d1b4a8db540ce080d639fcc8339fa63e803441384d0f7828c01a8e95b9a1d387

Analysis

user interaction
yes
max time kernel
447s
max time network
467s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9f598a-AddonWeaponsBuilder-1.2.zip
Size 16.2MB
Sample260802-vpgm5attev
SHA256 d1b4a8db540ce080d639fcc8339fa63e803441384d0f7828c01a8e95b9a1d387
MD5 be2cfc78d9dd09937aab4c0d1d023f43
SHA1 e2d0a2e01c82239c01ad02cbfe3c3426d1f1fbb4
SHA512 17f3d93ee199c5049442954aae79425a96540af0e9f3512067ea1a27f0072644a601f80caced3fa3e9e3f5e9127c27df0785c9dda80ed4ecdc352ca6a1948585
SSDEEP 393216:DfkfSGJ7qItfcrNfzyeSuhHY27AD+7ec2fE7onLjazbgP45RFVapAWI4nFGzPLjf:Du7Y0fc13+oAD+7ezEo0PWIJz
TLSH
T1CA0733BEC59809B2CD47433194DD1A867E6E7B022A02DCB33465CB62516689CFF3DE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
177	raw.githubusercontent.com
187	raw.githubusercontent.com
176	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8004_347352727\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1395762996\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1096303317\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1911647492\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8004_347352727\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_343548853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1395762996\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1207224615\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_188312518\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8004_1038458301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_343548853\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_270097599\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe
2360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301642896996789"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	AddonWeaponsBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AddonWeaponsBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 040000000500000002000000030000000100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	AddonWeaponsBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\MRUListEx = ffffffff	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	AddonWeaponsBuilder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Documents"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	AddonWeaponsBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{E9AED76C-96F6-49F7-A66C-25021F23C4F7}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AddonWeaponsBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\NodeSlot = "7"	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	AddonWeaponsBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 02000000060000000400000005000000030000000100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	AddonWeaponsBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\6\NodeSlot = "9"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\0	AddonWeaponsBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	AddonWeaponsBuilder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
5820	AddonWeaponsBuilder.exe
5820	AddonWeaponsBuilder.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6376	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
3264	msedgewebview2.exe
5068	msedgewebview2.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe
8004	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5820	AddonWeaponsBuilder.exe
Token: SeDebugPrivilege	6376	taskmgr.exe
Token: SeSystemProfilePrivilege	6376	taskmgr.exe
Token: SeCreateGlobalPrivilege	6376	taskmgr.exe
Token: SeShutdownPrivilege	3340	svchost.exe
Token: SeDebugPrivilege	2180	AddonWeaponsBuilder.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe
6376	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5820	AddonWeaponsBuilder.exe
6376	taskmgr.exe
4460	SecHealthUI.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 1104	4316	msedge.exe	93
PID 4316 wrote to memory of 2868	4316	msedge.exe	94
PID 4316 wrote to memory of 1132	4316	msedge.exe	95
PID 4316 wrote to memory of 1132	4316	msedge.exe	95
PID 4316 wrote to memory of 1132	4316	msedge.exe	95
PID 4316 wrote to memory of 3856	4316	msedge.exe	96
PID 4316 wrote to memory of 3856	4316	msedge.exe	96
PID 4316 wrote to memory of 5056	4316	msedge.exe	99
PID 4316 wrote to memory of 4276	4316	msedge.exe	98
PID 4316 wrote to memory of 5056	4316	msedge.exe	99
PID 4316 wrote to memory of 5056	4316	msedge.exe	99
PID 4316 wrote to memory of 4276	4316	msedge.exe	98
PID 4316 wrote to memory of 4276	4316	msedge.exe	98
PID 4316 wrote to memory of 1812	4316	msedge.exe	100
PID 4316 wrote to memory of 1812	4316	msedge.exe	100
PID 4316 wrote to memory of 1812	4316	msedge.exe	100
PID 4316 wrote to memory of 792	4316	msedge.exe	101
PID 4316 wrote to memory of 792	4316	msedge.exe	101
PID 4316 wrote to memory of 792	4316	msedge.exe	101
PID 4316 wrote to memory of 4520	4316	msedge.exe	103
PID 4316 wrote to memory of 4520	4316	msedge.exe	103
PID 4316 wrote to memory of 2792	4316	msedge.exe	104
PID 4316 wrote to memory of 4588	4316	msedge.exe	105
PID 4316 wrote to memory of 2792	4316	msedge.exe	104
PID 4316 wrote to memory of 4588	4316	msedge.exe	105
PID 4316 wrote to memory of 3604	4316	msedge.exe	107
PID 4316 wrote to memory of 4488	4316	msedge.exe	110
PID 4316 wrote to memory of 4488	4316	msedge.exe	110
PID 4316 wrote to memory of 3520	4316	msedge.exe	111
PID 4316 wrote to memory of 3520	4316	msedge.exe	111
PID 4316 wrote to memory of 712	4316	msedge.exe	113
PID 4316 wrote to memory of 712	4316	msedge.exe	113
PID 4316 wrote to memory of 712	4316	msedge.exe	113
PID 4316 wrote to memory of 3140	4316	msedge.exe	114
PID 4316 wrote to memory of 3140	4316	msedge.exe	114
PID 4316 wrote to memory of 3140	4316	msedge.exe	114
PID 4316 wrote to memory of 4464	4316	msedge.exe	115
PID 4316 wrote to memory of 4464	4316	msedge.exe	115
PID 4316 wrote to memory of 4464	4316	msedge.exe	115
PID 4316 wrote to memory of 4620	4316	msedge.exe	116
PID 4316 wrote to memory of 4620	4316	msedge.exe	116
PID 4316 wrote to memory of 4620	4316	msedge.exe	116
PID 4316 wrote to memory of 4544	4316	msedge.exe	117
PID 4316 wrote to memory of 4544	4316	msedge.exe	117
PID 4316 wrote to memory of 4544	4316	msedge.exe	117
PID 4316 wrote to memory of 3088	4316	msedge.exe	118
PID 4316 wrote to memory of 3088	4316	msedge.exe	118
PID 4316 wrote to memory of 4260	4316	msedge.exe	119
PID 4316 wrote to memory of 4260	4316	msedge.exe	119
PID 4316 wrote to memory of 5300	4316	msedge.exe	120
PID 4316 wrote to memory of 5300	4316	msedge.exe	120
PID 4316 wrote to memory of 5300	4316	msedge.exe	120
PID 4316 wrote to memory of 4612	4316	msedge.exe	121
PID 4316 wrote to memory of 252	4316	msedge.exe	122
PID 4316 wrote to memory of 4512	4316	msedge.exe	123
PID 4316 wrote to memory of 860	4316	msedge.exe	124
PID 4316 wrote to memory of 860	4316	msedge.exe	124
PID 4316 wrote to memory of 2968	4316	msedge.exe	128
PID 4316 wrote to memory of 2968	4316	msedge.exe	128
PID 4316 wrote to memory of 2968	4316	msedge.exe	128
PID 4316 wrote to memory of 3140	4316	msedge.exe	129
PID 4316 wrote to memory of 3140	4316	msedge.exe	129
PID 4316 wrote to memory of 3140	4316	msedge.exe	129
PID 4316 wrote to memory of 6128	4316	msedge.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\9f598a-AddonWeaponsBuilder-1.2.zip
1⤵
PID:964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff914c1c188,0x7ff914c1c194,0x7ff914c1c1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,13136465715933428253,3664910193034531724,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,4994997037000795017,10216161857532068618,262144 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,7852442158841905574,16629778174422695756,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7506286839661335890,17386064156945756317,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,4717899409611789042,3627543267841743477,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,15029158450708226322,15058975908914718824,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,9647537234053978091,18027123062378426582,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,5016473617154104056,14864314767982229940,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13618854799192193686,13839285338914301332,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,7094738303999702363,16110967643263652650,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15961523948667419941,3108249535925309472,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15961523948667419941,3108249535925309472,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,5345850487444761368,11184791292859702684,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,1772515764267255352,10006896595041315445,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6748,i,17422085711338303508,14650859308920147165,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3892,i,12442624093132481105,3254940723656900768,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6720,i,5712198958054429687,12524581704776907620,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6656,i,5898865720939974615,15674779646330029200,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6732,i,4330169117724835820,8103910940143918421,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,16334425222250318719,10640783029575543043,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,3402833001239734727,14228954279852448282,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3956,i,5280027864904175779,14080412117395219043,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,17923922275744213340,15057407325855063215,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,9455072887596269128,15680133864254091646,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,7524301829794034320,18293596398872015867,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,17164381839866572862,6128941250556655592,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5484,i,12914073827017958567,18351045248131889772,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5668,i,13252448444151399757,6844178939293794942,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,18038334488714122999,9127661132063810999,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,15217791410469988823,1457695604822361636,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:12
  2⤵
  PID:6868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,11729620708707763958,4120824460830169441,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
  2⤵
  PID:6860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10713680205790854238,10486959501976989993,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7820,i,10369419993123534460,2330060678382204085,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8148,i,7533017031665655080,18146666534237868101,2097152 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1683771872354401931,12791205182134224631,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
  2⤵
  PID:6712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,10506325121274116666,2590567592539305739,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
  2⤵
  PID:6772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,17959976664863605740,13414957614316576085,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8384,i,5084067533755311013,7716624661698373926,262144 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,5641480470793697411,5167814578455989138,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,9083068109414315765,11193402212011643654,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:14
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,11818634227170690914,1564963028663663082,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,18331803330531114722,6992053635006725367,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,1141158232499295196,2152839533178582835,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,10375171845858420916,581053611189763873,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8500,i,18141839910246153730,904171686944667010,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:14
  2⤵
  PID:6560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,15298927593817368487,16530357366827207592,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:14
  2⤵
  PID:7936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3256,i,1444918435969814613,13949493736154850206,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:14
  2⤵
  PID:8028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4130352830854153705,15289176349414535565,524288 --field-trial-handle=2244,i,5425012298928006174,5127002477474187204,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:8004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x2cc,0x7ff914c1c188,0x7ff914c1c194,0x7ff914c1c1a0
    3⤵
    PID:7948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,17418158181237654138,13892083364618048784,262144 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4094795856087937908,6910563406773618767,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,10941376167630630015,9893631271977020294,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1051582263775867801,11357373215705295634,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:8036
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,1051582263775867801,11357373215705295634,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
    3⤵
    PID:7216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4516,i,10697221398356604756,834155073875303229,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14826710942181810020,16853488453992178085,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2125423205752693391,703034323146338435,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5632,i,5884500165247763063,5408227496492072883,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13222220882981739050,758970970440160302,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
    3⤵
    PID:7600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=608,i,953551361990634940,4646769002183681820,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17619039042074935279,3510497203343014020,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,3460095301713775487,5053168355712132054,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6500,i,8934917396527995179,11842700873535625933,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6212,i,5990116339851103633,16509718187668097348,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,7354878754061123220,1251742731674422164,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
    3⤵
    PID:7848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,5990951112201284289,11152622134424769653,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,11382901557019031796,4147844239829480732,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7220,i,9992462434945961725,5937493282439800190,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6996,i,1151870500029923093,2547010257389058756,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7640,i,904381859506377928,11815710015711317266,2097152 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
    3⤵
    PID:6300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,15489188132735283050,12947529888898262510,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:7728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7752,i,9337398708385860301,13085241291668458638,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:14
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,18353420453761121172,10387495133949122926,524288 --field-trial-handle=2208,i,18275409268041559546,401526436547208943,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:14
    3⤵
    PID:7216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2248

C:\Users\Admin\Downloads\9f598a-AddonWeaponsBuilder-1.2\AddonWeapons Builder\AddonWeaponsBuilder.exe
"C:\Users\Admin\Downloads\9f598a-AddonWeaponsBuilder-1.2\AddonWeapons Builder\AddonWeaponsBuilder.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5820
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5820.2724.4913487833913078303 /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView /prefetch:4 /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ff905515fd8,0x7ff905515fe4,0x7ff905515ff0
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1784,i,1850683580462568052,11289730810380959897,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1784,i,1850683580462568052,11289730810380959897,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1784,i,1850683580462568052,11289730810380959897,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2296 --field-trial-handle=1784,i,1850683580462568052,11289730810380959897,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:e25a8bb9cee9cf4374e2f9ea894cab4e5edb50ba /prefetch:1
    3⤵
    PID:2140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:468

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1328

C:\Users\Admin\Downloads\9f598a-AddonWeaponsBuilder-1.2\AddonWeapons Builder\AddonWeaponsBuilder.exe
"C:\Users\Admin\Downloads\9f598a-AddonWeaponsBuilder-1.2\AddonWeapons Builder\AddonWeaponsBuilder.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2180.6496.18406693999391475041 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView /prefetch:4 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x50,0x1c8,0x7ff905515fd8,0x7ff905515fe4,0x7ff905515ff0
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2516 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:7360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:7804
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4364 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4596 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView" --webview-exe-name=AddonWeaponsBuilder.exe --webview-exe-version=1.0.0.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1772,i,17579709053390318928,7534199528262887085,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:ea1b825ebb4a84e440aa1d6ed1e048e0ef25b3ef
    3⤵
    PID:7960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b12b6aaacc3531e2606fa5eb280ae4929c75f82670a5fc331990dcf5f4b1e81
MD5 e293a66f886f80f5eeb21878c0c77530
SHA1 3926f358e61777fe2c930dfb5287451f962a40a1
SHA512 dc4bd1283e4faac05fed23611e49d4a83971a25110ee2bb1461701323edbedf609baf8812ae633d8648747b3b817f886edfcd0604af5ed76bf6c8a9f9a75924a
TLSH
T115D0A7A4BE25B290C519503548600600692A46A2396B968660A5941D9974080A297EBF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8cdc7a141ccc835df0bc9f4a1c75d2d72ac92ba2e9da1e1d74c1c896bea62e6d
MD5 027f3abb01a69606a93a664db6c7e791
SHA1 3004dbd04ffd311c598faf69bf613df0f987d573
SHA512 e329373fca2254a1859aa1cd1f9a12e623806e2273ec3311290fbdb5678296ceaa96bd484550673cb49894bd40e603ecd58e8251acbf2624075c9c1be4044612
TLSH
T10FD023B4BE35F2D4C51D503548600610792A46F2356F978760A5941DDD740C0E3D7EFF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

0538c50f-1142-476f-bdc0-3f2697686bbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0538c50f-1142-476f-bdc0-3f2697686bbc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 33ed18da280ba3ba11a52a5bfb7b71d736bfe9b876d451236e8340e2f52aac3d
MD5 8f98a09b3f0c9e8ba32410c8774d75bf
SHA1 d36a767b01337912b1d3ac8d4c56cd7c524a089e
SHA512 156854f3f97754ca6f1f18011cc9a21cca03f69d6e7b7ae968d25edee9e6caa09f6c1a86d77c19566b3fb23be3a925306b11e76b49e1840e2738c4ba7371674c
TLSH
T171E020C408C9C29DB957644B53FCDB0C91D5374A9AC4EA07370498CC78454C07383960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 44b8bb2275db71ebd425c448cc1b910997d9e199d0938a26f3ad48d9b218ad11
MD5 1b3c552bb497abbb8e69d6d6f33b5cbc
SHA1 8cb3cf438268d8bff5b2555856ff57bcadaddc9d
SHA512 522a423d5436dd045d8c7a7de3d6c2f4cd70c873840087e92824ed995e26f4e93104a03c4c808115f97aa2a5644e92006e06c8a77eddef9d9a78d6cf73d694fe
TLSH
T127E020C408CCC22E7A85748B52BC530D85C0764E96D4EA152714884979064407782E60
MD5 SHA1 SHA512 TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 231KB
SHA256 ae98453b4ca38782ad51f1111814a04a1eef4f4023ff278404f0a163c48b5509
MD5 b6a126c228059ed2a04eeea60d0147ed
SHA1 2340708d252e187ac5687738d3019e6911c87075
SHA512 fdef2dfb4bd94046a91007664308d6af0e75a97971b57c5939ea40d25cfd0a761919adda666d802f42d22cf5d1a108bbbc55de82f10d432f0d43f87137a6f5dc
SSDEEP 6144:q+flWoeIOaX0mHi52KJaYeJP3SFoY8d1Da:F1eO0mHi52S6qqzDa
TLSH
T11C34232E1CC8D0C3B34AA444923B0F4BC57F556B63966EF843492658B32AA1F1FD67C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 23KB
SHA256 8af9915f48211dab44ffc7ff31de198caed78603b3c7fb1db3cd5c45c40ae9e8
MD5 1cb903ed6f535d4cd1b66c098f4a2311
SHA1 89bb18d7ae9e43490d4fee41bcbd99ea572ed651
SHA512 c9620dfcc30a7bac559e81a6c9cab6b29438bb9e7d514a86b93a845e249e99369160692424aa1bbd047eb9f125a4f5936589d31c9ecd39a339a8e9930ebf22f4
SSDEEP 384:6p/djkkaKu1IBC+YLNlpk2VicdhCm3mbgxiKl8g4eyqDGlYo8vOh4nib/eVMnb:0Ii/YxT9VJdhCHgQKl8g4eyqDEf8Znil
TLSH
T15FB2E0FFC3A092B317A3C42EE527354448132AE18761390EC692C6F6B0639246CB2B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000105

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000105
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010b
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 39605da05f33f48f7e2346d641f83a4bbaa22fe28ebd6f647f997d78c0ad078b
MD5 6d8ae5db3fdad368261a088830735bc6
SHA1 f86c75ef384569e19f59c4793634172e153e8c7e
SHA512 805a4ebab4e641efdea8d3175fd892b4e1e8952436a7c0ee1bd8f6e6d0115ddd869b1130a23bb904c4edb7ec6b2b7f6200b60dee3d87f0feb219c1aec337fac8
SSDEEP 96:KO/DLBTblxKtakNwSZVgbPqweWZYDDgmgZaG3AHiZSyf5/Ugmv:1/FRwnZiLmDDgmgfQHiUyfetv
TLSH
T12DD17360979739B9FF68A37706D508053A35940DDC279EFA9A82F97134CBFA03E580D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 14KB
SHA256 99c979b11efdef4ea3a5ba7fcd35e21a3b40dd37cf6ad32d2aab2416e2cc41da
MD5 45c80bf44c9bcb2fc55418e61fb10568
SHA1 abc11e5d124bd5be700eb24c24766329232c297b
SHA512 8009db03fb2c01fb670407a681435ee9ddc26ab3dd100edb713df3a68a22cf008b431de723a1236146b503d70c594291110c6440fabc518c0b5645844f3f93b0
SSDEEP 192:Htnu/+UZlr6aDU19vQVIGcgJ/K3oItIN+JEltoRs:HW6auQUgt21I4aliRs
TLSH
T169621B5493A329A9FF78A3B205D548053974941DC9E3EEE6988EF931388BF807D34C99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ac833.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac833.TMP
Size 2KB
SHA256 f636e9e962d5b6941d3416837fa053489a109b40c226c371755ecdbc9dc4438d
MD5 1245a5433c576bd619be19288de81cf6
SHA1 1c2ebb7fe32f1d2f0fe1d00f4794191e3ca1a49f
SHA512 582d4caec84c4bd600f85101f54d261e2ebc2ca1ca9820b8d50c80e4e4e356d29afec363c3294b9a0399d5f7186dcb58aaed3b68495b04eadb5bc585ab1e010b
TLSH
T15251966043272EF1F7A4B8B216D018893F38D06DE52B6E1ED0D7FE3448973602E224A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gta5-mods.com_0.indexeddb.leveldb\000005.ldb
Size 1KB
SHA256 a54c9f1da11d09fea97af16967c3e02794aa71aaed7270a8382f1c514ecc47bc
MD5 8cabc08ce1ac59a406b4a5a3e1a20847
SHA1 71cf1075906ec66b9b078fea7dc7037320b5de3b
SHA512 45e0e2a90181f1ab94a7dfca8bd19695c500fc414b7a52851277a7ce0e208d4a6282beaa498ac83f69a552a712346b8903dbbe32b480d7c7792a51ffda7a6e78
TLSH
T13F111F20E75CE876D9B51F3392EA83D983F6D6886640C7862E64AB194852146A8F318B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gta5-mods.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.gta5-mods.com_0.indexeddb.leveldb\LOG.old
Size 1005B
SHA256 dfedd2c2977495edab33c7e1c3e998776347902830a1e75f04a2fd821eb28254
MD5 a9b2f4dabf42580b17c6e5635f223931
SHA1 ad43b1871b60f70322635217eb4127bd62ff0978
SHA512 160059bf5bc799561b9ea0c03c2757c585f29927dfbe94da998986dbe6dbd62f4b916290848e0bdc6aa5f5a2c16148ac42ff83a52d48c051437744fa07b49ad8
TLSH
T118116D9A09CD4DA058C3D053F42D370584DA704F9BCC9BA8AA36F55D5DD801AE109571
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 fa6fb1e85e6245bccb00362cfc9891dc5a9434d8aefbb016ba8f74e3df4e5fe4
MD5 a9e0d275d2bd280e2d39479d60442801
SHA1 f2f8b6f55cf802805c02e419ace827f0e1e604c5
SHA512 a1fb0c08eba6209ece2c127772742fb5ff07e18f7dd72f2fa5470df534bce272eb7f182146af0530cfb1e27f0391b2d95e86a742ea55045c9be399c627bbc008
SSDEEP 384:DCZZJN82JKNeoG8y9Ww9XaDGBaP/t4iDzLMaJK2wiUpR4Yn/gfMvIHOdRhC8pEP2:13Ca8RF
TLSH
T1C542ABF387E5AA2DD81256F0AA14BE1FCF2D0915835C3C1AC9D5AE4BA3E3831E14574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 8c4932a2fcc57cfbbc1d22daa3072477ee703268fe416a6e61970c9776715764
MD5 f0d72212ef6e10e363a4ce09ae2c3836
SHA1 6065ec975fc1d5686ae72f826b6662fa15783a96
SHA512 8db88620c7249a9403598add18fcd883e2b16c53f4f34d5fa5cb0b259a612cadeb1bf293448fefde12ec779b0850a968e626b88da3ff2ce27b1ff78f00b9dac5
SSDEEP 384:DWtv6F82JKNeoG8y9WwlXMXaDGTaP/t4igzZiSIHjkKQb1XlgzuagdRD3M/7X+p/:/At+ZRJg
TLSH
T12452BCF383E5AA2DD91256F0AA14BE1BCF2D0516835C3C2AC9D4AE47E3E3471E145B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 53660cc7fbb9ec6903761e7cfa68cde26c585307cfeca17e3a508d506656f3bd
MD5 44c14104313827f9452e1dd204a7bb99
SHA1 93fac1da701235ffdb56f24931f07114e34aaf72
SHA512 3abb8b9a10f1bf7d5744b3b35e82f9686c4c194638139c9d3db4645de98bf2410f01c70ba8ea26c5794be090ce89a919c55f5d397a27691fe0b8785085e8ca81
SSDEEP 384:DCZZJN82JKNeoG8y9WwlXMXaDGBaP/t4iDXZiSIHjkKQb1XlgzuagdRD3M/7X+pr:DAt+ZRy
TLSH
T1D762BEF383E5AA2DD91256F0AA14BE1BCF2D0916835C3C1AC9D5AF47A3E3431E145B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 613b4f62a57f926b81490200f51331df05d166fae54a87b9d42176648036798c
MD5 aa8a2cf9f47f894983a7af555573e15a
SHA1 c49cec6057e565228263a3a7644cc89655164e1d
SHA512 61e6d062b567e063e32dd242300bc760e4391bcfc912062a1ac662277b3bbc88b59d90a299f9a6c877fbef675efa422d0c400ebfda4c81885e1d7e4458d6e49f
SSDEEP 384:DtnB29SeRdah1JhZXQR5tok51oXaDGTainIHKQb1XlgzuaJdReCM/IW+p8PPU4sZ:vytiFRJ/
TLSH
T19252BBF783F5AA2ED91156F09A14AE1BCF2D0516835C3C6AC9D0AE07E3E3472E145B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 210B
SHA256 f8fbd8e751faa3dfd05b458da9222d6074fb543a4a6c1f2348d022a0c6bafab7
MD5 22eacafb6741270beaa93b280212bf3d
SHA1 cfdade2cfb359c4ac97a6ccc762a1e7d3956e907
SHA512 31580ad884d6631fc581013297dd612d3998230483947e02b5cbcce2054c65d9ea0a8088aead1d452a8ad7fb4df7722a76cd35938038a67f0979861a2051d780
TLSH
T14ED022B36205B1B5A65C3ED3A0AAFC8FC36610690C02ADD824D0589D0536A7C090B440
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 da89ee7f9518e56814c47c07f3067a355059ea4ce0308f7ae09a60b4ae5b5d8b
MD5 760a62cdb024c38b16250aaaed7617aa
SHA1 95da914d27f1dcaaac7bcaacfaa886557f58be69
SHA512 de36504fe71f261bce9be3b483d420346475aa453f51ab1f96e71236881c23aa870619eb456d0301249fc9ada6bcc04fa8cac0207cc69b8340e3bfcc0ed0cf30
TLSH
T195D022736201B2B6A66D3E82646AFC8FC3A710292C02FDE820D8989D45324BC0907140
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bf0a34a12daabc97d3a9d8afbda81793607a4e6b7b5e5dfaa55143c127e2b4fe
MD5 af1d2f3a9957556b20278406f4f39de7
SHA1 f5e515fc82c91c8702bac8a33cb2e3d440f3010d
SHA512 8a2f9d7690ccd61d4059cfc39f872b7b7c93081360cac3178c90b6c948152a462f69bef067bb786d5777c946c9afa1e04278bafc6f5734370f0e8b26571a36a1
SSDEEP 192:sxRYrScB1s/fdsx0KrjDSDY2oA8pJ1eKL/g6+WNCX8VH7Y/sAWF8FNXyjKTIzRMI:sxRYGm1s/fdsx016N/5hM/stK1xPkz
TLSH
T1B772D65769249D7B9CC6D61AFE31BF62D6F81022D8856E5CA7FCC90C04EB6ED610380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0609d5acadf813e3417476417f450e52a82113fa9d4386816208c120f3d0636c
MD5 d7633670c761c52cb4470ae766f6f375
SHA1 26ed94c64be20363aca723915d7ded1b698b536a
SHA512 d85f21b0a360e7fb2d707a64025235bf54daa0c3e904904f0ffc84bdc65aafaea366b83be75b9d616e377715fb558ca8a47903d878bd18cb46e33e3e6366f456
SSDEEP 384:sxRYDm1s/fdsxfKVH6H/5hMH/sl/LoVcMZxZkz:s8Dm1s/fGf9/5isl/LPMZUz
TLSH
T15382B563A8349D7B9CC6D629F930BF26D3F9102299845F99A7FCC91C04DB6FD610284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f2ba4c09a101f40742c74f2d98427d018571859473fda558347aac4847c9370b
MD5 f1db62c81fb9ac55aa34ea7febc96f8a
SHA1 ec278eb354a4d785fa7ae7e5e9e8099b9e3f378b
SHA512 5160f41c076530331fb5123518254b4edf5b3b35096701743ddf3d5fc55c434419bba51f79e48589886e2e583c509309b34b55af04277ae873d6ae548724aa4c
SSDEEP 384:sxRIDm1s/fdsxfKVM6h/5hMz4Js8iILCUVM4xZkz:sUDm1s/fGf2/5wcs8bLCj4Uz
TLSH
T19182C593A9245D7B9DCAD629F931BF26D3F9102298C05F99A7FCD81C00DB6FD610284B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1e25b505ff061cbc3d65e0b79507bdeb1fe9962f67216096123696c30f5c9d2f
MD5 37b7f62605e3e120ff2658ae18a9c9b5
SHA1 1431e08dd60a162a98e9b5978c5f4546b4dbb74c
SHA512 29d5126e052401ba5c4b2c2183918979d8263868b280915aeba74853ee6db7d7b2bf8ed2ddf66dc5ca729528ebe7c3df72278c8d2660138064054f6bce4e6e76
SSDEEP 192:sxR3rScB1s/fdsQ0KrjD5DY2oA8pJ1d//g6+WNCX8VH7Y/YM0iK/G/IgV3TnBkwG:sxR3Gm1s/fdsQ0O6t/5hM/Zxzkz
TLSH
T15162F8565924D97B9CC7D209BE35BF63D6F91022A8856E5CA7FCC90C04EB6ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 35KB
SHA256 f3cd0786f436112cf845673285a0aa6edf982f2bddce4a7e5431a12b51d9eeea
MD5 7d99e866e3e095d2b56ae1b0416e25ee
SHA1 97a41768096220d32815e3e9853fed0c4c4dc4ff
SHA512 51c46d9065eb093ec08f85cc3edbcdf0cd8a237bc69b61ab8d5794e4bfa4b249bf48da2de13df3bb894b768460d8fb95ebb8d4ab18ca43ecf65bbde7146092ca
SSDEEP 768:sUtm4s/f0YvU4Mnc7WeT+ll/5Yst39L6Iz:7tm43YvVMmW/DYsjHz
TLSH
T1A7F20846A824D86B9EC35D29B83CBE36D6AC106255C5DFDA67ECC91C00DE1FDAB03853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 37KB
SHA256 69ecab42e848e87319d2eaf8f7afd0f0cf1bfc5f63eea18e5d53ac9853ce0480
MD5 84ffb4f3b672cb9aaaad74bac9508fc3
SHA1 ff46fc376e6fddd90e19fe10d6c1c60aefe6061d
SHA512 9e23ccce60171eae6400408ad50aa58b45407aa83d7d58cae65d7b0fb80f3f6e6dae1de560b740fd276a29d79ec026513019dd4d2893f478d78ecf1f3602ca98
SSDEEP 768:shP8m4s/f0YvU4Mnc7WeT+lvHv/5Yst39L6Wz:88m43YvVMmW/vpYsjJz
TLSH
T14A03F946A424D87BAEC39D28B83D7E36D6AC106259C5DFDA56ECC91C00DE1FDAB03853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 38KB
SHA256 d871877301331fe6be75e7701e29b5943492aabff8c1dd8111b09729111dd509
MD5 a7749e78696b4078f19298ecdce27d33
SHA1 bd1dd79c7b3b858d1e2107e04e8e310e0072e6dd
SHA512 35db00d9b27de0777fac7dd4282f126f0d6097ced3db9328cce935466ef697b1b73844fe9870672f2c347206cf6b76436560fef438be449eb9205e109fe9eb0b
SSDEEP 768:shItmus/f0YvU4Mnc7WeT+lrHp/5+st39LaMCbWz:jtmu3YvVMmW/rH+sjzC6z
TLSH
T1AC03F8569420C86B9EC35D28B83D7E36DAAC106299C5CFDE5AECC91C00DE1FDAB03857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 39KB
SHA256 95e3e061f32dd61848c68bc7c410123740cbbc6f3b82900637dfee75f5ddfcb4
MD5 44d3fca4051971a119bcea0c284290e9
SHA1 64ae44fcdf3491b60a1665fc412f35b70f7a7de1
SHA512 d0dbc056b51ad534ffb713a31c89694096ccd3d0a6ca1387aa2d859b904b45ff36e61546b08bf85a175a180170e560ecaa33bae5f8ca7e65d16635e3236929cd
SSDEEP 768:shbtmus/f0YvU4Mnc7WeT+lrHb/5Ust39qs4WMCbWz:otmu3YvVMmW/rFUsis4PC6z
TLSH
T1AC03E956A420D87B9EC35D28B83D7E36D6AC106299C5DEDE5AECC81C00DE1FDAB03857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 34KB
SHA256 d151f9fd239bf9f446ac3aadf6e07422a701b108aecb592aff1905f0b067ceae
MD5 78d757e5c82e171dbb64c0109a516e20
SHA1 354350a40f74d0d96e9bd5cf4fc75abddac10e45
SHA512 0cd39e0e3760d717467d80b1916cfc215f1349913afcde54f81384af900dcf3420f14a8d177b55c7e6219ce47b2dd84aa2ef515497e2643808e3b6b2cac91507
SSDEEP 768:sU7m4s/fUYkG4Mnc7WeT+b0/5Yst39L6oz:77m4zYkXMmW5KYsjLz
TLSH
T1C5F2F7469820D86B9EC39D29B83DBE36D6AC106255C5DFDA67ECC91C00DE1FDAB03853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 5c2a5db6e2041aa068ea09ce5c731eb1270ced43b977eda8ea7a76bb18eedc99
MD5 4cf61e6daf82ed05f5833662bac55658
SHA1 0d2936de8f77e518dd948e0b080894e736fe57c4
SHA512 8568f5afd44868f6480c105a2d09d4d35883a31a05446301af79b99502215ebb97930587b4a2e1b2044d04528aaf1714d2560148a36cf95c10051bcce24609a5
SSDEEP 384:sxRIDm4s/fdsxfKVx6i/5GM19/st395H5vxxkz:sUDm4s/fGfi/5tst39Lvkz
TLSH
T1C392B59369346D7B9DC6D129B931BF26E7F9102298C05F99A7FCD81C00EA6FD6103847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 38KB
SHA256 3734f03611d6ab7511f9e17281e33d31da05497377d063a30cbd3d6ba0ed7466
MD5 9a4d043abfc1c3965126b5cc38194091
SHA1 ec5d52e024ab7afc3b83788b97a3a2f1f41849e5
SHA512 a7a048e9bc16a45fb05af0d170a81ad29c421ed60f81c9d9d8e04f067a38e233b07f9bed125345d95c9a39dc182f498cbefaeb94f77144de37fac63ffd4b6749
SSDEEP 768:shItm4s/f0YvU4Mnc7WeT+lrHp/5+st39LaMCbWz:jtm43YvVMmW/rH+sjzC6z
TLSH
T13203F8569420C86B9EC35D28B83D7E36DAAC106299C5CFDE5AECC91C00DE1FDAB03857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a8f89761bbec64f825f889d24b61424fee580aaccb4e71462914587c9115a236
MD5 b8e7c3bb5dec8d34c091dde445c3d5eb
SHA1 10cb2e0674e630b963669088314d8a9f7baac26a
SHA512 07eafe5a07bc279f60250f288b8cc859ddcce46e58e6207340d2030a62b96df5fd7d6aab0a843ba221ace65946de75d8102a82efe67357b2a076779390c934f7
SSDEEP 768:0UQiKk7pLuLfJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwOVqiroE6M:0UQiKoEfJaWgH7feQu1jaNIq5e
TLSH
T196C2DB7B640CCB7F4F804ADDEC297E9B6DA802CB9698CD8047FA941C03C7BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58ff1461-52f1-44d1-a048-e549f54bb96c\index-dir\the-real-index
Size 216B
SHA256 3c65784fba802135c795b9ac424a313d31adaa0c6659f071ce0ef00dc529ee49
MD5 6c2e60c7208e647164e5deafebd8082a
SHA1 0139de31dc134aa3eb95425a6f68917ce9f5adf5
SHA512 b06ea395f1d513a76d29547bcee549614c82d9e493647923f048571dfb831604b5a87a4e260cc5a5760cfffef5390200bd847362a7b37aceb757591bf02fbf2e
TLSH
T19BD08045EC575569DD1727350477756B233606DD19121F16409D105A76911DC4447505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58ff1461-52f1-44d1-a048-e549f54bb96c\index-dir\the-real-index
Size 3KB
SHA256 c1365cb22035fdc03f503834f2aba6002ea9cfe5a040dda98af95a33d538947b
MD5 adbd04bd393f61ad6ad4bfcdc792a771
SHA1 8fc188c2e51236ad3baff1467b4f6e0152cb4123
SHA512 b1ff7b8e643a2bbf8a3834ef41d4c1d45e9e82445092d6768ad772634c978ea769a04df00341b3cddd95b6df35a7f528a2fd10976b4b1724cd1a9ac8f3f88739
TLSH
T1EA51D80E4D0B7B76CEAD15B328B618C6333624FD46849F07949CE8343CC33291D2E516
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f96a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\58ff1461-52f1-44d1-a048-e549f54bb96c\index-dir\the-real-index~RFe59f96a.TMP
Size 216B
SHA256 80f39568831e25b02db0d387b5b1f0afebbd03c2a2259db13e72e2af3e56fe52
MD5 1cc6d89f798bd9b4157085452dd965c6
SHA1 ecabec2b954cacf7ac9318f40c0da930b9cba2db
SHA512 95c2149c2504424769a120614f3efd40cb57047a25f1bacffed522d188d96648458fd4eacd24ff68baf27a1ff2346140ffa86711e692c363a0a1e9c188ea62f7
TLSH
T1A8D08CDBA892AAB1D92729702457A25E22BB082828216A22D08A581F59F22EC484750A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d14cf11d-cf09-41be-8796-c61d0d15221a\index-dir\the-real-index
Size 72B
SHA256 253f4f83d1c0018c825a7c6bb101b7a08ef5486c79fa029b440d8ce1dc5da627
MD5 62db5d2a3722c509ccf23f2ad6fd4cbc
SHA1 a8b07c4f8297fe366de51d79058864775a83dc0c
SHA512 704127e47a4804cba8b4ce1bfa62d4ade715e8be8ab99bdc00ad0661924f2758cdf7b4f1d91a3e708852946e0af842f2d19e247797a7877866153fba35746213
TLSH
T129A0029483812421C00B9AF025D6214163104E10125353094990306DEA9454B67490AC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dc016d672862d74d10e49d3a458a3026abc3bf48c7073a7760051391828f8a1c
MD5 3bd937a4a0bcdf1f883e87ca6a579903
SHA1 bfb2cb5fb227e0430054da3ebc51b0bc3b778017
SHA512 8e827e7efebfa9727583b74adc75d9bdcb8bbe37cb6e1f2e8e83e71e9571a77d36060f162bcbd1c924622ae9de2987115e4538a34eb3793f1dbeb7d2469d079f
TLSH
T1C7E068BB2DF31850B86FE7D610718050001979589A09ED8E892EE2D760B23162405C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f6b02cfcb003bc26ad00c51c1577de6b2eebf38097811f22f8a02906d80a1ed3
MD5 293dc1a48c69c50d2a133557e026586b
SHA1 9149d9abc5dd9dcce725975401329f0ef63a2455
SHA512 61a28fb83e3b8dfd3115bcc3378adfc99e5490298a2c74f96816223be0b01fead171f1224d804a7c6cde6ad1047ae471e57452ee1f81bdd6c7bf5a2390a55b5c
TLSH
T10BE0687B2DE31494B86FE7D61075805000097958AA05AD8E852EE2D760B23162409C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 79738a44224687a91966c0185cb2e4be826d7346f64f844fecc6595201396cb0
MD5 52310eb1eace1e67220e3ced5044f21e
SHA1 2ade4e491ab2931882177ffe2a36447d8043b190
SHA512 b372a82639eea7635c6ededbcd739b248ff8cada78df99f2633ceb7820081f4a2b01e4eae97a12e9a9cf293605a85691a2f72df868a92e6522073e9067808289
TLSH
T15BB022308C0C80EAC0B80B30B082888C302CAC3C2B0A333002BF80B0FA3CAA00E8F002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f0de8bb72b5620e736b89769382b2321c4d132baa28b06e2647001f98d3bca71
MD5 28d254b07537065e5f4943cb4e5f500a
SHA1 a867d7b70fc05fae876bd537c92c55dadf5d6b41
SHA512 a26e5cb5d03ff4e1e605a57fef69160b3c26ec962d32ed888649a6bcb2a92d978bc9f532b8503e554c658f4d374be15f9c9590c2c94ee8992e89db7a3fbf0963
TLSH
T1D0A00275CE6C91C9C4081271946202886711CE9C6E062F5580BF8254A96829265DB148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f6395.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f6395.TMP
Size 48B
SHA256 fdd0018432b158ea2f31c3cfe7a35ae20dda0809c76c6c6cd234a82d529c2c91
MD5 346be029aa3c9e7eb9ce197a99c37522
SHA1 eedf8f6cd0d311c0f5f348c7ceb96a923f063087
SHA512 11de58e23a222030195b74fde445f36745d17ca2e503b64563b4a7bf8a9d0ecabbc50e3acdbb2e8180b2d43b0864577becb5b253ddb1f0afc0381bd727aafa4b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be270c23b66bc0cb6b503c29315513b8a709f2363b769e310760e3d6b5ab54bd
MD5 460f60e9f922a76aedfca00b78e5c40c
SHA1 95b3e6b8ad956ac478756a1a12639e406b3a6c32
SHA512 39d157a07487dfb7a2db47cca148d7829743ad598b4c3fecc116a0e25ae2cda783d87f53a98e99e0cc4eda02da13d461f4d6a1249dd1fd252a568ace23e0b048
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQWoAKdaCKkAK1imc:CdqjXNn7Oj4XfV+gBkldQznX+
TLSH
T11C91558071BE12803C7F684E8568896F514174D63439A83BB76A50E15F6BE065EFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8183bc0-7a86-4b91-9838-059567198ea5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8183bc0-7a86-4b91-9838-059567198ea5.tmp
Size 414B
SHA256 60e34d61cadc296190149fad08d8c51427dab7049a3254485c7375c9f1cb4076
MD5 9cf2f1644e239eef72c4e222f20008b9
SHA1 fd3bd5f4b073d8253349c1345e1ec2b9ae96ee80
SHA512 fc10bc185fb79f0b3c8ca4759d2e3c8faf79f8c6d24916f79c780749649c70055c7926f4503b9357a17f81b91b62adf9fe4b06461e4eaf519e269b1ab4ec9ecf
TLSH
T1FEE02B65C820DC271CFD17282050464AD799134A27509D9F373D950CCFB1A3741D685C
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5adea9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5adea9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e42e8804d0c79dd1ff1f2e975dd1ce1d46b7b6864c1f9d042054b68b666ecb08
MD5 2b008d736dfe33a5eedd70a3f3a89972
SHA1 69cc4e3e99c334fb6907eb20ce1c451d391b3c6d
SHA512 110b2cb32008353edc60451a2db713185c133ee7285c4e5ccacbbda3f769641065ac068a26866a9eebe7c5644c13cf34e2f3777fdc2426c814ba7e383660fc85
SSDEEP 768:603hqG6+xeDVpK48dHeByERRFzjK3YkCay:603kGUW48dHSyw/qCay
TLSH
T18AE2BFF06C655D735CEBD24A7A837797AEF04123C5C46A28D1DDEA0E44831AD1B0BD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 018b9faaf229a371d5387a0df2f326c2f00da4450158ff367c79587c670dcc36
MD5 afa578e474eec729c1b50f4db4fe474f
SHA1 baf603581e269b230d52e1b88a9672e7f413a775
SHA512 ae8094be846f0515f94c769c9e072a40e8c87636de18de9f362bcb2a01309c8d10128639f13dd74f97b89ebdc86b89f270bcebe889778b34846024c6c5c7c000
SSDEEP 768:gFQn3mwgSqG3+xyDBK48dHeByERRFzjK3YkCay:Tn3qGS48dHSyw/qCay
TLSH
T1981317F098D78976D8AE83876B7E6E4699FCC123B5C85994B3C85D0DCC821BFC706819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 87067ac089240f1ca2bbc7587b1f9e4b8da1987fd1f73eee6ef5e94d373c8bbb
MD5 98af977f897a23e7d172e1a1effbde3c
SHA1 a5d1dc3bce6554511d95d402734b68b7d236557c
SHA512 036ffccfbe612dbc8b1e817b916092f7d3bf3609a43bdcc79c4a5cc4a31fb744af24b8c75be138c9f6988473d2db2b0e105801a151c9fe6a96fb837802727107
SSDEEP 768:gFCQ3RwgiqG2dDZK48dHeByERRFzjK3YkCay:fQ3jGf48dHSyw/qCay
TLSH
T1171327F098D78977D8AE8387677E2E4699FCC123B5885994B3C85D0DCC821BFC706819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5400ddf89fb18ac897c75c3d0f43bc96b56161b91394126d6cc1b68dea4c45c1
MD5 f972b2c0b401a832f972edc738ee5636
SHA1 51c7492f7553ea2139da4b281357e0470f863481
SHA512 6246523baa0cf9f9201fddf5841e07326bdf4cf5663321554118374fd204c2aa3b0e8c355d086ffc68065ebce2be5214ecc0a99ce52692245fb67f5540258357
SSDEEP 768:/FHQ33wgTqGU4DRK48dHeByERRFzjK3TZaW:xQ3MG448dHSyw/iaW
TLSH
T1D01318F098D78977D8AE8747677E6E4699FCC113B58859A4B3C45D0CCC821BFC70A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c7d01d166084340ba93392e0dec92845c2059578b07c2d5fe31b04880618d44c
MD5 b7f701567c948d1093aa3a7c96255725
SHA1 d15bc15bf83d5d86d4999fb8c2ccd539de293bd0
SHA512 e2713995f69a26f5801e3ddd4b8f8f15c687d61786dbfdf2f6d4ff361f04bb0eaa2750316a4887883b07a008aed68baa882a3f90843419bff3ceb143952c97b0
SSDEEP 768:/F85swgTqG3i1DRK48dHeByERRFzjK3TZaW:u5HGV48dHSyw/iaW
TLSH
T1151328F098D78977D8AE4747677E6E4699FCC123B58859A4B3C85D0CCC821BFC70A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b2acc9800179a9c41c1d15d5be5f5395adf531f7fe1d71194f770b268cc3102
MD5 09a88ae8b3a97d60dcc4d35eeedaaf34
SHA1 42f586e32979de50d903977e07b8fe452091a16a
SHA512 c8c79f126949914833a76eea994f4b3aedb959957557ed5d455c4f989fad5d4e791340bc26d5bab1932e12d5545ae9f190824d121b2b9447024382afae63c995
SSDEEP 768:Qrv+4UNbdf3xqGYiDrK48dHeByERRFzjK3YkeVH1SCj:QbsbJ3UGxe48dHSyw/CEH1Z
TLSH
T1AE03CF71A8A85E734CE7D2897683B65BBEF4421386C41BA4C1DD6F0E85874DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 3c5e7790ad2df636a267e0113da595640b2e5b4ed908c6b3fa0b74ab24c8d364
MD5 65138a061e80d40396da25309028b6bf
SHA1 d28936777c4f4d6adea648d773c58b32a9479f77
SHA512 22988ec3c835cbdb8bf498dda6ec983c0746104abaf9602ddb60b07b22ba37d77b91305cc2e3221e5f3b064243e6e3289c41746dcc20bd110e6474d682d8b609
SSDEEP 768:gFRQ3GwgfqGCsDVK48dHeByERRFzjK3Ye0mbrjhzaay:YQ31GW48dHSyw/AzrNzaay
TLSH
T1CA23C2F88CD2897AC8AE6B47673D6E1699BCC137F1A455A4F3845B0DCC620BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ee329f2761ecbf1b7b2f0a994c675eaf6c020c19847f81b7a64863d4ae4fb64f
MD5 ae59f07e1f25d4853d73762518c59532
SHA1 82f7b3b5993bd21cebc9d52e1a90820bf46b4bed
SHA512 8cdecca7e62c43167236d4ea51032ae2c4893ff5c0212d1dd285248b84042e390edb947563dc0989ac665f6960528712cd4f3f7f1e94f924f991405b8c29db40
SSDEEP 768:Lrv+4UNbdf3YqGl4DViK48dHeByERRFzjK3YkCaB:LbsbJ3pG+148dHSyw/qCaB
TLSH
T1BD03BFB0A8689D739CFBD24AB6437797BFF0012385C51B64D5C9AA4E44870ED1B0BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2a22762676a65d3c4923c6ca75ce32510b28e3888ea53afa6f84c4ada99d0ff3
MD5 d6a59150e6da376ad30231fda70ba66e
SHA1 42c56a3a42d58724fc438c2cf8c58389f1a152bb
SHA512 89c0025f151a178c42db06fb8ed8917e0cbd7a8faf6d7420be38b79b7a5f1802185a5c4b9bb491ec98479c66ab4baab2777ceefa8da337ce27f00ce091e5608a
SSDEEP 768:gFHQ33wgcqGasDwK48dHeByERRFzjK3TZaW:wQ3LGX48dHSyw/iaW
TLSH
T13E1317F098D78977D8AE8747677E6E4699FCC113B58859A4B3C85D0CCC821BFC70A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 18dd5ef4ea5eef5bf8cd5ab435b4da20a522fa018faf041126c0eb2677a7e290
MD5 c20bea07fdaf95a599394947af1a382f
SHA1 9d13d1039855ea347d80f53f71489699360d8956
SHA512 e51bcbc32071a4ddaf232e8ebf2bb42456e1510b84c6319eb4d452c5d70b51fd8fc05586ae51aceddfb5730d41c1c1950925692ff070535894d2abfea20a6759
TLSH
T1F3E00213930000CDC454033000D31F21DF93C430015206169F30016C1C313407E22584
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2672e7cc22377c3b37cefd0d234db007727edccc9309050ed9694204b6508edb
MD5 89dcc982ac7aa2aff8b7ddf69b32a957
SHA1 71c06cb6ddc7ecaf077b140a2d73eeffe77bfbec
SHA512 3ab204f5f5d4d3f9fe8a02441bc780b63878a1a2f0a0a58cd8424854edbc4fb04522b68a13fdb4108e542bd340a527f456786f5bcfc4a1cdad584cdec7f603c9
TLSH
T13BE00113D30000EEC858033000D31F61AFA3C43012920757AF30056C6C353407E72A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 65a15b74a038c60b2da67797b5a85da66528dc108fa59cce2987840348e71607
MD5 015a6e0df6ac5869296655917320a4b3
SHA1 9c792e8b20e8a2fb3ba4559e19c605872a11db5c
SHA512 85d5608eefb39f73523c74a532660f512b80b43d29856daae2569ec5141fae8a81d057056ddc6ec2ca7be94d3916003734c4a08b3c0dd9ec5365875ce30a9365
TLSH
T117E00427D30426EED0AC027001D36F76AFA7C47012A70B578F321A6D6C327817F62AC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ab87969af8a96bf1822dd66e56651ca8ec0f394aa0dc2de2c48c2a251f3b39cc
MD5 b094c3537ab187e9ca6bbeb664011d26
SHA1 60cee499b401484f6098cedcebe583e346c5c368
SHA512 01541d6fb341ca1ced415082b65853020efa1491741e0f05cccb977eda72ee98b26151ffe99f8ef64b2dad5f5eace6c43458b71059eee90e69e0e368da3b17d0
TLSH
T170E00117970411EED068037001D71F66AFA7847412A70A968F35156D6C327417E62A94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7fe4db65de15116658943351deadb1a98c7151c6f96d05cc2c85c11c8e216276
MD5 96506edb2ab27c1d47a9a77d2bfcfd37
SHA1 8bcb7da7b148ae7ccbee932c6b8a1d096be92fd1
SHA512 dddf5c13c8fc58343a510b90410ab7357896b5204376d0f8283a6b9b080687f2752ec6d24565d2ea65406bb1859bc8c7a9dd556985aa0400223a1f6cb4c20544
TLSH
T13DE00927D30422EEC4A8037001D31F61AFA7C47012A707179F301A6D6C367407E62F88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 787256bdf9b2cf51a027044ab2de981f1090784122b1ba3a0dcdc85dbda62d4b
MD5 d3a1e040b743842b5a940c0aca759017
SHA1 51c9b466a0dcadec9f7f6e688aeee06369334296
SHA512 db00dbb3720d545ed733686a5fc42cbe0b6d40c8b109e5afc5388e0ce895b73542b42d055125a6754df6f6dc81d1a0e07443deecf4e7687c3d2a6cf4f2a616b1
TLSH
T1FCE00427D30422EED4A8037001D32F65AFA7C47012A70B179F301A6D6C367407E62A88
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5f3b4ccc2056dffe5e7fd4d979bb892498701781201e909aaeeaaf80c37248de
MD5 560c0bd6aa6741e3015634d2595bfb09
SHA1 8a582aad6374581999a725376690c96daa9f6da6
SHA512 1e32b329c13a588c2edbdb6f5283f3a379a409519621ce62a6aaab4dd904f310680642319636628ca6bde53a22bd12e3e0f221019424e750d288fb5eb889a1c6
TLSH
T1C3E00927D30411EEC4A8027001D31F61AFA3C47012A607179F30196D6C367407E62A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a8619.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a8619.TMP
Size 392B
SHA256 a9ead1553134f18af93c6e7990899c8cc75abada7c16e5b3e224545eecfbe961
MD5 1157e2f8b21142a2d1b46baad0f590f6
SHA1 36eae8e6045c34d39bc81ae80f2eecf582dc015b
SHA512 121e2fad887e8e70eb5cd872229c9dc0c9226b06450d751fdfc24c07f9457981de21bc6597cfb325ba1b14f6f6b2ad0de0519c9089758052801efd39cad41444
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 756ef3483952cd4f6f9b80821083dfbdf9bccdec392e28a2854f00ab9fd415ee
MD5 a5d8f3ba10a699f2b50cc8c1ed38bf37
SHA1 6d425c4f51f9dad92dae1d394bd3ee6fc81d3e6f
SHA512 8f5ea964e29453421e34eba8b37e4acc6dc0b4b7c5f89b5fb9aebe6b034a36a6e8a0373193f023de0a7f66ab8862ad8ffd7ce6177cf2d479f623e035d2160c44
TLSH
T1512111E1183A1EC2D5BE0EAFA0872AED50D8D216F1E434791888FD54963E55E215187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7f131d386f527dab6f8a4235038935e733d69317d35dc5eb69c52d96bf5b75d0
MD5 dd06dac0059d3cf25ad6de81afc96289
SHA1 38918b3e27aaa6d6adbeb99998847d2ea5649c09
SHA512 2cfd11f573eb223b18eb9882182d481ed6dbf7ec2357286c8210d4285f689d38e1e6cdce4e81f7880da9e59d1f0a7873374a7a32a0d86f20fb288f86fad7ac5e
TLSH
T1DA2142E0183E1EC2D17E0DEFB0472AEC90D88216F5D434792898FC64963E51D214087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
MD5 a4942446efe6c44ae76e03f049f85743
SHA1 501f2a79ecaee0f14e1e17bbd93516fc73cb8cf7
SHA512 b8cb3908d88cca44b260e44c81f0a093cb6b4c92d9225a93390f336b886fd571202edb51f98654dcb7c80c411f600f090de5af458ffd3adcea3b636210b7b69f
TLSH
T18F1150D14C3A1AC2D67E0EAF60472AEC40C89626F2E434B808C9E854517945E314183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2e6e9f61-aacd-4252-aa8c-baaa20dd9321.tmp

Path C:\Users\Admin\AppData\Local\Temp\2e6e9f61-aacd-4252-aa8c-baaa20dd9321.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4316_937529663\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 362ec45fc72d6f40c8a00498c4c2eaf1593acfaef0521acac639c9a24ab2410f
MD5 fdfa128e0fb413f1433c684a5f1e7b60
SHA1 2e5f9f0fd4381115f08db60e389f105a80971415
SHA512 4a1ebd5270b565eb9499545a11fa6ab67040f215895c110ac367d3ee0f58da11e712087121f64c6825ffeac310dcdd39cb4d774eced6e7b0b093f264bd84f320
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d7cd657ae2f210bd493e6718a7eede243087dc5eda0f49deaf910f9b21b1c85d
MD5 8a5f759e895f32a8da16c03511b1c344
SHA1 a2f21e5de5112c211be12991921de661b83c5d3e
SHA512 8ca9d8ef14643b9f595dde626fa7d00337bbdf386b6cae4dc5919cd7d8d38ee61c418c702b2b838cf6dc7da137b419ac9b744bb768cb2bdfbf40ea4eeac8a332
TLSH
T12AD01122B2028AB8C02028330002AA080A02C20F800A8288E82A8A2E2A080A00E22E82
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Default\Preferences
Size 5KB
SHA256 c9ce80f11adede943b41d2e32aeaf5303034ebedde39e00b07ee747db0945dfc
MD5 fecb07501b3a57fa4501f47e3c2656bc
SHA1 cafcd766ba7c4bc462afd20db1f5345e76d9cec1
SHA512 6770538119b94fff625af3e8eed34a5f0e6fed59ecd8e194ce11e1aacc6fb04acaa87cdba5fb1828c18745e0964b95adc55c531a700f02b3e9b9ff26e5ff8d78
SSDEEP 96:stb5WwQGKvLV35h16ZZs7/x+6MhmuecmjevK+gKn28XMZCB:stbsDR3+sV+FijVKG8
TLSH
T121B19602AE247A7B8CC7E1197E757F52E2F5106275D01E58EBF8961C08EA5DC531380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab5e46c0-e4d5-4f47-bc22-eabe0230058a.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Default\ab5e46c0-e4d5-4f47-bc22-eabe0230058a.tmp
Size 5KB
SHA256 f7f8197c2ae489b395d15f8af30a85fd3c2a06919fd7e63c2841aecec6253e59
MD5 809628d698658f72e057d148c825703e
SHA1 96af4da9c9e7ea64d80b705a783dc842b1c14715
SHA512 949ca06198b636f80c1cdca19e1758a89c7cff30e004eaeac27ed31141fb7e26d838a31d7fd8b1c1e1e1ea04097a5d35968a7b3be7585716be7edd78b3a5a28a
SSDEEP 96:stb5Ww5KvLV35h16ZZs7/x+6MhmuecmjevK+g/i28XMZCB:stbsdR3+sV+FijVMG8
TLSH
T148B18602AE247A7B8CCBE1597E757F42E2F5107235D41E98EBF8961C08EA5DC631390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Local State
Size 15KB
SHA256 718b34be6f6601a5ef463ce8e0c9e850475e517edaf46feebeacaac35e7c44bd
MD5 890ec44fcf49fa1fdb1983767bd49737
SHA1 fad1eab4f9dd3e6ec44910309fa242e2b00c9384
SHA512 b6e96732c1e0b1d6fd8d041ef52b91fd825f4e13e2b145c32ce9778fbfb0d834538b9d8be9c06a02e2a932e76c8cea12b706d7135b31bcc2c995046cdd468485
SSDEEP 384:r+aQikB+z/xvxjg/qhEdNBSlHtNCAVdpzqH9zA:K/UxvxjgC+EzCUzqHFA
TLSH
T1BB729E37A8693E33A9F7EA05395D074BDBB594B350C12EB84AE96F0D06C72E81343C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Local State
Size 2KB
SHA256 07a06c4a95d2d2b27a21d601f2642a3b3b44d26592d6d04f2679481325076b9d
MD5 14d2c7a80cc0f55b680c9004b24372a0
SHA1 21ffafc7546ba7d9e663a4036e6fb4d4e4f1a024
SHA512 45cebcd91b27ba0faa18161ce19cd3315e3582ac43f592df63f621ef62d416dcd0b75a64c16dbb9fcb0ed0f43f0ea6a4f4e28d95be1ec84b7261dec4f811b572
TLSH
T152517433A819BF37DDF29605794A3E23DA7690A2AB511F6097DC2B0C00C665C5347D73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Local State
Size 3KB
SHA256 d012fedc45dbaf5943b77995010639e2811dea674048d52265847a1e99c2d7bd
MD5 c6056eff9c5587ef1bbeb6fb602793f2
SHA1 3df189effe41c699d9a73ddd3d38042f6e9ec2b8
SHA512 1a6ac9a9e324243d9fbf072bdc26600818c2fece42622cc66738bd8ce9ddbbf86b901243b6fc90eb076e2fbc4e444bae457c96f351e65c405dc16a863704891e
TLSH
T114617337A965BE378DF2DA0579862B16A7A65027E6912FA4C7EC1F0C01C76981382D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5e2da5.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmpcmfkg6xi\EBWebView\Local State~RFe5e2da5.TMP
Size 1KB
SHA256 2f255d752837f3af5783d6b65abb8f7dbc8dfaff625e18f12a7b99dac26582c7
MD5 a39b88f5a825964b5feb814842ab43b1
SHA1 5aa14eeec05034d136f7168efcb1bdc4e628332e
SHA512 95a937aced63693c4d8ad0406a4231602e8645a9af54d1a1f1317056cb4821230a4ecc369c677d1867982e2b076bc16954723301d6d01a05dc28bdf74a7b234c
TLSH
T1F1216233E5596F33EC91A20631422E17AE32507B83504E5093DD6B1C05C659C8BAFE33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4a5975ed5afde22896ce805d5c38ba56fca135590ab1314f08d56cff094e1c79
MD5 89731f34ec8763452c1d35aeadad15bb
SHA1 33571f5043dccbbaa87ae5c58d559726b1a6009e
SHA512 972badd16e18ad70163e83abe180633ccf152466e6a0113897778f75b621c32e2ec136bffc962b0c7404795ab786b5995879142fd1228676dadb322c76d15ede
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4a007e94e83739351eef3732a11b27abf195dc1883e430885e7332cb45396d1e
MD5 bd409a7e27a0fbf94e3f849c6a50624e
SHA1 8b3b8a9ce0a1d060fad3e2452bdb884a975694f4
SHA512 0e68a68f801665f013f6dc6169af321463879fdbbe2549714e7c160d0d8c2dabef779e57101090131b34a3419a300e04b3fba6c03ba6e8b9f2de6d3ea376a9f9
TLSH
T10DD01223B2010234C41030330542B5591800E11B414A4040B86DC51DDA880949902491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fd6f2b6b57814ddd066889f24392c116ffed4f5334807101e1dc4c72c4bf18a5
MD5 a2eddc565e71f95c7c2e6a9bee24868c
SHA1 e2934a0d9d45681e112d9696a521319590ca7f2c
SHA512 5aa691bf1ad5a2d466976111000cd473e260d1c2cb43ebc9036e7e8229c23a55250b3b2ceb5f2ad69e96e6eb383d9c9cf5e8a2400f364af518bf019a7242483c
TLSH
T1EDD02B7362150630C614713345C1F5A82400D12F014B40407F7AF91CCAC40E14C81881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

724b61de-2539-4f5b-85e4-1149106984f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\724b61de-2539-4f5b-85e4-1149106984f4.tmp
Size 4KB
SHA256 eb119389c216dd0e8f252b71757ca2543f0e45bcba5746c9138697adeee13af1
MD5 83e222e20668a5321e0a54022b71fc35
SHA1 762c47e35b783794ab8d4c9cbc4dad60479ced34
SHA512 63fff757996bfcba612b0391d0d7eb677156d2e4dea7ee961903adfb826761491832d34c31b25227c34d67200afe85f695079d27803add408120e587ba9d6ec1
SSDEEP 96:stX5WxuWtxLW35h16ZZs7/x+6MhmuecmjeuK+gA628XMZCB:stXs17K3+sV+FijqnG8
TLSH
T1D9B1A802AF24797B8CCBE21D7E367B52E2F5106235D01E94EBF8961C089A5DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistanceHomeSQLite

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite
Size 12KB
SHA256 1bff58feb2b1cb1872f87d9b74fdaf4f9c8c03e74f68548a20e395fa83689982
MD5 a463f433b90929ce7fd01690e65d0307
SHA1 e9b440e30ba07b97aa2181e5df5935ba6cac9c81
SHA512 f47456f054ee011bd36be7e023dac35df208c18361d3e83db47b4fe6e11298e3d7bf0107d5d86438dbb67c1f4d7d96e9b68b5e7b422e8d93a604f42be333bb91
SSDEEP 6:l9bNFlEuWkk3LH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkKORuHEyESeXdwDQ3SOAtD/ie
TLSH
T11842D80153240408CE692AB321826BB50ECB52EE82346633696498418CD19C744EE52D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bf8fe6c45a9312caddaec11e1c8c107034e52d224b53cdb0c0196cbf6d90ac16
MD5 4e0599151f3ab0e488e4e3dda2f44b3a
SHA1 4ffb5401fe7beab29cc4b541a88ad7da1acf5621
SHA512 f6ab08c2158d47c1bc7d556b31ee2e4576d9503d843bf93e6c0db975ce5787dc37420cfcc3a2ff685b34b73c66cd7399a0e856a79934d03d0781a1ab3813c894
SSDEEP 3:MsEllllkEthXllkl2zEklxzl:/M/xT02znx
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1c5e518dd1a87224d20d53d32e0d30a40688dd7fc037e2e18b63b64e1a146bf3
MD5 cbbe726a433cd1efc536dfb28b4223dc
SHA1 e56db16eefa0cc73cc89777e2d63d1a05413efa1
SHA512 7a34e6829d3624f41cc254a6349a29f940417342448357751bec05ef37ec72935e0960e0ac013eddf4e9aef2e9192180b06dffcd4dd2fe79cf1604a52aa00bce
SSDEEP 3:LstlNllkll/lcd5/ll:LsX3lEtcdh
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2c3df8a455ed1ac5bcd99976c717dac136a95b3baf879ce480fe5901c59802b2
MD5 8217e93c7d831f1eff2bc857762a1890
SHA1 cc7de3bd98d23c6b71f2ba2d26a96ed1afba37de
SHA512 98b5471ea1d318401e66616e749525073298f276297363cb8a72cc60e079ecd6165181eb523654061d9fa585b41004146fa4ae54d71cd01d52179f3394b75951
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 b7ee4ba1918ecfe7827b8e0e47e8b16b9002b315bd409e666becd4079389e126
MD5 97718483f84191e714c0d1d00c7821a9
SHA1 c2de2949061a33c835c3c6399bfa3012063ba406
SHA512 2e096042ca971776fb364252fc5dea3f3675800bad0885a041c0ccc8d2ca4c4daa8b6db44461772c24712d9c7e3a2603ec0b00f4a495880691c4659f730ce074
MD5 SHA1 SHA512

Submit Download

EdgeEDropSQLite.db

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\EdgeEDrop\EdgeEDropSQLite.db
Size 32KB
SHA256 5fc30796b36360e25e81a1d385f706694379ea3a8a2e1f7e85e83f74f5f19327
MD5 6b0d30658325621074499d3e7cca116a
SHA1 21b28673f8ebc880b91bb4db591a786b9877a114
SHA512 6a94925db52f2e34490a55f7c32fbf4dc3db49f0478f2ab01b8c079fde1a0dbdc029fd64c5a864bf2dc92525188c0ce828c5efd3376320fb2246672d471de3a7
SSDEEP 24:TLVC30OIcqIn2o0n5UFlA2cs0US5S693XlejJ:TkLatUnAg0UB6I
TLSH
T1B9E2D04D6F60BA0CC4BF137B3DE5A8E64D6DA02C474AB443C4FC44E49EF1861419D297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 28KB
SHA256 61e59f34c56a499d8ac18398cc0cd1deec7e8df33f1eb017a93ef6a00da8bc2c
MD5 db72c0520eb144fff5c8a971bfe35881
SHA1 288a5f0b05205d12159f73333d7d3035b5de8957
SHA512 8f081a378cf55e494cd64fdcfd8cae5c5d581abb39042d9616890401202d57e3e84d5369d8817f57ec7c4b3071972c0cb043e9fab0bef1ccc76909fbde0b8e4f
SSDEEP 24:TLE7Us9vb7OkIbz9EODDNzWjJ0npnyX71j2Zco5fc:To7UC+lf9fD4jJ/pKckc
TLSH
T1ACD2AB8D3E10F421C8EC733CA0D2C5D06EBC643C4B8DB67142389CA68D62AA2F09E51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Extension Rules\000003.log
Size 38B
SHA256 1c43a1bda1e458863c46dfae7fb43bfb3e27802169f37320399b1dd799a819ac
MD5 51a2cbb807f5085530dec18e45cb8569
SHA1 7ad88cd3de5844c7fc269c4500228a630016ab5b
SHA512 b643a8fa75eda90c89ab98f79d4d022bb81f1f62f50ed4e5440f487f22d1163671ec3ae73c4742c11830214173ff2935c785018318f4a4cad413ae4eeef985df
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5d29d2.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\Network\Network Persistent State~RFe5d29d2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State
Size 2KB
SHA256 98265cb556e52458c81456f0ae5dc74fbdd7b7e375957811d57b8849cfc425f0
MD5 1c605574cb44b31c2eb494c2538c1ee9
SHA1 217ae70c3a7966297799320df4ce543173af8f8b
SHA512 e91946b4c0b2b6c513cbe15bbf5a82cf49393cda4bb3b5ae2a72a6c7db54e015b89c1aac5388fa711d08a98e1826030b8822ac239303746428092f30dcadf271
TLSH
T1B6515333A924AB77DCE24F447E4B3B238A7A50B2EA621F519ADD1B1C008755D5342C76
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State
Size 3KB
SHA256 3395df41da50a74de123b0e4be8b1e31a62a5ecca0512840ca8df1d5bac3b195
MD5 b1e54d2b45972b0b4ea2447de493e997
SHA1 5f121cafd0381f08641bf770e79d1efcdd8addd8
SHA512 f1786d5939e0fcd232850a2989d5e26b8489f84b096fab3327040efe5954763b528f030753b7998503d73e979b884901b019fd4c0cc6ae9e11bab2bc773ee70e
TLSH
T1A2618237A974EA679DF38F0479863B12A6A95033E9913FA5DAEC1F1C00C72981342C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State
Size 15KB
SHA256 12ad60e5a4647709298bd1b5bcb68b70ec8476bd9f79ac3ed474db95b8e2e052
MD5 745e5ceae65d043cec5c22f290614037
SHA1 56383af6ff7b71cea1d34aee5cc3c476d044b4e4
SHA512 c1b34d3b52f93e19c669bee3ac01a5bab7b44daef5d446acb2bcabbe34fd96bf0cc6f73d4200d442a1b291a77bf343eb7baaf44f66c60458672fa2342671d08e
SSDEEP 384:L+aQikB+z/xvxjg/qhEwNBSMpgajhAVdpS+T9zP:q/UxvxjgC+UmyhU1TFP
TLSH
T1AE72AF2BA4697E23A9F7EA053D5D174BCAB884B394C16EA84AFD6F0D05872D40302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State
Size 15KB
SHA256 5663fb4ea8fb1141a71ec85fb7374c411449b79a5786259eaf93b85ef65271aa
MD5 c034fe255eb6610f5930d1730a9581c0
SHA1 9a70a887dd7355363b5e0508f8de31fb9e9d653b
SHA512 6e0735ae9101d1fe5d3684636773703a7237d50b64cd95861f099800294c2782d4686bd506f9982a957e35a551531c5206af9fe53ad0725c894d489d25268742
SSDEEP 384:x+aQikB+z/xvxjg/qhEp3NBSXVaj8AVdpS+T9zP:8/UxvxjgC+pCy8U1TFP
TLSH
T12372AF1BA4797E23E8F7EA053D5D1B4BCAB8947394C12EA84AFD6F0D01872E41303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State
Size 15KB
SHA256 cc6e54b80d578c789dcb01ca541a9880dbf6b59b8e1d05e323be3b36fed74edb
MD5 08bdcd9dd98384e8983e336f4721323f
SHA1 f692897b6d72cf91a3229974b852d54a4e8a9cd1
SHA512 bcf828937b1d66588f887b1a074204d9f30b4d1d1cfb405f2650ebfef1a8eaf66980eaa24cd27d51d681afe7ee822975c862e15c4f4d308e6daf1701d812eeae
SSDEEP 384:6+aQikB+z/xvxjg/qhEqNBSXgajhAVdpS+T9zP:F/UxvxjgC+qyhU1TFP
TLSH
T1D972AF2BA5797E23A9F7EA053D5D174BCAB884B294C12EB84AFD6F0D05872D41342C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5c7ac5.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmpqqfwtn8c\EBWebView\Local State~RFe5c7ac5.TMP
Size 1KB
SHA256 7d1c82463a9425b094bfad97efa640e00b32ce1331202165e45ce0f6daaf6c0c
MD5 020c74b47f4ab1066450302d9c69074c
SHA1 23800b02315ad56e9974afbb9154373a39503f90
SHA512 878af8c7bc8ddf93b0f5c9e8fd260f59f1d22ec956b1f0db3604e81ceb8dfc1b24faf40a7cc08699be276d5d803a7ebfb2155fce960342b2ae713dc8019e03af
TLSH
T11D216273E5689FB3FCE21B4636073B234E2610B7D9110F0066DE4B2D018609DE51BD32
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_1934184753\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1474782642\_metadata\verified_contents.json
Size 1KB
SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
MD5 449dd45bb3743ba9d74d22e229d240b9
SHA1 5416597a6279971cb80324d89a19eaf15c8ed112
SHA512 fedd551f65c62f157240c1dc360efe0d5b9793a34ed71291d6ea4c65a7f0cda6c32f0f2608ce4bcbc61591acdae76d9d4a610337d9d35eadd10f80bd43544e4d
TLSH
T16031F956010CE1DA3A8F13B90FFEEE12D35F10D2A2E525316AC6571EE0DA746D2315A1
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1474782642\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_1474782642\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_188312518\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5068_543999472\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2140-1986-0x00007FF938E60000-0x00007FF938E61000-memory.dmp

Download

memory/2180-2342-0x0000029F585D0000-0x0000029F585DA000-memory.dmp

Download

memory/2180-2343-0x00007FF928FC0000-0x00007FF928FCA000-memory.dmp

Download

memory/5820-1883-0x000002753C250000-0x000002753C258000-memory.dmp

Download

memory/5820-1885-0x0000027554AA0000-0x0000027554AC2000-memory.dmp

Download

memory/5820-1880-0x00000275549F0000-0x0000027554A64000-memory.dmp

Download

memory/5820-1881-0x000002753C260000-0x000002753C27A000-memory.dmp

Download

memory/5820-1882-0x000002753C240000-0x000002753C248000-memory.dmp

Download

memory/5820-1887-0x000002753C280000-0x000002753C288000-memory.dmp

Download

memory/5820-1884-0x000002753C290000-0x000002753C298000-memory.dmp

Download

memory/5820-1878-0x000002753C070000-0x000002753C07A000-memory.dmp

Download

memory/5820-1879-0x00007FF9292B0000-0x00007FF9292BA000-memory.dmp

Download

memory/5820-1886-0x0000027555090000-0x000002755564A000-memory.dmp

Download

memory/5820-1893-0x0000027554AD0000-0x0000027554AD8000-memory.dmp

Download

memory/5820-1891-0x000002753C280000-0x000002753C28E000-memory.dmp

Download

memory/5820-1890-0x0000027554B80000-0x0000027554C22000-memory.dmp

Download

memory/5820-1889-0x000002753C280000-0x000002753C288000-memory.dmp

Download

memory/5820-1888-0x000002753C280000-0x000002753C288000-memory.dmp

Download

memory/6376-2298-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2294-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2299-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2297-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2296-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2295-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2290-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/6376-2288-0x000001B143550000-0x000001B143551000-memory.dmp

Download

memory/7128-1918-0x00007FF938E60000-0x00007FF938E61000-memory.dmp

Download

memory/7360-3042-0x00007FF9397D0000-0x00007FF9397D1000-memory.dmp

Download

memory/7360-3041-0x00007FF938E60000-0x00007FF938E61000-memory.dmp

Download