hxxps://www[.]mediafire[.]com/folder/cqr9vi2stjzh7/MecchaChameleonCheats

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
367s
max time network
369s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/folder/cqr9vi2stjzh7/MecchaChameleonCheats
Sample260803-e7yrcsca74

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
720	5336	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
5572	MRT.exe

Loads dropped DLL 2 IoCs

pid	Process
5572	MRT.exe
5572	MRT.exe

System Binary Proxy Execution: wuauclt 1 TTPs 4 IoCs

Abuse Wuauclt to proxy execution of malicious code.

defense_evasion

System Binary Proxy Execution

T1218

pid	Process
2256	wuauclt.exe
5476	wuauclt.exe
4128	wuauclt.exe
4788	wuauclt.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\MRT.exe	Windows-KB890830-x64-V5.143.exe
File created	C:\Windows\system32\MRT\28EBAE98-B985-EEBF-6378-5F17AFCE2087\MPGEAR.DLL	MRT.exe
File created	C:\Windows\system32\MRT\28EBAE98-B985-EEBF-6378-5F17AFCE2087\MPENGINE.DLL	MRT.exe
File created	C:\Windows\system32\MRT\09DB5B3C-BD02-4751-B804-84E85E1DEC18\MpGearSupport_20260803_054119EE34A55C-0C93-A8FD-881E-D34C70CF33F4.log	MRT.exe
File opened for modification	C:\Windows\system32\MRT.exe	Windows-KB890830-x64-V5.143.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1376	MecchaChameleonCheats.exe
9164	MecchaChameleonCheats.exe
5552	MecchaChameleonCheats.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\RUXIM\SystemEvaluator.dll	msiexec.exe
File created	C:\Program Files\RUXIM\RUXIMICS.exe	msiexec.exe
File created	C:\Program Files\RUXIM\RUXIMIH.exe	msiexec.exe
File created	C:\Program Files\RUXIM\RUXIMPHDialogHandlers.dll	msiexec.exe
File created	C:\Program Files\RUXIM\PLUGScheduler.exe	msiexec.exe
File created	C:\Program Files\RUXIM\plugscheduler.xml	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6000_1967913219\manifest.json	msedge.exe
File created	C:\Program Files\RUXIM\DTUDriver.exe	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{DA80A019-4C3B-4DAA-ACA1-6937D7CAAF9E}	msiexec.exe
File opened for modification	C:\Windows\Debug\mrt.log	MRT.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Ngen.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	Ngen.exe
File created	C:\Windows\SoftwareDistribution\Download\49ba6ae83fe2a990fc76e38a96972f75\img\Windows-KB5001716-x64.msi	wuauclt.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	Ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	Ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	Ngen.exe
File opened for modification	C:\Windows\Installer\e5d3d0c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EF0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5d3d10.msi	msiexec.exe
File created	C:\Windows\Installer\e5d3d0c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2076	msedge.exe
6020	msedge.exe
5280	msedge.exe
4004	msedge.exe
456	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotificationUx.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302053643893213"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\910A08ADB3C4AAD4CA1A96737DACFAE9\RUXIM	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\ProductName = "Update for x64-based Windows Systems (KB5001716)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\Version = "140378112"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2CDB08E73A58E9F479620A1ECA5BB824	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2CDB08E73A58E9F479620A1ECA5BB824\910A08ADB3C4AAD4CA1A96737DACFAE9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Net\1 = "C:\\Windows\\SoftwareDistribution\\Download\\49ba6ae83fe2a990fc76e38a96972f75\\img\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\PackageCode = "1B2A9C9F1C2FB70499AEC9ED21C428C3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{61187F06-49A8-4C33-B07B-70B64413BB67}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3EBE5BD3-8785-4DBD-9DDF-4E02A2832277}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\PackageName = "Windows-KB5001716-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Media\1 = ";DISK1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\910A08ADB3C4AAD4CA1A96737DACFAE9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\910A08ADB3C4AAD4CA1A96737DACFAE9\SourceList\LastUsedSource = "n;1;C:\\Windows\\SoftwareDistribution\\Download\\49ba6ae83fe2a990fc76e38a96972f75\\img\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5476	msedge.exe
5476	msedge.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
1376	MecchaChameleonCheats.exe
1376	MecchaChameleonCheats.exe
1376	MecchaChameleonCheats.exe
1376	MecchaChameleonCheats.exe
1376	MecchaChameleonCheats.exe
1376	MecchaChameleonCheats.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
6000	msedge.exe
6000	msedge.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
1504	Windows-KB890830-x64-V5.143.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	taskmgr.exe
Token: SeSystemProfilePrivilege	4608	taskmgr.exe
Token: SeCreateGlobalPrivilege	4608	taskmgr.exe
Token: SeBackupPrivilege	456	vssvc.exe
Token: SeRestorePrivilege	456	vssvc.exe
Token: SeAuditPrivilege	456	vssvc.exe
Token: SeBackupPrivilege	4996	srtasks.exe
Token: SeRestorePrivilege	4996	srtasks.exe
Token: SeSecurityPrivilege	4996	srtasks.exe
Token: SeTakeOwnershipPrivilege	4996	srtasks.exe
Token: SeBackupPrivilege	4996	srtasks.exe
Token: SeRestorePrivilege	4996	srtasks.exe
Token: SeSecurityPrivilege	4996	srtasks.exe
Token: SeTakeOwnershipPrivilege	4996	srtasks.exe
Token: SeShutdownPrivilege	4128	wuauclt.exe
Token: SeIncreaseQuotaPrivilege	4128	wuauclt.exe
Token: SeSecurityPrivilege	4840	msiexec.exe
Token: SeCreateTokenPrivilege	4128	wuauclt.exe
Token: SeAssignPrimaryTokenPrivilege	4128	wuauclt.exe
Token: SeLockMemoryPrivilege	4128	wuauclt.exe
Token: SeIncreaseQuotaPrivilege	4128	wuauclt.exe
Token: SeMachineAccountPrivilege	4128	wuauclt.exe
Token: SeTcbPrivilege	4128	wuauclt.exe
Token: SeSecurityPrivilege	4128	wuauclt.exe
Token: SeTakeOwnershipPrivilege	4128	wuauclt.exe
Token: SeLoadDriverPrivilege	4128	wuauclt.exe
Token: SeSystemProfilePrivilege	4128	wuauclt.exe
Token: SeSystemtimePrivilege	4128	wuauclt.exe
Token: SeProfSingleProcessPrivilege	4128	wuauclt.exe
Token: SeIncBasePriorityPrivilege	4128	wuauclt.exe
Token: SeCreatePagefilePrivilege	4128	wuauclt.exe
Token: SeCreatePermanentPrivilege	4128	wuauclt.exe
Token: SeBackupPrivilege	4128	wuauclt.exe
Token: SeRestorePrivilege	4128	wuauclt.exe
Token: SeShutdownPrivilege	4128	wuauclt.exe
Token: SeDebugPrivilege	4128	wuauclt.exe
Token: SeAuditPrivilege	4128	wuauclt.exe
Token: SeSystemEnvironmentPrivilege	4128	wuauclt.exe
Token: SeChangeNotifyPrivilege	4128	wuauclt.exe
Token: SeRemoteShutdownPrivilege	4128	wuauclt.exe
Token: SeUndockPrivilege	4128	wuauclt.exe
Token: SeSyncAgentPrivilege	4128	wuauclt.exe
Token: SeEnableDelegationPrivilege	4128	wuauclt.exe
Token: SeManageVolumePrivilege	4128	wuauclt.exe
Token: SeImpersonatePrivilege	4128	wuauclt.exe
Token: SeCreateGlobalPrivilege	4128	wuauclt.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe
Token: SeRestorePrivilege	4840	msiexec.exe
Token: SeTakeOwnershipPrivilege	4840	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe
4608	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 976	2224	msedge.exe	86
PID 2224 wrote to memory of 456	2224	msedge.exe	87
PID 2224 wrote to memory of 4660	2224	msedge.exe	88
PID 2224 wrote to memory of 1440	2224	msedge.exe	89
PID 2224 wrote to memory of 4660	2224	msedge.exe	88
PID 2224 wrote to memory of 4660	2224	msedge.exe	88
PID 2224 wrote to memory of 1440	2224	msedge.exe	89
PID 2224 wrote to memory of 1128	2224	msedge.exe	90
PID 2224 wrote to memory of 1128	2224	msedge.exe	90
PID 2224 wrote to memory of 1128	2224	msedge.exe	90
PID 2224 wrote to memory of 2420	2224	msedge.exe	91
PID 2224 wrote to memory of 2420	2224	msedge.exe	91
PID 2224 wrote to memory of 2420	2224	msedge.exe	91
PID 2224 wrote to memory of 2884	2224	msedge.exe	93
PID 2224 wrote to memory of 2884	2224	msedge.exe	93
PID 2224 wrote to memory of 2884	2224	msedge.exe	93
PID 2224 wrote to memory of 4544	2224	msedge.exe	94
PID 2224 wrote to memory of 4544	2224	msedge.exe	94
PID 2224 wrote to memory of 4544	2224	msedge.exe	94
PID 2224 wrote to memory of 1116	2224	msedge.exe	99
PID 2224 wrote to memory of 1116	2224	msedge.exe	99
PID 2224 wrote to memory of 4752	2224	msedge.exe	100
PID 2224 wrote to memory of 4752	2224	msedge.exe	100
PID 2224 wrote to memory of 2624	2224	msedge.exe	101
PID 2224 wrote to memory of 2624	2224	msedge.exe	101
PID 2224 wrote to memory of 2624	2224	msedge.exe	101
PID 2224 wrote to memory of 2984	2224	msedge.exe	103
PID 2224 wrote to memory of 2912	2224	msedge.exe	104
PID 2224 wrote to memory of 2912	2224	msedge.exe	104
PID 2224 wrote to memory of 2912	2224	msedge.exe	104
PID 2224 wrote to memory of 3088	2224	msedge.exe	105
PID 2224 wrote to memory of 3088	2224	msedge.exe	105
PID 2224 wrote to memory of 3088	2224	msedge.exe	105
PID 2224 wrote to memory of 3468	2224	msedge.exe	106
PID 2224 wrote to memory of 3468	2224	msedge.exe	106
PID 2224 wrote to memory of 3468	2224	msedge.exe	106
PID 2224 wrote to memory of 1384	2224	msedge.exe	109
PID 2224 wrote to memory of 2396	2224	msedge.exe	110
PID 2224 wrote to memory of 2444	2224	msedge.exe	111
PID 2224 wrote to memory of 3252	2224	msedge.exe	116
PID 2224 wrote to memory of 3252	2224	msedge.exe	116
PID 2224 wrote to memory of 3252	2224	msedge.exe	116
PID 2224 wrote to memory of 1136	2224	msedge.exe	117
PID 2224 wrote to memory of 1136	2224	msedge.exe	117
PID 2224 wrote to memory of 1136	2224	msedge.exe	117
PID 2224 wrote to memory of 1932	2224	msedge.exe	118
PID 2224 wrote to memory of 1932	2224	msedge.exe	118
PID 2224 wrote to memory of 1932	2224	msedge.exe	118
PID 2224 wrote to memory of 1376	2224	msedge.exe	119
PID 2224 wrote to memory of 1376	2224	msedge.exe	119
PID 2224 wrote to memory of 1376	2224	msedge.exe	119
PID 2224 wrote to memory of 3288	2224	msedge.exe	120
PID 2224 wrote to memory of 3288	2224	msedge.exe	120
PID 2224 wrote to memory of 3288	2224	msedge.exe	120
PID 2224 wrote to memory of 216	2224	msedge.exe	121
PID 2224 wrote to memory of 216	2224	msedge.exe	121
PID 2224 wrote to memory of 216	2224	msedge.exe	121
PID 2224 wrote to memory of 5984	2224	msedge.exe	124
PID 2224 wrote to memory of 5984	2224	msedge.exe	124
PID 2224 wrote to memory of 2544	2224	msedge.exe	125
PID 2224 wrote to memory of 2544	2224	msedge.exe	125
PID 2224 wrote to memory of 2544	2224	msedge.exe	125
PID 2224 wrote to memory of 4712	2224	msedge.exe	126
PID 2224 wrote to memory of 4712	2224	msedge.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/cqr9vi2stjzh7/MecchaChameleonCheats
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,7823403238062041521,8138776224253579172,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5873839655242914600,12853634185407997555,262144 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,2991536914501987123,5831809014951972788,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6759156391159216803,13698946750727718216,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,10481313192125665318,11905048273205776393,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,13732661511511736459,213341231766213970,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,18304635149213800929,4817322091746123700,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,1050246587389980051,18388084228181057634,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,14891381974191455608,9118964790471715810,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5792,i,407384344326107890,13831059776624694495,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,5487596771636444686,441232473689372364,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,5487596771636444686,441232473689372364,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3984,i,5819726139388144587,2058224582220593370,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4452,i,3934685222017797734,356809291788543452,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4424,i,1874103267772341268,2118239940321458407,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,7154000769128815365,2305366629586127453,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,737655678422280246,7687296988104467263,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,9509011941557623852,12841888445994486214,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4020,i,16977806789885145411,12588313679313440613,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6580,i,8245337638030832187,3830761262713666381,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4368,i,15712085877747272749,16389036542592771606,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6568,i,2653939660180208062,7015158335843622514,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6936,i,2155549422657246447,11527011511440774857,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7072,i,15088388713461932880,6292414532266750374,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,4972617332787148912,11343563323796140909,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6856,i,15095753234431033337,13110724275801535474,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7300,i,13035716140808686818,31400769711230753,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7520,i,10454867458307172972,4158814467582545824,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7548,i,18073354187405944774,1060840349199093726,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7536,i,2142913228857798784,258457544566446028,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8216,i,7287525553081616849,9843461011721699072,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8728,i,908651933787324878,13277704075716944430,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7824,i,11319554095847195838,15108187315480450608,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7800,i,8812477094885432530,1182128464828676210,262144 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5224,i,4811096316532237236,10731868702797413171,2097152 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,12840857427357617478,11390926563221892656,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,12840857427357617478,11390926563221892656,524288 --field-trial-handle=2260,i,9833000131324192848,9666146074611688345,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf2af0551h1cc2h48c2hb56fhc09110fa98d9
1⤵
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf2af0551h1cc2h48c2hb56fhc09110fa98d9 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,12422457749764754371,1921091811974424906,524288 --field-trial-handle=2464,i,5727498904693465716,8584991239064739703,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,12615341930729117791,5322157466780019723,262144 --field-trial-handle=2464,i,5727498904693465716,8584991239064739703,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,1853468076078693906,674285783529645294,524288 --field-trial-handle=2464,i,5727498904693465716,8584991239064739703,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2b014ba6hb9c5h41fehb236h02d542d1d109
1⤵
- Enumerates system info in registry
PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x264,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,13334369854104991083,8777124154709273910,524288 --field-trial-handle=2884,i,5587863341595213267,254263499254907547,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,4007076660745282674,14854867498973740124,262144 --field-trial-handle=2884,i,5587863341595213267,254263499254907547,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16619959842213480262,7645437710217268413,524288 --field-trial-handle=2884,i,5587863341595213267,254263499254907547,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf81d45adh8783h4966hadf0h7ca48dd9c5f3
1⤵
- Enumerates system info in registry
PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x310,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7134974116705217662,1726375554659123238,524288 --field-trial-handle=2380,i,10825387387021421509,12880058489770810673,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,4831320328996585878,7526908980788135983,262144 --field-trial-handle=2380,i,10825387387021421509,12880058489770810673,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,12611207310921550394,6837572748224404801,524288 --field-trial-handle=2380,i,10825387387021421509,12880058489770810673,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,3150569002204374880,13352004374105012127,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,14060758787461167260,13146462891161773006,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,12947814888711145681,16759877704999392317,262144 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,4347008527561516191,18394047362539394290,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,2028414590925957703,1876640657527715935,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,17529534407744375604,12796741731857493172,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,17529534407744375604,12796741731857493172,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,14296922786455735081,2581717420091146945,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,2738145649952728150,903932736035752997,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,18423189455064806359,10291648387086400277,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9183951617030650507,2165508417165929352,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,1465544434003827660,10860306412206431957,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,2132025502148522552,3019228562199822310,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,10373328289507844532,4724318226671723655,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,4943973677624940264,1040300473797809300,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,828001978834361639,12044021425064642425,524288 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3232,i,7525506032552830685,4970005406242496365,262144 --field-trial-handle=2516,i,4882735176583249023,13441161535593661169,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:7872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5480

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:2504

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:4176

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4608

C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe
"C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 07b01f24-9985-4def-8401-d7cbd923d93a /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:2256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2032

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay
1⤵
- Drops file in Windows directory
PID:4056

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 02b2db61-9c37-48ea-882e-fef4fcb4ba11 /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:5476

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 4f745db4-839a-4b32-b9a3-201101e10bd0 /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c RD /S /Q C:\ProgramData\PLUG
  2⤵
  - Executes a command shell one-liner
  PID:2624
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\SysWOW64\schtasks.exe -delete -tn Microsoft\Windows\WindowsUpdate\RUXIM\RUXIMDisplay -F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2980
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\SysWOW64\schtasks.exe -delete -tn Microsoft\Windows\WindowsUpdate\RUXIM\RUXIMSync -F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\SysWOW64\schtasks.exe -create -tn Microsoft\Windows\WindowsUpdate\RUXIM\PLUGScheduler -xml plugscheduler.xml -F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4272

C:\Windows\system32\MusNotificationUx.exe
%systemroot%\system32\MusNotificationUx.exe QueryNotificationState
1⤵
- Checks processor information in registry
PID:4428

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 19
1⤵
- Checks processor information in registry
PID:3684

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId af376891-a55a-460e-8bd6-ec982935edfc /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:4788
- C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-x64-V5.143.exe
  "C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-x64-V5.143.exe" /Q /W
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- - C:\Windows\system32\MRT.exe
    "C:\Windows\system32\MRT.exe" /Q /W
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5572

C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe
"C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:9164

C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe
"C:\Users\Admin\Downloads\MecchaChameleonCheats\MecchaChameleonCheats\MecchaChameleonCheats.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5d3d0f.rbs

Path C:\Config.Msi\e5d3d0f.rbs
Size 8KB
SHA256 fbfc054f2834a11469a9841a6012466cda19051abf96659df952b136bc401375
MD5 5066e19c88ee1d76b579d79c21803b34
SHA1 cf26390189b783b183dd88dae7dfb04c88efd75f
SHA512 5792f90baea04c529e2c0bc65b76853204228b5fb16dddbf5193b84c5a45f19e539a6eba881f733e06a9002c5205cfae2470ea99b7c5b3edccd3d6d17a24ca67
SSDEEP 96:kmznMCQHtPm7eS1FOFUZeD2f4KCOTlkMFUZeD2f4KCgjj8gRTliNO05H9ilWqbsY:hznMZIe2pGZGWTGZSomwYHpYIl
TLSH
T170024306B605C5D2EA931B78C7070B543BB3D2CA931433AB08CED5245E6B3585F6A39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6000_1967913219\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8fa7095525ec5bbc52a652cfcdf4981df67934596348886fddccedea5c0cb5d9
MD5 f21cd3022fecbe0940a91e413b6fe3d1
SHA1 dd68ebb50937215baf2966181903f6aee0563d38
SHA512 b4890270a32677c5990236590aa055667effc0497182bd5a4c753cb23ba016b5e9ad4e98a5a96347bd4c51fd91ef904f0dbfaf1b8a431d3ca7005f89e8a572dc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7B:fwUQC5VwBIiElEd2K57P7B
TLSH
T105B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4371a57d104cacf01835d7b1e7c57cfe938b72a37ce2255f489f558bff1ddbf1
MD5 dd0698d0915344f95f2ec4407fbaf7b5
SHA1 1e7d9cd9f6b7559e4b1cc2b57458517115c471d4
SHA512 f75310014f771e0f700d554959e2913d57e46b85b378fd9029eb6450fdfa40fc7fe022a0d09c9e5c0fc676da30865f425cc58c6ede7bcc8122942df24aac437f
TLSH
T19DD0A7A4B205AA20C61F40355811F260A6A241317077C6A2A061580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae1124c9c8979ecaec67c358c8313c06d2bb0d3feb7636968cc9a24483b633fe
MD5 1522558780c86e6c2aae39cee93e748c
SHA1 2d4824cdb48b3424b5a494d7f46c5b21a1a139c1
SHA512 5a5104603caed9348fdb863b4f88e96122b91edc258d791e1cd5b769b7654e22ab0e850f52005f8a60e46ebc025baba93571f612d1f497a9e62c9102f54a1fb0
TLSH
T163D0A7A4B605AA20C61F40355C20F260A6A241717077C6A2A065580D65B841893EE5A9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

4ce4a830-e305-4cbb-bdcc-31c93b198d8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ce4a830-e305-4cbb-bdcc-31c93b198d8c.tmp
Size 414B
SHA256 00c8518cba826bb75ea31c9dc1a6ac7880657b634f3367be1590d3d4b3eb5408
MD5 b2baa84a35d5ce1d33bbf9892643fb7c
SHA1 52da01f095a219ae58c6e72327d13c2ddfc2b23a
SHA512 9cc223fe1aefdba1c3853dce2a4fd3759bb9e010190a81d4d4194e90b41f1a010fa303cafe5ae7f94f06a88f5ae16cb9cb3f6ceeb76ee79b2b414a60d5c71bad
TLSH
T17EE022EACD22FC3B08FE1B2C24454B86EA64131B2640984FBA3CA1188FB077F4695C1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

1ed16347cf732734_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ed16347cf732734_0
Size 238B
SHA256 aa28dc6e79113c78e82104b0a41c0b544b5cdffaf0ea29a48c6a329a91e27b9b
MD5 33c251c73e177b87e12d2214636ec85f
SHA1 808a06be22a7f64ff31acc64646ecf65bb3b9a92
SHA512 09ae69562867145e7a0f52eeb97e104d2f5919eba8723a44ff894d46348c88c8127858ecd59972e78239896ba481c52e4c2f9b3e89b3c964852f75fabe5cc2e4
TLSH
T19ED0235355C15D41C72E16F0D2EF699DC30351A81CDB52D20214A2F3CD9147055C310D
MD5 SHA1 SHA512 TLSH

Submit Download

2c3b3d91b4562436_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c3b3d91b4562436_0
Size 233B
SHA256 4a08382d09322e76f7ab279531c401460dc3c9abfdbd6f7db5dd6de845fe590d
MD5 1433c915b1f3f9a524741af9d10ffe78
SHA1 8eb6afd5af0e26d96e914bfaf6f72afbd32e2c67
SHA512 f82376584c57b8622b5ed01e5591b6e6e78416bcb147495b0d630eb7abee79b51d881429aa5ca635e5d33026799f25fd2052d439ff4d548ab70daa329ac57a86
TLSH
T18DD0239755501641DB5F14F0C1572E18D303459C0CDD52525518A1B7D650071984550E
MD5 SHA1 SHA512 TLSH

Submit Download

61ce0db95edc5e0b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61ce0db95edc5e0b_0
Size 236B
SHA256 1d2c2f2bf65ea8ff1887c62ec95988c9a83b0d75ffefb3d68ed98981f3b41d3f
MD5 c69a739a2ce2719bcefea59550e50f9b
SHA1 67b810487d1b17dc0fe3d6504e59c8b5701cc2ea
SHA512 b6cf55593994279eb7df0a30d504312b9cea9a98a3f8a75768a70754ab3ecbff87f99a89fbed2c0aea6f7d40c08c44f8335b2fa5dd21564370a2ff98d583ae78
TLSH
T155D023D3A4400B41D33E15F1D65F565DD3031191189AD7D24328B3B348914B07DD174D
MD5 SHA1 SHA512 TLSH

Submit Download

b89bd795667824af_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b89bd795667824af_0
Size 228B
SHA256 823344e147bca28ef6686b96c259935835fa4e1660cc9ffaa554bb74b6ccfbbb
MD5 960a88f75d38220c032dc7c58ccb7884
SHA1 0b35a973780d7248540fe8792ddc740c82f3b6ea
SHA512 bf7ca531b547128f65c5375c9fdb541673b0b78d34e61c8e4ffc94b6daf64fde08bdb5c14ecc864d1baa1de999268f3e8e2e442c04f1d202bae83cc33a3598f3
TLSH
T193D0A9A3C8840921D72E78F4D57A2616821606D103895B634768BBA3EA380B0991601D
MD5 SHA1 SHA512 TLSH

Submit Download

bf20258e591a3f1a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf20258e591a3f1a_0
Size 237B
SHA256 c00cb22a4951723bfeb5b02a84d3a20d11b2fa75548806c49527790d6f98e390
MD5 49e9b77d3095a2e86ebebde8abda9d22
SHA1 a2da500754757ad85f8e49b158a72eec41512be4
SHA512 3b3f064554e601e283c998aab5d8576752fdad7cee10ba669ba501ca11ef7fc6f5870005fca962a645a97018411b77f7d3c4a70ebd9a5a67bb688fe09d690235
TLSH
T17ED0A7AB58A01D43EB7D55F4C29F6A44830285D289DB92095608A1F3A984070690950A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 4992cd18ae923f95b7c138c06caf9cd50f3db36ca01e5332c3bfd359688985f3
MD5 e0598052a1faf8ec27822b4aab8fae6f
SHA1 5615d48dbd0a9695a60e3302f4896ddfafa7e527
SHA512 4c5c0d31c00439c2f9f2a50300ff34b196ea6b1e532557c6b841ec45cdc56a1af5cbd344a1f40c7d38e857ffdd33ccc2b0c8f69ae2746e6db331b8a5384cbafe
SSDEEP 96:yqqn5vDaISi7+maMAGWxbtqOOm+Q11B08g1X7Zo6bW:8n5p+JNGW5tqQVE80X7ZtbW
TLSH
T16EC1802A15E034A2FB90D2335AEA993FBC338DAC7A1F5EC105CC9C39F91EB544762408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a662a80256cf6b96f44520eb2c9a6810ba30c947798820239c216cdd21227d05
MD5 03e7aa279f77cedf5728e6833d0dd491
SHA1 aae62e2c5ae80e630973ae966ce57a678afaabff
SHA512 d99fc5a8739b9916d513cc7f487bbba04754c27d2e0cd7dcdf44464ef499a0c543135409e8d40ae051eddc156acc4467120d44e303a9e7a51a8664d4db72bb23
SSDEEP 96:Jqic5vDaki7+mTMAG0xbtqOOm+Q11B08g1X7ZoDby:lc5c+YNG05tqQVE80X7Zsby
TLSH
T10AB1612A15F435A2FB90D2335AEA983FBC338DAC7A1F5E8515CC9C35F91EB544752408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 708468e4427fe0c83c2900bb00e5f89d5580997c3cb2c18922b4c75894b49c36
MD5 b9649b4921295638a0afbc458d3a1cf2
SHA1 cd53ba4bd9faeabdca60639cb4b87196bcde7795
SHA512 803b5401ccf9654a86a7119c76e3ee8977658297e569e5da995b3d7da003473f856fd36ccdf22980b10c4846e6b9a381bf66b3bf94c0b2569c0a63efdeadd889
SSDEEP 96:zi3MbIGL5vDLItp7lmUB7Tsop2u9OqZuyzFCwG1YDJoK107ZTdm3L:ucbI45UlDpTHgu97FzxGeJoq07Z83L
TLSH
T1B2F1D76944E4B0E2FB51D13725E9A92FBC728DBDAA0FAFC250C88C35F81FB945791844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59679a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59679a.TMP
Size 3KB
SHA256 6f050bc45a341fdb0d02b1cbd73b0c8bbd286461b84814880be26e3423d8ba02
MD5 34d4c26d6f3e6a029aefbe82768ef7af
SHA1 829d4705c328af161450e1bcc00c30bfddfee4bc
SHA512 8419e11258c1622a5da3b56086c943099bcfb1083954c5a8c10b737d3b18ce1279f374c359829f3ac399b1c1a5862eca58d936ac88b59ea95526dbdf2a8122d2
TLSH
T14961D52909F534B8F761C2309AD21637FD728CBCB95F9E5104EC6C72F90EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 627B
SHA256 409d4c47e940688527d730b996e8991e010988c7671565467ed69d640d0947f3
MD5 9d7435ea49a80fdd66e4915f513017f9
SHA1 469f6c6e4b19b85cc1be497812b2f20864f4ff2c
SHA512 0561cd632d4219aef4686de40ec092921384ca89755d354801e0eaec8645a8630a180807af518ac8fcf01f71eb3d10faa9ce1e62c7a7226a274975bdcb7eeb4c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 602673d7c716972899a0f055c200289df9c3c0b80c1b4efcadec4b778e59b991
MD5 aa5a199374837a6f2aff37f5ff41c31d
SHA1 886cd035929dda14529bd84ea11cacc82fa35dc6
SHA512 751d422e83c8d7d57961bcd8702f39a0e04ee790e462706ecbd10413e0ce4ac37f1c39d808e39b152614bf8da940fa5264691f41bfce518af5897bdbea4da4da
TLSH
T14AE0262438CAC27999286897827A8B0893D83512FB88B942674A9CC66241341A2CBF91
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 ca4f0cc6f3b98d1d960e83d6668cbefebc2082e2265320d762759aa5f898ec3e
MD5 c48c3f4f14ee42e9e18ab3fcbbf1f007
SHA1 c633941e18811eab4d8e1d0bc3ce63642f6205e1
SHA512 6569e0bb79dfc1154673da537a433d0ffb17dffbe73c87ebbdb0e62b82ec829779d6c346056a1ff3d87c95d2bb2304eac97fa65dc24fb68f7471569e66bcc844
SSDEEP 48:uzBmw6QU1PzysW5Pkvi6xVqKRmYhu4VTz7nW:6BCxPW5cKkVqKmAu4hzbW
TLSH
T1849270936DB43403DB660E772237547CCA37D1BC5FA7DCD4382584224DBA84260B9EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 af097b7bbf0c54e3c82146f948782bac21c876a375cd033720a134a824d5e034
MD5 b98e7df1c19add77a1d57884e5c327d3
SHA1 2c95238c135b229a97975070c80b54c21a91d677
SHA512 250708078ae3b785005e2d915442011137199ca93077968c09115142c99e52503e4a00579db659c1f8078ffd751474656e77acf60a959ca857a6d68157d03e88
SSDEEP 192:QFS5d1vG4z5vG03b7f+G83uy3Ct7XBBKc7IFSZnvGbFSCFSJH7DXspU3iTvG:6Sln/83uICtTBB+SYSsSJ7DXspU3i
TLSH
T10F243A1F5E603336CC7E50BB60A7A1B29C7DE0278B5399CAB8210051CEE6A5561DBD6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 28KB
SHA256 aecdf3256392c4e1d7378daebaa42239862eb5956f5b2c60df4ddcf53e6fded2
MD5 1848ae21aa3a2ca1b34675339d92a8aa
SHA1 ca022485b1f7050ece92fbf434a576a41171fe18
SHA512 d24b8727dc9641bc3a3552a7031cbee2e72eacc7e1f387868c98b60da74b9513a7431959dfd6346a2d0253bdc37370b79d1ba0cd94626f15d0a90a8e54b60173
SSDEEP 768:mLrod1eDWgTeDWgeOPVR91mnwIVf5vsOb:mvodcDWgKDWgeOTlOb
TLSH
T129D2D8B79858CCAACE4778E2D577FD5CF2474D3BDE89FDE9D1A8844E02A80343291906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 9cba9ad31163dd80b9de9a41c8124bddff5947027d6dcfa1dc9ce429d945a1c9
MD5 56eeee888028a8347e4baf1d99ae3b17
SHA1 8253ade3ac836f5e0d63923e7de280ccc2b14168
SHA512 1568c9c870f76fe7fbb0ff09ebc40517e5c7d707c7bd80f69a0c461d6e8e34c55d58301c8dc545071902afc42071ed107480b07f8efe0bce3136d221e4ac52d6
TLSH
T1D9E0D8B159DEC26A57182047522BA708E3E03516FB88AA417B459C8DB242044B6C5ED1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4b3e0aad3d2acae6101e6873c1735ea1c27f831534541011a05c89e789a70dcd
MD5 a0dfec3ce67c829adbc92c47855c2a2c
SHA1 67db65617b2da2647f2160072ead7642d575b51c
SHA512 50bb15c2666e40629424fba6278fb6a86e81625f59aeddf4c87ad329c2b709f75e6fb0d3106fac4f81154886805b5a201ba1e558874126cab7c6efbc262d387a
TLSH
T1D031AEF3C2E8956D894152F0E6187E1BCF1D0950532C3D9AC4E4EF1B97E2970E14055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 8233dcfb1cdba1de51a7d4afcb9b7e3082d7f0c85e2c62e5609da9e9b98f906e
MD5 3dede552de7f0cef929c98021c4e5b48
SHA1 4f3d492e5c40f81ecc7e134da536facfe3be6d8f
SHA512 bb7f23a021019b3c1a80d79330124a8f2a9fc87f7bb5ea8580ea3e1b725d4c15de124c32de83068aa829ed6d71ab3d4957ec95912358a1dbf1d233de52d3e1fb
SSDEEP 384:De5YlcInA8Ah4lfzbFr4mrqeaaK9eRJgzJSjPe2lclDi9hYF14Vawfy4jkKlYKLj:foDRo/As3sbpHgofVlTk
TLSH
T11FB245F383E6D56E891117F896146E1BCF1D0629432C3C2588D5EE87E3E2072E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ae1b3db4273596a86f01acb7d54d428cecd5e899af7c379955a052dc2e23ad54
MD5 7fd0c8e931d062399867ef378bf36431
SHA1 89e6392863740dcb68d609c487788f5fb15a982b
SHA512 ff4ee46f2b54d285321b39738492be846e0ac0fca7328fb3577a8a0732726045e683f73988a1fd10f2b1a0991bd816b1d63cc628de96aa0943b1e943a817ebcb
SSDEEP 192:sxZORHyM/jK1Ml8MkA/fDskqxIdp8sHW6+WNmMl/YHZrO+9gIgrJ:sxZOZMA/fDskq6lHb//psc9
TLSH
T15452F812AA34697BCCDBD309BA517F53D6F50472E2900E48A9FCDA1C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 09a0ffc65b7fa53243a305ed1e1bb2684dddc08de646c4c8f638b858291f5493
MD5 196ed26a7f8d9efc86af4da247043d1a
SHA1 4858b535aad52b3fb863378270aebba0fb018b46
SHA512 0fe5e237fc2232d5b94e8bcbfb714baa6d73d5cd308743e01da86af9e35c349eea4d529e4d128e16652f49f7b2add9752ea5c7ecdc64fddc884aa4c3bae22c6d
SSDEEP 384:sxZqn5ZqqA/fDshWv2fHWvHHbATSKFSPRcW:s85AqA/fqY2fAHHbATHSPRz
TLSH
T18E820842A570697BCDDBD21DF902BB63E6F91472D5904E58A9FC8D1C00E6BED6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f1524d0d4bc36f9083c495e15ecf3e8b4781f1f0e3790d6006381ef7c89ff6d
MD5 91df3526c1aa85dced8aeffc7546bb1e
SHA1 097bfb0ec15793b7c1693f9907f0f65486b79af6
SHA512 223757b52c04264daf8fea1658a888d9ebd1c217d7f7d5afddd38837ec0f6df54953d5ed66ad2adf3559a766c1eb89d9a257fc0fa1ee40e453d73c53424d54be
SSDEEP 192:sxZORHyM/jK1Ml8MdA/fDsRf6Idpy6G7SoyXHW6+WNwTB0OC7QFYHXCSX+9gIg5S:sxZOZ1A/fDsRfTvlHbADFFa3scw
TLSH
T13A62D652AA7469BBCCDAD20DF941BF53D2F5447292900E54A9FCCA1C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 71ad816719fc46f0d71b47861e7a70c18f2b4a9508c1dbe830dd13b0540bce4b
MD5 fdd24562245fd00ca74e16c4f5ca5de2
SHA1 20c6b885b208fe573e4ee180924891fa41691ec1
SHA512 ba59af3bfb7859b888d0de9bbaacff217ffc7861b80c0225daf6189851c1fc6c1470728db8691617208cadf05eebdff30274295dda3ca1dd2505e495a7d0f7f5
SSDEEP 384:sxZqnHZq4PA/fDsRfsKvZHbAIeqFo8scw:s8HAKA/fmftZHbAIvo8sl
TLSH
T10F820842A570697BCDDBD219F802BB63E6F94472D6940E58A9FCCD1C04E6BED6203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e4ed47b63d039f71d61078b095854c932c21ee93b61dfcea8fef0069f1b07ff2
MD5 b4241a6968eb31c7a89389729fb90898
SHA1 4cf113120e240c4521449d8e9a64b21566caed9d
SHA512 2a041f4797fa5575b99c17190547f3541282f6243a2554e001a1529e9234dfaa9e08d5285a9916a6e1ee7894ed026ed318f32b226dcf43757f1983bfd121ae85
SSDEEP 192:sxZORHyM/jK1Ml8UQhdA/fDsRf6Idpy6G7SoyXHW6+WNwTB0OC7QFYHXCvX+9gIx:sxZOZqjA/fDsRfTvlHbADFFa8scw
TLSH
T15662D652AA7469BBCCDBD20DF541BB53D2F9547292900E54AAFCCE1C00E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 428dc701a73dd69fafadb27b317966fc55b7033886a7375abb11ea2b33d40591
MD5 05036a462e3e255c66fed88d49003f54
SHA1 3b5cd789ef40d2ae0f21d087ded7add4127e0e95
SHA512 505e44ef0393a05d92d950262ce9ec518a9e3b0c1b622d118ca3269e897e94f051720097599d32c7bd167f44413ef6d6ec0bf2c622bb7f0cb09a3b33c24b3af1
SSDEEP 768:GdUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RdroVD0x:GdUZYTMWvg09ou1ja7eLZmRWSx
TLSH
T1A0E20A2F280CCB7E4F844E9DEC2A6F963ED801CB5A584D544BEA894C03C77EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3ab7dd32-5088-420b-a499-877bc12f8b16\index-dir\the-real-index
Size 72B
SHA256 6adad0c2751e2015717e5218abc7aeec8fef8df0bd484ae6d660c56b202ac01d
MD5 ee3bb6a38ec69c27761f35e68a1c0207
SHA1 01cb6680c5db4488f7b8a6fd76cb2d4a82fa6e23
SHA512 5111b4c3780b9c02d2fcc3b8c4ad42ca45625a4c299572169cc37075ff7207c0e990e60922033e4e28ec3e1de97efbcee9d398e35e20a428bb58419f3dd8ae3f
TLSH
T117A002B301C18995C64853705483497522109D66A14402C743D5F0649870544650B808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afa6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3ab7dd32-5088-420b-a499-877bc12f8b16\index-dir\the-real-index~RFe5afa6f.TMP
Size 48B
SHA256 5681a8f6b88ad84cb94caefd6228d0fe9291690cbff170755840ef56941b0588
MD5 4318873925c02a0e5d79dc89176616e8
SHA1 3c153e969bd36a5eb0cf702db8d8a8b041b2a3d1
SHA512 f0d6493c1aef5a5c7853d234a33c7c418c6f2dac595f43f12b6f580532c88307e151e2f39f11a1f96023c85c9969da0f6c6e4a0b70a35942037f51727a5571d6
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\623cd082b6202da0_0
Size 61KB
SHA256 dc3354c664d5a2b342f4a566bbbe916e9f7b233486b74bb7c33141f6f1ed8c99
MD5 f21d8fbd1c1601d6a009c0475f026ed3
SHA1 f663765f6cf15c0fa08c02fd065121dec556b7d6
SHA512 fd000b3d340e62f2c29ad443e469a842089edf7dff7c16d07e6bef876b7e9ad3bd9b97bf6cafed6cddfacfb39a5fbf679f850cde12acba1ff52a7108aa0a2967
SSDEEP 1536:TFZmnuBHKut3JWWOQ7Dt3/YdslHqtyYJgnwbQp5HPwqpzGi/T:5YukgMgDtvYdIK187/T
TLSH
T133533AA7B1626135CBAD21D1A49A7F00F12B13461944C9ECF0BD66953B18E8B53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 d6daf536067ed301368a4abcbe16619f4a58310f5e90c26fec780ed911e0644f
MD5 56714ce4c0c0e50d83a0befa72dd2ec6
SHA1 48dc173acb3adb8898ab581d590628ddbb9da0e4
SHA512 2c31c09671a86d01e9ac3704828df15ebc51afb9b240ec4ca61af54e0d4ee38f5574e0b2499169dce4f1fcd15f3345b33c3b67235787bc815120e8515c18c8b8
TLSH
T1A4A002A802C1C211D05B12B01A92C14676824C200644931F70D50544C8D08D0624100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afa5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index~RFe5afa5f.TMP
Size 72B
SHA256 4a38c96c9642c8ad0f7998609b0ce2591bc7ca85a2d60de2286200ae849aeca7
MD5 5d404655ae06ed7ddd6b0067e2426a29
SHA1 ffd57c80ce23eddf092ff0ccf5e2cc9c3ceef176
SHA512 a3d6f0215c86e36cfea31a7fbcb72bf85df606ddb27f5cf9205ca9eb96b0c15128c51a98b4717f4157a3c853d9e852b5722da9a5cb6e9d03be9de72f9916efdd
TLSH
T1DFA0022003800055D81752B2955607811311CA216200D70740D14054CD565C09DC210C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 5a703fc81a1a613818acba1fcb8a1b8ed1f2b98f55f19ea56c1001bb3640ca54
MD5 f5d2989cc055396bea70be8c6fdd34f9
SHA1 6f91232250afcdd3d640d77edd8b2ded957a0067
SHA512 3fc7e557d47b5fe5f56d55c885e1356b4b1ac2eae5ddcb4a975879a61b546671969820c26f9297a604abd465bfbb8b418feb909f0f6cd8b2784063869c0cafcf
TLSH
T16951B50E4D422A6BDDAC02B328FB18D43779A8DD56449E47A49CA430ACC7A292D6D226
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afa6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5afa6f.TMP
Size 2KB
SHA256 af90dc985d4b604a7375bc18dcfbe0bd15ad0b4d2b4c332960317998d810e8ec
MD5 1b22f1d4ca58c33b2c6f92eae524a335
SHA1 51bde38a031a3d6b60036a3fa63b0996211a04a3
SHA512 a4afbd929f25c7ecb39888f66eb3079a3a77f8ca1dcb334eb2414be35fd388b4282e68b5639cdeee919cdfd740fadae54c0b4a7b0dcbea666521743874a7b14c
TLSH
T13451849A8E824639E894417709E3A8A437391900C619BF5374FC9636AC927AE3D0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\4f2277ea2139c475_0
Size 61KB
SHA256 f9b3082d09f09f468c42939b599c4bf22410048044126dbf073aa5f3de6dac6c
MD5 21716ab98e7e1a006c9cea91bc6e5376
SHA1 4363a26e8868d1436a873103da18b116f861c731
SHA512 44342da3303bc922e9660a7bd3c0bc56aba91e3974d76800fd820728cf3f7c863fe08a07f6a5c29d8df8f0f135c07387075c11aeb3d605cec48798d7efa7bb70
SSDEEP 1536:cfFZmnuBHKut3JWWOQ7Dt3/YdslHqtyYJgnwbQp5HPwqpzGi/Z:c9YukgMgDtvYdIK187/Z
TLSH
T150533AA7B1626135CBAD21D1A49A7F00F12B13461944C9ECF0BD66953B18E8B53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8b22c76-83d5-4ba5-a263-0cc9da1f9e0e\index-dir\the-real-index
Size 72B
SHA256 001d6d190795f8afa58ac3a399dbb55e9c0464cac634492718f4eb23dc3172bb
MD5 c9810efa06c39fc0d37328f46c862414
SHA1 23a46946f17d74d718f798c4ff65839deebbcda8
SHA512 f5ce2db132f998e1448eadbc616d3f1a9e6f3dabddeba17422e1ee0cccacbd773ca12387a5d18dbda1f3d32e82c4ed4179883455975bbbb7fe6d1f1fab433490
TLSH
T17CA0026081D5CFC0C01205B09247C1993B896E254409579D78D1055A8C656FD4503858
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 96fa815f16453edda04b11006f016a65b7f581a0d28829e141aba82151b089de
MD5 2a22f162d05c964f0e0d10ac52bc0ade
SHA1 370b88881c150957122e92a2c5053c685aafda15
SHA512 b82f01e89cab425bb1afd8bc297227f4ff87566d0d08bac0fb123453a0b0d7f7d59acb6bb1460ac960d17c8ad8e86d59256e442bde61730102c942062a919840
TLSH
T1AFF097A37EFB1800FDAFC3D74071A0A405557CA8C54DAD8E115A726680B2304154EC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 d3729d13eca975b6ba23ec477e0cbd67af5ec56e8681802ef66e4e099c6420b2
MD5 f3d78d498a216f6ab106e0384fc79cc8
SHA1 9c0dc4068a28f8402177c5c230131a96e2ac498f
SHA512 c5397fcbb7ddd67dcd744168299b36b3fe8873d889b3b6fb4106d5f0aafb8946474fc56647861027fe428b57042172fd75d6a74f0f224c1230b3818877416b37
TLSH
T1A0F097E37EFB0800FCAFC3E70072A064064578A8C10CED8F115A72A640B2304144ACB2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log
Size 9KB
SHA256 b8307f1dc096184f0102363fbcf6dcd6fbfeb67009437d08a1e2ddd7ac870b1f
MD5 e5e8e08382dcf70efd36b3d7e69fc4e4
SHA1 3d6fdf6d40f3794810baff001993cd64d34da44f
SHA512 bc32a3ce996a9ccae87223af24de15f0027c6330dfceba85c854ad6a236cdf28cf2f4eb96a628e75a2f86a4f03c9e09e26b9b6577af835947a0fc3b55fa3e72e
SSDEEP 96:F1m5HzJp6P1Vprkp6P5LpoRTQU4DTQs7TQxlTQqTQS:F1YHlg9kGmkDrIln
TLSH
T11212ACE3DB14A053C9C866FA2039F6D8551DCA067BFF87A615BC8F6E52412D23329B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 93f6b5bc2fae0c1ea820a0ae3e39c384ab11f7ada610e49023af6edf2cf4ffa5
MD5 df1b301804f60f0f4d4cd167017599ad
SHA1 4803de0ddcb04ab31e58032f97cda165094373bf
SHA512 b57b6e8c353e25a64b200744f4640a1b8a6147f4cbbcfff9e9dafc7f4c37961daf5f7774e07458d7450484bae836ad6cb50abc796c6760d68e0bfb78088dc2e0
TLSH
T150E0DF2819CEC279613564C70227870CE2E47527FBC8B9426F828CA56642504B192D90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d3ef611118755c7ba70eb956f54c3499cb2d81148c71e3faa62b435865345987
MD5 c0fbbe2c497efcb9caf72d531031c008
SHA1 eb782cb2067cdb28f1a9099248b1fae0abe6261a
SHA512 0b9706c48f07b00ec3969390a6f47dfda6c80f93263d32ff2c83b0703879101a85df9ddb254e0034d222616908e0b6cbf4cf85e6431d33c3ef3c53f27871dc83
TLSH
T123A00271CBA4D480C0044270DEA1054C5B80DCFD4948735952AC4454886904086E2505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afa40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5afa40.TMP
Size 72B
SHA256 89c6b42b7727d70ac49732dfd02c415bd441c89b292f1fa275a6da87177ee5a2
MD5 0e658cf0c311ef280efff2cd3af95861
SHA1 8ef35556e69f88e2a9095116e73a89da1642dc5f
SHA512 589f244e2d20e191d36eef0f5af4acb37468992af2a3eca4aa00ff00a41b4b1934de4ccefe55cc43aea2d213554a06f9ed02c871e609ea1a79edb15049218f0a
TLSH
T1E9A00253834B2508D45449B5A1076264535189AD0244120744D0D198EC910C055B110E
MD5 SHA1 SHA512 TLSH

Submit Download

9aae18bbc83c5843_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\9aae18bbc83c5843_0
Size 63KB
SHA256 fd1bd82a5b3fa388ea9a1c5ca6d669cec91e59854b169e0df98753eb0ff3cead
MD5 3f4b32c8971fd7394684313ba2018299
SHA1 4f0e7deda4bdf4968a8e9d4ad0e46cd9abbdfe01
SHA512 05173aa1bfe8509a0f989d76368a9c11200d92ed0eb290e7406f6c0dcef22f6825115e248127be7f12a1d92909ddf991d37df60e2f178f0f382716ba824b7985
SSDEEP 768:Io7D6c61j/SAXPeEFfgoAaWhrJTt9/XTghUyqxTBXSD74+EACmiQsNnTBVR8noGS:B61j5RmtRXNyqx9XY4JuqdV6no83iPj
TLSH
T165536BA6337178B3827BA1B190AF130B713ED167B404C4F8A198EEE54A54B9A0177F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ea2b42fa32a1313c34883f24c86233115cbf5f8e7c1f55385cee5a2a61aaca94
MD5 95f436b9d0365cdd1cf49627c798ffc3
SHA1 a80a7bf07944f949be5b2306e070469460f6f655
SHA512 852dc6c161ce720302c51ec6e89eddf80ed5a5a093f929184f35bde1ade0c0ba65d4ed41d0f2bc7fbddefc7ce92d1abd3f640b353d570f16490edb2361d7fba4
TLSH
T139A0023641942A42C02242B16B87429523188CA653550701D4E0004A98D85524261690
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\db
Size 44KB
SHA256 f97b5cf92dedc9c38ddae6e172597d8ee86896b5adee933fc0760a1a05ceb228
MD5 b27b201b2c106a6f58a891013da18ec2
SHA1 4d0c58d627d965e14b44bcfc5c6edbaeeb6b0891
SHA512 eb14cd516a1443a088c949df378a11a0a9bdb460b0a93ac5b455e2f567321f41f3f19c6a79cc88ace6f658edcf86e1d20af07153b1e97bdada5521a6fdea86dd
SSDEEP 24:TLovgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwqg8/Pq8cfBGT3eue/rtR:TVOIy4m1b3fbUbgqqdBJQt1zRGqq
TLSH
T184131E9F0E543486D1BD1536E4AB4FBF193F248C4B83B9D065B055B38CA2028596FA3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 187B
SHA256 65fa6a87430959acbab42cebfa69d7d58eaf94119bb0c4aef2acac4fe40c9d48
MD5 7b93deb32078eb5c23f2978f3ec6f1db
SHA1 494ea067d7f03e3312cbac352ab96c958ca8fd86
SHA512 e4a91d66a082f213f3d06c7287063497e3a7f4488359b3d63771f4f27cf87c8156b8d4d70ddfceda590ca30f6773e026f39d9c39e869eb2250f2a62b5f9e608f
TLSH
T1E3C0CC20FB000203CEBB0E3828B22B82CB30EC02002002038E0CEC320E023B8FC000E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 8d645eb6cd1b9fda6c958a0f074395927f2dfa12fc99b97f635c6b37613ac97c
MD5 e0fdb33adc8024d6f3e4beb1fce14ad6
SHA1 3b0f5a821813bf666f7bb4b38316c6d96f8e029a
SHA512 c04c00dd6dade9d8a0fb8b58338711b1d4514aa916dec1e8c9231c989a99b033011eb6e28fa3441bb84e3b1a3193f5609bf03c90cea0d741c2716c2ed663d4d8
TLSH
T162E0D87429CAC72AA276208B522ED708A2E37516FBC9A9517F49988873062507787DD1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 0a89a747894657e2c6d5f531bcc37ff3c54de1a6e65e2216f308cf37a03ccb58
MD5 2d9b7627ae8c387042f0dc2a0850ce9c
SHA1 0561412e0c5bfda4cd4ad1328c2e6af304b0790b
SHA512 96cbf7a43eb171ac9ddd598205561de9bcae36637e6f7d7af746296e9983113b8fd45449c10682ac89a1fe1176594c34c2ff7b3e33f8f8c14f160a0780bb3d47
TLSH
T139E020B459C5C739953060C7427D970CA3F17916B7C57941A7484C88720222077E9DD0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ea5336d4234822b242e53ccec66c11556019865879c7d6ed8d8236e281fe67a9
MD5 7c5f358c6c7e642b88beae6dcf492a69
SHA1 0f9a8ab172a86bc4eebc8d5ca99f7fa1f83109da
SHA512 a5ed94cc218885d544210a586550cb905099f90819435ccc64a14385f9baccffc851c738fe31099f3f4b66af28a68ad0102eae4ce0fda90a43cf3414051b3d4f
SSDEEP 96:KA1eK2A8e8KziWa+EKLqUy8K7iSiKkKf6H:EWDXgfnY
TLSH
T189D1069670BA82513D7F2B088794C7568E8273633418E53B7BAC40B65E27E249CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7e1e652-8033-4ccb-ac04-a83f5f411bcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7e1e652-8033-4ccb-ac04-a83f5f411bcc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59677a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59677a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df741a76c7a1b72f296ba5258e39cd00b2fc75e7efc08131766bd7254e6d41c1
MD5 509aa7304cac4eede5e731df18e6b850
SHA1 d17b6441489cf1e4d018b0ede917040026079877
SHA512 28a86fa27bed45433b7e096026e29f57767c28881c3a5c52e7c3967e510a12d758fecb1d63e4b8e58db877aaa373d8454b2a152dc6adc9cd7db1f890a1d9a7b6
SSDEEP 384:tAZcIhsNjUXQ4x74UZzX5od+s8YxiXTX6HlytEDq1CWs:t+h16UhOlaTXoy6DqQWs
TLSH
T1FD927D3195786C7B9EE7B155F84A35138FF89027EBC86FC492ED6B1C00C92A9131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 7ddc482b26f65bdc7281ebafa1d17f2f975969a973767f88852f4b3f93da92fd
MD5 96eade17f9087425e4399bd4031ab15b
SHA1 21ffeb6aba02c9204b7943477515622abfb169ec
SHA512 2e2b348c6cd6e3e50f03230fb035a0c98b6d58b1a9e79472627ed0534de9fdea9147cce7a748de2411c9da97e2771bc357501d6392ff03f3c852546a4b021d37
SSDEEP 384:n43iFKZcIVRsNE8TUNTUlIlfTZ4xoNizX5od+s8YxiX2PD6HlytEDq1CW0Hx/7Iu:4yFovPwgsuWOla2PDoy6DqQW+
TLSH
T130D217F244D7987AD9AEA747A77D2E129EFCC013B5846A90B3D85A1CCC451BFC30B815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0112a737e529ae93f9e0403a43df95d346b5bddcd0f3c8af4e47b11fc0fbad98
MD5 49a556ac5c4c914df053efac104c7a2c
SHA1 79e1364492f367a0d0922274b61d28ebb3fc4ecc
SHA512 b2ee5f4ea9e2fe27891d7f505bed5e37f32d305ec39ebd00ec2efd7c22ffa6ef09df096a1f813ee4fd25fdf6bb2b1b70daa0a793ddbf21facdfcd561d1791715
SSDEEP 384:E3iFiZcIVzsNY8TUNTUlIlQQ4x7rUi2zX5od+s8YxiXdX6HlytEDq1CWs:EyFQtdwgg5UiqOladXoy6DqQWs
TLSH
T187D22AF244E7983ADDAE6743A77D3D128EBCC017B584AA90B3D85A1CCC861BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3efb573943bb593b504f63b2a1f8116908100259318269217fce99b6f16baecc
MD5 a16da2811a60f4a77af70f98c20db18b
SHA1 94af39b9dc83b2621e59371d9ea0946d38d8d00a
SHA512 9bc4da3f62cacf8a8a8d13e237f0fdbdbd40584a61ee0e13750691769156a3ca13ffafd9f4b892f665566014cd99254fe6a77dd121938c9f42c8faa01caf8a9a
SSDEEP 384:E3iFPZcIVRsN38TUNTUlIlfTZ4xopizX5od+s8YxiXKX6HlytEDq1CWs:EyFHvAwgsYWOlaKXoy6DqQWs
TLSH
T13DD22BF244E7983ADDAEA743A77D3D128EBCC017B5846A90B3D85A1CCC861BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba25043cf7a3ca1e2179dd76cd6b2a573851b2b76bd856b72fdf5cd9d4565cac
MD5 5d069f691be0d077b1b612a0036ee414
SHA1 beab945608ff96219a266bc5294d44a2246c0461
SHA512 4db8e0951fd6da42d9237759c5a962d798a30f0605826b2ed4169853973d37972ebf1adbe7468f84f925b61eedfa52fca103476bf128e443e952e3962c07ef9a
SSDEEP 384:E3iF2ZcIVRsN38TUNTUlIlUQ4xEGi+zX5od+s8YxiXlX6HlytEDq1CWs:EyFkvAwg0PiSOlalXoy6DqQWs
TLSH
T1CAD22AF244E7983ADDAEA743A77D3D128EBCC017B5846A90B3D85A1CCC861BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3f797543707f237d4a5a4c27641fda91c67f16b68c1c123346026a67cbf3dc51
MD5 00f67e4b17781b149a996cf03f46b054
SHA1 cbcabc86cb19939dfb76dbc40a12458b3019188f
SHA512 6554bf31169804c01ad92260cafa7f838a557923166067f0fb91e0b0974d3ec3248b3ce3d88839f2b4b9a10fb3e45566b5208bde47f5e473a780775a09b0ded5
SSDEEP 768:EyFovwwgsOWOlaK0U4j69aNVcoy6DqQWs:EVvx4lWlsmTf
TLSH
T1DBF25BE184D65CBAC9ADABC7A72DAD025ABCC037B4845958B3F4652CEC4B0BFD302811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49983a042380a176fd9d046546183cb4465b04318c99aee76490dc5958ce8938
MD5 4a69906e062d6d6b14235f764d88b450
SHA1 47cfb1aa00a2fa0a20b1516b9fdad86bb8127c5f
SHA512 c067197ee525c1382d47cac342223b054610fac287e029b758ffdeb868568fc482994ce6f266a832cc516422cb146f064c51f40aff4d139c3caa798950de4a32
SSDEEP 192:zONR61yWQmiUyQRCbGX5Obd+jgjzorYyRNMiX1UjJ6qvU6:zONR6bQbGX5od+s8YxiXyXU6
TLSH
T19A12E832A468BC6B5DE2B555B44B32139EE5512BEB896F80D2EC2F1C00DF69C131AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9a5358f93406ec563574617e4caee80ec952cb130f272a4723d1f89fc2247a25
MD5 d18dbc70ba5a87a8ac6ca5412a899cca
SHA1 619882823a79f189e03c22225801fbf03e81034f
SHA512 25066b1741eaff97b3c2c26e80d468417ccc1da3285ea5a46cf96c3d93340d17ca441cd2ccaa7c9c078574afb43566890635ab85690477882df86c316c15cafe
SSDEEP 384:MAZcIhsNjUQQ4x7fUi2zX5od+s8YxiXTX6HlytEDq1CWs:M+h6FUiqOlaTXoy6DqQWs
TLSH
T13C927C3195746C7B9EE7B155F84A35138FF89027EBC86FD492ED6F1C00C92A9130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 2f8b643328e2720c0cdd9a863152b6f7eab777dc491d58c58fc453e64bbe38e0
MD5 daa8e1c3eed4f55e5d42cb1c45a403a1
SHA1 94834626c1de42be1475869e752c152789702bbb
SHA512 d624c6661383cb8b78a4141d27a80e02dbc1d6ff7c67005e46524aed36d793ff1145538e4b41ca774c906ac8d4f7d718b6d5aa3a3a693dac3a23367cb3d3e40c
SSDEEP 384:n4viFKZcIVRsNZ8TUNTUlIUfTZ4xoVizX5od+s8YQ/DtAzKy/K/1hJ9MHlytEDqM:46FovywgHkWO0rKGQK/1hJ9Gy6DqQW+
TLSH
T1BCE22AF144D79CBAC99E9787A77D2D125DBCC023B5845A58B3E8692CEC4A0BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 20e06b874522ed0c2d7424f0b8b9b83edcf2dd10395b818020096829a4edf794
MD5 30241224c16cda62d916248c95f3271f
SHA1 429024f988f91836aa3ca91ef890a03342b38196
SHA512 67906e3134b03a3170f60fd44e085b84fd0d20dead37456f8ddbdbfb82e2f81d79670c6f8431339aa8de098e0893e36a4b5f56143cf5899483e46bc4c4f282cf
SSDEEP 768:EyFovwwgsHWOlaK0U4j69aNVcoy6DqQWs:EVvxplWlsmTf
TLSH
T138F25BE184D65CBAC9AD9BC7A72DAD125ABCC037B4845958B3F4692CEC4B0BFD301811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 3801430101d1db2a5182f2034b22d7f8f0f7d68563bd47d17c0036fcc8f9ee21
MD5 b396ae37f38e608f281bec634e168d00
SHA1 b8310644c18c72ed69130983362b7a5ca2be22a1
SHA512 5c75169f8f768e761bb68b3201aa1acb9e706af53b2ec3dc99277e33bcec0ab555da0c62bff6a4c24c4df5ef02d372321f8a564b6f5578c8d326ec52351f4454
SSDEEP 24:TLc5UOl0afDdWec9sJMuXVMmrss5ejB5fc:TA5UUDbg38ahs5eDc
TLSH
T11692C122B9342067E89F1B76F9834CA10DFC13AF8D677404D9A00DD11962BC56F955FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b47d1ef738101ab4970aed8437d7ae11b6776ce02ed68761fb9ec2f8fdb14eb
MD5 969a7e26771cc255e2e17c9bad9bc357
SHA1 5ee8589ee50f32f1cb08a84f5482eb745c60f8a7
SHA512 e811f1464e6e8d1accd8e55f2c2402ed7ef0eb55c6eb2a336e749b91013160e8765919c914bbb23f65ddab765ee00ca36e6a37784293a92d6794edcfa6fabb3d
TLSH
T11AE00206E31440EAC029433420031F201FD0C10401B213474735025E6C7B3143D20BB0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 10c127de8935732e1f943f90839f8f500c6fc090607369f284a316538e10e57d
MD5 4d64ad338c4fc001f256e21b2b211dda
SHA1 7df4b4db8ab48a5748472d2396cd4ce4c0573fbf
SHA512 86262427e086c40eabbd152f013139485fc299b447d97540d7edddb20db2697b126fc9d07276aa63e2e0e43b594da585a1abdab795cc975956aa167f88be4bba
TLSH
T13DE00106A31440EAC029473420031F201FD1C11401A213574B35029E6C7B3143D20BA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59c440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59c440.TMP
Size 392B
SHA256 e6a7d279a7d0ee1ebeaced8072308d86f65357e61204f14d169ed79769dc79d5
MD5 5a32d4139b565b5ec88c8ce842bb6781
SHA1 9c28565d6b301465e547b847947c7d1802574b69
SHA512 7d3eba3dd30ad9a7312bc7999fcf7b0195580883dc34d3e0ff4adde19172319e453b09aee592d39f4df5e95f0aeec470fa1c8040070a6b6a9cab2236c761c823
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 01a13150013ff3583ded0c3caf00dce6410b00aec1361fa39bcf4bf694db70e6
MD5 1f38c0da935dbc05f66898201f8ff8f3
SHA1 673d2551356ede99d5cda9079d2d871025d39d4d
SHA512 163048281e2f23ba91d08ba87e50f602fbae3814c8f258f99a19154dc6f75d10d9c5cfc8494b56ed3faa0d968e2e498fffa67502b9cb312043336023c6dc122b
SSDEEP 3:MsEllllkEthXllkl2zEgltnR6/:/M/xT02zjv6/
TLSH
T1A6440404FFC04505C5405071C531C35C13F0D4540535574334550C17DCC55414C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

bd2ed3b2-eb32-48ab-b0dd-617742aec421.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd2ed3b2-eb32-48ab-b0dd-617742aec421.tmp
Size 8KB
SHA256 8788d3e9d5969b89b6f791d794c4e2e5e6b62add65143cfad21b559c30e2fa58
MD5 02a982c397f1474d844f8cbe730e7af2
SHA1 897ddf8cc2bcdd766c9fac6deb854051f9693e64
SHA512 e82d0e2b3cb5bcc26db18fa24d4b9c642829bdfd008de8917f64fc2503bea716f917f535244cfae5dba8d4bf473f3d236fd294c6304ade3e0f6d06dbb05ef748
SSDEEP 192:yONn61VWQmiUyQ+CgGX5Obd+jgjzorYyRNF/a83PmU6:yONn6WbgGX5od+s8YB8mU6
TLSH
T12602C735A8687CAB8EE3AE49B44737135FE4106BEA956F80D6EC1F1C009765C2346937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c4412c10-224b-4d62-b12f-97b5d7d0036a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c4412c10-224b-4d62-b12f-97b5d7d0036a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a4f2e86fb65a10991531abb6f100e2659b3be5a85934788dfca4ba13952fd850
MD5 af5494cd668fc297513bf033bd4f1456
SHA1 09d58486f57ca5b0f18cdceb17d0d8381676ec92
SHA512 8e76e439519e870dc412e8ab5818a93888ad92c7362715fe0d9a33442f5e488b7195f25d14b0bfbe58eabce50a2ef366357266b5174b01abf0c8de71657eeaa2
TLSH
T1EA411858BBF91108B3B36E56ABF6A96E487EB8772E0AD45D00010E4F0622B40CCB1733
MD5 SHA1 SHA512 TLSH

Submit Download

0a078c5d-e000-4fe5-87d3-04bd6d4a5e40.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a078c5d-e000-4fe5-87d3-04bd6d4a5e40.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6000_1745275177\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a993198c-2abe-4156-b3af-f10536e7bad1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6000_380415115\a993198c-2abe-4156-b3af-f10536e7bad1.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5d3d0c.msi

Path C:\Windows\Installer\e5d3d0c.msi
Size 860KB
SHA256 217086cf53124731dcc96ca0d060a00c076f0ed0bc43bc49b92573f35c84f614
MD5 9aa2d782c2474614301f5f484049ef00
SHA1 93ed79ecb4810a21beb4bbdc947b684198a4fb5b
SHA512 e464c29ad2bb1ba81a5a842daad99e2e68a57458100057a5affec09bcfcf4427e4592a8e0b4553604ac2901e9062daabb86a9e078f933d531caac84639b0a1c9
SSDEEP 12288:A3QIYBpY8Wiz+sPMSiEdkLhRI7V8W9IzMRJ59H0PvmyKaF5UIGACl5DprdAKbgof:KxvMMS3mou69H0PvmJabil59uKhf
TLSH
T17015234E21746713CCD016315A57EEF36A389E8B4B51EAB322E0F8046A7BF585378DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-2559-0x0000000500000000-0x000000050023A000-memory.dmp

Download

memory/1376-2562-0x00007FFBA6B60000-0x00007FFBA7195000-memory.dmp

Download

memory/1376-2561-0x0000000500000000-0x000000050023A000-memory.dmp

Download

memory/1376-2560-0x0000000500000000-0x000000050023A000-memory.dmp

Download

memory/1376-2558-0x0000000500000000-0x000000050023A000-memory.dmp

Download

memory/4608-2547-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2545-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2546-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2554-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2555-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2556-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2551-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2557-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2552-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4608-2553-0x000001DDAC180000-0x000001DDAC181000-memory.dmp

Download

memory/4840-2652-0x0000024F700E0000-0x0000024F7019D000-memory.dmp

Download

memory/5572-2653-0x0000021764720000-0x00000217648F6000-memory.dmp

Download

memory/5572-2654-0x00000217754C0000-0x00000217758C3000-memory.dmp

Download

memory/5572-2677-0x00000217646D0000-0x000002176471A000-memory.dmp

Download

memory/5572-2700-0x0000021768E10000-0x0000021768E11000-memory.dmp

Download

memory/5572-2699-0x0000021768DE0000-0x0000021768DE1000-memory.dmp

Download

memory/5572-2698-0x0000021768DC0000-0x0000021768DC1000-memory.dmp

Download

memory/5572-2697-0x0000021768DA0000-0x0000021768DA1000-memory.dmp

Download

memory/5572-2696-0x0000021768D80000-0x0000021768D81000-memory.dmp

Download

memory/5572-2695-0x0000021768D40000-0x0000021768D41000-memory.dmp

Download

memory/5572-2694-0x0000021768D30000-0x0000021768D31000-memory.dmp

Download

memory/5572-2693-0x0000021768D00000-0x0000021768D01000-memory.dmp

Download

memory/5572-2692-0x0000021768CF0000-0x0000021768CF1000-memory.dmp

Download

memory/5572-2691-0x0000021768CD0000-0x0000021768CD1000-memory.dmp

Download

memory/5572-2690-0x0000021768CB0000-0x0000021768CB1000-memory.dmp

Download

memory/5572-2689-0x0000021768CA0000-0x0000021768CA1000-memory.dmp

Download

memory/5572-2688-0x0000021768C80000-0x0000021768C81000-memory.dmp

Download

memory/5572-2687-0x0000021768C60000-0x0000021768C61000-memory.dmp

Download

memory/5572-2686-0x0000021768C40000-0x0000021768C41000-memory.dmp

Download

memory/5572-2685-0x0000021768840000-0x0000021768841000-memory.dmp

Download

memory/5572-2684-0x0000021768A40000-0x0000021768A41000-memory.dmp

Download

memory/5572-2683-0x0000021768A30000-0x0000021768A31000-memory.dmp

Download

memory/5572-2682-0x0000021768910000-0x0000021768911000-memory.dmp

Download

memory/5572-2681-0x0000021768290000-0x0000021768291000-memory.dmp

Download

memory/5572-2680-0x000002175F420000-0x000002175F421000-memory.dmp

Download

memory/5572-2679-0x000002175F3D0000-0x000002175F3D1000-memory.dmp

Download

memory/5572-2678-0x0000021774210000-0x00000217742A3000-memory.dmp

Download

memory/5572-2676-0x0000021764670000-0x00000217646C7000-memory.dmp

Download

memory/5572-2675-0x0000021764660000-0x0000021764664000-memory.dmp

Download

memory/5572-2674-0x0000021764650000-0x0000021764654000-memory.dmp

Download

memory/5572-2673-0x0000021764640000-0x0000021764644000-memory.dmp

Download

memory/5572-2672-0x0000021764630000-0x0000021764634000-memory.dmp

Download

memory/5572-2671-0x0000021764620000-0x0000021764624000-memory.dmp

Download

memory/5572-2670-0x0000021764610000-0x0000021764614000-memory.dmp

Download

memory/5572-2669-0x0000021764600000-0x0000021764604000-memory.dmp

Download

memory/5572-2668-0x00000217645F0000-0x00000217645F4000-memory.dmp

Download

memory/5572-2667-0x00000217645E0000-0x00000217645E4000-memory.dmp

Download

memory/5572-2666-0x00000217645D0000-0x00000217645D4000-memory.dmp

Download

memory/5572-2665-0x00000217645C0000-0x00000217645C4000-memory.dmp

Download

memory/5572-2664-0x00000217645B0000-0x00000217645B4000-memory.dmp

Download

memory/5572-2663-0x00000217645A0000-0x00000217645A4000-memory.dmp

Download

memory/5572-2662-0x0000021764590000-0x0000021764594000-memory.dmp

Download

memory/5572-2661-0x0000021764580000-0x0000021764584000-memory.dmp

Download

memory/5572-2660-0x000002176D050000-0x000002176D054000-memory.dmp

Download

memory/5572-2659-0x000002176D040000-0x000002176D044000-memory.dmp

Download

memory/5572-2658-0x000002176D030000-0x000002176D034000-memory.dmp

Download

memory/5572-2657-0x0000021768E80000-0x0000021768E84000-memory.dmp

Download

memory/5572-2656-0x0000021768C90000-0x0000021768C94000-memory.dmp

Download

memory/5572-2655-0x000002175F3B0000-0x000002175F3B4000-memory.dmp

Download