa5674
SHA1 204be82f52e33f5e3dbb0e3937206134c6bd5179
SHA512 c20b749c8ac6f9c017bb25e55d8bd4ce83e96355c4502d3b9df21083498003f280a0bbe32a54c262663933b9c93393a297d0ef57fcdaf9bf72cd01fda1bb58d3
SSDEEP 192:gMkRi15vZsppuoFqMFCEEGC9++nZtSnsEJvl:lky5vZHoeEX+nZttol
TLSH
T10B42430C49C52470DB729AB8E4D288DC3675D89E850BFFD69A7858FD384F3931EDA026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 32KB
SHA256 e61ea217c19d8cef84eb775ed66c4ac154d37a0366f49f2606dcbc0cf5f77348
MD5 a3d9496bebd52443d425f94dd18d8ea8
SHA1 73e1d00433ddbbf5d87badd1bd9423da4292f14e
SHA512 9392b902503cf8fe3c0c97686f04e3852ac0f2bebd324823836d4e2ca5cccd71b5d024f57b782f160c58c9b0e95947d6652693475f94225a23aa7004f430fde5
SSDEEP 768:JuCykFoX+ymyyJvnNtyaCJp1pgiTl847N++0l/7747kMRGzY4Pt84P:JF93yaKQ+wauia
TLSH
T15DE27966B5F9120AF2BB5FBBA9B217924C7ABE562D04D81D5860221D4C31F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 343B
SHA256 16f2ac04a27532b971771652bc45a9351918d9d058af525c947198ad6d652d90
MD5 dd2c22f370fb4a0caaec3bb082100b1a
SHA1 261960fa1c7265cbf1f135b977ce05d8aaf84884
SHA512 9329571e07a9ec02f825cbb9afb94fcc2a5897c4e10f68168c968d5a75dfcce9328a90cc5b91ecbcd2442c69df08ae929885768253bcbf02698a5387d7f4b8d5
TLSH
T1E6E0D8B885C9C11F515460D61535BF4AD5B3260AA688BD451E0DD8147442144F67D2D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

2fef33cf-d2f2-4e3f-b620-cff04ea5b571.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2fef33cf-d2f2-4e3f-b620-cff04ea5b571.tmp
Size 211B
SHA256 16321fb2aaff629c85600e947d04129626763a5976ac1192f3bf6f0d77e7d758
MD5 e1624bbb966a50fa8d7cfa4567be10aa
SHA1 54ca61d9a87c5085632ca64a8914494c7c0ec5ba
SHA512 55d7e50151827ff7db221877eabfe897c144ca3bc322907e0b6652034e4ac8ccc48757f06265e3901ceaf76f9561c13d7d5b99f269be586e6c85694c7a8cda62
TLSH
T170D0235351C53078959D3D91805BBC8EC73504200443DDD414D85859053545C091B344
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 7730a31d719fb3272bf008dad9067142b681a71005b8e2ab198083c4ce611596
MD5 a785d426be3b40f8833230a305c1d525
SHA1 5fa8e29d3b269ae3fa61158c4c5e38ca7dd22b24
SHA512 3d44953bfc1f6fdc0b6dd49090beedba43aa012f2a60f5e4c5923ac4dac92aef990c2c2197cd6ca04ab235340bb1a2a2fafd9636e994286dad9ce66dbde3d9cc
SSDEEP 384:D3AUU1M0NEFDTKVlKukxXgeYJBtbeO84ODOx1I91GJs81V0j1I+zbRhv4A1kzbRY:TIJy8cnVQXqge9r
TLSH
T1AE62B0F7C7E9822DC91152F09B247E1BDE5D051683283D6AC9D9BF0BA3E2471E20179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2465972987dd2e240332a274563e5454fc18b463e6be8b5b44c4449adb95e264
MD5 5a0a3becf21a0cf2508633479c740e1b
SHA1 a931f55a696b19beaf009507d2c2988d44152fd2
SHA512 2920e8448bb97be1aa4ae75e794fafdb2c6e4c99843691f3671a92750eafb8645a79a78c6c28973a0b73665fd8ae7308c76f3e20997ba956798236629735ea58
TLSH
T1CBD0222362C570BDAAAC3EC6846BBC8FCB3600240843DED421D898980A3946D092B344
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe588d66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe588d66.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fd561bf54c5e1adaf9409eaaebddd91565420295a2819c04eb57d3855cf23a20
MD5 919b943381dd8c88452b80d2d0f252f4
SHA1 7e3af24da6323aa848650d453ec6b0750a9c4266
SHA512 5f320f48a6b285f2e4d9903624c0838025e8a98f948abf7e795fe522a0a1b25e1876c1edb447cbd5f1c4595c509494c90bfa40e90f7d37c4c11cece8c6c75836
SSDEEP 192:sxZTQUnAR6yM/jK1Ml8M8O+/fAsfCU0V6NBbQeadpjyk/W6+WNB3M/Y0a8g9bIg9:sxZ3nAIEO+/fAsqU0V6ovb/bm/549
TLSH
T15F620716A634597BCCDBC219F906BB53D6F81163D6904E84A9FC8A0C08F6BDD2213D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 67948338884bed00b5f91d214dc69e31795c26016c4bc1b29eebf84681633aec
MD5 0e982c9b85c952c51df927b356c95ef7
SHA1 9e675f75313de0223795d2bb9485d69135d1df50
SHA512 adc137b631f7d95b4b4b1747a738c7b212ffc696250a8d5fbca875c74d6ed8780adffea38b414b5c2518445023482026ae57669d7bc0d90225e475d760e55add
SSDEEP 384:sxZ3njIqbm4+/fAsAUm6i/Upu/bXVDjEE8f5l1BusIr:sPjPbm4+/fUN6SB/bXC5fBYr
TLSH
T1BC92E857A520897BCCD7C115FC25BF62E6F50063CE914E88AAFCCA0C04E67FD6A0291B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1724d3f2c9983118a7f95c3f50bbebec945e756d608fd2982a813e3433ed1297
MD5 4769871174f8002dd8ba14625bdeebad
SHA1 55bcd68673436ed32b861837eb8e9ff9a3778ecd
SHA512 076ca8ecb40aee7107e08e725d40fb04ae0807fff743a03562ea308f9d95ab234b38c79ff07ba8f2f57d99c4c68620bb8ac68bf1ad84e20fb48efe2768af0640
SSDEEP 384:sxZ3nYIEO+/fAsAU0VWwASy/bFDj/5OmU:sPYg+/fUzVpW/bp5y
TLSH
T1E072F827A634197BCCE7C215F906BB63D5F91062D6944E84E9FC9A0C08E6BDD2313D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 08a640876fb81a3fd1c1b4b4fe4cf6f8a75a0fdbcf9997579eaccbfc0a819ead
MD5 17ef288ceba46c8c9d45b2bef42e233f
SHA1 65fc73e6ca0b5ef7b235752e55687bfc052f6d29
SHA512 95869775f8fc394dfba9aaddbe2db07575ee5385659d47c355fc191d7dde94cfbf6ba6792ea20870ab548e00191e7d2318c461f76808ef6d82483c830f351bc9
SSDEEP 384:sxZ3nfIBm1+/fAsAUm9WwASG/bX8Dj7/5J2wr:sPf8m1+/fUN9pi/bX055r
TLSH
T10B92E8136520897BCDD7C215FD25BF62D6F91463CE914D88AAFCCA0C04E67ED2612D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 430380d50f7a0858ecbaf3768e1d0a2ebd7f3b964f43589b6e311dd9ed1883c4
MD5 d5540a53768f028c0f8fb2facb94e192
SHA1 e9526aa4c383dac3b69ac1e3baebdfd4a383a2c4
SHA512 3a229c842ef0ea28e94de3632a280b7cd86c36763245be5f3ed4ddf03d4ffc5e33dca5a4dbd76ab91733fabe451748c33f35118f3a9186029df578ea77389069
SSDEEP 384:sxZ3naIBm1+/fAsAUm2a5wuf/bX8DjE7/5d2wr:sPa8m1+/fUN2cn/bX75lr
TLSH
T12192F953A520897BCCD7D215FD25BF62D6F90463CE514E88AAFCCA0C04E67ED2612D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5fe8f651bd2a1b7f81a8550c772eaaea0449b8e9583d45291f7a260b91e053d2
MD5 b677bcfc93a23ccb3c33b6a2b8ad787e
SHA1 35971ed58b18444ffa0353724c2c8d6c62a5dea2
SHA512 5ca9c83db487cbc19286aa1e3b324cacb4998715d811c82fc3477a4ce7437a7112b441b5ffc289fa8d6c86dad6ad0a7244eb70884778c6e4c1af781fbfff694e
SSDEEP 384:sxZ3njIBm1+/fAsAUmDi/UpQ/bXVDjE8f5A1BusIr:sPj8m1+/fUNDSD/bXh5kBYr
TLSH
T1F592E857A520897BCDD7C215FD25BF22D6F91063CE514E88AAFCCA0C04E67ED2A12D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 21118d94a333706b19ccb660afa70362a7b46949cd864952649c0197d8e1eb52
MD5 655eaac2bd62affe8e7540f7a797b5ba
SHA1 41909a7ba57344647305da60ca2cc93ef1cce43b
SHA512 3e3e17829d6ccfb2c41c6823bfc2576b8f52d93c5988af7c889d2c184f749446e7c7c21e31c4d181188b8f0e2a5938761164e4cbf9eeea0bdcc6dd3b67a92329
SSDEEP 768:xw/zh8dF2PkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VQOroPp:xw/zh8dF2PkWRmEcQXwu1jaKWjLp2tVS
TLSH
T196E2093F284CCB7E4F844E9CEC266F976EE801CB66684D5447EA894C03C77DA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2925b63a-8c1f-4b6e-8f49-1b6375c2a060\index-dir\the-real-index
Size 2KB
SHA256 b2e3971d7256692cc782264ba3fa0c5d8852281a446ba1bf91eaf94c5baffe26
MD5 8b7275f3e8221dca9cbd91d5c00ccce7
SHA1 56bab2cffc1a309c5e35a7b1ac6e1f18b0e44d09
SHA512 221fe65f9b6cd553ca50ca43e4b06ad89ac240ad9de0e7adb7469c49055c86017e1cc64d366aa15001cd45130b9315db9515a8c43f0c045125027c53d0e4d1c7
TLSH
T10351D80F0C4B5E76CDBC12B354B904847B3AE8DD56845F2B71EC51746CC7A192899239
MD5 SHA1 SHA512 TLSH

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45a03993-1152-45b7-83ca-ba4317a4901c\623cd082b6202da0_0
Size 60KB
SHA256 edfc7d26a89b5b73303e7efc7e598aa7b58cace527b490ea87ebd4eb541d4a40
MD5 ff86611e63c9f419d16d4aae20839d5e
SHA1 dcc2f6a167481644207cd30ebf12b1b441f331f6
SHA512 6b804428339395ce3b3a96a89e0a41c351e41163e9757979e22f201040b2dd38c2a63c556a4118b8a8a45625096cad54e83f7af9b17e622401329f3b703e7a7e
SSDEEP 1536:qPRAT6GuBHKut3JWWOQ7DtO/YdsllqtZLsQF8OdRHPwqpzGu/8:WarukgMgDtyYdIYZYeZ/8
TLSH
T132532AA7B262603687AD21D1649A7F00F11B13561544C9ECF0BD76913B18ECB66B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45a03993-1152-45b7-83ca-ba4317a4901c\index-dir\the-real-index
Size 72B
SHA256 570e85aea56fca75912a149d73f424fa4fa219c9951735b05c10cde6f44d06cf
MD5 79e129a7a7c951df36a458826699254e
SHA1 d66196f634af2100c18af1c18d36a4d86d39394e
SHA512 1d8b92d74731dc7d99811a0811301c1d49a5c4490079d0ee71c2486b8aa760f23b999ac9a014a720cda0b19bed43c47d9f38ca01563c6a4e28433f02620a20a2
TLSH
T1BCA0021822D0441AC03626B425D752792A22FA13C702570B42A221A4C85C556459281E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\45a03993-1152-45b7-83ca-ba4317a4901c\index-dir\the-real-index
Size 72B
SHA256 9d0efdda71b784ae1051a0b38346ebbbfb786cf4ca4cd19f1fd6bf21fa8023d0
MD5 c98b27ca1c15d7c27e55b4092fb9b7a5
SHA1 5fc2326344566ac40c24c15306c480e0a04b30e3
SHA512 821283a8300c3c53c9c9f9bdfa3a0ee58b0166bc86f3900665f09c1b52f083ce6bbd23c2b763e9a9b91389594b0c413082469cd42136819f27cce2505af5c7d8
TLSH
T154A0027D47C0102AD00322B0AEA2C381662448211313160641A70245C850E41554D00F
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\504c3e48-13ca-4d14-a0b6-57b1ba24e933\4f2277ea2139c475_0
Size 60KB
SHA256 3e881eb9685085300586daeac9284262d8d3f06654d4a06c0e8786d2ef274211
MD5 3816aea23b4425704056ccb927c677a6
SHA1 111d3f762694ef32ffa74447b41d218bc68c9fcb
SHA512 fdbbac55f46fc9106923cdf1b3f565967d01cf22b3524ac500b2e00a7b874dd50517c44cbc00d54de514f7918ee829d539e48ae94ed0852f96969bbb715e5a4f
SSDEEP 1536:c+PcAn6LuBHKut3JWWOQ7DtO/YdsllqtZEzNQkvZDRHPwqpzGo/z:cr2WukgMgDtyYdIYZqtz/z
TLSH
T16D532AA7B272613587AC22D1649A7F00F12B17561504C9ECF0BC76953B18E8F62B3BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\504c3e48-13ca-4d14-a0b6-57b1ba24e933\index-dir\the-real-index
Size 72B
SHA256 5d9478f1c411caf64ab7cfe0ed414fc165f8b0cb837957aaf67be98fafc594fc
MD5 ddf3c57284540ad45fedd29552846823
SHA1 821763afc5df6ed9c5b06eb26f6cdf50a558346a
SHA512 a911d5792716357bd234b975b61f9ae347e47508849ed11de6bb74ddbe569329b14004351518dfaea9db7741575e39e48898d97539f227a8a339f62d094ab765
TLSH
T10CA0022802590056C10187B2514206D033545D1D12095719A0E05457C8B55594711049
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\504c3e48-13ca-4d14-a0b6-57b1ba24e933\index-dir\the-real-index
Size 72B
SHA256 1d9437b39cca8d02707ad6050bf0ff4c687207c2a2046697a810de0ffb659b44
MD5 6da472153b1e64b5f4e936ada11a300f
SHA1 f315eaa211ea5722bfa12629f1af5ff55c0ab7e9
SHA512 83f813aad3756136eeb35994911054c30df095aa635afe86cc2f7875eb4b044a123ee90d04bf856340343acd81ac856647fe17b005fe061672bd1e2b87ea99dc
TLSH
T113A002380D940475C10297F1559212967314AD150509670690AC0595C8B11994741054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f4293882-65f2-42b5-9f4e-948f64af404d\index-dir\the-real-index
Size 72B
SHA256 52714e344027374dad97f938122287d1523ab0f29ebe705d490d05cb82c22086
MD5 7bb353f7d63bcf83b08f0bcd96588158
SHA1 1a7d75870e7f23f9e5df54dae7e481315264d03d
SHA512 e76e60cdace0bbb01b7378c50722cbf7692d8622fd9031e5cec840fba1cb4feb8f4ba84be0366a016047f080ac413a303427296a78e4854033476301b442022a
TLSH
T129A0025C15484315C00047719246A274F390B82527A182B94194018588F43A4920798F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f4293882-65f2-42b5-9f4e-948f64af404d\index-dir\the-real-index
Size 72B
SHA256 14787db4b433a9a8a876faa016684f64b6c620f749994d6befd5cd791deb361e
MD5 ff9f6a04cca3d683cd2717b51e721691
SHA1 d5045b4e2b9b29c27ba60cd17f341a6720059432
SHA512 52a9144db8914e3912ed9bd911f8074250ffdb384cd3174a28cbf659f8123edd9c65b248fb947d22fff2d228c47ea68a2f571b4513d5d4d98180026dbe4c22c5
TLSH
T1DFA0021F0DB84612C010077174491384B3948C2921A6A2A1449904868AB4941CA2791C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f4293882-65f2-42b5-9f4e-948f64af404d\index-dir\the-real-index~RFe58c445.TMP
Size 48B
SHA256 5c3e54ed570ed1fb09b090951a2f1fe3a07668cf867005ce09877b830ad172cf
MD5 78ae20902989c6b57254662090c1153a
SHA1 180265273157895858605e3413553e55c25866dc
SHA512 2e5c7e77319f083c7b889512ecc9baa53328ce667f6b8c537e71b8e15b32a0d1903cc70f66d450f72147eeda3d5dc42c844a9f7977e6deb535518334695ab826
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 741a31a1c2776ecb3a1388dc9a866f2f66523b830737fe2bb1880f0746504443
MD5 a92f274659355fa1127193a742a3211f
SHA1 8e9e0bd9900d878efca5071e0ce0eba3f5efcf44
SHA512 5e801bac2694b2fd6097e78bc45632ec8087cf38151d2520d8823351ce2f3fa55ce0d6c7cd64523ab65cf255a54b089b73fa0881a9b95e16881cffad14e49653
TLSH
T137F05CB32EFB1844FE7B97D5507244E219027C58C591ED0E58AAB3D3F0B132A744EC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 ff3d159fdfb64da58cabe3583640170b1c37b86b726103313c6350f385e644e7
MD5 9fbaf5e994053f2f22c3bb7f80982852
SHA1 b8661b5d987ee461a82554a7a9a4664279983a03
SHA512 1784ef6854c0c08e6ae0a7c0b976178b22d661b13d006f0bcd358722a32cba9431a97f1917456c65e7434c8d27b6d7dd100b5ca6420518452d35763a5e9deff4
TLSH
T12DF05CB32EF71844FE7BD7D5103244A256027858C5A0ED0E58AAB3D3A0B032A344EC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c5a2b6e19113e9c73f646c098ca55798238bd71819d4a22a747eebf514caba53
MD5 108bc8272029728000380e8f5ddb19ff
SHA1 62761161576a0b71154dccc49e083b20aae04f5e
SHA512 01fff4a8ce2e334ba5ff4a6596276b75387a515badbbee24e6a33194dd300b8342a4f20e89b8393c8017ba1c6904cc5ee7b4118887ceaf17b05636d968c5b188
TLSH
T14EA002118A6DA492C82207F9517B5240B392699902055B3289DCE0D88C9116651C5951
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e80e2f9b11003524eefee2d8764ca14371bba4113c6f11fc9623b79b12b473fc
MD5 2793d9d0b1d70795e3dc4df15d6a6962
SHA1 4b968d0628ba5d0e50c9bbf4fa9431c01e4c897b
SHA512 c6beeba677838f52b4656945d3b46bd181ca1aceba1cc0e381a6bdc1e9db28a076c6939cb0b6b9c4e77a61e997febabcc1f9d7305180726c4e88abd502fd07ad
TLSH
T11FB024004F0C41CDC41003FD005004CC71143CD43305035D40DCF0DC441D75150CC4C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58608a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58608a.TMP
Size 48B
SHA256 7f03e8e7da75a0a6fa2467c1d61a12a56ce2742f1e63f9d365efa2ba5f103ff9
MD5 31599e1d9139644b7c841f2726ee8bb1
SHA1 a937d95c13138bb371e0bb044cd22b462da59f19
SHA512 5a05754352333fb04f6e68c577c59a3ca4427fcf148df5a8717bd6d2ab8c45c664d07b2197ba5b404196b38e9a3ff7905df79cff10cc31861d5befeae4098147
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 82d5c7e7b9e44b833cf5eb39436dddf6e318ebce28f46283fb606b254c2df6c6
MD5 537be0587cc5d4c2b5f541df3586c138
SHA1 371992e5814e362178a218888b2da94a71c7e304
SHA512 e7413e013bd7a445c48d34eca0c344027142f8e43c7c905c3a4512a39972811037de318150e725abac9dbfdd93166228e890cec6c9629f7158536d44c4467417
SSDEEP 48:KEWIHKv3XIZKsQELypAIzK1a87yZuIXKjaMg:KEWgKv3XaKsQiKAQK1a66uIKjaX
TLSH
T1FCB1369671BB82413C7E290C93A4C7575B42F2A37024A83B7BA800755E27E385EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

92d0ea6f-03e6-4e8d-8e2e-14b81941c76d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\92d0ea6f-03e6-4e8d-8e2e-14b81941c76d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b60dae2fd39d22cf8162e913c204510c66408691d8911152ccd6bd9e3c5607e6
MD5 77425f1b057c652cff1483673222e7c1
SHA1 ea2fc1de7453ac1c9f03ffa1f42ea88e7b891c62
SHA512 6b4a969c8f66510d9e1c706dac6a06ac26712b152dbf17f8b380720b86154555cd61d0bf6e62df1fbe148ce7b02d12869f4208e16437772fb9f01ca69975432f
SSDEEP 384:niFmZcIG8Neb8TUNTUlIRMToA0uIRzRcnsudK3V0OEDVcl1lIO7w/mIBu2Z:iF0Gpbwg57z7ksuJOEDVcLCO7w/DBu2Z
TLSH
T115D23BF258E7483AD9AD5747B77E2D038EBCC063FA895980B3884A0CCC9A57FC302915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ed4a93ff9c9ea3104e77ada3c9b04dbf69b7c811fca163fa4c4932788c8b75df
MD5 e9848b5b1ea2a85fd0b5aacb0f767427
SHA1 8e4e09cbf9df50153182b27671298ff32a91376f
SHA512 f2c8de0b0bc4a758bd97586b5ddea918cb22503791708862afe9e495eef1bced7bd33f3ca4eb6131a7ee0d37ef6e899991079325f7ac863bf48025db80e08451
SSDEEP 384:niFLZcIf8Ne+8TUNTUlIlMTFA0uyRzjcnsudK3VjOEDVcl1lIO7w/mIBu2Z:iFTfp+wgW79lksuqOEDVcLCO7w/DBu2Z
TLSH
T105D23AF248E7487AD9AD5747B77E2D038EBCD063FA895980B3884A0CCC5A5BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 29db54680e8ff331cfd94988aa17a30bbd5304eea26c043921e443c0dbced96c
MD5 562136d645b4cc4a320d2f3a8aeb76d4
SHA1 94e5dd54910e65a410ac6af7bfcbd06d93861ec8
SHA512 0c0d3dbb1c9418f4a84f6e9598d4fd01c1181212d3dda159c7b4e5825b21fc2415c343c17cef6433cd76bc23c1e2f3d872b5789a040c378bfd33d1290ffb29b9
SSDEEP 384:HZcIh8NBuBTFA0uIRIjh2nsudK3VQOEDVcl1lIO7w/mIBu2Z:vh0I7b0hKsu9OEDVcLCO7w/DBu2Z
TLSH
T103927C36A8745C7B9DA5A546F88736038FF8A073DBDD2E80E0DD9F0D019F9AC1312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1c38b2e2aff33dcd1d227444f38de0381321a600c04aceb28e9b7a6bc49626cd
MD5 544770a92b0f230979a09e9c432f9d5b
SHA1 e29d58a930cefa5205dc7e1782d3a13037b9c81c
SHA512 2cc525b0ee081af0ba6d0a47b991948c56d3fa51652aee1ed588c00ef803913aa0dd6b0754cffd2fdbbc338b893fb82247dd3606970e94f0a38825db17de09f2
SSDEEP 384:niFoZcIq8Ne+8TUNTUlIloTFA0uvRzjcnsudK3VOOEDVcl1lIO7w/mIBu2Z:iFWqp+wgG7UlksuPOEDVcLCO7w/DBu2Z
TLSH
T1A9D23BF248E7487AD9AD5747B77E2D038EBCD063FA895980B3884A0CCC5A57FC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8f58b75fb706ccbbf860b41e7543cfcc405320904efc69b30d4d76620e4b4061
MD5 ca1f8be245c11a3f6f39b94efaaca8f6
SHA1 1377cc57598acd30f76784e720773ab9bc0397e1
SHA512 612deb972635bde66c663afb17e332f6adb9f82571e731c930a8c26f9c26e7adecf4687160cbadbce9a24ae50e36b3ec99fa7ea767409e210fffcdb7f1537859
SSDEEP 384:niFPZcIq8Ne+8TUNTUlIlMTFA0uKRzjcnsudK3VuOEDVcl1lIO7w/mIBu2Z:iFHqp+wgW7ZlksuDOEDVcLCO7w/DBu2Z
TLSH
T111D23BF248E7487AD9AD5747B77E2D038EBCD063FA995990B3884A0CCC5A57FC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1de410ea89ae7555e8734837a46344685d795ba834b6a8bf4c4a1b8c70a08125
MD5 4e2df7121a6003be2c77208a85f20e57
SHA1 6e6eff879f4307f8293d2d89f432c62baade776d
SHA512 8762572c7c27c4209ed58c588f1c795cd68be5c092ba80ad330b753ca83fa57bbb10358727322f7cbd900c602be3226e1aeb24a0731622bd7e9eaab81314e064
SSDEEP 384:niFsZcIP8Neb8TUNTUlIRMToA0udORznQnsudK3VKOEDVcl1lIO7w/mIBu2Z:iF6Ppbwg57z14su7OEDVcLCO7w/DBu2Z
TLSH
T19CD23BF658E7483AD9AD5747B77E2D038EBCD063FA895980B3884A0CCC9A57FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 df40aee819827a6aa563b250d2c2cbafb47f92ae47709d3db2dc1be9a4e6ec8e
MD5 2f4ec8592b400b9ff8151eb5d3e2b6d7
SHA1 82fe43b87949af59a3393946f5c0f28bdd485c30
SHA512 c70790a399f8d67be6b37a588b3a7b44c4f3bbeaa736a7f86b47c5d548e0f1d40f2f185507da66af0f2f3b9d16e661a801551ded658e00f2e4b526ddaefd62a0
SSDEEP 384:yZcIh8NBuoTFA0uIRIuYnsudK3VQOEDVcl1lIO7w/mIBu2Z:Ah0V7bNgsu9OEDVcLCO7w/DBu2Z
TLSH
T17B928C7668745C7B8DA5B546F88736038FF8A063DBDD2E80A0DD9F0D019FA6C1312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 42bdd90a6b3e561f85d575032d101008453b793cfb72aff04ff42cb72b56d66a
MD5 018e0d5061803380b175c56d6f012f2c
SHA1 9ac59905dcab2d885d6390bc9582a72d4d229ff6
SHA512 1d5c141927233ce39ee9439e6b6cadc159b9b0a9f39e30b83e7b2ef07ac6dd0729ff719463ad7ffb4bebba64283f519a9697da4cd039c852fc9c109b9988a2b5
SSDEEP 384:niFeZcIY8Neb8TUNTUlIRMToA0uKRznQnsudK3VnOEDVcl1lIO7w/mIBu2Z:iFcYpbwg57/14suKOEDVcLCO7w/DBu2Z
TLSH
T148D23BF258E7487AD9AD5747B77E2D038EBCD063FA895980B3884A0CCC9A57FC302915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 916b5e0dd96032a399b79ee6b5f0b6a7aa75b04305d1ae88da110f7a229bcd3b
MD5 44ba9f64f550b28e235a3253888481ef
SHA1 f75ae1490df8976c47466d0a1eb942587ca96b21
SHA512 508e5e1c63ff4fb16f1a63f874ef222e6bb8be34814d4980f67f17ea854abb13c4596334cf197da5ac383ff37e9ea1275d8fa4ad6b64cfd07e9781c0dce1e475
SSDEEP 192:BGNS6P2UOcQmiUytIUXEqGv0R+FdKsswSO2ThU6:BGNS6eXsaI3qGsudK1OwU6
TLSH
T10C02C8396C786CBB9FA2AD45B88777134FE8106BEA962B84D6D45F0C00D765C2303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 15000c9d3d77021c8a94617d41a6395bbf48eac75ef6ad8d84fffc1bd0cf406d
MD5 ff31f986cb09f4457cb46ab0aaf4c4c3
SHA1 77fce59ff5a0785647849663287d66b378317e07
SHA512 4b6319654b610d31a0a054619c38332c4b8683698612370d93d4c5757bbe8872cbf56c2c40679cdc61484b44635a7a9f899d17826cc05e4386d861ccd07be0d3
SSDEEP 384:niFIZcIi8Neb8TUNTUlIRMToA0u8RzscnsudK3VtOEDVcl1lIO7w/mIBu2Z:iF2ipbwg57XOksugOEDVcLCO7w/DBu2Z
TLSH
T183D23BF258E7483AD9AD5747B77E2D038EBCD063FA895990B3884A0CCC9A57FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a7fa43d56384b0036a816395369868ef4a1ffd99445e1685ab91ff2b2d253ef0
MD5 208069d13bd5d9b8cd5bda78abcc9946
SHA1 648a9212a06d4053cab707dc6651668298c5ccd5
SHA512 95ad857b8cbc9f1eabc05aa21397b2c278a0e1d542fbdd31c29c667fada10b7d19e7880ebd72f95dc092a42e8125cc4cf21ecc55261e8caecb48e267e81d774b
SSDEEP 384:niFiZcIJ8NB+8TUNTUlIloTFA0uIRIusnsudK3VZOEDVcl1lIO7w/mIBu2Z:iFQJ0+wgG7bN0suuOEDVcLCO7w/DBu2Z
TLSH
T153B27D7358A4887F9DA6AA45F84A32038FF59073CBD96A90E2CD9F0C119F59C1307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ed757dcbef8625b20e246fcff1580d685705a561827e28d2ad02c84f797c66f1
MD5 fa42dcc4b919934fab21c95b6db8543b
SHA1 e8d25d5a321a8e59bdeef3aba713b50ff00b25f4
SHA512 1f78a8cc673f9785c782187c580ad607c5ca3c7fd6843de138608276c0d089a77cf75b78f5f2a2ae286a1b83a1e27c65793848b2480691cf0c7e1d398f0b8e9e
SSDEEP 192:AGNl76P2UAQmiUyZEXEwGv0R+FdKsDz+V20BOTq/U6:AGNl76efwnwGsudK3V7OEU6
TLSH
T13512F93668746C7B5E92A845F48736038FF55167EF8A2B90E1DC5F0C01EFA6C6307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4e4d56077f1958178ac25bf0a3a943382bec0a3119db94b3dbaec8e6738c6b00
MD5 c37ffc6489873dbbabaff87e978bc9bc
SHA1 acf17f8313b0e500adb6dc884a961f6268e67fa4
SHA512 f9e57f678bf623471d1d997a3f45e2d5b1c74d95b4af440b0234870247a4dad67eebf5b77f0b078551fa35e95f016dd6129f3e844979a116d5cb35c914c768c8
TLSH
T195E04827A38851BBC428033804C31F183FFAC06183B303438B33067C7C22300BC20A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2fd5093fda14936e8f457af023439241be16dccf876160cdfa0f3404a0398329
MD5 eb7f46d0e03db288db2105defe179fd6
SHA1 c217a241e47525979861649a9360cbebdb88aad1
SHA512 0ce56ccb5c217673fe46d1e90803a2c9f4beeb07409149202725b1da440835ae12f93c2017c4abb679c2a79e333819567c19773894abdf9d712623db9e064a08
TLSH
T1FEE002126348017BC01D033414871B5437E1C01003F30306852106682C123105C30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 079bc2013261348d8b67b140bdd4bf7b85a5f2a55d17207507ff18e223a2b0be
MD5 c49b57be2daece11fd5c1cc94e517c93
SHA1 18c33aac5a2c83990371e41743131f0e64b4e3c6
SHA512 0c4fcca98db4027846d1c55ef0b49321e6a8bc87bf432ac408bf8a59642b11a7acdc56948cf7ff8cb3d3e9aa1c995c20ed4413ca2068482a299a72ee19b6efcb
TLSH
T166E00926A248017BC419033914872F446AE1A11047F7064A873106BC7C26314B870F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 06b89ee8950e7c05d0e86778d7a800bda6c055820676f0dbb2fb7a186440ed0f
MD5 e9df0eb41df285e5d0c3632a1a2777b6
SHA1 97c485a7547c5212edf9b5483c145b8e187a145c
SHA512 ae9270228ee14f68fa8f47294e1f0de4a42eb02590c863b8dfc15c5845f608cd49b07fe4a0912c99392856b0542358073838c338e3edb26ec75284de07e42965
TLSH
T19AE00926A24851BBC52D033918C72F54BAF2A1214BF7068A8B3106BCBC67314B870F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b2f69ffa1a6364574f8baa414f8ef1ce2028cad9a1106e73c777d45ee364ab6a
MD5 dadff3573f1f070fc146c8d0ec52acad
SHA1 c97fe5b84ad2dc2dd32c98b55932b57dbadce346
SHA512 7dd3adf6c43a889b3fb75d79fad9305620237f9265d4474f9739ea84ec2ca8e8bee761b202a7b2025eafc926c16f02ebe8cb4b194bac54fb1a3123655c1f38c7
TLSH
T127E00225A34451BBC519033814C71F597EF6952147F302499732467C7C67310B970F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 21b5c411b800b7791b8bf2a2b8f12386bbdc03b65548c5ae38de7ff644c0e285
MD5 ddfff1505db0892960cd2efb84362967
SHA1 d1f33cbc4f74b13a722715d2ba08913f43133dad
SHA512 a5417ab5168b5d6fbf53d5997f00c0c2cd60bc64ffba228d428c5e702c4fd8373c3054bab2f3378359bb2f887c166f16570dd6a445abf9309fdbc484818e7fbc
TLSH
T1D9E00825A34451BBC529073814C71F597FF6952147B3035A9732567D7C67310BD61A90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 78862930dc663561cc20bdc7eb8127c82bf6695113bb8668ecb62b74efef49f2
MD5 8cc5355a544f24fe993bc6033694f738
SHA1 3c4193fbd842b40038a28df0835c4ac2a529778a
SHA512 afad763611260b7491f9d667262eb871b7e9a9707138caeae86c3cf71a11c858d2cc2df489d1ba3d669ba8fbdd613f7c7bbd347476f69fa934ec7ec5e1544a32
TLSH
T1A9E00126E248017BC01D033415872F547EE1915047F3034AC331067C3C27310AC30E40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 849f8684e7b06be1437be7988f8ea1730eb1436192cea41ed74bded6498228e0
MD5 368af6ce0946163b4c0b9fb43dd9bf96
SHA1 2f50ad54f332c89d78d07cc97cf8974675200563
SHA512 df2872ccbdf137870e4cca59d6e6a9a394e8d3101f3bf9ee807442e4245b6b7268446f3cc101d01e56bc3d7dc8631dcfe82c83224ccf58aba4a1906aeeec82dc
TLSH
T15FE00127A348A2BBC428033844C31F283FFAC06183B303438B33067C6C62300BE22A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 88d830e6932375d0c6e4b95b8cfa256a77c2106828dc670e349e07caee5f7461
MD5 beee2211275e0fbdb3d5b7f14fba259c
SHA1 f34570cf0c5c6632e1882c85d38368d50c2e3196
SHA512 b70ce0897c18d4d2e03ab2029744f3ce5232a8375473c7f92e0d486223da059c260c6b06904365ab2a3c3fc86889d520a1f25b6c3194710eb26d1d4ccf9d1d24
TLSH
T1B1E04826A38440ABC428033804C31F183FFAC02043B303438B32067C7C23300BC20B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe582d45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe582d45.TMP
Size 392B
SHA256 f680c6d3977d6068c6a079a46bd3ae0970a36c15b14bcd368fdfe3a3ef58d52a
MD5 10dda8c09fa56924bc559ee7a3b72cf7
SHA1 b2388ab572f4729de76bbe5d78bd51dfd8d69aef
SHA512 dd54fa3a08cb5915f0d3bc96b344f4f69b60a7de6461b88a3ff274d2c4b08edf09635fb45682f52f97d1c42436c7d8fef2c176da4ada405f520aa68844bab3da
MD5 SHA1 SHA512

Submit Download

a74d4d14-f2d3-49e2-bdc8-d8ccb8dc1f40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a74d4d14-f2d3-49e2-bdc8-d8ccb8dc1f40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Drift.exe

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\Drift.exe
Size 2.2MB
SHA256 ee0990cc4a6892bfcab2ee493706f941899dbccd8300a1f0512767cc8f6611f0
MD5 e2231c7bd10333e44baca1c91c503e8f
SHA1 c0204b177c8b9a1456bbc00c908a392a9990809f
SHA512 522e79fbce6b39f800fce902c41b0989528b8f8ec9b01a62d55cb8f41ff1d89046b325650e4533aef752ada88d4af8d71448144b13f1b569ba7036e0145bda11
SSDEEP 49152:4hl5eKSXghJQAbKuc8E6odztSp9gJFbZLGzMTAupUyp04T:jybKFztggZuMTAx
TLSH
T1EAB58E3566AC01FDD076E1B8EA8BA917F7B33405033019EF17D08D561F6BAE84A7AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSans-Bold.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\NotoSans-Bold.ttf
Size 562KB
SHA256 c976e4b1b99edc88775377fcc21692ca4bfa46b6d6ca6522bfda505b28ff9d6a
MD5 8bedd188f4c137b79409d437de74f91f
SHA1 86ad3e50b3687015f1c90a5b0d9182b10dbe1687
SHA512 0099576bd6f351a3015ce31e2d386cf70e1519f9eac35f3c969abcee8048c5589fa4be98c56e8ebe38755f18a75520b7a54023468523af98e027013bdd4a21bf
SSDEEP 12288:7inWqE7De0CvEenmj3OYPBV3a2pDADobh+3NwW:OWxPCvEF3OYHP+33NwW
TLSH
T1F7C48C03F706E74ADB161E7856B9539B2394F8B16F1B834BE5853F6AFC9B0D00A611C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NotoSans-Regular.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\NotoSans-Regular.ttf
Size 555KB
SHA256 b85c38ecea8a7cfb39c24e395a4007474fa5a4fc864f6ee33309eb4948d232d5
MD5 2c157a50aeb376ee5a69032d7813ffb2
SHA1 33f4a777d254522f7ef4d780a595a83765f33c34
SHA512 f51a40f38cd588a0fbf90df68de3d415c1bd11a15c25a552f235c87883907cbf8acf6ff82d49714f9c4b52af96269f841a5f66cf0d99e80e3939b5b37eaa2e00
SSDEEP 12288:xxFnJWzvP5zAEk/rIt4zj7uFgTOJ095wU/l6W:xPc3CEk/rS4LyUUW
TLSH
T111C47C03F706E38AC7161E7466B953976394F8716F2B438BD5863F6EFC8B1D00A65288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa-solid-900.ttf

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\fonts\fa-solid-900.ttf
Size 409KB
SHA256 fbbf06d7437aa30f3cd44c968380193545a8fc3eadfb7ad897bbb101eefec5a2
MD5 25914cfeafced317e1a0372187fbb2b9
SHA1 54217d79e7b35011798d712a96d1c4ea08a0ca70
SHA512 ee22fdcae2600a3ceb16f562ae88477ddf20b865aeba8f242400d3215ada4ad9b560aa2b84969c9da65f88c687564707f26f21f1452ffa11585e9e145d8454c5
SSDEEP 6144:Yma14LJlyQ0nqgBohapS3Asznhp+vvpt93aGqFHhjqYa89C:7Fly1WaAJrOvht1aBJZ280
TLSH
T15494F8D3B7DD9D06E42339784B405E0F2356A13882558226FF875AAEC5BE8E0C736F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imgui.ini

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\imgui.ini
Size 326B
SHA256 c3c5b6b94b5e5e1984472cd82a99ec65424a05924f24bec3b8e99a840d9df576
MD5 05129fd8fb3d38b6b4aa79b6c9e1fd1a
SHA1 215f228bf5e05cfa47fef1ade82c7c2b04f625e2
SHA512 e2149d8fbd89c869ce52db18f7f4213fd5aeba739f653a53b268a0deeda41db3f70977cca1b5c652e2fc857fddc3afee21eeee100ac726dde2cdbd78b80200fc
TLSH
T161E046427337022B86F7E099A23613C8BA8D2A40A846B4C1B4482436AE6B833140B2CA
MD5 SHA1 SHA512 TLSH

Submit Download

lua53-64.dll

Path C:\Users\Admin\AppData\Local\Temp\DriftStaging\lua53-64.dll
Size 488KB
SHA256 167fd7a98a744db7b6039a717230011e003a45b1807ce74e25ee5ef11b0aa338
MD5 1cc2b8c50079c0455d6c3d2aea06b2e7
SHA1 65967eea0d8797bbf32b31a486e829c452b795b5
SHA512 0b1c49335d8214359932aafb10d466719f14eeabeed301042ad52d468c8a1beb1758223d2a6c1cc4758ce69ada1f45d1a06de67da73fc2c7036cd156b429a77b
SSDEEP 6144:fTFPtBjud4F+NKmakXhIAsoJK9j95SY3E6qS/LmI7b6gh7Tnoyw7UTQU/F:bFju6Flk6AsKg3nUuP6+o4QU
TLSH
T167B48C59B2A406B9E573D138C993464BE6B274250770DAEF03E18B762F23BE45B3B710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriftBootstrapper.exe.crdownload

Path C:\Users\Admin\Downloads\DriftBootstrapper.exe.crdownload
Size 322KB
SHA256 c21d46b067cb5f86af94d6cee1e0754fa9f15eb73c041a3ae35b4364eb0921b7
MD5 33a87409c02b784366bf978f5bb3de7f
SHA1 93286cbd9c129b1fc42f1beb8380721c7602f23c
SHA512 dea1493a1d06f9be4be0b5de8404bc3a719a50970e50717c97fa567251c5f70db49b07f345de58ea35d1bfa66297c0f7f0f873cbaa61d41c130b1d62f6fe4db4
SSDEEP 6144:UvgvkNFNaxmNEJJ20n3Mbii8JmferrBYHn:UvggNaxmB0n35irn
TLSH
T14E647D12A3A8417AD2BB4778C8610941EB73781B5BA1E7CF03951CBD5EA37829F35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Read-DRIFT.zip

Path C:\Users\Admin\Downloads\Read-DRIFT.zip
Size 423B
SHA256 e5066d21e99e83583c9428e80ef06906141b933e665665fc231362dd67ea22b3
MD5 5f31cc6b3980cd537b1b048f39919bc5
SHA1 abc272fd65174902d25a3c3e826721d7a61a2173
SHA512 64cc842507c4308952f21e66f78fc6a90c3c5e1427fa02fac9f6445bb1f7af905ab0dbe50855169c6dcfd004f673568c54fea685bcc72c523b9a192a21e19573
TLSH
T127E0AB20934E29D2D40882F3C0C149A2AC04869F100CB383E07BE80256716A19E0C392
MD5 SHA1 SHA512 TLSH

Submit Download

Read-DRIFT.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Read-DRIFT.zip:Zone.Identifier
Size 92B
SHA256 69a90a3b8639c70ebc1d58b9fd8723329de736eb3a900eb41e4c88ba58f10a73
MD5 a71f986205904f590b21d84f7813392a
SHA1 38aa4d5e2fff0a81842a1e964f5b3a515ae51979
SHA512 50221fbc288cf598e40fb80a74052352ef0faaa95643349fbfd024249b21c123ffedc5f98ee2ef6e1d59e85cc7db6e3285ad9c759ec6e07fe958d04582d49fb1
TLSH
T19BB012170584A805072071C810EC950DE00E2449C9044984DCC050CFE4461E959E4011
MD5 SHA1 SHA512 TLSH

Submit Download

Ronix-Installer.exe.crdownload

Path C:\Users\Admin\Downloads\Ronix-Installer.exe.crdownload
Size 5.4MB
SHA256 e8e7e6ed24bd6932c402828334cdb17d08eb4ce9b2afc30b49b73e93cdf38634
MD5 00e7c93d610841d179eb75683b05f1f7
SHA1 fa51d17b3e8edc2315341f46c72201fa3506b564
SHA512 639892febf0c3a56020f063410dc63bd8ed72528b0796f489aed01fa068f30213d34a42dfad6b683f60a26c80a2ffc05e61c9e50c3a239d953d6ddb1cf3cfcb3
SSDEEP 98304:juRO1zNIfko55jRMmro9B+iHR9lRu1Ux6ONgwKo/lgAVbNbEYL9kA:juW5MjJw+ix9378OaFogA19Jz
TLSH
T1B346336E42C63D91F2918BBA6D7519898C12EE375F46C43EE61F06A6081C35ECF3768C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ronix-Installer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Ronix-Installer.exe:Zone.Identifier
Size 97B
SHA256 31784522346b4a1bb8f1c3a01e875d42596e73b71ce6736a65f2413a173cde09
MD5 9d0515f4c7a777d6d35b973f93fdc509
SHA1 cf5a9fbb62469c563def9693d0f8adec5e5d7b7b
SHA512 466ba984588fb236b96ec52ffff246f532801839e52129f949dd6e8d856676cac1977ea5210f14d6c7e866d2cf1a97794a1ee15ce859cbd7aae4d785aaa676fc
TLSH
T184B0121F464580142B097389028AACAC900E7214488C4240AFC105C5FA8219806F0443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2856-2935-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2962-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2932-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2933-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2930-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2931-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2934-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2936-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/2856-2953-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2871-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2874-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2860-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2869-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2870-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2872-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2875-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2873-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2893-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/4172-2876-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2984-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2983-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2982-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2980-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2985-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2991-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2986-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download

memory/5304-2981-0x00007FF735F80000-0x00007FF736DF9000-memory.dmp

Download