ddd4e90b1d9013795659f3128757b23bc375339aec79e7015824db92134f6c69

Analysis

user interaction
yes
max time kernel
141s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoidBoot.exe
Size 158KB
Sample260802-vg29vsda23
SHA256 ddd4e90b1d9013795659f3128757b23bc375339aec79e7015824db92134f6c69
MD5 76b62c230d20d40f1464a86f717b7e13
SHA1 d5f34f07540cd118b06ff0a06e256f46a37ccaed
SHA512 58a86be37a4761386f54a8549cb68d703b85afef994d411fd3cba019fa015983d147441d30b75f7cf211a8f6ac7c73e373dcebd7d30a909e717329cdbe7eadf4
SSDEEP 3072:uVDxk88wN1xL+x7dL1Z9QnlP97E3swm9uzaAT5d0:yRax7F1nQnhcUJK
TLSH
T1BDF33C13A6A851BEE1B3D678C9924941FB7278594B71A7CF03504EBA0F77BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	krnl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	krnl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	krnl.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
126	api.gofile.io
130	api.gofile.io
165	pastebin.com
191	pastebin.com
205	pastebin.com
1	pastebin.com
125	api.gofile.io

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1316	krnl.exe
1316	krnl.exe
2912	krnl.exe
2912	krnl.exe
2148	krnl.exe
2148	krnl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_252_465272993\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping252_101508401\_locales\ta\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5924	msedge.exe
4120	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301635411818063"	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4291CDFA-D4C0-4F2B-8ABF-0E57CA08E336}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{5708EF88-CC7F-4195-AF6C-23E3D621CF40}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe
1316	krnl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
6064	msedgewebview2.exe
6064	msedgewebview2.exe
6064	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	krnl.exe
Token: SeDebugPrivilege	2912	krnl.exe
Token: SeDebugPrivilege	2148	krnl.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
252	msedge.exe
252	msedge.exe
252	msedge.exe
252	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3480	OpenWith.exe
900	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 4616	252	msedge.exe	91
PID 252 wrote to memory of 5924	252	msedge.exe	92
PID 252 wrote to memory of 1956	252	msedge.exe	93
PID 252 wrote to memory of 1956	252	msedge.exe	93
PID 252 wrote to memory of 1956	252	msedge.exe	93
PID 252 wrote to memory of 3780	252	msedge.exe	94
PID 252 wrote to memory of 3780	252	msedge.exe	94
PID 252 wrote to memory of 1816	252	msedge.exe	95
PID 252 wrote to memory of 1816	252	msedge.exe	95
PID 252 wrote to memory of 1816	252	msedge.exe	95
PID 252 wrote to memory of 5576	252	msedge.exe	96
PID 252 wrote to memory of 5576	252	msedge.exe	96
PID 252 wrote to memory of 5576	252	msedge.exe	96
PID 252 wrote to memory of 3808	252	msedge.exe	98
PID 252 wrote to memory of 3808	252	msedge.exe	98
PID 252 wrote to memory of 3808	252	msedge.exe	98
PID 252 wrote to memory of 5836	252	msedge.exe	99
PID 252 wrote to memory of 5836	252	msedge.exe	99
PID 252 wrote to memory of 5836	252	msedge.exe	99
PID 252 wrote to memory of 5772	252	msedge.exe	101
PID 252 wrote to memory of 5772	252	msedge.exe	101
PID 252 wrote to memory of 5252	252	msedge.exe	102
PID 252 wrote to memory of 3208	252	msedge.exe	103
PID 252 wrote to memory of 5252	252	msedge.exe	102
PID 252 wrote to memory of 3208	252	msedge.exe	103
PID 252 wrote to memory of 3132	252	msedge.exe	105
PID 252 wrote to memory of 3404	252	msedge.exe	106
PID 252 wrote to memory of 3404	252	msedge.exe	106
PID 252 wrote to memory of 2208	252	msedge.exe	107
PID 252 wrote to memory of 2208	252	msedge.exe	107
PID 252 wrote to memory of 5844	252	msedge.exe	110
PID 252 wrote to memory of 5844	252	msedge.exe	110
PID 252 wrote to memory of 1256	252	msedge.exe	112
PID 252 wrote to memory of 1256	252	msedge.exe	112
PID 252 wrote to memory of 1420	252	msedge.exe	113
PID 252 wrote to memory of 1420	252	msedge.exe	113
PID 252 wrote to memory of 1420	252	msedge.exe	113
PID 252 wrote to memory of 4840	252	msedge.exe	114
PID 252 wrote to memory of 4840	252	msedge.exe	114
PID 252 wrote to memory of 5732	252	msedge.exe	116
PID 252 wrote to memory of 5732	252	msedge.exe	116
PID 252 wrote to memory of 5732	252	msedge.exe	116
PID 252 wrote to memory of 3132	252	msedge.exe	117
PID 252 wrote to memory of 3132	252	msedge.exe	117
PID 252 wrote to memory of 3132	252	msedge.exe	117
PID 252 wrote to memory of 908	252	msedge.exe	118
PID 252 wrote to memory of 908	252	msedge.exe	118
PID 252 wrote to memory of 908	252	msedge.exe	118
PID 252 wrote to memory of 3928	252	msedge.exe	119
PID 252 wrote to memory of 4540	252	msedge.exe	120
PID 252 wrote to memory of 52	252	msedge.exe	121
PID 252 wrote to memory of 4108	252	msedge.exe	122
PID 252 wrote to memory of 4108	252	msedge.exe	122
PID 252 wrote to memory of 4108	252	msedge.exe	122
PID 252 wrote to memory of 4648	252	msedge.exe	123
PID 252 wrote to memory of 2844	252	msedge.exe	124
PID 252 wrote to memory of 4648	252	msedge.exe	123
PID 252 wrote to memory of 2844	252	msedge.exe	124
PID 252 wrote to memory of 2844	252	msedge.exe	124
PID 252 wrote to memory of 4880	252	msedge.exe	125
PID 252 wrote to memory of 2372	252	msedge.exe	127
PID 2372 wrote to memory of 2104	2372	msedge.exe	128
PID 2372 wrote to memory of 5528	2372	msedge.exe	129
PID 2372 wrote to memory of 4120	2372	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VoidBoot.exe
"C:\Users\Admin\AppData\Local\Temp\VoidBoot.exe"
1⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\PushUnregister.htm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa484ec188,0x7ffa484ec194,0x7ffa484ec1a0
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,7706517455904539640,9663385314696313546,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,1538212759827345290,4348012777555304533,262144 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,15215859035207260338,9816321154708889564,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:13
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,12665974597955964865,15141007970440373041,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,4748223384388159345,6904054226871140261,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17894995781540035201,16323026518687093105,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,18134733331560610451,10443263587773817374,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,7026204017728957218,435075602087701123,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,7597674362022146813,8042470363984847545,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,2274203762138748646,5465827825230290956,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2612533520154953388,9100926993170652095,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2612533520154953388,9100926993170652095,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15477819727932970196,399515764716961243,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,16262652490036797051,109289926284318377,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8030737923123352703,16231942083232556942,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,7562031639067028128,15559916672584917782,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6684,i,8742214981283465912,14478033099916722379,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15888652546882051302,6322458140258520454,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6112,i,5173420027703372396,15050114839117332835,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5364,i,12744979618706356747,4303389516468634700,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4984,i,8928874705447923151,12552963253170801912,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,6801670059131967352,17164683792230710541,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,15970990408729037641,11663181476487951281,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,1125582250800947641,15452192624357978803,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
  2⤵
  PID:52
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=1392,i,11031398610881001525,11393060245177744588,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,6678033117372905259,1194367821566412420,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5168,i,2387110661825114886,3252599093740915668,2097152 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,2647523130422106690,6984694490500902774,524288 --field-trial-handle=2432,i,719302488338717197,5191041678913548177,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa484ec188,0x7ffa484ec194,0x7ffa484ec1a0
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,16001675357931369015,6588702056845102690,262144 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,2913201896008728486,1924377869102947246,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,11676878262199526191,1710591847686273057,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,17794702345007339399,12460840996604569090,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,17794702345007339399,12460840996604569090,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,3274504371332171844,15577811066638600192,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,13422949528069056455,1840978817916799195,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
    3⤵
    PID:2264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,8257168096596706361,3118374676011572000,524288 --field-trial-handle=2292,i,13969979861083342580,4816174732652711639,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5508

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3404

C:\Users\Admin\Downloads\Krnl Remake\krnl.exe
"C:\Users\Admin\Downloads\Krnl Remake\krnl.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1316.1260.17708542876043961280 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x164,0x188,0x18c,0x50,0x194,0x7ffa42b45fd8,0x7ffa42b45fe4,0x7ffa42b45ff0
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1816 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3508 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4564 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4148 --field-trial-handle=1820,i,5656376122982955906,15199683274381475396,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 /prefetch:1
    3⤵
    PID:1996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:900

C:\Users\Admin\Downloads\Krnl Remake\krnl.exe
"C:\Users\Admin\Downloads\Krnl Remake\krnl.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2912
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2912.4124.17127844386471137810 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
  2⤵
  PID:4548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x198,0x7ffa42b45fd8,0x7ffa42b45fe4,0x7ffa42b45ff0
    3⤵
    PID:5952

C:\Users\Admin\Downloads\Krnl Remake\krnl.exe
"C:\Users\Admin\Downloads\Krnl Remake\krnl.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2148
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=krnl.exe --webview-exe-version=1.0.4 --user-data-dir="C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2148.4180.16250133084834176296 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027
  2⤵
  PID:6028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:dd9b982a0d4c951ff7b6d1807a27156f2f7f5027 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0xa4,0x19c,0x7ffa42b45fd8,0x7ffa42b45fe4,0x7ffa42b45ff0
    3⤵
    PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55a7d885fadddbff4768ba6c4d1831cf3c97e5cee2c6278de82c828bbd98df7a
MD5 b27d7e363563245c4556040952fdbf95
SHA1 dfc224d76f71496470da48460fe6bc98bd6b630b
SHA512 53bb58d5ad6a6e99815ef4adad0abf35d7e22ee9cb08396210cbf4d6d7c933cfd85b85d6129c7d2584767453a8628b8d168f33fd574d277fc5d3c3ab08469a5d
TLSH
T1AAD023F079B2E3B0C60C00388110021011224A723AAB23176240480CEF3C0C2C1CF8FA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1ec854c28a4dde8f950dd736eff851c97e2de74a6ee334a0c4f8ce987efef0a7
MD5 8f11697845b4fbadab0fde43aec86cde
SHA1 af37a7dc93f0db8fd6749a5664b19f0a2f4325d3
SHA512 8eb6fd72d82337a73aaaa5092a72a5fca4509a46c8d7233beb5861a8bd49cd0330b7e154c478a8e1ab7121086e1c741d7c2dfa38c63584207867333e415582e4
TLSH
T194D023F0B791D730C60D05359950732056B35A7034AFDB739151540D7E7D095D2DF069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

72c48c64-d48f-4af0-8de3-a3101b16284f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72c48c64-d48f-4af0-8de3-a3101b16284f.tmp
Size 414B
SHA256 be655a100d0c8396578dcecf2c0a635e7b3ab60674dd634cf6903a99798ed86b
MD5 944e6dae38fe5d8861e8ea3e9ba23029
SHA1 8b5b7e80b20dc9aa46d37797949efc2bd828b2b5
SHA512 25dfd92b925816ecd6dcb8f126bc61b5d5102db9c8fb2ed9a7e6e54b97ee20401f9546f5b1efaa0e4ecdee5489d619ef1ab2f708bbf53a76f663e910284886dd
TLSH
T19CE061A9DC31EC3B18FE171954501B47E60013573A50859F3B7DA21E4FF2A7AD58586C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 006b6a4daad39d406e23b7d30ceddda20dfd92c6d8ee71ac8a0d69fbe44ad06c
MD5 fe9c3e02399509d7fbebb1880c8c42da
SHA1 574ca5ddd53cb7ddf9fd40687cb448da78a7a0b2
SHA512 523198efda4eaac37bdee1cfd6de4077455da10e7f7e9eae2b59bb5af2fb0d3b85e71fa66a66cd2a30a7a7b0704bcc4ab76a595b36ace0718d5c7634de9849db
SSDEEP 96:EfQiRTOfNsQPeHzRdxB1gVfM1peWV3xaDNS0aJznSK7:MRAsQPMnz1gRggWraDkzSa
TLSH
T1D9B1EE3647E4EB81FB2444B8B39A9F29B6E4C425480A5FA3CA446E35784BFD735F8017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 399B
SHA256 55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a
MD5 a15ac2782bb6b4407d11979316f678fd
SHA1 b64eaf0810e180d99b83bba8e366b2e3416c5881
SHA512 370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 30f2775243cd4c86a7f4f4707c2356c6bd7e433066d036478b54689a3bbfab3f
MD5 35eee28fb126c29465c68fe56fe55f62
SHA1 70b6460f5af1dafa74b5e2c709881606b4cb1292
SHA512 67f5dca3e81dd602158889653bc381e6033e6ed9965446d7c0ed22a0dff1ad4d74711479811e2702b3c66bb87c2bd2cfa7f4650fd368e3c53e5ff4798ff52772
TLSH
T18FE026CC09C8C12AA65B69A782AD670CC2E03412ABC83D361B4A8C80B143A41A2A7694
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 fa3c4d3956ab2d550df7d2bbc578a26ec6e47808d40854c3f76921b10a64cfb2
MD5 cfbe03b138fca56156e57334bb290d6c
SHA1 a871a257de87d6ee248bb9047a5df7bc640906ae
SHA512 3cbc99200255bb052c8d3c024cd7c0a1a8b05b012703506892310628046e1624115df3f14c20e61b2123a3048512bc6988ad8f39b24a397d2bb13fd7d06a617e
SSDEEP 48:uzBmw6QU1PzFjtxMyXPTOrc2JFiZwrSXtNHpIyW5Q5:6BCxFjtyyXPTOrcKiZwrSX9It5Q5
TLSH
T1D592B34B9A383853C7642EBF2AAB1874DD3AC2585FB6DCC474A084124DF8056C8B68ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 1a079669d7b257ed8384b50b7a339574db683e2a85eaaa287b4d251708995f8d
MD5 0fd82559e11e757c72e39ecc27b66b71
SHA1 7f458fd929c2f812b911ca7021a9349f746a52dc
SHA512 69af0f331949eb13cd37fc6025b5d5dd7354eb677815f603d58f936239e58c986bec89039cbe3bcb6944d11e04ed04e445eca30cd5ab9f079fdc8eff4196f109
SSDEEP 192:BT+zK3QSMYH+bF+UI3iWGV4WN3qL/CoVVV63:NQSMYIkUI3ijV4WN3qL/jA
TLSH
T10824524F5F342712CDBD913668EB44A35CBDF03FCB1266DA68610474CEE2652A45C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 14KB
SHA256 0444790e906d782ef1bfd988238953f2744ff1c1aa74a5f9e05d5f2150592af0
MD5 16a2692124d61a44212cc50d94e2e849
SHA1 c15adf1af98c70a9546b27911e4fa0a9463cbc19
SHA512 4eb1c77c2d4180e98f8b292b967320c9a0a84ef908f0952af2a7faadbe52d288e803117f8d0709578153b8a9e1809354b6a8b3a815c55e69f290b653962bcdfb
SSDEEP 192:yHEJwRBqCuNd0OtXPmJnrHotf9y1G+3GwAjxHczTvn+k:BJwRBqZiIfm1mf9yz3YxHATfr
TLSH
T1C862E9FB180CD497DF8554EA86BBED4DD257682ACED9ECDED1BC899E02E80343671102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 2f778836d7cacc04a435ad148bc5eccf53d1a7cea26f2aa0ace3c1e07690f8af
MD5 78c9da00d0202aca3bcc74da57437c6b
SHA1 6fac8cf3adb7d6975f78f64bd63423a2926e5081
SHA512 dd34bf2027d5031873b07293d284530c7fc2dd6e92b15580b2bca9a33ed6bc930a9f4685686aeff3fdcf599bb97f8ba8fc9ed583bba256ecfe85df4e20f5cf4e
TLSH
T1E3E0D8A148DDC1696629605B525B770CC3E03407EBC87A051B0B9C41B006804A7926D1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 60cfc162c90c01a73fdac6aac2b489779204ee65b6f496ff2bc765abefce56c8
MD5 d9d25a549cb63443f4f5c92c41d46548
SHA1 748b04fc716ecaacdd98722e3623ad78937554e1
SHA512 32d47bb8f415b294ec51bcdda9820bed198c74e5ea574a710145f34da4c1a8d5ac9e9d9d6098024f806694206a2611de9f573a5b5e6388833fce4af39a7cf293
SSDEEP 192:DkPNTi1pja5qCfvzxVt57s4G+GjSPhxq2z8YyT:DkPNTi1pja5qCfvzxVt57s4G+GjSPhxu
TLSH
T1B2D1ADF3C3E9862DCD1196F0AA146F1FCE1D0456436C3D6A89E4AE1BA3F2471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c95bbcbcf1c587deeac1a237b1ccb38427ab09971d2f64d40b21269832b78b3f
MD5 5944dcfcf8f60b736476df843ca65c91
SHA1 2d01bbe96cac822c7dcccec735a28c3af8864dc5
SHA512 f8f7b00b8da52640a76164e774d60c764fbf0358fe330edffd1469016d6c458e58ee02b2050a58ac70998017ed048621bfa1c2580d3a08e3d436c0289da9fa58
SSDEEP 384:sxRWnai2/fUsHWvXKQ44UP/5GEJ/ozEZ6:sEai2/fPYXKhZ/5GEozC6
TLSH
T1C982D816A9249C7BACC7D518FE267F22D6F810239CD55E4CA6FCD91C04EA6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d465984602bd6eea3cf98c734d6ca4a980eed4f5452189791657b6abfe80a328
MD5 45e0d46caf1a0da1108c0bdc6bb92fde
SHA1 b8fd808ea3a3bddefc909ba2a3ba3e1434d42a30
SHA512 27bf40d8853ab1268e21bdebd33f45570137848ffbd84d0fee70ab563663a457b274065f76708d160927e3b4dbde891af91c8e1323a4578e8e8649823f24f24e
SSDEEP 192:sxRQQUnaRaO2/fUse7KmZuqYWb3On2oA8pJZOlk/g6+WNO/x2q+n/lil5giiYgGB:sxRWnaf2/fUsiKQs4UP/5bz/oO1Z6
TLSH
T19172E916A9249C7BACC7D519FE367F22D6F810239CC55E5CA6FCD91C04EA6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a1219a1e2df2ef627a8bc174b44ab5fd3cda3c9639382be84de18518af2edb97
MD5 9141c1415786e03c6a8b3276364fbd62
SHA1 4d7520c071de51cae20fc0d01b76f4eff9a4883f
SHA512 1df6d711c42c92d55ecaca3f47efa8722062f14c252318e0297636672b51eb6252e8500518286296aacdb24d57fe6457ce262c53bf4445a1cb78cff27d2b1125
SSDEEP 192:sxRQQUndRax2/fUse78mZuaYWb3OyoA8pJZ0/g6+WNP+n/YgeiYgG0IgDu3Tx4w5:sxRWndO2/fUsi8Qi4kM/5g/71X6
TLSH
T1BA72E916A9249C7B9CC7D518FE367F62D6F810239CD45A4CE6FCD91C04EA6EE221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b2d55480ef868dc3caa848bdb24b6ab349f545ae0fb161f3e88d06e4616d5651
MD5 5a01ecbca9116f6c05f766323f1fe813
SHA1 aeb1602a6bb996f0733b36b4a03d5f80ed492c9b
SHA512 4a86138e9eb7a5b98eeba4223b27d39ee1049e85039e999895a7b1f1947f71f8915ba96f0d97cb37951389c077f67dcddd4c8a9df1f8d3271ef4e578b57904d9
SSDEEP 384:sxRWnai2/fUstWvq2Q3+f4UP/5GEJ/ozCZ6:sEai2/fFYq2FfZ/5GEozM6
TLSH
T1FC82E916A9249C7BACC7D518FE267F22D7F810239CD55E5CA6FCD91C04EA6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5fb629da7be3235d263588cfdf05aa64dce85a94e3d4f2dd6ed225ef4cdcefee
MD5 43bf3dc5db7c3de89e420f9221b2b871
SHA1 b127004cee82accd4bd084209bff1eb3df5fde62
SHA512 248fa5c739eda75c0d90267f4f7c3cb430c863b83afcfed47ec82ed35dcbaf888a585f7235a48aa55f4e314661609f103c8ee8cf4adb383ef454129cc084863a
SSDEEP 192:sxRfRax2/fUsu78mZuGb3VoA8pJr0/g6+WNP+n/YgeiYgG0IgV3TxJ:sxRfO2/fUsy8Qt8K/5g/71Z
TLSH
T18C52E816AD285D7B6CC7D259FA15BF63D6FC1033A4D06E48E6FCAA1C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 8cf8783c47f2c1812c052f906fd2cf4850ce428f66c59185469c345a446befde
MD5 ccbce8ed9335a3c518df1e9a652098dc
SHA1 d4fb1adcb1f8385bd61b21e9ef845ba1bf3be22e
SHA512 672e52ffa33516e1563720c1b1e8753b81ceb1199e63b2a768136283cb552a35f60dfb861d36580343724a2ca373a222215034a5e4635d558702d34b4f2fc025
TLSH
T17FA0022403C180C7C04656F035D7127122144A50A253278582A18248F9546A555E304C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 ebef7e8fbf956d4ec4436624317289be2937f3781d3e9f178ffa22d8038b49ec
MD5 6e4503a999627a8138766d8e18d17687
SHA1 defda5c68066dc91065362146fe6e6cd14b73f6b
SHA512 663242a48f8350a2113ff2e19d8af5c5074e9cc99594c2f1d2926625196df05a2a353a4628c53281deef56675bd2c921b1d51deb187538d73752fd0cc31e80e8
TLSH
T122A0022A36C14020C0D211BA365741425200C9110109170599A01984CCAA94945C58AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aa11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index~RFe59aa11.TMP
Size 72B
SHA256 337229f71628a745104bfa198670f4ae9cf69bfde7a78d75d6dd58d6d9a9c669
MD5 79c065a47a59f93cb2cb6e22b92e3fbc
SHA1 ef4e7085eeb183ed8d397125c73c8ef41b11a706
SHA512 42b9af09ca4eb9f0dc3d429e46c8dbe8bb22f5a370c4a40b15b633b88d6d71e1edf1720ebc34e192050f0df3cbba57447e4dff1bf667eac1b4e087a235774c10
TLSH
T105A002571780401DC0A311B2765262465602D8282140120781A19484CC639404DF510D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f940d52c-63ed-432a-8611-7a728e14d11e\index-dir\the-real-index
Size 3KB
SHA256 22493613eb91d719c3893956b9d0b25658e9e3121a46103b3b3b5845c8727c8f
MD5 46654ae6a34d5035740ddbd511ccf5a4
SHA1 5016ba7cba956fc9d250fefd68843dd51747bfbd
SHA512 9e7dfb5434a618896de5707900301a04ca00140e75364df55e15334fa6bda6af6667c542d033f97bd77ac42166fb3fcc55aa9b80b7a17e912c4e2ba761976052
TLSH
T1D751F84E8D4A1D9FE9AC14736DFA159433756CEE4B44DD0B669CE1307CD332D2A19101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a26b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f940d52c-63ed-432a-8611-7a728e14d11e\index-dir\the-real-index~RFe5a26b3.TMP
Size 48B
SHA256 5e4f7aaea23672888cac198133e9a7ee8ae037aef00b88c5737373c9b576282b
MD5 beeab02e6ca3ad67343fad84a9dfb095
SHA1 ec4033a04be9d6ab39587148697becedcd50aff5
SHA512 46c73613630f5ec61bb3c8e8fcaa334e4457f328db482c7b48991fb28c1c8ba47223a2f0e15f60efcf74d0578d14a45e1c83ca764d5637a4dd907e66ab917b16
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a8807e58b19c912d022aae02fa6c2b45e42489bb55d952860c77ceaabcfe7406
MD5 2fe18be7faf5d926815eb47b44fb9ae3
SHA1 0d50215c17558ed4d89bb8dbaf1087690e3ce226
SHA512 68627f56f381892d7f8c7c83bb9d60c0414fd802215c5cba10b1dd33b291543ce95d46d2fd2f053c9d6d3df9d173bcfa85053464e4698a3fc278fca88b68ec11
TLSH
T1FCE0D8B629973814ECAF93EA3830A4980241B458D548ED8F251AA6C251F127578ABC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 7a03f13f317a56491ff815082a7b6c95e68ac3332b2469aa90bc353f376c4431
MD5 b4f1e4ab703b2527d86d94e3e5d33083
SHA1 e7d2e4551aa5f343186ab43993ed44124c347793
SHA512 03cd67107f8f95c4117cbe1c6c07a12668aebcb8c9217331c7acb57a487639f0d0c0182751685ca303bca651546768f88602712f90aac65da2f11823a4765a90
TLSH
T177E068B229D33810EDAF93EA3430A4980244BC58C944ED8F250BB2C210F1232786BC20
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 8b6bd805910c90c4b95e27462764e634abe063a7856ac72ba715f60dd23522d7
MD5 c0b2cf55bbc83bb92ee018bc8e3df199
SHA1 1824a49af795abe65d8a1d52e9534b443b9492b1
SHA512 529a1c3974114dd158fd952f2e492048c6ede534ddf4b19dc3aa87db2e49e8fbf8b98b146f7d4d3bf31c2562f032c4809e9f1a8861eacc334f155ad41237d321
SSDEEP 48:F2em5HdYlB26TQj7f5gONTQsqTQj+5gOITQd5gOV:F1m5Hu26TQj7XTQsqTQjTTQt
TLSH
T1D191CCE3CB146053C9C866FB2039F5E4151DDA066BFF87A610BD8F6E52412C63329B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 3b74430d49287bb2b3f7350c7142133ab8ca6d7fa41c75659eecd6bb1c895d29
MD5 0889404d753b5f3c1e8e1973e8b30df9
SHA1 8918a3a4e85b08788c6d1a2c5d9221b9195a6e9b
SHA512 8bc9ed064fbf7c112a77d7782326e648960234f2389c1d87a745ee010814358d6d07cf2cbea2315386abf0193f2e939f8a06c3d1eab133983c8e0354e547f287
TLSH
T1C3E0DFA00DC8C17AA22B349302ADD30CC2E4B40BDBC8BA062F419C84628798DB197590
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bb65ace25d4d3e3f4d98b7f1250dabfb2cf61d38afe2177f534fc61a4e5a8e29
MD5 06637039482a43a46accdedc5b037853
SHA1 ddb638402bb98b8c431962ba600a897ece446aea
SHA512 18fd8353cd82310739133f58b83f39c43ab283722dd9c645426dce151cb50489fd8187b9d931d4682a31e0286dc8f70c39e5694db7df64d6a04fc7d497061b4d
TLSH
T10BA00230DA49D003D81506B05B7A62557BD08CB9421517494A98B5F8DCA93A472D5101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fdaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fdaf.TMP
Size 48B
SHA256 60426eaf308605a26573de3fa104bde596f4a07ba3fb4c387d18e49b496412c2
MD5 25ac297aa1257261b00d4b9cbba7e40a
SHA1 1634225919e512a238ccc8d01179d8b949771ab8
SHA512 838d94cb14fec250363d1d1ab32a541a81c82e646bc2b9600534fc3332757829676e56acdbee5e6c80fe6dcefbd55fa786b4c17a4ead3fe8adb08acbeb4e25f6
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 184B
SHA256 0fcda045d423814bc1b2705c9190b7e76b6a4d374a3038047ebd63e520fd828f
MD5 bad294176fd93eef7f68fb303e85fce7
SHA1 4167f4a9b99c76fad19b19fbb0fdf4ae41d672bc
SHA512 b9d7167f5ff010264850b4e34a68a64673de31fcbdd64d971d161e8f45d2263e350adb669d81ec7eabd6585dedef9b7ef9b2051b57d560b9a30946ee6101bab5
TLSH
T13CC08C283F045246CE8A013405B02F89E318FD0295898623B80DEF620D1E5A82D2BBE9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 7873cabd4d2f4a4cbbf97f8ba15c1e90ad88cd84ebae523ad950da41da8e9a17
MD5 6de77b699883450da2f90f17ef59deb8
SHA1 c7ce87506537e0cda658914d5fbcda9b0fa01260
SHA512 c46f2b2e4c9cc665d6c9c5bae4d71efad2e77b063dbce92139df2a14a64a312041a6d9afefb85c98dd8c9fa8c14f7da65119661ecffd19745e68d3deaacf09af
TLSH
T197E0D8F01EC9C62B665B64D7526DE30CC1F27402DBC8BB253F09D880730B584B287550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 5647232306469bb9be8bd9a2436ae63da2a03022ba5eaf43e0556ba4ff1c82a8
MD5 ec30640275512dbe1704e9aadb6618c0
SHA1 acd5991016dec5db37e3e84c64fd7dbf9d431b0e
SHA512 c8702e78bfc2c89e3890a56cc0afdcf3069b680c579f023d9610120674dc5628b826863456258d9eef3fa1085be0e93d4b53be1a44ecfcb82977282758d7c3dd
TLSH
T166E026B04DC8C63A655A64D342BAA70CC2F078469BE8BA0A5B184840B54E908B3A79A0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0893ba24048c0256f4ae34815df3c743dfdcf893855c28003d8e907e04c4c44a
MD5 139a3840723306693ba395c82e4efa74
SHA1 814f8e6666c04a9e5aa186c20a189b331c216abe
SHA512 c357f5730c63913744c23e14c924fbd9ee83d6d2dfa21717c5fb4fbe3a50517ac0d3800e000b1d2730bf49497b222c68987bc4cc13404d0f53e68ab2ab1f50c1
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYj:C3gFB31lERe1JDggH2vHG5FaHGbqGAoV
TLSH
T177912405707E12C43C7F658C80F9982E93C174A23429B92B7BA912A90F6BE174DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b13780f1af78c5d9291ce6334ea1e269a55666680d69c0533866c7bce2ebc041
MD5 f72547f20cbaef3c951038c207475d82
SHA1 95856b6642b63bfbc458ef3c9a8f22cc28f85b1f
SHA512 224ad01964eba4eab2ac0ddbd82b4a1069d0e658786dda479facfc0b42ca51cb257ff27f7075c91e1b72fad6ac599a3abe5b530da3712832ec5afc9c3f7b3c2f
SSDEEP 384:DNrRZyCSDnxTICQMEhIKyll7svbFKfk7:xFZJSDni8yI1l7svbF9
TLSH
T1B644850A7B747001EDE6D9721CB080771E3C716D8F62A6D16DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb802254-9a07-4c76-bd6f-004459b36f00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb802254-9a07-4c76-bd6f-004459b36f00.tmp
Size 29KB
SHA256 e9113acfc8880d6c6e5f4beeb24ad3badb78cf3ac623f0446d678593abe85058
MD5 358b917659c3f0c644d20c373e8dd0c2
SHA1 d1372745bba9665911a12ad069fcf7e4f75b69ca
SHA512 02d580540e3f06d4eb6f2e4c9c74b8bd9f81ec558a379741fad18c543596fc8d63460b004510b4fca30cfeb332434505fc8197e02bff2052f14eacb853985be2
SSDEEP 768:j26HJP7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVOTBVuwOro9Ie07:j26HJJEf6RWgs2f02u1ja9TB4wF7s
TLSH
T179D2DA7B740DCABE4F800ADDDD197E9F6D6802CB9698CD8047FE941C02C6BEA511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 9ee2cb08474b785d4c34683741f4e849c8b5a35c5e7e507308e9639cbd97e8ff
MD5 dd967bb1b198095571ef56a4cbdf5d92
SHA1 fb763ee66d49a8e1410d2491f6f80409535614e8
SHA512 06f881f7bb918a467f5ee6afb0016af4019fb312682398ef00e5515cdefb471abf7782fae18515e3ace626b151858d1a5b211d400c1fca17eecdb31f45c13f76
SSDEEP 384:6QkIIIbbLMIM2BOCbsNGsXl++mX3+vHf+eHf+bO:6QhoNnXl++mX3+vHf+eHf+bO
TLSH
T14862A5AF22051B73C1AE6B7613769684A7F48C814C66A61D72597C0F4DF3F6386C42F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 702cbd8b191bd9c48647774523baa16145f5743d5c2e7a19ec2a5db71add5fc2
MD5 59ba8f1066eab025723e7d6a9a1ad0a2
SHA1 f78287d0a30225847ca7b7bbc908dc42dbb38dbb
SHA512 ce0b8ab676f7460608a4e317f65360d3ada0abc90d05066a782ce20be33c1f25ec26059948379a20ff209cf06377d5f5c55695bb79c7e71e1d7e3d50dd43ec0c
TLSH
T169E02694ACC8C9BFB65A609751A9534CC3C03903EFD8392A1F01C888B206604B2AB591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 be977a16e4c01bdb642f4f055c0dd79442d0fb72098331af515f4eb61df2bdca
MD5 03b1863659ebfe66e52063ae5089bb7b
SHA1 635770de08efb85b5ce44726cd24e923359d1c2b
SHA512 377b9aeef831d6bebcf53c80a0572a49a4972d050443f6a02cb2123b6718c93dc36deada7ca462eda3ff333f35c2a8ed6dcf7fbd0641506af235986282f6edc7
TLSH
T124210055F330C149E15A863A607F5B361738E8168FBCEC0F84BA20346EB6B040E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 f027d7c5bd8667b4199c79a419ea9a359af2359d161a3c4fec007ef9c448815e
MD5 130e1a426b3888b18982c0ee3c652bff
SHA1 045211f6c59001dc9c851b561784331a2afd36c7
SHA512 5ea8e3405d1e521e911801916796a25684953e1aa98a1982285976a14edb55dce6ef92f56ceea2d8897d868f5b7467ce54e50f802514b6aa1d5872ec95667fe2
TLSH
T1C4E020556CC4C27F555620D342A9938CC3D23843EFC43F152F02CC48710A5817257561
MD5 SHA1 SHA512 TLSH

Submit Download

f1a1716f-03d0-437f-adc8-fa4a1d7c423d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f1a1716f-03d0-437f-adc8-fa4a1d7c423d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 3f36fa7efbda70a752247dba107e59e4d7ec4d6553584545748f87011a810d82
MD5 9b857365b16b828ff0ec8e015bf8dbd7
SHA1 714f965c57aedab0237fcd73bfe770c5fdb433e7
SHA512 d89fa6a41ebb4e44e15a91768f4731d910c90c6b86aadb6d392e705be83355104996d7aa7d04e464244c7ee8acf388ad25170a2a16b4e122f30d25fd8199c388
SSDEEP 3:MsEllllkEthXllkl2zEelNaFzl:/M/xT02zN
TLSH
T1EB44040D7FC41D05D51C10314011C3501F70DC103515DF4734510413FCC7D411C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5e036e2ecd028df5c8137d24e9edc337111be7147ccea4a4769ba5f02797e3a2
MD5 9bccfa96c6c707852c8918668ad6be14
SHA1 504409346aef974159177fc6b0b8800d4f7e48b4
SHA512 789d1f3adf5639f3e800e2c1559f8deb84af650bd5099c3b5184195d707177030cbef91d22890a62302f66ba5e4a267dcebc3e1fc6a6cc669cba5a3a9b95f218
SSDEEP 768:iK3czTTq/TBOWCuttiONXyer1IRCzni9L2ewBKZOk7:iK3cz6eSIqnQ2evZ17
TLSH
T1FAF2BF70E4669D234CE6F396B5467343BEF82073E4C40A64EAEE6B2D059365E170F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a1bca233251483be158fbc232546c35af70486fa1d5c7202d7086dddd76f264e
MD5 2ca8a1381723e020648c4a4e52a371a0
SHA1 0d9fb5928e52bc37af4b25acf236d07ab2f17d4c
SHA512 08c9a5e781af6773074da3cfc2030361b10c5d2e624eda9818d42cfc9b6980ffc03ce742848e35b5f9ae59631011e71fe07dc3f95cbba253ad80a24c69bbc3f4
SSDEEP 768:F23wzITq/TBOWCuttWONXyer1IRCzni9L2ewBKZOk7:F23wzRqSIqnQ2evZ17
TLSH
T1E7F2BF70E4659D234CE6F396B5467343BEF82073E8C40A64EAEF6B2D0593A5E170F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 97dc99d782917d9419428d29f3e4c54a1b601b0d4240431e1e0631b734046ff2
MD5 0dcb2335e3997f1b91073d3b712e9f04
SHA1 aac57bb02ce0cd22b36f09b5da0a0a8aa49e2f0d
SHA512 7ead72b6bfbc2f175d45c4aebe90d6b5597df0bf4461300f995b227fbebb9f46a298e32efdc448e13c9c6f4ad555ea2d16c312efd77926780ac2b3a037eabefc
SSDEEP 768:Tv3ezrTq/TBOWCut8cONXyer1IRCznieRJbDjhz+lewBKZOkl:Tv3ezCWcSIqnPpDNz6evZ1l
TLSH
T18B03AF39DC559D3B4CEAF386B50A62176DF85073E1D80A64EBEE2B1D00B395C630B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d5245f506bfec01f384f4b7826fa67a0061f7d7f5497f764eb2727c512fdd40b
MD5 2f32a2747a785f782564fb2413250737
SHA1 0bf62c41414d5b87ed09f46539017fa8be2fffb3
SHA512 80ba3146865c559ed407e87bd56fce4612f7b291c6e4cf7b9fb58f1c9eb4c3221d85a024eb796bbcf3bfad1292b7b4c889d629f7829a4453e6a4b503d4bf2ac9
SSDEEP 768:uv3czITq/TBOWCuttDONXyer1IRCzni9gECbDjhy2ewBKZOk7:uv3czRnSIqnVvDNy2evZ17
TLSH
T16C139C3C9C655D7F8CAEB785B50E66266DB81137E0F40A64EBDA2B0DC07395CF30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4bd929239417430d52f8d150996cc1a91c0030eff00dde2c0fee6c93cc10d726
MD5 49ac26de3da4af926a1f9a685d5521c3
SHA1 45472496b6aee7dab85c258c0ba6663338578b44
SHA512 056649638a3845c65664caf377f7f91d6a6e11e09292c99086c88e15ef6cf6d57d0fc46ac41f5040b8e690a5fab588ddebee2f751dbb7cf5e5887ad900666091
SSDEEP 768:hrv+4UNbdz33z/TBOWCutsONXyer1IRCzniBeeVH1SK7:hbsbV3DySIqntEH1l
TLSH
T13F03CF36A4A89E338DE2A3C6B14773037FB86057D6840790EDDA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 591a8d4782f7e5580405727c06d932c11ad752698819f25202d4fb8a52c37832
MD5 ae7b5cbc279830a436958c58860518d5
SHA1 6980fe53a4c55f66dbd6670963277776dbf6e37f
SHA512 085e91d49d43450cd047eb4f6a6deb9286582a1a37b294f23f8c6603831db90f148690df9b11c4feee36dd161abea35c08ddeddb97872413817b7f157de09b71
SSDEEP 768:y23nzUW/TBOWCuttWONXyer1IRCzni9L2ewBKZOk7:y23nzVqSIqnQ2evZ17
TLSH
T135F2BE70E4659D234DE6F396B5067343BEF82073E8C40B64EAEE6B2D0493A5E170F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 61KB
SHA256 659582a0967742d04d932e539a3cfcb4960cc785b4f65ce52c8365dcbef7ec34
MD5 99cf15a494d8b0e4327c47c7993a7a4b
SHA1 fa99415ea8f730d3f8cb4cee747d096976492efe
SHA512 841a951cc62dbd9ea15489f06100117aadc2bafdfd372febe23312e4c3e9c88eadcbf99a2a1bcfff5c4454e90b28af96c8b12a8bae36cf21c36f94c65abfd99d
SSDEEP 1536:cv38ziSSIqnltHplv1OIklk0HpDNzjevZ1l:c/QtS5nPHpmI2LHpR32T
TLSH
T1F2537CF988C3897BC89DA387A73D2E0649BCD167B1984894FBD92E4DCC9247FD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 2d17589fcfc340a9f19e2ac9937867e42b3d2b28e41439e7722f9c1bb9b02ab7
MD5 cd4339c8bb57b17782607024ecb0e50e
SHA1 53a6889603511856ea1ceff84e4cb0fd94eb2aba
SHA512 c77ffe051b4e8c86e561eec0aef61a310a3c95228d40bf183dacce0363a2b08f92aa8b4da2562897f89a23289536e80117a476bbfd65d36e8de92057ae2a665e
SSDEEP 12:TL6KeJiEZXiDiIF8izX4fhhdWeci2oesJahvGFUxOUDaa1i3isOmQQtudMzQdFzd:TL6Rj0afDdWec9sJVUOjCGVjy
TLSH
T17392022179352023E8DA0B76B89348D00DFD12AE89677840D9D44D6109A2BC2A6451FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ead2561945817473daf7ff9d48a65153a0bf469c69f019525bd35f35bcda9eaf
MD5 1f595982a363231a1c9a8eca6fc343fe
SHA1 01d067e38d69f499a4842e845dbd5aac9f3b8ce2
SHA512 05f3a8effcfceaa7a6fbc5eab156cdabfe4bbffa8fd5e13f5de78542c2a46a5e00eb44322447d04099db7857c2eccc12b1478b0230997ed7da71fa2f55a3450c
TLSH
T1D1E002019321016BD44513701087171027E1C42512760306441001642C137002D22F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0c36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0c36.TMP
Size 392B
SHA256 a560e96e571c7003a71a68137c1370a4774d5bf21cd5bab0cd034fbccfd6978c
MD5 27ebac690cfa510564e599944b0a85bf
SHA1 6cde005ceb677c2b329985e461187076326d075a
SHA512 2f6be4155ecedffba87a7f423ce7c0e652adff0f42c9f334db427a60205eedadda5674e9e2a8b13ea0f3a4152f826f2c7aee8c744773debc7d433fcd924029c0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fb3790ebb04e7470406991f5c355f355007e01ba66528824a4148fff92a298c5
MD5 cb327fbb99065f0676393c217ea85879
SHA1 281c7e9b2e7a4ae9ebfabd6cbb055d7aa4d66f82
SHA512 edf0fb20c6242c6532faf5b3831477a3e2e50544f1b2728474f03f8dd677df254ce8de90afce87d90f3f47232642570e4eb781c8674ba3ff7f386b1ff06d8890
SSDEEP 3:MsEllllkEthXllkl2zEel7hll:/M/xT02zN7
TLSH
T1D644040C7FC51515D51430704511D3540370DC104D1157C33C510417FDC7D501C11000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce2968e0-f82b-4fca-b0fa-8a86f24d9ceb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ce2968e0-f82b-4fca-b0fa-8a86f24d9ceb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59b349.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59b349.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

c3d5a131-07b2-4ae9-b112-3288749c2e15.tmp

Path C:\Users\Admin\AppData\Local\Temp\c3d5a131-07b2-4ae9-b112-3288749c2e15.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir252_1510682762\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Krnl Remake.zip.crdownload

Path C:\Users\Admin\Downloads\Krnl Remake.zip.crdownload
Size 11.8MB
SHA256 eb56c51797b7746d8ea9de55ee07defb1dbd8d85177a1d473027073e84769fb5
MD5 f4010e18aba4223454e0a4e6f5638d1d
SHA1 9e0093c51b256aebb559dff7232d4de1fa335ef4
SHA512 bc61cb6a06f3f275df2f2594ecc532fe1ddca4bd881a84eeedfede781852384693141a3064fc95d6a3e77ea7bc3778c21695bf79693a9c0b72dae429fff9ec32
SSDEEP 196608:BHjmRIVhWj/eMVchPKLJp+ICQk3ysuH7iVp6R5uC2SBpDUwoiQFtGlqypvgxwQyH:BHj3Vk7cwqJaHrR/2SB1MiQFmZ6ibRb
TLSH
T149C63320731B8546D1C76DBE31B163EF639FF1AE61E0376B9A987B104EC34A08E4A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c3cc4053177eb940295b939207d68b5ac43d690be02df2f32cc50674a567f732
MD5 b9238c0d5b16c664bd553aff41b1c8b7
SHA1 03dc742f2d6594ba3b1b4ddd7476d0a50d8752fa
SHA512 49c86abf779e9c01d602ceac9aa0b7ec7365cef39253ede09a2876b699f976ffa8cd63df2f001b8421655fdc6a0de252e9553944f5fd9ac61b05974030986c7e
TLSH
T190D02B36F5410BF8C81538721133F04C2110E84F81454243F9BA9F6E0A844F40943543
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a2400d0834fc89ccaafc8536203c58ae0aa2881c659271979b76dcf1123ff480
MD5 cc245fce717426ef96cd333bf72ae866
SHA1 28daabd73f1f5f3c95d924685c408e265d83bbd9
SHA512 97f34fcd6d914af08a1111f1ad27c963d55d64c89c099e852e203ce7ae08fcfc383c7fb9998c0f586d2156469c4dc3ad9bf432b991f1d0eccd727d89ac7fc769
TLSH
T105D02B32F21147F8C41528720123F14C3210E40B81454243F9B6EF6D0E848F40943483
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 07a3be48f3bd7efe41dc4bd8fa9016303598b2da39ee2ba4035330e58ae86b09
MD5 51dcaad1f20fe7da482b79a263b060b4
SHA1 a710f5ca2a6159f8dad8572b1e53c72eff69ca2e
SHA512 733080e1b3305985ac5d49bf28e390a692d718b05e1e0e1eda2dfbf3c6820233a5aa8d4cbb97f9405278732bc5d6c80c58a32cf71b0dafcb5e8a6c300d3692cf
TLSH
T1F8D02B6623350330C21035334183E54C3200C01F408781103E35FD5C0EC18E10C82842
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000006
Size 817KB
SHA256 d7adf511d77e673659ebd768c5540b834f6819a6a07b60c18599b442b36efd26
MD5 ba3708455590abc3d0db5125037fc596
SHA1 08e491bf4c0c4953f996d2c7d9aa6e511d13ad78
SHA512 5d78f9d1bd9a88fcc9849e671be9b75be8adf9f153315abf9030b7b17c1a6a12389c16af40311a548f339fe8231d79bd0e61255eb9bcbbc48acfefeea7af5a07
SSDEEP 24576:wVWhDuiDlJH8zIY3AFa6N9DBeKdek2bJVqbbQ:wYYSbcE096DBeKdek2bXqw
TLSH
T1CF05332F13A6FAE12609E4CE21D29CAF29595443F45BBE4D4F8B0F9DB2424C974F1C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000007
Size 18KB
SHA256 8230d15614bcbf922cd05a18d130c21ed4a563f18823d338bf4c8ec0d9350f1b
MD5 74ef53e412efff0eb812cbf2078b8d38
SHA1 e2082e8a3279f0a585f809ae0f44c8cff0389041
SHA512 36fb709e8d5d3e8d1428c0d7cb6670cc2d445d63a4c4232b83f4573a8283dd3fb065ce35cf74d3d1ad1f8cf4e23cbf14c9b90bf251745ae7c7508dc1839f1fb7
SSDEEP 384:Gg03OmbaXVG2GXjENS714+g8WhpQ1m6IGrtzO3czb1wME52q8:LmbWtaj+S71pupQ1m6I0cczZwrsq8
TLSH
T10A82D066B92F689D2BEBF5B7840D78428BCECDC175072097D9A7393D404086C6BE640A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000008
Size 20KB
SHA256 13cb396994b0fb7cbb24d9040fbafaff4abbfeb30a6e1fd8f3ccc4967343197c
MD5 0d26339d3fc31bdaa583b125bd08f6e5
SHA1 072ffdd05dde22513881a81d82389949c438e1ce
SHA512 b9be0fe3d1fdc56a29ac7818edddac5586ae15696fb52a484af9d48f14e76f036e4d692dc8ceb1b3febb4b355f9eea00e8295da24e49b7c09360d5b063efa49b
SSDEEP 384:Nw866FWJMQLZe9kgqPQazdg1E3aBgPVoIXrfwmVMSy/bJxtj3Tj:G866wJMOZe9pqNBg1EKuh1mSy/bJxhv
TLSH
T1C8A2D004367C92116558F093CF3899FADBF298D992DC795B02910F52EC0B7E843A3A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000009
Size 100KB
SHA256 b731dfa0123900f4e1d66b1ab0433deefc7fbab3a290b165879ff5c8175a8355
MD5 2b327c2b9077dad07f6392d0733bf49b
SHA1 7a691467d4c283785a2e8fe440fb189ffcffa5e7
SHA512 de823a2386f22c03517a9a607b65d90ac0dc7dc88d3184aeca4ade003cf6c27f48422d647b9600d0e76d55f3500d6c349d0e867bb9059a85869d87cccc21a986
SSDEEP 3072:S9Pk0roru9hKBQypy1jR+6sOXotMvkXs47DrS9:S9PkW0bQypy1jWiotsss0u
TLSH
T11CA312E49C6ACCEDA58C1D654D180221BEAB82CB1D574E1DE0FEB904EDF6D1B42F58C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 338B
SHA256 a20a55407dfbe49309b91b76e4f2f89d7b0b8530d07f3c1e1218672b8c6185b0
MD5 c3a4db332d13115de0d2ba0bfd017058
SHA1 d7ca445eb0f9ff5d7fa9ed6a6b4973d2c6dbc108
SHA512 79eb63e0f16a66a7f0415d410c1d49b8a30e99cb1f812cf6b2a6ac5bc88ff10d0f7d50fbc44ed2c9c801efb69c9b0db8dfe8d146c7ff8b5fcd08fd73facbf821
TLSH
T1EAE0262A81703AFE074393E466287837CABB0083429CDEA4DA3C7F6A53F1078941581B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 7b8dbbb1914a46430a562d0f96c6cb2fb17a1c1a36c1d13eed607c4de7793af6
MD5 711a465ff3577558ad7a03a9e6c7234a
SHA1 49845597432dedfdc039a179536587b8a5f562de
SHA512 8c60a06258c1a5c477dadd1366547e2da6540bc9c733408c379c8e851dfe77007a218305ed5ef9b56f87f133773d1d269a768defb317a90c87343822e1906df0
TLSH
T1B1E02663807AE47620B8593A1940BD416EBBF53A4942ACECC763827CA1A08B76623477
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Preferences
Size 11KB
SHA256 349d866c24468b7c9359faceba1c1fb192a9bb9fcd19155d0817dfb56fc4167e
MD5 542126108a1ff1ec926b4229247bcfe2
SHA1 f20cc20501197d81160c9e485604b2dadab416d2
SHA512 8364681d0f28e552f63c7f6d8443eb7d15b5cd5eb85b2474d3aa6655d4792664a49fe0d02d7718ea81855f00a7a6913fa50aae77d1e3881d8c4af8bcdf864e04
SSDEEP 192:sxR1CTNin0zkJMNc6+WNZW/3gl8TtR8LGL3N7:sxR1CTNUyN9g///8s3N7
TLSH
T17E32C51BAD24983BACC7D118FA66BB52E3F9503365C15F1CA7FC4A1C15EAADD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Preferences
Size 11KB
SHA256 fc89d490401c09faeab6b2b10e5fe8c85121edf984f48878754bdbbcfb62631d
MD5 a7239040a5ce6cc5116b02e46f430066
SHA1 4ad24d21c7b0b645eda82cbdbded9aa6509c5661
SHA512 1008a5acc7f1b266b957617c59498c4732afa02b4c7620c3d7161be87f2d6e4d1dea9a0e51e74f22a44a7a786a0c7c0e8c34d24cde7bd2d73ec49b52027bb112
SSDEEP 192:sxR1CTNzn0zkJ/Nc6+WNZW/3gl1TtR8LGL3N7:sxR1CTNVZN9g/+/8s3N7
TLSH
T11232C51BA924983BACC3D118FA26BB92E2F9503365C05F1CA7FC4A1C15E6ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Default\Secure Preferences
Size 9KB
SHA256 057967155898a34c23e8277c3916f58e93935b7175c33f0b4f5088ec4151c486
MD5 141df10acd92ff34f1384f98a7e363d0
SHA1 fa7d3d1b201aef8a6e84199f59dd5d7e5788bc11
SHA512 18c7e373fcd4a58d20bdfd41e1745197f5fc92637c8c1dbb4ebfea1086a8bde606986fdfcaa00ddbf3ed131c02fae2823dc3b7d177cacaefbd1cf7d9b4d5222a
SSDEEP 192:ziv6V9lnfB8TPDCrusEZgRSUGHhIdYvqGoAhRoKVung6KiAbI+F:zrV9y2JaKenandD4
TLSH
T1E7122AF7482DC9355F0956EDDD3ABAC7C85505DF86DC1C0992E7C2480682BEA30DA8D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Local State
Size 19KB
SHA256 ac1c76fcef65afe4dfd9ba1d6a88d0dc7bdd1a7a223f45399768ad69ff8a47d4
MD5 231b5a8ad1dd5a7c6a1fb427cb8562fc
SHA1 e23b9217638b7c01ed04da0d5fd61ce73744e874
SHA512 6f46df791913b09cf3afb8898dee3ccf20c86e51e33cd33ff16004781f1782952ac99e06aa8e01b2ff0b63a099ad657979f7631c78c0af83c16fc7e82c585c63
SSDEEP 384:zx+aQikB+z/xvxjg/qhEzNmFr2TA/IHAVdpMv9zz:A/UxvxjgC+zc/IHUMFz
TLSH
T122927C26E469AE33A8F3D645BB596B87DAF4846285C41EE48DE95F0C06C73EC1307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Local State
Size 10KB
SHA256 b260ee0f57b643d6319f90886b020203dbad343e0c5e35199835c5408535e6b6
MD5 2acccaca0796f305bef8a46b8d14c7f6
SHA1 be592afcc098858f78c2640553707272b710be25
SHA512 eabbdb2a2933c3f53c42f8c7cbfbde0656e8d8974b9ee9ceae014854b49dca368ecf15ed2fa713bf95f048d960357e435e47744cbb956bb8ff711f5a7fc5b240
SSDEEP 192:zqSSNWMsnMcPPQLz3XX9VoKNTiR0EcTqmiU5H/24Ai5IT3:zRtNn/s3n9SKNm6rxvAHT3
TLSH
T1CB22F822E965AE375CE38689BA463F4BA6F1425786842FE4C8E91F0D01C739D1347D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Krnl Remake\krnl.exe.WebView2\EBWebView\Local State
Size 12KB
SHA256 3f7dd4cd2ed7bbc5eb6a6d6f55d6af2e721e1f711b951ac4739571aa8597c2e9
MD5 29bd76c20d76875b79a61f9448b43537
SHA1 94812ca0eee8a0fd9d8e2104e05d0ead950967fc
SHA512 10cd43d51f3108f4e31344739221484169d36424160376a165c7f99c5f5e72f6efcffc7755a717a70d44756d90440fb939ede8bee99874442090d342600539c5
SSDEEP 192:zqSSNWMsnMcPPQLz3XX9VoKNT5RAEcFEmiU5d/b4wYiEHifRshEhw3:zRtNn/s3n9SKN9S37EwY7uje3
TLSH
T1FF420871A621AA27BFE38AD5B6537A46DFF05157C5842E94DCDA1E8C0C8B3CD13C3826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-1642-0x0000000001C10000-0x0000000001C11000-memory.dmp

Download

memory/1316-1644-0x00000000229C0000-0x0000000022B0E000-memory.dmp

Download

memory/1316-1639-0x0000000000C70000-0x000000000114A000-memory.dmp

Download

memory/1316-1640-0x000000001D180000-0x000000001D544000-memory.dmp

Download

memory/1316-1641-0x000000001E490000-0x000000001E6A8000-memory.dmp

Download

memory/1316-1647-0x000000001CCB0000-0x000000001CCBE000-memory.dmp

Download

memory/1316-1648-0x0000000023320000-0x00000000233C2000-memory.dmp

Download

memory/1316-1645-0x000000001CC90000-0x000000001CCA4000-memory.dmp

Download

memory/1316-1646-0x0000000022B10000-0x0000000022B4E000-memory.dmp

Download

memory/1316-1643-0x00000000208E0000-0x0000000020938000-memory.dmp

Download

memory/1640-1751-0x00000242FFC30000-0x00000242FFD06000-memory.dmp

Download

memory/1640-1692-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/2148-1860-0x0000000003340000-0x0000000003354000-memory.dmp

Download

memory/2392-1785-0x0000028F13620000-0x0000028F136F6000-memory.dmp

Download

memory/2392-1701-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download

memory/4688-1884-0x0000023B0E650000-0x0000023B0E726000-memory.dmp

Download