c2d1a731986c705ce035969b00f8fb6329f6511053019708274df31058ed3a3d

Resubmissions

04/08/2026, 02:31

260804-cz1jwabf377

04/08/2026, 02:12

04/08/2026, 01:48

04/08/2026, 01:28

04/08/2026, 01:08

Analysis

user interaction
yes
max time kernel
480s
max time network
487s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vozolomis Setup 1.2.6.exe
Size 74.1MB
Sample260804-bvr69sttdx
SHA256 c2d1a731986c705ce035969b00f8fb6329f6511053019708274df31058ed3a3d
MD5 f0151fd77001c5ec63bdf04b0c5278d6
SHA1 ae0c77b089678eea397b702c152e7a52389c30c7
SHA512 c8381ee82a9d7bee48f33ce985cd1ca05110f8c1d91efc499775cd46fb66be8a28f0bd792c5471c4a6661514d98be6e4ccff0ab69878520c812827f192038b9f
SSDEEP 786432:x1VDG3sSMiP2aCCTt3IUf/zUNUgPV1szg8iYjHmxc9j4aIgpx3un+o/ZNnAkNt3w:HVDG5MiP2aVxUXd0jHmy23/ZNnAy9Rwn
TLSH
T1CA08DF1663E112AAD577D138C7AB6603EB72B407133087DB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
5096	Vozolomis Setup 1.2.6.exe
5096	Vozolomis Setup 1.2.6.exe
5096	Vozolomis Setup 1.2.6.exe
3940	Vozolomis Setup 1.2.6.exe
3940	Vozolomis Setup 1.2.6.exe
3940	Vozolomis Setup 1.2.6.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe
File opened for modification	C:\Windows\system32\eventvwr.msc	mmc.exe
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1403168612\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1403168612\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-shared-components\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1856462515\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-tokenized-card\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_267246202\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_636377934\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3760_531745596\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4484	powershell.exe
1232	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe
2604	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3428	EXCEL.EXE

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5732	msedge.exe
1768	msedge.exe
1064	msedge.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302811624653066"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{91195115-056B-4FCA-A13D-94CAFA09D52F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{0933AEBF-046C-46F4-9E35-881B35D0F087}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{E7F9B4D2-E1EA-45D2-9062-7F98D44ED5CD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{2DE7DBE0-E5A1-4235-9E32-CE6F2EBF219F}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
3428	EXCEL.EXE
3700	Winword.exe
3700	Winword.exe
4996	Winword.exe
4996	Winword.exe
1088	Winword.exe
1088	Winword.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4484	powershell.exe
4484	powershell.exe
1232	powershell.exe
1232	powershell.exe
1232	powershell.exe
3760	msedge.exe
3760	msedge.exe
6124	msedge.exe
6124	msedge.exe
6080	msedge.exe
6080	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
2556	mmc.exe
5208	OpenWith.exe
3112	OpenWith.exe
2176	OpenWith.exe
3232	mmc.exe
1344	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1344	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeIncreaseQuotaPrivilege	4484	powershell.exe
Token: SeSecurityPrivilege	4484	powershell.exe
Token: SeTakeOwnershipPrivilege	4484	powershell.exe
Token: SeLoadDriverPrivilege	4484	powershell.exe
Token: SeSystemProfilePrivilege	4484	powershell.exe
Token: SeSystemtimePrivilege	4484	powershell.exe
Token: SeProfSingleProcessPrivilege	4484	powershell.exe
Token: SeIncBasePriorityPrivilege	4484	powershell.exe
Token: SeCreatePagefilePrivilege	4484	powershell.exe
Token: SeBackupPrivilege	4484	powershell.exe
Token: SeRestorePrivilege	4484	powershell.exe
Token: SeShutdownPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeSystemEnvironmentPrivilege	4484	powershell.exe
Token: SeRemoteShutdownPrivilege	4484	powershell.exe
Token: SeUndockPrivilege	4484	powershell.exe
Token: SeManageVolumePrivilege	4484	powershell.exe
Token: 33	4484	powershell.exe
Token: 34	4484	powershell.exe
Token: 35	4484	powershell.exe
Token: 36	4484	powershell.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe
Token: 33	2556	mmc.exe
Token: SeIncBasePriorityPrivilege	2556	mmc.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1312	MiniSearchHost.exe
2556	mmc.exe
2556	mmc.exe
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
3428	EXCEL.EXE
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
5208	OpenWith.exe
3700	Winword.exe
3700	Winword.exe
3700	Winword.exe
3700	Winword.exe
3700	Winword.exe
3700	Winword.exe
3700	Winword.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe
3112	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4456	5096	Vozolomis Setup 1.2.6.exe	81
PID 4456 wrote to memory of 4484	4456	cmd.exe	82
PID 5208 wrote to memory of 3700	5208	OpenWith.exe	97
PID 832 wrote to memory of 4568	832	msedge.exe	99
PID 832 wrote to memory of 5732	832	msedge.exe	100
PID 832 wrote to memory of 1900	832	msedge.exe	101
PID 832 wrote to memory of 1900	832	msedge.exe	101
PID 832 wrote to memory of 1900	832	msedge.exe	101
PID 832 wrote to memory of 1840	832	msedge.exe	102
PID 832 wrote to memory of 1840	832	msedge.exe	102
PID 832 wrote to memory of 5176	832	msedge.exe	104
PID 832 wrote to memory of 3208	832	msedge.exe	105
PID 832 wrote to memory of 5176	832	msedge.exe	104
PID 832 wrote to memory of 5176	832	msedge.exe	104
PID 832 wrote to memory of 3208	832	msedge.exe	105
PID 832 wrote to memory of 3208	832	msedge.exe	105
PID 832 wrote to memory of 4736	832	msedge.exe	106
PID 832 wrote to memory of 3252	832	msedge.exe	107
PID 832 wrote to memory of 4736	832	msedge.exe	106
PID 832 wrote to memory of 3252	832	msedge.exe	107
PID 832 wrote to memory of 2040	832	msedge.exe	108
PID 832 wrote to memory of 3472	832	msedge.exe	110
PID 2040 wrote to memory of 4960	2040	msedge.exe	111
PID 832 wrote to memory of 4624	832	msedge.exe	115
PID 832 wrote to memory of 4624	832	msedge.exe	115
PID 832 wrote to memory of 4624	832	msedge.exe	115
PID 832 wrote to memory of 3760	832	msedge.exe	116
PID 3760 wrote to memory of 2408	3760	msedge.exe	117
PID 3760 wrote to memory of 1768	3760	msedge.exe	118
PID 3760 wrote to memory of 2508	3760	msedge.exe	119
PID 3760 wrote to memory of 2508	3760	msedge.exe	119
PID 3760 wrote to memory of 2508	3760	msedge.exe	119
PID 3760 wrote to memory of 4636	3760	msedge.exe	120
PID 3760 wrote to memory of 4636	3760	msedge.exe	120
PID 3760 wrote to memory of 2460	3760	msedge.exe	123
PID 3112 wrote to memory of 4996	3112	OpenWith.exe	125
PID 3760 wrote to memory of 3744	3760	msedge.exe	126
PID 3760 wrote to memory of 1824	3760	msedge.exe	127
PID 3760 wrote to memory of 2324	3760	msedge.exe	128
PID 3760 wrote to memory of 1056	3760	msedge.exe	129
PID 3760 wrote to memory of 1056	3760	msedge.exe	129
PID 3760 wrote to memory of 4600	3760	msedge.exe	130
PID 3760 wrote to memory of 4600	3760	msedge.exe	130
PID 3940 wrote to memory of 2604	3940	Vozolomis Setup 1.2.6.exe	133
PID 2604 wrote to memory of 1232	2604	cmd.exe	134
PID 3760 wrote to memory of 3088	3760	msedge.exe	137
PID 3760 wrote to memory of 3088	3760	msedge.exe	137
PID 3760 wrote to memory of 5324	3760	msedge.exe	139
PID 3760 wrote to memory of 5324	3760	msedge.exe	139
PID 3760 wrote to memory of 4252	3760	msedge.exe	142
PID 3760 wrote to memory of 4252	3760	msedge.exe	142
PID 3760 wrote to memory of 6124	3760	msedge.exe	143
PID 2176 wrote to memory of 1088	2176	OpenWith.exe	145
PID 3760 wrote to memory of 4564	3760	msedge.exe	147
PID 3760 wrote to memory of 4564	3760	msedge.exe	147
PID 3760 wrote to memory of 3048	3760	msedge.exe	149
PID 3760 wrote to memory of 3048	3760	msedge.exe	149
PID 3760 wrote to memory of 1984	3760	msedge.exe	150
PID 3760 wrote to memory of 3048	3760	msedge.exe	149
PID 3760 wrote to memory of 1984	3760	msedge.exe	150
PID 3760 wrote to memory of 1984	3760	msedge.exe	150
PID 3760 wrote to memory of 2068	3760	msedge.exe	151
PID 3760 wrote to memory of 1000	3760	msedge.exe	152
PID 3760 wrote to memory of 2068	3760	msedge.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Vozolomis Setup 1.2.6.exe
"C:\Users\Admin\AppData\Local\Temp\Vozolomis Setup 1.2.6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4484

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2088

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4404

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\mapping.csv"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\cv_debug.log"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\DisableEnable.xhtml
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff86794c188,0x7ff86794c194,0x7ff86794c1a0
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,18067072555887518489,16233474523159747761,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15413585286998994390,12468591788184478032,262144 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,15006350607360248944,12823955393019706956,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,7759057033005864398,5481911790531322536,2097152 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,746658133801795656,17483663276204784086,2097152 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,17961456533526169281,10466357871322889779,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,11490717847292812277,264274690811389595,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,15473753911011564690,14983501221648146438,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,18285710693972209307,6267528625767294922,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,18285710693972209307,6267528625767294922,524288 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6292,i,5013023487300379316,17635659997505889344,2097152 --field-trial-handle=2316,i,4565736561353853879,7616307503782107500,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff86794c188,0x7ff86794c194,0x7ff86794c1a0
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,11304911862425431583,15378613607116877174,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,16069191361719709072,14394795832101028177,262144 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
    3⤵
    PID:2508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,1541740542903403741,10359148421736212871,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,13954803251712114216,16359975831251624361,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,13954803251712114216,16359975831251624361,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,14505970797284163693,6733158646332357996,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,849681230696578244,3454269096435247978,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,10882779919103158541,10830466716524300819,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,6977993114735274549,5229009212444947532,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,12124826513065790631,6207084089318557248,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:14
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,40487381372090408,2035887039946258973,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,9781595489397285432,11329059236239045010,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,13343497719743944768,5448606261716131527,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4600,i,6329626663106197332,13263650264911377667,262144 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,7864849757212669111,7500512860053882381,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5112,i,5871266640770977833,4448311657532649944,2097152 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5108,i,6699476797594373033,1235605870062022867,2097152 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,11481011440255726526,17822444880518081565,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,13743806395414268405,4246374033191480380,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,9348870824956971499,9725386025864242171,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,9348870824956971499,9725386025864242171,524288 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6276,i,14697136259465923722,12057424318036842091,2097152 --field-trial-handle=2704,i,8861513860305901477,3012565391073185735,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2e8,0x7ff86794c188,0x7ff86794c194,0x7ff86794c1a0
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,869096096158260385,14379186728748871589,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
      4⤵
      System Time Discovery
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,1784229660615520753,12728577628109852572,262144 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,4600383606602500646,17369129744518117187,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,11020305287546184160,8865702235216623392,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,11020305287546184160,8865702235216623392,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4868,i,14724423745889547722,3921729801976289870,2097152 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15051899202293205138,9447446948718350261,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,4890314113079389862,4051215816213846463,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5596,i,604691142073177713,17731244283152703467,2097152 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17755606336129712819,4225839293255763311,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,5003636067725188919,1337284276177874054,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,13784632255201612334,6432225724358552795,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,16005016119942373261,1702377255268736217,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,17136936676524791866,16540564613314986001,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6720259706349749604,34927830913526752,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,14623085742501337362,2584444277039062032,524288 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,4920595856548866885,17917851699523161812,262144 --field-trial-handle=2152,i,17866841904532504955,10156263219135147138,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\{25E1E6AC-9EBD-4638-B5AD-8A2C4BD66E4A} - OProcSessId.dat"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  PID:4996

C:\Users\Admin\AppData\Local\Temp\Vozolomis Setup 1.2.6.exe
"C:\Users\Admin\AppData\Local\Temp\Vozolomis Setup 1.2.6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\cv_debug.log"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1136

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:3232

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

@primno+dpapi.node

Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
Size 134KB
SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
MD5 5dc8861862329b3b4122314922be3ed9
SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
TLSH
T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Users\Admin\.cache\pkg\83e01b565231e035038f13df6c559bfd6a0199a5f2850684be28b268c51f4e75\koffi\build\koffi\win32_x64\koffi.node
Size 2.3MB
SHA256 83e01b565231e035038f13df6c559bfd6a0199a5f2850684be28b268c51f4e75
MD5 94b81851afafe9664280bffa122d50df
SHA1 4b32ca954b759debe983de187f6a014da75ea92c
SHA512 001bf016f8c6b2c572e51a60032f7a5c28d645bf8bb4d3faab437374c4ab99fb7fa3df773f3242630d428b06870bdf18452134b6a4bda3a53b575c83630b90f4
SSDEEP 24576:doaZnAccPMk0XHXKPpSoY03rfvk8sFnRUSf9uw2C2219kuyU3J14cL2J+ETbJssg:doan2C22zTyU51P2J+OMJ
TLSH
T1B7B5DE064758C8E9D83EB022B4177776E56A221B083D52DF04F48D62086ABFD5DAFFC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_sqlite3.node

Path C:\Users\Admin\.cache\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node
Size 1.8MB
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
TLSH
T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3B7CEBA4139B7484BAF665AC9E712D61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B7CEBA4139B7484BAF665AC9E712D61
Size 1KB
SHA256 c102d88cd5b72f2a10c0758ec8defd19b58762f4237ea7b6ab43b172e54b1553
MD5 b56cd9ce0f8b622c4b5033fb933f0f3c
SHA1 177c6483a31a3b5472dc4a5883a89f85dfd8f786
SHA512 2f602d35c57f76b304a1726b5652664c61691ae083bbbbf3571575257cf2bf17879ac5e180872dd23e701ffe721d637e0e7792c2b078b2b54ae0111b542dac82
TLSH
T14C11C02212296501FE623D70DECDFEC6EC2571A32AC0CCEF8891594C141DFA16BD5686
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 0cb7d1a873466b15f880bf5eb1d13fe4fe5b6551aaf30e4b8d8ab7aeeddff815
MD5 2f57986862ebadc1457b53702f20cac6
SHA1 769112fcfa76dcb721ce46f681ce00be243b8fdf
SHA512 e57b21a172ee874f8ece41b59914d6c3d8329f69ad4c80c745808b8e12e8f6e5954696f06c3a7d34831b5ac8242f6da19a097be68e588f50e39125cf212403d4
TLSH
T192F0D45240DCC4743C8BCDAC26F0EA382880615F5494BC567079D5A25D40AF9AB1F03C
MD5 SHA1 SHA512 TLSH

Submit Download

3B7CEBA4139B7484BAF665AC9E712D61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B7CEBA4139B7484BAF665AC9E712D61
Size 264B
SHA256 a2d17e71b8463f4783e4a0fd028799e8ad5e373f4eaaf87ca31ceaeaf1185efb
MD5 695eb747251015e8dbb19c197e0cf69b
SHA1 b291ae75923d04b3b662aa6d225d7f174fcbe905
SHA512 b1a2e5a2816c408de920e09cee3ec8643346af08d77a15a98022376bff2907545a6ba50c6866f22e4e008889e2169fd84859defd6861b41218d8c0d60ec724a2
TLSH
T165D0C918B3B58322F9528B3E4DD1296BEA7A1D15A902D7910BF08309762CDA2BC31793
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 db4ed009bbaffa3369c735ef79498d0eeb0890898e0388545565439e94f87e67
MD5 2260220b1b4386a47f9f8608e27c9880
SHA1 f3a20b88c0434e6de7944440dfdf388c9fbcff17
SHA512 f46bcef96a732acdb560ce533b7e4f518e6df662d11b0b88ad40b0c38b5ec229f67d1bf60016d4845d12b30712b0d927c8b61fb2b79bbf959d2f1f3892ca2590
TLSH
T18BE0C02019F7821CF4F5D1354BE7B5308596F1111401E3B21BD02718AB02640DC51D30
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 de397f30a3e7e6f59a59b56c6627b34c9c9b386ae680b5dbbdf07c0313988ae5
MD5 56e577496004775e6afcaac108e5193a
SHA1 1bf54a2248f81b7cb2321d70016b32d7028f449a
SHA512 85b75e4d89e8b3bdf64826b1b21506db4454b6aae43102be873e010626b47cefca3bf53f184a1631b9b4de1d8c78a17966fe65eb7f62e216310c2eb216161241
TLSH
T15ED0A7E4B342D751C61D4034A8D0A221267691F4349B8A62A065980DA9D406CE2EB09A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c13d5adfa4a19ca30255ae503a65cbf8143dadb5a1d22dacae2fa6a7d95a632
MD5 9b7cf9d5949ff89d1f1747650a7807cc
SHA1 17596d1ac92b4601a5683eabfa11377571478e2b
SHA512 24be1bcd85b4f27f51142ab44f90ac0c44ed752a829216448a149049ad78aa549a3345cb1800d3710ac49d7aa7f11b309ed816812bda6f5dbf444d800fd73798
TLSH
T192D0A9662A5AB492E73D8238E5D283102A6A64E229820701B218CC1DC9B40D9A6D3AC6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f7f6808b2537b1caa7d1e0f259b76151d74a82eb0250c06d8941323baba1f07
MD5 6d6f7ad5954e15203fdc164c9f4c5a7e
SHA1 05a9e9b15f453c1e8e657e9e4302f80d0f171a38
SHA512 50edc209854e3b060fd7cd0b7b70f5f59f6a5be24d75e188dc407fea08630781fcf8c0f0ba1974bcfc9afbdab0aafe50353ae0828b35a94cbcc62e2ea20e77ca
TLSH
T113D0A7657749F551D72D8234E8C3C31126B660E434574A11F114C81D98E40ECE2D6086
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 683e43ba09dfb18ab772dac1e3e234c81f1fab9f768f86c94ee3be40db02bdc0
MD5 da3b539fb2dccf4d3c604bb23a9df60e
SHA1 00a6c23962c91a531aac495d44b497f88fe20406
SHA512 b25fd81b1861106b6cd866b7d7a27f5533f16e58f836819ab70c67160ec2b967b748f9b307858f9845111bd39f72a35dc44b189f902b187ad9441f6a6e4f192f
TLSH
T12AE061E5C822DC2B09FD175D78548B46D74513272E80995F3B3C920DCFB463B059791C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 030d20073fe737a151d2f3f6792cc39f431c4e9e98cb92ced19221c772968623
MD5 d689eff23dc263bd67d4986f5ef60608
SHA1 4b1c9546317f2a2ceb4b3191a0a645636d9ff54e
SHA512 9fc28ff35fbbb123110808b1e0c7f362d267e22b43dbe44f3d504fb836b7bf383834d99885cb0a14139d46f4cadc951adf8dd4ae8b895c2b9c1e970e3069812d
SSDEEP 384:d/X2NWdJ6shsK+/PW9ZhMqya2+tS9k9PadxDnbIDKKYXx7r2kn1:5UW++sKAiuqdNtS9k9MT6KKYtr2
TLSH
T12E13D6FC32549D16F9F7517C589F0A70A7BDF9A0E2E4075BB3F2B05A136AB1A090E502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2d775726577e2e960ba3067663b6d4e3cd4cc46af66a2c71a8920778545dc772
MD5 37cde7d919c6b5b75a5b69a145bffdb7
SHA1 fba19457646bdce5cd65fed20e26bf670bdee95d
SHA512 5b99e82266f10ee46f7b05ee43d2e91fbfb3c4ea732b8a7a2419546d5fa28a9944e29a402d801906b664122865a6a0a77eb2b102019ea3a461a19f48a7360b4e
SSDEEP 1536:qokDeE2L/GML/LHstZfZDdMdlfU8pCL/4L/EA7Mgrjf+bZQESm5xWGt5:qWL/9L/TqoJU8QL/4L/rpfuZQE9j1
TLSH
T183444FFB0951A01BCFA802F5E2033E2DD177055D7DE1E9E9E67C0C952825F22B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 8343575df7bb94b9b3f36349e3695ad134675c77f3e450eacbbe38ceb7874f8b
MD5 6374eeacc864b7cb7d1c31f0e7ed1b91
SHA1 42f3b038068486601327e9d6c7f90e6f0ebd3796
SHA512 3e91d1697983a680c4dc56e3f69161beb4847c6f51436d41b1f9ecb2268d3b13890f645806be2717ac6082399106a8b38883c4ac83f96b7ece8990dd1be6df84
SSDEEP 49152:nwe8YHLZTpEsW2GS9oOZe1LhJidZGXHUD:nwNoFtzGSe1adUXU
TLSH
T1C9867DEDCA6898C3CD639970B0F0ED477C7413C3F595C1D68898C684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a9ac4d99f9f1940d0ef57c63b001bee133a04d92585901e4c3e4589647d467ce
MD5 9159f24e502f03baa1870d5034d096df
SHA1 1c00e67297acf25b536df24ca8572ef79764caac
SHA512 785033f31fd184290e412b5c55252968f9fbf1154c251060650af2d05605ac7ca94b6b05b2c7a777adc9a9ca0275ff1e7015dc7903ffde11966cef2c58b07170
SSDEEP 96:Bvwz/UkVSB7RyiBH1Src+lvOuxkwS/mS4W/yTM3:yz/PYB0f9lmuxO/mSHyw3
TLSH
T1F1C16ECD62D6954CEFE2107DA3A39E77E7F0B6900B06FB8618C51678670F6B90AD1807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d98d324f0bc19f77ec41fa3104e82f521125124655059ef24dd4471cc66237f6
MD5 2a4d879aef04dffc222196afa1431ca1
SHA1 c39593d095d878365199bac3a6d20f085a98902c
SHA512 23074950fbcf965320517724d8b253ad10567ccc610e5f7fe254b9620aa4f97d0673fd49fa84ac9dc92baae0ed4e45ae2d863b62e2d700d62b613f8befa92a2b
SSDEEP 96:j1LFFd0p/dIimdHAbH/70+lvt713L1J8Cd4BeZ+Q:JO/IAbf70+lF79N4Q+Q
TLSH
T11FB1F6DC22A2414DEBE1587DA3E38A77F7F0F5900B07EF5258C616B4670A6BA04D2C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76f98e8c8bb52d37557db53e11503b3a649353f71a56c8cefe22d147abc42f27
MD5 736039b458998e730d7e42d7bfe50452
SHA1 ca7de126c9c69a699913661a57a8a09668662025
SHA512 c6e0d6cf0fffcfe7fbbb5b78bb2f210898978d1efe4c76540a096b99e96353d5ffe9b7bc7f24993f0cb7c9a0fef0b13eaf4286df8df54ce024efa6f09f07ab6f
TLSH
T148713DD832420844E7A024BEB3F3ABA7F971F5640B07DF521AD617B1AB2AB7E40D1C04
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 5654ae0991635d7aac2bd169154ca0adbc6c3713ac71c50c3b8502591752a967
MD5 811257d94be5ccb3028be81ad82d256d
SHA1 d8b1c3610c030194381628c5a8f3c0b0f3a84cc8
SHA512 db6dda793cb4ab546d928ccbba97533a9673049a96cecf36749602e7b9e9c884fe2e4de27ea766966d0cba9154d4b2043094f8bab4ef7cc746bd6fc683366760
TLSH
T1C2E0D89465C6C15E692034C3A2385718C6C03556DEC5FD47271C88C47642805F655A7A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 3c85d9069d2dc5cd825f1ccbe581de5131b6ab02e26407dc59e3568378b677de
MD5 ef1a875304337c85ecba9b4d032fdec2
SHA1 e2e20ed5d9260da65be1d883ae7b10d9d9d38ea9
SHA512 2e4b90297363792b48674e19246f82d99a1605b874d785199bed6645f1828d96a8ebb963e9f379eddb820629ef7a5897d6dc26b6fa3700ec7bd4d4c6344d7428
SSDEEP 24:TLAga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+jnpW5L7lK5fKFtIiqYpK:Tyi+7f+UZD4jJ/BLpWx7lCKFOiTpK
TLSH
T101E2E28D3B11F511C4ED773DA1C2C5F05EBCA83C464DB1F0A53899768C52591F8AE51E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 40125b04147a2461c1f332060263591831b7d917b5501d188cfb8fa135d74ebc
MD5 44039019bc7b3945aef47e9099b55152
SHA1 3b729e20a70f043700225af6492ea860ad70eded
SHA512 82f45655251cb1f722229676b976d68a274e26967820587c86d0149b5bb0bed3371f58275951dc03cca12572c012c26523aded29bea21ac638c3cf902fee945e
TLSH
T115E0260C46C8C16DA5186997D26D4308C6D0390BAEC8BD4A271CAC486101A41E2C66F4
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 43a272c509217350186e883d30c37bd18bfade479b49ac90a1b62b6c44b85349
MD5 2f8e643657480af99f13348cb8726b2d
SHA1 ddce1ba09d441825c28a6db7877191e5859fb2b6
SHA512 893b2fce59862a82af191f78052cdbaa4905f58d8ab613aa9076317faf1a112db8f8a90a1d6ece1f0071737cdac96311cbb7da6b811a4e04501cc884b3232a07
SSDEEP 96:xxTHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jNZEbjBHMsDETbiI5:xF0+G83uxXBBK31GkSJOEJH7DNspUm
TLSH
T1E414F15E5F353722CDBD813668E744A35D7CF03F8B1366DA686114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 b505dc284916e3ddf60208f41ef2d34e8cf6b8fc31fc29deafe1b31c3b7f3479
MD5 e5191b1e7370e3b8ec43cd04358ce67f
SHA1 4aa344e0be8ad576accb5530145b430df5256d93
SHA512 c788b68834795c034784a86d043442cf11ef8a110fbe58904715df30c7c308ef735fde2fdecf1bc7e03a90a3fcb9a92c32153c911212be8f6f0fb72135aef727
TLSH
T121E0D8B146CDC159A6442047A21A670CC7E1352EDE8DEE461B18FC49B042404E2C65E5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 6caa67d3a4500131d44576e342d1a85394d29f658e3bbbc617b98ef981e981ac
MD5 6ed562a4ffb1e85b76341eac6547c445
SHA1 5d38b8dfb6d0681c46b10da910b3b6bda57ac748
SHA512 5280ac234b21a4fc5078d5f2ef46d2b3cc8b3a602871e2885184e9fff8b992ace9e1f331c7dbaef51bfa8d5cef03eb3e285d0c42bd318b0869f096d0c818b738
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBMoC4wO9cLeHQ+y7v+AwH:T2SLopFMatSaw/auUOt8BMoC4wUAwH
TLSH
T1A4921F4E5F306121D1B04F72E9E181172FBC212CD3733699DE1420F39E9259BF9150AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 54bea1f61e1eebfdfe797ef16d252333973b3f60c82fdcbf9983aa5e97ef2153
MD5 509c596531f44e0b2931e19b0269e955
SHA1 b1eb7adac89b995c8340f17f30cc97fb1e37293e
SHA512 67c8d03dc7fb219b4f1bf6faf347dd268d2e7b1ebb20c8ba3f471df9c4025bd7a429e5ff9c953fb849552204beb16eaacd8d55011d9f5c46ccd3a551b7d1cde5
SSDEEP 96:D1sOhE2zaij6izN64awBP0BGO5cH/6I/jk:D1nhE2zaij6ix64akI75cf6I/jk
TLSH
T1EB81DCF3C3E5812DDA0196F0AA14AF2BCE1D0555436C3D9A89E4AF1BA3F2471E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ed78c280a1c65a2a916e7652cb2ba596f120f10425ce02ff182bbd1c54c7f4c7
MD5 294eee2c9fa86d5391bdb6b54f050fc3
SHA1 56b6ef812448912a8ec3237d28f3bfc0b2936b1d
SHA512 874702cf8a2df80241a8371c0ebe06d584e2550782af3f289be47f82e53564f066b517edc3996d8397774e2ae6b532016239ce55dd48c78c64acddbb7ae47517
TLSH
T12131B2F783F4856EDA1196F0AA18BE2FCE1D0510431C7DA985E4AF1793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd5db5d501543a6b714b443cbc0ae1cdf6d27b2feb6aeae6adc85b99cc9eebf6
MD5 753db6a4d4b8069448246fba637ebfb1
SHA1 3375eacc28fabbc079f44594e002a32f9f4f5328
SHA512 e03cbbd390a4e67a1124020f296766533a992ec3a31d2fc05d5c6522eb9c5350896d983a6ac3efd637427ab873c378735e337fb43bd722c8a60ca11c45132357
TLSH
T1F34190F383E4C56DCA1195F0AB18BE2BCE1D0514432C7D9AC9E4AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 a7683e7ef7da212cbfdf16174b8628372b2eb8cfe428031200d2c925177368e7
MD5 fb8f50593442fa6255e0947967aef97d
SHA1 cc97e808eb31b22ed411a47ff3aff4dd1a5e6f87
SHA512 d6d0dfd2d711755fb5d6e9dc4d834edf5e91be9faf49d00410e61c5bb14d8a00222371c6784d88be6afb41001188148ef38318009ca48816a9515b1e8d9321c9
TLSH
T1EA1188A782BFB42B203C687E0E097C051D7EE931825129B0EAAE863CA0944F74A12467
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 c96e90503f1a30b082c1aa1b8b4039db40da6eac2dfdd34f069d6920aace9235
MD5 b4ada9357bd4d62eee1d76f1bb999f7e
SHA1 e0b87a0d85113e5e85dd4f4ecff19128be9236b2
SHA512 df793247a0dd60204b97954088f9dfd0e5d68cd988d4046e1424ec132d8e56aa1adf88e7822162fe57f11ba454ecbb27e6aa7d00ea280632ebd6cd6cfd04746d
TLSH
T156C0226285F8E037202C043E4A90B880AE35C030001044A4DD98C33CF1A00FF5F01039
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 66f73fa457019cc5915687bc646c046dd703b4ffec388a404ed26badd6c99a1d
MD5 d49006b885b0eaace815e08db0005ffa
SHA1 d5fa25034e180c60fd78506dcf1e25e53dcbce55
SHA512 ea5a8deb9d70f284c349e6e236c0d541a855c1ae218cd00019d7e5fbaecdd2c687145623dd22434853289c950d8f0399e036c4d98b90a22a868123d370604efb
SSDEEP 384:sxZqRme/fys/WvDyV7or80Te/bhT/5JkZJP:sCke/fFYDygy/bF5JI
TLSH
T1D472F7156A749D7B8CDBD20CFA597F93D6F9152391900E44AAFCCA1C00E7AED221392F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 0c9db069a35445d90af3016523b75fb1195289d8a744bebdbe51dd50fa91b8dd
MD5 312e8e569319947966e1e7347541d2e6
SHA1 ecb879e678a970840cda647d8cf7cbab4ade8c99
SHA512 bc4eec604849d7f1eede0ee899c3806a53f29a9ee755daba60521bd1b73051115190b8664013f34a55167cde68d4bae9b81c649dee30d5ac70d36b44e9701d49
SSDEEP 384:sxZzn9mme/fysOWvYEV7or80y0P/hU/b6jB/5UhAEqk5:sr9re/f8YYEgi/b856Ak
TLSH
T1E292E706A574593BDCEBD218F9467B63DAF81523D5804E48AAFC8E1C04E77ED2213D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e2616b5192e4ef643fe8370ad767b15a90fc69fcead1c02a6add7ecfbf4551ff
MD5 42334e432e2dc81b0282c88058dfb4f6
SHA1 fd2dce167c22ccc4bc4e904bdee306a6a2ce545d
SHA512 554b24d9eaf99eb283ab97e1f9081af430a9f8cb4062b8b96a4e7496c394762451a92495e71250f3dd46fdc86c01ce89dc8f08cf29bf49cd6118ab0a2861f98d
SSDEEP 192:sxZqR0yMqZjK1Ml8Mce/fysYA1KQ7PgYs80QzodpE//W6+WNGY0ZYZs+NIgjJlJ:sxZqR0e/fysYyV7or80Te/bG5REjJP
TLSH
T1C862F7166A749977CCDBD309FA457F93D6F9152391900E44AAFCCA1C00E7AED221392F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b0b8219417078fdc381a6dc8dfda4e5d529f7094301657b9e4a6023cc5bd3ed6
MD5 89747c31b59df7567891fad204db0b01
SHA1 2db4b5519ecff13e05b02e2c3f95eedaf889cd70
SHA512 62377f7f87b33332dcb8aa6f5fe04c443cd56c3585babfed3919e9c9e0561132b0a81b9f8e4d8eaa85b7d1932d1f019033edb4883e667c4b1abcb9900626afa4
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AGq9Llg:XwZh38Dv2SkEnZFWRm6GQFmu1jaKAGqA
TLSH
T188030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C02C67EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c2350ed-43be-4160-9475-f2d7cc98fd47\index-dir\the-real-index
Size 72B
SHA256 92ac3221ba87effc8737929831d00e6cc67bff3f929fb9261bad19da5db82c9e
MD5 f185a06dd80fff739a44de2e10bb9aec
SHA1 755ecb947251f87bfe03ec5b3bc7979699136f37
SHA512 0fbce7a3aa70858eaf35092f7c2be54df0ad1254636ac7181bfc943457eb4bd5d906f7225e5ba7f73d02dc831342ed89d552f601af04e87966f46d2add41bd9a
TLSH
T18DA00220115A0145C9019EF061526591A7245C6A81134346C1D014578A5555CCB211E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 3KB
SHA256 ee793ce0a21974801fcd394d17944b8c03de1c3b7af8a0ffcee9e7703876c4b5
MD5 e41598709b7a7f883c8f0ed38626fbb0
SHA1 470dbb0e1b04971fa60a2de7ef79586c57396d32
SHA512 d396b744a4e1eff4c53cce0078ebe5ba9f0c2221c2404243023f8a169ff7f53441b13794c335cc1a6f245090012f7792881251773bc934c119b8cbdaa37e8d3b
TLSH
T13351C70F4D830A6AC9AD11B268FB1454377A94CD4389DA1F61DCE430BCC332A2A69225
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 2KB
SHA256 5db0221f23ca49a2ec77de81991e6bfab6c6dbabccd969e32e9b33cc7e691deb
MD5 587c65c5db7c7a4d163d45139095a642
SHA1 39362e25e13aae5f9675bbbcf9515f5664d883e0
SHA512 9e64fbb19cb5ed88580ac12510eef0e282d1d1a450ccf51488178a4f0ea2eed33650ec555ba8bb3e2eba2895f5fdec275f2b86e94a63c0e3bca40372b35afb39
TLSH
T17651C60E8D4A8B2ED4AC42B215F758D433B48CDC2355AA2358FC1232EC8776A195B6AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d72a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index~RFe5d72a2.TMP
Size 2KB
SHA256 99dc1030c05a9ece1147907a0ce9a454648ae5a55df426096a1e436f57a3bb76
MD5 c07184e989a7e9ebc946bc7f9b8cf42f
SHA1 25aa5dcd392dc9e2660924ded4360f68e19bb0cb
SHA512 c310cb8da20d52a7ae46dbf4092c3b7a55f6415b10bbbb6029097a6d9ab68158ab64bf9699d2a1fcb05b0425bb9806471fe1e0872f749ff968e2d35721f43af3
TLSH
T1C051955A8D428639D9C441770EE3A8F4373925008719BF5374FC9636ACD27AE3D1E2E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
Size 72B
SHA256 d23f10307ecdcb91400668313fe0f18feae8929b275acfcf72f449b5be003b65
MD5 6b8400267ff16ebe828bc3b58e1f2158
SHA1 8947ec271d3aeb5fe1cbf6d83a8e41aa108b7cc9
SHA512 7e1c6263abd5521edf1f2d6449513650227d05bfd1eccbb6d188dca52f9d05d20a3afafc1111a2d92110ec0a80c5d7c4bc988b3d31cfca832932f5b6a947bcc5
TLSH
T16CA002140AA93005C046D2F027DA01E5134459140243131DC1B043D4DA9044D8AC260E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c8d9706-d147-4773-84f7-c6f620552bef\index-dir\the-real-index
Size 72B
SHA256 ddbc0276bbb82af2646e98560ac06130cae9a204d019b2e0da162d0d67f9fab6
MD5 c05919f24e7e28ef520dd41db86b4878
SHA1 4f7ec14218e07b4e167f11038729b1a5d663aef8
SHA512 144e627a06a64430326ec4d4c84739fb8f06028957063a4bdf6e5fc5431826b84e943e9b99d221f13d74d558000e4d17128196af98ffd8af8352768f6cac1c0c
TLSH
T1A5A00210CFD04515D02319F156F343426F00DE951110130B41D21944ED505414D4184C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab3abbd2-ab0e-4ac7-8f0e-d179881337ba\index-dir\the-real-index
Size 72B
SHA256 c43462fe656254878291d6ae3c364116fdd6e59415447dccba62784f667275f6
MD5 f19a6fccf11115c6f62b5db956086ba2
SHA1 4f84a0464b6467d2b3d5bec82b481b070d0bbd1c
SHA512 6c068a9fe4bf8995f90ab300b04720f2855c7422041dca42e8c555dc8f302b9db39d1ba25db56895422e370fc2a56c5cafa6d58d4f3fd0863a9e829a9943a0f0
TLSH
T1E3A0021D09C507B7C1D51773214505C96721C99831072303C894118DDD6154CD663A09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e25a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ab3abbd2-ab0e-4ac7-8f0e-d179881337ba\index-dir\the-real-index~RFe5e25a6.TMP
Size 48B
SHA256 71ab386b0ef309be90b6131c49ad54c4a3eb8f312c97b8c0b1188d412f4ed35e
MD5 ac01d49704f4e6acf1cfc047d1baf032
SHA1 a85015a53124ce9fc662b1378e74a0ba449a297d
SHA512 f02b0e3dfc8a76790d32ae809f32329d404cce0602be043ce2fdc52c8e09016d08ba04a8f44ccb6b9ddd9baf04491e3d854c06d706b1122ed65405b942f0fbcc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 cac1ab9bfc38e745868248761cdc91bd4d1d3b77d7ed5d331d7efa8d98ed76ee
MD5 6f22616328eae9cf514a19fe5a92e852
SHA1 63577411194917da4da7f1f81ef34dce780a718b
SHA512 5b131192cf0c938807a18ecf23ac7430b4a134cccbd0b1ce229c1f08b218a3997c5bfe9c2d12297274cc5d07ae6a5f21c3c284226d0a850d275efab827ffcd34
TLSH
T153F027BB6DE32D15FEABC3D2243284A408147C55C904ED9F181BB6D3D071735249DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c0139eef19a91238fc997ce9019d70068e23db348c766d105064c5a5af53c747
MD5 1483755d8e5aba7a102367b731c1ece2
SHA1 f20bc5d48437f8cbc75904fa27ddc1de92287181
SHA512 c5149b4a102d6018adcc6bb830a757f8b2ec6635f5503c9bb4f5f4b71ac9bfef34508540f9a4646567db5fcf8a8737383924606b390a5c2846eac6e637d65f48
TLSH
T182E068FB18D22D04ED6FC7D1143245A4080179658904AC5E046BA2C3A071B753859C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 620725044d3019eb9b2f92b494ec48b6bfe3c8aafe9a17d8bca018766abb927a
MD5 aaf5fe65e4e6c7445d0c091dedc96829
SHA1 32d0dc18d48c74b7066dbac161aa0feb8d0375c3
SHA512 d68eb8403d4b7d523b2861efe8599ba3e9d5e0ecb2aaf75a72064f15b4671500819a96b8800b74ea5afbb84cc0a0e1a9bc6f86f352ffc8b945ac912764b2bad9
TLSH
T11DF097BB6DE32D14FDABC3D12032847004007854C810EC9F041BB6C39071734248DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 927c707041c449aa0a604dde46b73b634248b060201805506dbfc3621c06b661
MD5 d47fbafa1d5263fb80ee39124595de31
SHA1 ce3f5834ae1e31e0142208f72e5149eac6308f4a
SHA512 aba987533ecaeeb3a1572a74f4a8e1f00a8a3fb423bb138c97ac0a5e0d4b315a1d6013171648618c9c059b5c8cdf8fd4a0ad180b7d56d2d172f8d4df164b1865
TLSH
T168E026104BC8C1FD70263083533A830DC2E4B90BEEC8BD463F28FF686142904F1929B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4799f61d6a0c9b1307774af3b310792a0282d1ef36322ebb725952b211d6b0a3
MD5 be3294cdf69e12668196139d5480ded2
SHA1 c40199c34e844765cd758e1d8c39dbc3e46b6d9c
SHA512 69f07f60d99f95be21d585b19af151c06fe414a30ed911b8945a16801af48730cc120aefc4d22867be1d38022cc00a3b6fd24bfae603edd44531f543e93b87c1
TLSH
T118A00231ED5C80DCC0848270B521566463148CEC7D44231594EF42588D6804149EA115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d95ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d95ea.TMP
Size 48B
SHA256 c21fe67245e8b0e0e2ef131de47e36894d6fd753668595764815824f3978021c
MD5 715454e248b3f97081300bb61c25e411
SHA1 707ed1bae1ada55d038a636ccd4bb5e27594d524
SHA512 feb0ed29043eb8015dc36eb87b961b88412f5bf1bbb2ed56390162a04c438f155bb96695ab191d7f9dd210043f07ee3cc22827a83e45ef8fce529f90c1094ec4
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 2f536717018b9c9f667e3a3feb2ebbea5517bab0d9e5f86811af1a78016c553d
MD5 876782f2faa41109fc8bb00d745e9a63
SHA1 3d0f4d197fab5d27445ddf5fab78a70f58c17d7f
SHA512 e77062050c0e6a25fa3250989220ec653b4f0a8ea9be354d9f176b289f4e431e7938852bcac9e0d16e537708a99631932c2a03bbc0cadb97ea6081b2aa555e3f
TLSH
T1C8E0D8245BC9C66AB54A20CBB219D708C1E27507DED8ADD52F2CF9486306540F243571
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 3f354e636edee29b8d3120372a94df24bdd9f7f22a9020d7241dad4005b85820
MD5 59698fda7a971e6dfe3fb15d8a5107ee
SHA1 e2e6d3537fc9cca3c1433887677cf91b90007fc5
SHA512 22fc3f300f4f7520150ff4b36e3cd306455f4b5471caa10f2c5e67a7b0889bd6c7617969c063452a8609c3f3354f249668cb5646c48a671fb6719ac958a7aee0
TLSH
T10AE02670CBC8C67969006183936C970DC2F0790BDFC8BE8AA71C6C48A101504F2E69F0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 a67c5bdee361a2f1a49ed2f2254eb8d37a94d8f531369184938156cd8c15b8fd
MD5 454c6b69e5e371ce65272bbbdf2ca464
SHA1 99b6eac17560cd715743cc4861d7ab3eb3367d5e
SHA512 3714bc1b4a80d5cc06e2c8f698af0dfb4d3b5ba368d63040ddd07b52351cfa39240390c41dd5677a6bf32222fdc586222b91bc29c06350b53675ec5dcfb35621
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjllFXyB:ctGj+BCNC5qFVpKxl1yB
TLSH
T13FB2691632BA02023C3D791D87959B375A82B1733418E93B7BE954BA0E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 e067998696e5a26759a127ef9cf83fa506db337a9b51c1dad50773c89ac3fdd1
MD5 38bbd094f2e340ab219a39267611d14d
SHA1 a5f70e27b4a6f84d22d69d6e06454e26bfdf5fab
SHA512 29c76ff98722b52f27d6c9f3b38aa00ea9985a81c0fcaa17dcb8fd7954f43925b123aaa192b3a8377630ce83c5fe2631901f67f2936ba4fcfc3d103535a5ff3c
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjllFXy3No+:ctGj+BCNC5qFVpKxl1y9o+
TLSH
T1FAC2781672BA02023C3E791D87A59B371A42B1733418E93B7BE954B60E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 7ca8a9e494a9c0ef36b4290c78b1e5c182f6f7481e462561fb5ac5ebeb2c7d73
MD5 f91f39a21ac2917118ae5729c3d22aa2
SHA1 af56c0c0ab819b2e0b0958b7f7951e5baa7cbd67
SHA512 f49721c660499c2d3c5b74c011abffd76b040ebfae6075c4d47d6101c0e8c484e8ef0e1f4ed6cf29131a65f8b44360cd50edc3869ef0c5bb192157e86c34c658
SSDEEP 192:FvoWPrfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:acfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T17124520A6B747001EDE7D9725CB080771A3CB16ECF22A6D15DA254698DB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 a979b878668526302d2e0e77757072553d2032056c2fe41ab37b5297e0e62228
MD5 b53b460f2fadb0ad83b51e1a3cf77be6
SHA1 428a30bba650c716a163efced27aef5e124b83c9
SHA512 e991df9a067068049d829f299f63e9fb8020f1ce44e4e846aa725b22cf271fe4f45112b4b2c81a14bb0f2f79934805e1b377a11633a778767771cfbcd873cc30
TLSH
T1D651A8C093FA14957F8AA945C20E561378E27F6B290E9872632D54F44F88C284E6FD39
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 13KB
SHA256 ff78e7c21798fe94786a4165a868c217e96a072f08ea91524af56cdfdd7d5e0b
MD5 c471334464723464c7f56623f56b80f0
SHA1 0f9fa67d5d2c17a8412d30deaa05e4503cc357f2
SHA512 42fa4df1175d2836c64707b104f9cee70814806f406e2e7a252fdf519dc7415432411d47670aae88740938abfd942f74f3b1b34ebe637519fa8029ffdf220f05
SSDEEP 192:HeOQjAsvlrqxrsj5RLhFCA1BZQoxIIIRbhMIMr9EYcYgR:FQ8sNis/vQoxIIIRbhMIMREBXR
TLSH
T1D752946926071B3BD04E5FB703A947A41BC589C2017732AD30A22C8F8DF3A5786C95F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 721a06d06ce94b8a81a7142ee1a7b5b4bd460397cfec44583d946238e97b12be
MD5 1a354ff4c4c31070a36d80692c75e3dc
SHA1 8a65ff5eaa0545d3f5f37f0d0955304c4a06ebfa
SHA512 f17af76c33b5fbaeb5e155ed2d64856f78cd1be6602a5b953616f919b11a382f1f94012f2cfc7990c6df6c4bd5511749030bcc82a51460bbe4343a2c7d678532
TLSH
T1B5E08658EBC9C5AEB518218B616D4348D6D13E0BEEC8AD8E2F1CEC4CA101544F2D65F5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f0133e103c624453a6732ca95b9e4ca2f7f15b16699444b7a52ac89a1f8d39a6
MD5 e5d24f0158b3a0d449a3fa8ebf05718c
SHA1 21d8bc6c2ed1347dbd571b7c844a38efc30448d8
SHA512 cbc932deef35ae9882f8f437098ac3547b115db9f046a19c7f5c0310bee4ae384b8123d1b4ded81cb4d73483133c0c7ea549f39f1a467681b860fc53a0e38625
TLSH
T1C1216056F321C149E14E8A7EA12AAB361328E8029FFCED0F447920256D76F015E8F6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 feee4fa9ce129d21db34523662868da7b54d1c761acc8dd03b4e0c521cb99740
MD5 1327abe21b94c86cc6c917042c84c0c6
SHA1 844e2462a4314657e861e12af21d1d02415cdc37
SHA512 71a529a44b9e2903cfe8e1dce014512f82c0794fad8309a665d2b2c5d128011d413f6afef3db703b0cee7f372168277be9e54f29287e2a61f925abc3eeff76f6
TLSH
T103E02618EAC8C1EFA1182187616D8348C2D13D0BEEC8AE4E2F1CED4CA101541F2CA5F1
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.19\data.txt
Size 150KB
SHA256 e589f794c343744314bb92dc03cb87b0aabe1a0e4df61bd77327638125d6e1a3
MD5 67a2e4e53750b6b992e203c4e98608bd
SHA1 f84203baa2f63c3dd4e3e6378e9d74faaa27a35b
SHA512 86c77bc809e6e9d80b1e1c16ad97f6a3e9fad6b010f322e0e1146c8cccbb9c0f71146a87e1e6094034c0adb5c2e5f9229a90551bea00b9df975a4a6c05246a6c
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEn1dm//OKXXJ1RxGfI:YX1aI5aZoKzMJ07NC1d81xGg
TLSH
T11BE3F210CAC41FECDEA4262C60FE0F1D6790C78D883B6A89D7A7FE4A5F9750895274C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0b30a7303ef121ddd0ba6398e3d8fe4830662198e8588e6cdef0873f4cd04a49
MD5 6c3b5cac02e04af478ef80db6ea29524
SHA1 49f3e78b06808720cdac7814ea53976cb4581462
SHA512 222f82a2e23ecc2215043bc695de170a5187474e7213d594d5ef21f140327184b877f5ff19943e88ba2c60e1092e9083b7a175d0ccc8a704b38d753b6bba354c
SSDEEP 3:MsEllllkEthXllkl2zEflGV+lt:/M/xT02z5glt
TLSH
T1BE4404057FD00405CD03103040F1C7503370FD100531574374DD05375CC75404D00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4689c12b9476d55ce3e6fdf8337a4e1924a200d6a3bfea07cc6b76cf84e96859
MD5 36d2f0293d6b347cdb4fa9f201110e56
SHA1 6e843d572d813c23e131a5de9b35dd77e9b51c3f
SHA512 f229db5855b82d64dfd784df45aeb5426df300abb07ed3c6f369cd9196c04c2a2f6bc7316d4e0118dc9df53a9215ff31becedfdb6ef106106df4148998400526
SSDEEP 384:nciF9CcmyWCs38NA8TUNTUlIxBrk6oICF1ifbLoInm/SRe4KV8p0Khty/7Ig2t:HFccps3Hwg4kCuoIWSRI8p0st
TLSH
T120B26C36EC98CAF7ECE64F98A74E6603DEE0516385889ED4DAC85D0D00971DD174B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 afe25ff4274d8d4157dfae688eae314c153b7d42d9fed2450e00d924d7684f62
MD5 5b606036d804697f00497c8543f73e3f
SHA1 bcd170314525c2d91ccf4733ac7b90cfe4aad8fc
SHA512 7f613a0003d142d3d5974e85654793cdf565cd287f46d6a4164675c7f86c395e81d14c3318de07efaf13f2f8c93b77b403e1305a64dac9038ee1d3931d949f53
SSDEEP 768:LFHNQkwgF6zho5ewKYfy0P9wLyKnL4BjKgqmUShOGW:9NQwxDKL0PKyKL4MgRUS8GW
TLSH
T15EF25B79DC95D97FACEF6B85A34E3A128DE40133D5A889D4E7D95E0C406308DF30B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 18f16336056dd88efd95dd494ae91bdd3dbfe0545354bc7060e0f64e475d691d
MD5 f256e1833b5b0fd6bbb35d2410111313
SHA1 a712b5cfed9d80049120c8f12839b711abf5bc44
SHA512 53350e921e9940fbc6d04973be43014e5709650faa023c53b5dd2b9b857c15ad3a97507dfa0586ccac186500746b475cae16fa48322de86eef34051a2e66d23a
SSDEEP 768:CFncp9mwgWVzRoIfQKFimTb4tGMTjKgqmUShOGL2:f9vgcdM4MigRUS8GL2
TLSH
T1B9F2183DDC958DBF98DE7B88635E2A129DE01137C5B889D8E7C84F0C907648DF70A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 abd117a5ce7d78e1fe3d8aa3c85b617d5d9384b8fd049b25b4c6aa32e2017db3
MD5 b7e49b93b8daccd1f708641f4ca442c5
SHA1 625275c4a15d57064f4def5bf8bc217f6187ace0
SHA512 6869e5bd18bc36d6ab59c2124e85548a8f552c2d024442d8662d07122fdf6f3ccb99a547f88c14f3586d0273845ce4863aeb59aeb8f18a1abb91aca51cda1c00
SSDEEP 384:nHiFnZcIP8Nz8TUNTUlIRPrk6XRz21ifbLoInmeQQKBeRs9JKgqijUShOGXHx/74:CFPPgwgy2zRoIfQQKTjKgqmUShOGW
TLSH
T196D26C75D899CAB7ECEB5E98B34A36479EF01163D5889ED8E9D89C0D00871CE170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 49ab617100f98503013b9ac6417689f72c56cb5e9d69d8d83ba7c4ca84756443
MD5 4932a2c92757ded8c2a758817fcad058
SHA1 ce9bf6073dc140874a144470023fce72f2867eaf
SHA512 60954f961edc61ac3e9c2c8b7459f8791d8d59808b4bcd27d75eb8f02de75a9f8d6480fe2a2a2266164500c7933e69f003fcba2369fddbc5a96819cc599555c3
SSDEEP 768:LFAgQkwgFCzho5kwKYfy0P9ww7DKR2JzjKgqmUShOGW:GgQwpVKL0Ph3KMJCgRUS8GW
TLSH
T192034B7CDC95C97FA8EE7B84A74D2A2289E40137D5B88998E7D54F0DC07208DF70B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ad650355f52f7e917d3f6041ca18b4f1b9971144bdf17e1cb8b72d4318e60682
MD5 5c43036df531301d5d39804b20c71595
SHA1 b777b6eefd32f9d9fb0b190eeafb8027f7a6a8e5
SHA512 f9fde40ced5c896f9d70da5d16574de46f057b1e2d2e80b465ded6f2f20f5c89b222340de95e5910defb71c0f54acbfde22eb417bc1e6243ff98008ce6fc64e3
SSDEEP 768:5FAgQywgFOzhoPQwKYfy0P9D86KnL4ljKgqmUShOGW:YgQmLhKL0Pa6KL4AgRUS8GW
TLSH
T1D2F26B79DC95CA7FACEF6F85A38E3A128DE40173D59889D4E7D95E0C406318DE30B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a237922466f3d1c553559b23cb021fb256d22aae398201e69f55436c6ee68137
MD5 54ff7481e10c992b040bbc4e3b4b3219
SHA1 f206edfafbde1b2dd115a9dcce843f7f63dc76b3
SHA512 b2736e64af8536f08c18a19e099bca428db28f4d49d17c38663b8d8d95ab174167ee016f4c97d27a0913e3cb85da81b8528e5daa9b760b45225f94cb98804ea6
SSDEEP 768:EFPPgwgy2zRoInNEAKnL4AjKgqmUShOGW:UPZaiAKL4ngRUS8GW
TLSH
T102E25C79DC95CEBBA8EE6F88A34D36039DF04133C5989ED8E7D85E4C406708DA70B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 129c98fd982144afd7ad74c61d0c6967f1cd9a5ef066eb66cca82633fe18a742
MD5 ff0e91889f4e066375a7f9269aa46ae8
SHA1 ae21968b0056a6202e2a904c18085be5cea4c022
SHA512 99eacbeae9862563470ce56ab43ec7952379067959db39d997f57fda38ea02e4232e71981cfe59a5004e5f50c66050b7577460fff5b862e0180cc8d1c2b9f654
SSDEEP 384:nHiF9CcmyWCP38N98TUNTUlIRKrk6AqS1ifbLoInmeIKZ0BSty/7Ig6F:CFccpP3mwg/2NoIfIKZy0F
TLSH
T1F2B24B36EC98CEB7ECEA4B99A34E3643DEE0116385889ED8D9D85D4C009B1DE170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 818e54f223f598246c1ca107b2e1036195c8e07fa77884f0001951e1a2a754a6
MD5 ca1a1b5f0e06cc1b120d2683b6458c04
SHA1 f409b1af9a69dfee34f54f1f359d46a730a473a0
SHA512 92a57456343a3f98cd5240f71e5a3740f38cf036b7fcfbdc0d554fb1cbe4b290b7215aaa1fb7f55e652d88b4163a7486986531a98182522cc947b4cfeb1ec849
SSDEEP 768:CFncp9mwgWKzRoIfQKFimTb4tGMTjKgqmUShOGL2:f9vBcdM4MigRUS8GL2
TLSH
T1E2F2183DDC958DBF98DE7B88635E2A129DE01137C5B889D8E7C84F0C907648DF70A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1affc02d7f19cc2b01da80f51e3a73789dba715627bd8b89ad21e89115cbbd2b
MD5 1f974cc5553c54b630f0fa66e1b29e0c
SHA1 f0a24fc078628e01d30f07e9fb117b1247dceb77
SHA512 e1d00ed9dc0630cca009c68348acf8ed1ac6473af4480ff0013db8dce75b42b0d0e8fa2762020116438df38c5dea7f39596401df7524520257631080d18b0101
SSDEEP 384:nRiFnZcIP8Nz8TUNTUlIRPrk6XRz21ifbLoInmeQQKBeRs9JKgqijUShOGXHx/74:4FPPgwgy2zRoIfQQKTjKgqmUShOGW
TLSH
T12DD26C75D899CAB7ECEB5E98B34A36479EF01063D5889ED8E9D89C4D00871CE170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 03e8cbd77dbde687ec124bc84e79c61d8dede19567817718bbb2cead790d7d9d
MD5 2affaf755fbd4809efb3a134fbd4ae7a
SHA1 45ee2fd344032cabfe9061f5bb92bb405d111c74
SHA512 f6ca1a4f175d3c80f09ffa02e17c82161b63167f884df856dc9381ee53d567b1d145663e2bed369053d2f4e6e8a0e67f832d55f08998fd564298047ab837ba05
SSDEEP 384:nsiF9CcmyWCs38NZ8TUNTUlIxBrk6Qdcj1ifbLoInmeIRZ0Be4KV8p0Khty/7Ige:XFccps32wg4ZckoIfIRZyI8p0st
TLSH
T15AC25B32EC99CEB7ECDA4BA8A74E6543DEE0517385889ED8DAC85D4D00871DD170F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 963c87c1097ca0f37738a9f5a90b5dfcf7086d9a6c75c82e93de8067a4a18b71
MD5 77ef7a579e7525aa0ef6d2c275aa2fb5
SHA1 72ad4f2de88142ddd8c3accfbd21fd9d9d360520
SHA512 936f2167e11bdb6427f8b9063adc7ece4371597d3d6bec9ece4ddfd627bcc0a22abdbeee168b833d400a4b9909c06a3768d7e972ddffb1e036235d2fa21e2dd6
SSDEEP 768:LFPPQkwgypzho5eLyKnL4CjKgqmUShOGW:RPQlK6yKL41gRUS8GW
TLSH
T14BD23A79DC95C97FA8EF6F88A34D3A139DE40173D5A88AD8E7D85E0C406309DE30B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 25d41d93f9099824bc63b95f8094c742c6a66d6480477fd72a8e84c0b43780b3
MD5 6702bf4270d87351d41a415b440303b2
SHA1 2d8ea7d964afd1d53726799ee996f1cb8c5ce91c
SHA512 b29595f209d472bfadd73dbb0e1eeb4a111c522a13d2077f54635d92ca18dd36143256268d0b4010eeb33e01637ce09e157e4dda90d05bd70afe12da724fcd5e
SSDEEP 3:MsEllllkEthXllkl2zEfl3UlX:/M/xT02zSUlX
TLSH
T1094404157FC00405D50010345071C3503370F4500531F74374D104375CC77430D04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\manifest.json
Size 118B
SHA256 a50a524184b2420fa2d050e10c7ecc90ff3ddddbc1d39dd7f6ee65aea7e89904
MD5 0839dbc235945a441183b3b1c54e7cff
SHA1 7d50cc09092601adbdfb99927ad0cea8f9b5be01
SHA512 5ef438077e1f23aa36d9abd6639769eedbdffdda85ee368f386638c288893a1b80c8ecac9eb9659b5559296a189c77fc24a7b716bb7914868e6744a30e7bd50e
TLSH
T1EBB092B00C0AA03B22819B60ECA0668683F81218E8029B1A088036482F8817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.29.1\typosquatting_list.pb
Size 927KB
SHA256 8da21018e6a6063f029ab8f81ef3de28adbd1740594d43934a231e9bc8458496
MD5 21617bc586960af1751aee4ef90d7b7e
SHA1 8e44d591d02917d5470a382ba5ecb31d03f0cec3
SHA512 75afeab96c768f0647940e940d0e842b2ecd422628a9c0adae06442dc6a27020c85ab03580e6f56382cc2dba3c6cca1f3b8b3e42194f5d27c211075a1faffb27
SSDEEP 12288:a6q8A6KIEJiCG5sskil3XYXHm+nQBfjvG605F0:jGskil3XYXHmyQT
TLSH
T1B215B5B9DFC00194DBB8112D20BE71D8181412A540E9EFEAFE7C855F2BC29C977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 761f11a57abc21733b78fab35701ae3797ee9a8aa1497ff5144a0518fd712169
MD5 7e23594a6538d96e1ebc05c6952bdeb2
SHA1 1b4c0327766ef77590c305a97e7ba0bc9b8ab045
SHA512 83d281c5166df6eb7d6d922254f996965144c757526054030c827993b071f1ccb5f0c5bc90c5d583aea50789c581e4194395968c3b3027148a8e0fc273b02178
TLSH
T1804131E04C7D5AC5D5BC0E7EB48B38EC85E89725F450343838A8EA98597D61C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9144105fc42e11d9dcabbd6cbe4f0886fc01392652a1ef8a5f531c6633079f01
MD5 576804a6dce68c704b8d161eeb3e8843
SHA1 1f075eccf196328af98387b5e2c724ff7f7c1d66
SHA512 fdbd35b59c7a816c040b4b58705e51a21b21866a7c1d93512470dc072363132fcb3f651b830ea31c9a04d49ef67ed8ab4a8665452b32ef2e14a5450e85a90838
TLSH
T13A413ED04C3D1AC1D5BC0A6E748B38EC92E8D725F5A435786CA8E9990A7962C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d3198ba2b3c74f92c2af6b7f74e0b95aa1b1530df1aad6c256681f5775d0fc81
MD5 314c3ab259b11851bee1ad3bd7063af1
SHA1 05fbf1a9545e3c7c4ddcc840785401b513979a3f
SHA512 0a1c490ea445290219cd698ac7b2dad264e28a38e9b6c94736f3b3fb298fc78956604a1ac7900fc338a0cbb21b70d3d50f3a7a094190d15bf9336ac1375cab3f
TLSH
T10F4121E04C795AD5D5BD0E7E74CB38FC82E89A35F490353878A8E999497962C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 39f9e4ef9f80217390d4e4f47efaf46830b258822cd5e8b708a45030d2df6404
MD5 3e07aeeeea7d8052d5b693ff07ab57d3
SHA1 1f65c200f5497abe1b1705a3cc7d3d95a95056c4
SHA512 e0e8db5c95f2ca98f779c10fa8fc5652184ccad039061ef30cf76737e57331fedcb316b3352f425a3e716d22ab35be9ef9e0830b57d5a4ba70cf0b497e236858
TLSH
T12B5142E04C7D5AC5D5BD0E7EB48B38EC85E89725F4A4343838A8EA98597D61C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 480c41ba3f6c79327c77068d577a3b219e5f7f7fa2cffd8e21aac7e9f054e511
MD5 254a786be0ec77e7ddcfa79da8787924
SHA1 1ceca59c3c8fa2776a6aebdfd5c36e9696e046fb
SHA512 ae2a1592f5fa01cc4657a730f1109fd89a30bb947215caea08d1aff33007c695b08b69c437d25a92e545051aa3952af52a293c57587e61be649cd4dc7841507c
TLSH
T1735162E04C795AC5D5FD0E7FB48738EC85EC9721F890343838A8E65859B962D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5d20f473028d2c2718c225ca411ddfe74e7e303396d37f197d92f6a179616315
MD5 0c513e5e51f98e17b6371e6e7e277b86
SHA1 5e3043b2d15f7207b7a6b79724ee27a8f2bff359
SHA512 7abddebdaec54beb112ef608ff3f220135ea6b35ac32171a29c1cc76792fdcb12d5fb87a384135a6b1901868850d5b8b9dfdb0e5ee3f328004dad43daaa01e52
TLSH
T1214131D04C390AC5D5BC0E6F748B38FC81D89735B5A035786C98E9950A7962C348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9231a56f493d3d96e6fa5e5a93c2dd47aeb5585980b918804ee9644c3bfd26a9
MD5 95b5cb5629086baa7f2a45d9da2a8df5
SHA1 de617296741a035043c40ec7ec116c251d998724
SHA512 abd16118462738e8b1658812bda3218193e0436904cab6a72efc35b05fec086c2cafe253879e6383b566b9df172c84d17fcb2afc98809faf0f3c3df7231533e5
TLSH
T1DD4130D04C7D4AD6C5BC0E7E748B38FC82E8AB35F4A034386C98E9994A7961C349483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

Word.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Word.SurveyEventActivityStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

B964E767-67F1-402F-A847-214CF3B40DF6

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\B964E767-67F1-402F-A847-214CF3B40DF6
Size 191KB
SHA256 1163c06ec3bc900e255d4717ee478d452f4361aef9ad25bbec493a16f0710009
MD5 97aab3726d7bc285e06f7275927408d6
SHA1 351b6a6bb4f303620388fe7813baa9574f06fb55
SHA512 e0b02696a8a759fa38b26675a5c5c7abfe652d2134292070ca9332186294c5ed7e6d80bfdaf166abb9918ebbc83142e9c1607d47e8248583c7bb12bbdeaaa857
SSDEEP 1536:IrVe3b3yFKTZbDxsghEa0e7HWsDXjj/mblcAZl1p5ihs7VXXdEKD0aO7qamZdGVE:Pce7HWsDXjj/EXi57cL
TLSH
T1E21412A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mip_sdk.miplog

Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
Size 12KB
SHA256 3f3e46d5a9859cba544dbd9f067db38419459156cfe739062cf98878012d3732
MD5 650cd3dd5358e6eb7e18e8b8bbd610c0
SHA1 73313083b0818907514460ef385f6f3d43ea6a60
SHA512 09969b3317e55a3146109db218d84cfc96f3d564a4114c2446c64e7399b0203bc6c1ee073574953eb29c595ff9d3935f32600b8ebae69a42a26955a4ec7e3698
SSDEEP 192:vjH99o8z8IZNljYW99+zBhZmwN9jKE9rN+zd5ZyfNjW5o59m+wzNtZGt:E81+9NRN++PwG
TLSH
T15042F29782EDC5EB9C367F1753C73350400A766A2BC77009975C025A358AF148BFBB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b93512a-0dae-4795-a017-35bce76222f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\9b93512a-0dae-4795-a017-35bce76222f7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_hyliqnpc.czg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hyliqnpc.czg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 2KB
SHA256 5232d0084bf0f29c14a411d5fd618d419543cca9d7dc14975e971dfbedcbc7ab
MD5 d31cf53b04bec827aab7c91ae2b3a316
SHA1 f46cf74929a55878150b7f2703fcf120211423b4
SHA512 b00690373378f6948e4e364c5221765fcb47293643a7df1e8a0142d7c450c945dccc0e0a590c2eda5e084623a4b204a83638edc579b18b1f0044c2155d4ffb06
TLSH
T1EA5120821ECB8FB7F05443F9223B4762D370B907CF21811EB204E25E3D759009A6EAA7
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 e0eea4397235d96a4136dac3f191fa8058d0d59309ea330495134d114cfbcfca
MD5 f3ca9c0abd5ac5f46ad75ab52fbaaba5
SHA1 fa882934ccf977437b13b2066580add77aa12e8e
SHA512 8e5dea1d9e3eecd8b65ecf86c51d7da4b8dc43f44f0ee7dededd78b021494617834381c68f21debc1349f863321f9a8c52da89d5cba40c9e8effbb74058f6aac
TLSH
T1A621B181099F5FA7F08163B5223A0761D7707D07DB25651EF204A51E2D74D405F8C66B
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 1KB
SHA256 e4209f80db7626f32c3af864113d771cf92b7fd67cbbf416e8eb9117915beeb4
MD5 43ebd3a610f1e68575b36fae9a1e9b27
SHA1 77ec4fe3a0479a79382cb3af0f336d35a6ac8491
SHA512 57aaa05aca1cd5aaaf77ad0076ed0ee3c481385c747834bc674fe946ba0ed777e5ed0dc1da25f6e3068b1830b4983593a8c3c47f0bd1dfa6b448ecc61a8062ed
TLSH
T14B21E181099F5FA7F08063B1233A4361D7707D07DB31A51EB204A51E2D74D405F9C67B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1254065645\manifest.json
Size 53B
SHA256 551c5f7ed9a2139eab8089f6fd9724b0b38d226b369209cb2ac295b3884571d3
MD5 1bd4aa2766777b47a4fc061677395793
SHA1 5e88d6015511963e10083771e9747459117b0eba
SHA512 0d7d7b5d8f5ea16308268e5ac5986195d5238bf5f30465fc541c70de8dcf8b3f87bb1e2bc38e837119df1d52a78072088d5c822836d04490027a8e071f52db0a
TLSH
T1519002604424951716C10F5065B0BC819391765995850D1D0545155902A546CE054298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1403168612\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3760_1856462515\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1324646044\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1602434497\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1775820523\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6080_1775820523\manifest.json
Size 146B
SHA256 aeefe4f81560fcaff3291ea907bb7a77361e90e68b866a3e30305edb239c8034
MD5 b5198ae671d9790681e5f5531b056679
SHA1 b53dd9270669ddcc2e53dcbde5add5baa165e29d
SHA512 9107edede2dfc2fd54b2dd11f434457dfcbc79d859172b6bec71afc97bef626e751bf3c5fb671c3f605d07e56f86d222586e4801ec7b7a2357f9067f069611c8
TLSH
T132C02B33C831AC30053007D408F08741EB34134BF500B0163730008D0B3C4706030AD0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-1105-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1104-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1103-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1137-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1138-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1140-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1139-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1102-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1088-1101-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/1232-976-0x000001B16D6D0000-0x000001B16D783000-memory.dmp

Download

memory/1344-2198-0x0000000020B70000-0x0000000021098000-memory.dmp

Download

memory/2556-154-0x0000000005110000-0x0000000005BD2000-memory.dmp

Download

memory/2556-158-0x0000000005110000-0x0000000005BD2000-memory.dmp

Download

memory/2556-153-0x0000000005110000-0x0000000005BD2000-memory.dmp

Download

memory/2556-155-0x0000000005110000-0x0000000005BD2000-memory.dmp

Download

memory/3428-164-0x00007FF845390000-0x00007FF8453A0000-memory.dmp

Download

memory/3428-166-0x0000023391E80000-0x0000023392150000-memory.dmp

Download

memory/3428-210-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-163-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-162-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-160-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-161-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-159-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-211-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-165-0x00007FF845390000-0x00007FF8453A0000-memory.dmp

Download

memory/3428-193-0x0000023391E80000-0x0000023392150000-memory.dmp

Download

memory/3428-209-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-189-0x0000023391E80000-0x0000023392150000-memory.dmp

Download

memory/3428-208-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/3428-212-0x0000023391E80000-0x0000023392150000-memory.dmp

Download

memory/3428-173-0x0000023391E80000-0x0000023392150000-memory.dmp

Download

memory/3700-219-0x000002D0F5670000-0x000002D0F5940000-memory.dmp

Download

memory/3700-244-0x000002D0F5670000-0x000002D0F5940000-memory.dmp

Download

memory/4484-134-0x000002193D4E0000-0x000002193D50A000-memory.dmp

Download

memory/4484-133-0x000002193D480000-0x000002193D48A000-memory.dmp

Download

memory/4484-138-0x0000021922560000-0x0000021923022000-memory.dmp

Download

memory/4484-118-0x000002193D420000-0x000002193D442000-memory.dmp

Download

memory/4484-135-0x000002193D4E0000-0x000002193D504000-memory.dmp

Download

memory/4484-131-0x000002193D490000-0x000002193D4AC000-memory.dmp

Download

memory/4484-132-0x000002193D730000-0x000002193D7E3000-memory.dmp

Download

memory/4996-679-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-675-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-699-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-678-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-677-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-698-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-676-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-680-0x00007FF845390000-0x00007FF8453A0000-memory.dmp

Download

memory/4996-681-0x00007FF845390000-0x00007FF8453A0000-memory.dmp

Download

memory/4996-697-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download

memory/4996-696-0x00007FF8476D0000-0x00007FF8476E0000-memory.dmp

Download