hxxps://gamejolt[.]com/games/Part-1-CreepyPastaCraft/755756

Resubmissions

04/08/2026, 05:50

260804-gjve5sgq2z3

04/08/2026, 05:48

260804-ghvphsscla3

04/08/2026, 05:48

260804-ghps9ssckd

03/08/2026, 07:46

260803-jl2y4s1flc10

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamejolt.com/games/Part-1-CreepyPastaCraft/755756
Sample260804-ghvphsscla

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302961409414281"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{56EFE750-7500-4785-9057-DF359D7D1794}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5124	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5124	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe
5124	vlc.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5528	OpenWith.exe
5124	vlc.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1812	2628	msedge.exe	86
PID 2628 wrote to memory of 4192	2628	msedge.exe	87
PID 2628 wrote to memory of 4684	2628	msedge.exe	88
PID 2628 wrote to memory of 4684	2628	msedge.exe	88
PID 2628 wrote to memory of 4684	2628	msedge.exe	88
PID 2628 wrote to memory of 4816	2628	msedge.exe	89
PID 2628 wrote to memory of 4816	2628	msedge.exe	89
PID 2628 wrote to memory of 4680	2628	msedge.exe	91
PID 2628 wrote to memory of 4680	2628	msedge.exe	91
PID 2628 wrote to memory of 4680	2628	msedge.exe	91
PID 2628 wrote to memory of 1556	2628	msedge.exe	90
PID 2628 wrote to memory of 1556	2628	msedge.exe	90
PID 2628 wrote to memory of 1556	2628	msedge.exe	90
PID 2628 wrote to memory of 960	2628	msedge.exe	93
PID 2628 wrote to memory of 3264	2628	msedge.exe	94
PID 2628 wrote to memory of 960	2628	msedge.exe	93
PID 2628 wrote to memory of 960	2628	msedge.exe	93
PID 2628 wrote to memory of 3264	2628	msedge.exe	94
PID 2628 wrote to memory of 3264	2628	msedge.exe	94
PID 2628 wrote to memory of 4996	2628	msedge.exe	99
PID 2628 wrote to memory of 4996	2628	msedge.exe	99
PID 2628 wrote to memory of 1644	2628	msedge.exe	98
PID 2628 wrote to memory of 1644	2628	msedge.exe	98
PID 2628 wrote to memory of 2540	2628	msedge.exe	101
PID 2628 wrote to memory of 2444	2628	msedge.exe	107
PID 2628 wrote to memory of 2444	2628	msedge.exe	107
PID 2628 wrote to memory of 2444	2628	msedge.exe	107
PID 2628 wrote to memory of 4456	2628	msedge.exe	108
PID 2628 wrote to memory of 4456	2628	msedge.exe	108
PID 2628 wrote to memory of 4492	2628	msedge.exe	112
PID 2628 wrote to memory of 972	2628	msedge.exe	113
PID 2628 wrote to memory of 4128	2628	msedge.exe	114
PID 2628 wrote to memory of 5192	2628	msedge.exe	115
PID 2628 wrote to memory of 5192	2628	msedge.exe	115
PID 2628 wrote to memory of 5192	2628	msedge.exe	115
PID 2628 wrote to memory of 5300	2628	msedge.exe	117
PID 2628 wrote to memory of 5300	2628	msedge.exe	117
PID 2628 wrote to memory of 5300	2628	msedge.exe	117
PID 2628 wrote to memory of 5292	2628	msedge.exe	116
PID 2628 wrote to memory of 5292	2628	msedge.exe	116
PID 2628 wrote to memory of 5424	2628	msedge.exe	118
PID 5528 wrote to memory of 5124	5528	OpenWith.exe	127
PID 2628 wrote to memory of 2144	2628	msedge.exe	134
PID 2628 wrote to memory of 2144	2628	msedge.exe	134
PID 2628 wrote to memory of 3092	2628	msedge.exe	135
PID 2628 wrote to memory of 3092	2628	msedge.exe	135
PID 2628 wrote to memory of 3092	2628	msedge.exe	135
PID 2628 wrote to memory of 6104	2628	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamejolt.com/games/Part-1-CreepyPastaCraft/755756
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff84a22c188,0x7ff84a22c194,0x7ff84a22c1a0
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,3327480663214274945,12936494679344674156,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,6492878640750810688,6109418960672155052,262144 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,3503194724689650261,2942663737070812018,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,12864088808983126855,2049742260317827919,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,11796925668030295311,16333669204916259693,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,7092196019139083549,4729137066494522956,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7250733573158905984,7661111144613991231,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6744661546585809254,16339942642422946905,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5602471867640335288,7881378387828434689,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5501284924728424845,15436521946948639082,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5501284924728424845,15436521946948639082,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6068,i,14907412020905620778,2467512210643914524,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,3647888271419052835,10848778626126259441,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,9079354269998888358,10376005262035868165,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,8564857624776803975,5478396887249751063,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,5713753708066250554,4254025596005137204,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6656,i,60231080068847067,695416794596905642,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6092223537826177754,14905314897460969557,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6936,i,15717392988271597196,11512045450378720489,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,12040582491753668718,4964310793838810489,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16668775264362949640,13096189496710251200,524288 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5932,i,9830043243892169893,12838479503169938036,2097152 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4032,i,15357800186116360568,14622962178595249539,262144 --field-trial-handle=2248,i,14744742230777038750,7489217664304216590,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\38-34-35.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
MD5 855cd69f46ca80eb69346c8a580ca6b8
SHA1 edabd216a3773be95b50c047ece50793ca1b0403
SHA512 3eba5699e57eb3f6a05ab94cd60ae66b60f73621303363a5393ea34f2b8a556e243a128d41829e64f21b76f4c24cd5978cf832f4255309101adc2b7bbcb1babd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 1024KB
SHA256 6c31370c5772cee25bc219d230e6229d5b83711976492b0354e4e17e57dd5654
MD5 e1c9649a5a1ba00eea1423677bc045be
SHA1 a4261e7e2019f7c7dca33e9fb956f289e9054e63
SHA512 b11295f6b8f97c3ac1ad49fc4b7b7a06b942083c0043ba3719d04983537f58016c2539d3a3e971b900553ad45c6878038eef94cde8fd7ca344557da2a63475ac
SSDEEP 24576:xaxqspJxP6+QWoS8YM2UwKDTesb2SBpR2EBV3Cg:xaxqspJkCM2YDCsFpR2EHv
TLSH
T1DA2533B01F65994309C43CE8776324C2C78DB64D5B89AFD783A14B9637B38EA28D147E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 907KB
SHA256 8cff4ca0fe891b09ff3b3b3dc6183874f6c1817c7cc31296a647bdb29d48ec26
MD5 c168ca354f9f14687c25a92d3860670e
SHA1 3012f8448a2c42f09114e248caa833fb5857babc
SHA512 2fbeeaadd85b0af8a4460cc5e526b11dee1e255bc78bc0c0b9885fb59839777d03c2f4888474edd7c49efce509f68922b0764e4b07fd487c0cff9b73fa4b4f9b
SSDEEP 12288:t19L+/NWJ1fluI0VFXRKNbHFXziYFnsXxWPH9NVYpjerlUL1WvkFDozANXh:VaWJzIX8NjFXGYFnsX4rVwJhWvqIyh
TLSH
T1AD152389F72F3C42D94755B4285320B623912E321456D36BBF2EBA7A2F91005FF75CA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 da5f9321797f28f5e92b909f06acd35e4596477b078b07818d815ad631f2cb7e
MD5 3da02d5135787f26e9b1534d1fd4a6ee
SHA1 b3035755881a11af36b45eb616d07af79cff74df
SHA512 a68cb7cbdde1cd75a4fdd657a6fa1e608d9baea8c6b795d66799f58afd19723d4f38c27964fcbb1fa3f62716a2bbdbce2134d393320a6841c41a6b208c8fd149
SSDEEP 96:K/YKl+WbeaTpVgGs7BAtig+JF3EKW7/MYQb9kVQIR6rHjINS:K/tNeaVvs7BAtigsFVW3UyVQvDIM
TLSH
T1CFE10A94F1B62454F7320932C9D0C0707F7E6E7A3947BED0438665FE12B63AEC862008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 cd116e959dbaca25b2fd389f96cf18cf64de1853a045529dc3292ecaae46641b
MD5 6dcf16aff1614c340f52ba5bdb9932fb
SHA1 2f1b1e0fe4c3cceac96e5a7709ad8dee4c6b0091
SHA512 17da55ad08159b845d626e5b8480e7501ae17b8d17a3ac60e0a2d3eeefec8514871335940831cf62bddabc81d59aaaf53b1a374301d8015a531b91e6f2a76d47
SSDEEP 96:I/YKl+WbeaTpVgGs7BAtig+JF3EKW7/MYQb9kVQIRIrHjINu:I/tNeaVvs7BAtigsFVW3UyVQdDI0
TLSH
T130E1FAA5F1B62454F7320932C9D0D0707E7E6E7A3987BEE1438665FE12B63AEC866404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58efca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58efca.TMP
Size 3KB
SHA256 a7e6bfbaa381252bee9316985ce159b0f343d175cd8cfeb84701c0db37c1b921
MD5 a6b6459af5f6ece70c5cc4210284ae7a
SHA1 28ac9d6f339c034d5ec498a3ad8e845511f20459
SHA512 ed0da230547cae3dc51962e2486c2d94452be15743821d5c7f1fd0e7fb17d454d2788a813739039b80999ad9868604240bf83dbac40bc02bf3054d810517d57a
TLSH
T123717E2875C20441D7371A32E9C0D0363C72A3AE366BBFA192D6B43F05B67EDC874804
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 603e308e93bab1476c4bcee486fcf15fe09b5bdd0f60b0f5f3cf55a16a3a411e
MD5 2d1f0e3aed7933edba10868de82c3d1f
SHA1 311eab45ef1039e2bc20edb8f14e4b2108356b8f
SHA512 e6f6fd3a4961aa1cd8dad6ba31c32d54ed4dbd66d8c6b2e429145587bc975d12f4c09c3e0f271dd3579f7e56178cf43ab4e906303bae7ad3ce3e532fd83ea6d5
SSDEEP 192:D+9IZSBTSgweNrin/J1J4XJRJ5RrvmqQ6XRcEAx2e9iOiIDkVr5rdlxrRTvIx:D+9IgBTSgweNri/JD45RJ5RbmqQ6XRcr
TLSH
T1E412A0F3C7E8AB2ECC716AF0A7152A1BCE1D0D1496283C2AC8D59F1F93D2471E145A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d1731f6ecddef24319dfc0ee6d34652a8eb3f67185d9578c2602a67a7eaf7afb
MD5 da0802d47800b7373164f790fe55c68b
SHA1 d11706ca0383ab71becb2ec9ceae0b55b1df821f
SHA512 36b50cfa76bec09977054b7a589e42c250797012cbe24f184483361bdac5c98d83350de0505056e6f358afe2c5c3b3251aa06b3251380b9b3e8ec2deca1efa6c
SSDEEP 192:D+9IZSBTSgweNrin/J1J4XJO5RrvvvqQ6XRZPEAx2eFKGcEU6+VMzOiJlckzu:D+9IgBTSgweNri/JD45O5RbvvqQ6XRZu
TLSH
T1E912B0F7C7E8AB2ECC716AF0A7152A1BCE1D0D1496283C2AC8D59F1F93D2431E145A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2d429013e13bd4d69029e4a36c018d0c33ad3a52011c7d67d561632db1a4b7b0
MD5 fbd29c283fc962984ca03490450422fd
SHA1 3a206c32bf3eabbd6f4fb1bb588a518b99d1961b
SHA512 ff6c2e23b5f153641f8f0d6ceb9f46568751b85b97c91604c2108aba6aed5b4bca4687b84dc158979c8f72d601110357fd95ec41965ab0f71dbcc3a5d66c4023
SSDEEP 192:sxZ5V5RYhyM/jK1Ml8MkoR/fISsk5d550IdprF5UHW6+WNW5k9G/YwsT5TUSejIa:sxZdCMG/fDsk5dRr8HbQ/V9
TLSH
T15B42F911AA34A977CCCBD209FA55BF53D6F90572A2900E44A9FCDA1C04F6AEC231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e7590a50fceaef0b0a03951dad2acbe901e457f3c01bcbdcb435b7b4471c9e8
MD5 0c4862cee9fe2f66ca99907a128edf8d
SHA1 0b4485f4bc94cf4c47154b9630f5119396bbc618
SHA512 6080613e1a6be7e1c5397fa3ccc17e57cad855f3b87de11df277f163790b15b7cb0877126bb4a6803b6978636b40befa4d845ecd8357624e63dc4ad2be5994a9
SSDEEP 192:sxZ5V5RYhyM/jK1Ml8UQoE9oR/fISsoR5OE550IdppF5UHW6+WNW5h9BzYws/5cv:sxZdCqvG/fDsG5fRp8Hb6zvR
TLSH
T1B652F812AA749A77CCCBD20DBA55BF53D6F5047292900E44AAFCDA1C05E6AEC630381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 070f4dab955cb6ffda78e9bdbb613c516354806e33fdf4bb1ee90689251d9862
MD5 898f474b15bc7368594225d07ec055d1
SHA1 a8c598edc39ba697fd0f806153e6943dbd051bc6
SHA512 14d7e57f8cd93286f0c21bcf51915cb01469bde55e743bf09117c316d3dcfb46af147c2b5ca3bd46410be2372be7690ea4eca333f2fa95153e1354277106e417
SSDEEP 192:sxZ5V5RYhyM/jK1Ml8M9oR/fISsoR5OE550IdprF5UHW6+WNW5u90dYwsa5LUSeV:sxZdC1G/fDsG5fRr8Hbgd8R
TLSH
T1B952F812AA346977CCCBD209BA55BF53D6F5047292900E54AAFCDA1C05F6BEC230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e49649d8e401d38390c62f6261e3189c230ec71ba53fc211709883b01c65695
MD5 b8f03886f6890167e0095c7f267997f0
SHA1 d7870118b5c19a1816f3c9e6588c85b96d6691b9
SHA512 eaeab8d7059c00b1ba75830b6cb5058f2c9c241a6cf89ea745227221689d175cdfe9e60265ce99e82e1e33a56bc610247d4f96cdd1ebb9c0b61c6d385ea9004d
SSDEEP 768:8N4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dXrohHIQna6:8N4jeXmWvmKxEu1jacPLZQdE5I4
TLSH
T1B0E20A3B240CCF7E4F844E5CED26AE976ED802CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 6171a8251da3e07303bca6ef33a4fc5d279753ab2899ee69176fa81f65b58186
MD5 4d52a139553ddd283a8ce014db0bde4b
SHA1 e8897dd27303efd3d680a7b41655606038cba83b
SHA512 013152e4c2b1b796c47c85dd6dbb65d64d034fd17d05ad1959c3297ca0ba3321e8aae34618f17f54d7f85e646a44263743a93ade77faf2179bcf9d678a88a3b3
TLSH
T10DA0021459486001D02402B17BD121497B2448205B050A1143D41548EC5D2934551710
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1e419ec9b550c7376ac39285232729090f2d335f45f91c0f884e050cf34248b8
MD5 7e759d809fe884b9cf1baea947c7ffd1
SHA1 7e393cddeb425a5d9d127cab378aa7efb535d84b
SHA512 c225705efa0f45bee8266250d6cea2f790240001647b58b9bbeb51473d01ab1762d70990a6c4d7033a10b593ee5fd431863fbf1c6f8deedd1e49660326285688
SSDEEP 96:Kwj2KE4u2jqKsEqUTg0i6q2s6p9q02KyTqe2u8UxOUn6qYKj6S:Q9JdVPR
TLSH
T197B1110235BE22213C7E651C95519E665A53B063351CB87B7FB924A20EE7E204CFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 af36b933cde0b9aa554f8a8d7b5fd314d1cf521023862129941d06ee8be02211
MD5 eae0f7112fbaebbf33d25920ca8d5486
SHA1 84ea8163d23c9122a587305c80d80804d6b4a5ec
SHA512 d0014d211ed01117933b06b2d2196ad08afe73eea8d3c66e9c9e7c7ab64aacafa465fb743b17cce0eea17812f7c8e425cc848b5854d7e9796395e94e0846e88d
SSDEEP 384:hZcIhsNv8PGpNf+0d2YHRmEF8NBeRs9JKgqijU2hOGG:phathth8NTjKgqmU2hOGG
TLSH
T194928D315878A8779DE6B942F4873A074FF49027E6D47FD4E2EDBF0D009A5AC130A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b5da063b4dc0433c55c81359d0624e71eae7e364ed4c7b42e9dcea0b4fb9ec0e
MD5 05a8fee530a8a9c52f76a0b8160e5e5d
SHA1 c48cab6be1015a0a2a13f3ce52c2249992fe6b22
SHA512 c2e27a4e2cd61d94a04720a07f89c901edd149b71354d2dac9694c5fc1def319f7186d04a6f65684dc31918408fd3ef2394a6a535a871c52014e052122666b0a
SSDEEP 384:eiFPZcIyfsNR8TUNTUlIlPP15Nf+0d2YHRm3F8NBeRs9JKgqijU2hOGG:1FHOIwgBthts8NTjKgqmU2hOGG
TLSH
T18ED219F244D79436D9AE9B43F77E2E024EBCC027B590AA90B3D85A0DCC561BFC30A914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 429816cb47c049a50c59b061b70fc58eecacc0d29ba62df3432d07d8a9a05469
MD5 58797f1f07e8f35fec2b4daa5707e477
SHA1 6c2d068efdebd64b21fb4ff6b1024bc8497b6301
SHA512 4691dd5e12a3b2082d9664dce95f6f0af331838904562457b0a072525d2bf5c4b0b4e66ea5f85527fdd28cf17e156f8afb1899919c1ba218b88db063d294cbe2
SSDEEP 384:FZcIhsNvDPGpNf+0d2YHRmEF8NBeRs9JKgqijU2hOGG:9hRthth8NTjKgqmU2hOGG
TLSH
T178928D31587868779DE6B942F4873A134FF49027E6D46FD4E2FDBF0D009A6AC130A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bec948890a14ba8fb2f29be44d16d61c423fd0050ad637782efecb9860b755e3
MD5 eef3fa0da0047f2c72a8093ac91886b5
SHA1 74d72fc17f95a7862329e1d67e755b8599c61cea
SHA512 d0272c3b4bbfac2c88d2b508aa29006b844c280c07c66c735e7542f3eca5cd0a4a292523294082f7bc22661ecc482623960f4381bee4139d9bf38d06751f516e
SSDEEP 192:EONY6hZ0QmiUy5B5Mpc/+jVx+Fd2YHC5wOZqvcnU6:EONY6oBpu+0d2YH528qU6
TLSH
T18802DA35A8786C778EF2AE05F48777235FE4216BADA56F84DAE81B1C00D775C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 544a627b593220454e8ab226ffcdc11d2dda0054fcf118a9141882174457c13a
MD5 cb15a22032d344f51383113a1683c688
SHA1 ef00ea3af008b9db0ebe6af4f5d9fe8a9be38b80
SHA512 078815eab0756f52054e6d2a08999dd6ea6107d387e482fa095af024b75bdb0a167e980cd3bb839675de52000cfe6a7301515d3d547dff7b79511cbdfc5b9ba1
SSDEEP 192:brONHa6hZXiQmiUy5P5MbTc/+jVx+Fd2YH8FEmz5cOqqv1qgU6:PON66izPu+0d2YHRmO98NU6
TLSH
T14B120C3168A8BC674DD2A942F48736135FE4512BDED5BFC5E6ED2B1C00DF6AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 33734238beee785aefb41a290d301888e59a38d7cddac2118c0cf5c97b5a4134
MD5 8ba74acda99ad835c0f74092937c27d3
SHA1 e3d79df6234105c512634ce9e0765ed509fd1297
SHA512 7b65515646e190dc994b708842ab507cd70d11e322552cf297313cef290748eef987064ebaabdf0d3630763f8af6148e828bae6bf0443e77d1653b341eee5b5d
SSDEEP 384:AZcIdsNvPPgpNf+0d2YHRmEF8NBeRs9JKgqijU2hOGG:+dfthth8NTjKgqmU2hOGG
TLSH
T1DF929D315878A8779DE6B942F4873A034FF49027E6D46FD4E2FDBF0D009A6AC130A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 72b2db74c6a8daa094e9b279f28d2cd53d474053ed9f647437a617372604e2bb
MD5 69cfbc26061bc1187f532595d877f73d
SHA1 b2ce9d5374dc86379c70a9a83c5fcf8ad7bc673e
SHA512 d62390065b12e49a71d9d504846e2fefb84eb07be432cf2fda69c175994a06b5289b24a4323353d258b4eba0b2cb40122b595f5af538f586bfaf607165c36fcf
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59481b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59481b.TMP
Size 392B
SHA256 1194429e6b47af0c2828e31e7180f55b740b97685227827414d5d9c8b1e50b3a
MD5 fa1ac229995296ea2e1a6f676b3540ba
SHA1 5f47996a9e2dd0359ee225c0508c66db930999ad
SHA512 5e921b80fad8f0acb913753d9ca75362135187c366763e5917803187f5e86e39c3be7f45a90a11a9528b0054e9fcbb1fe0ef71708c5807db83552ec62af65c05
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 873cb3ca2cb49a90838fcacd9f105008b4185a32aa859cfe611cd329e8fd99e4
MD5 50cfb5d7997741e8c4b6abf68abf70b8
SHA1 0abb05472263f534dd01913e0573aa1858090bfa
SHA512 64050909f6f243957f0a603c9ae044b59cbbcc1f35f0ef7a85f2f74b74ddfdbcbce59286cfa3d5091940a2a201ec97a53ac488d15f70b9185a90be780c012ce7
TLSH
T18441EC58A6F90148B3B7AF575FF6695D487AB9772F06D15E10110E4E0532B40C9A2B33
MD5 SHA1 SHA512 TLSH

Submit Download

38-34-35.rar.crdownload

Path C:\Users\Admin\Downloads\38-34-35.rar.crdownload
Size 6.1MB
SHA256 bc94a67e5adb6c7ad739ad44a545e9c023b4df3eb17ee8346ac66e257d329c65
MD5 9e5b25965da5beee657d8389e94c3442
SHA1 8d2aeb1aa37d62a116aa787fbfb5a2b2eb5c9572
SHA512 223aca21e62c62b7a19ad62cada58d06ffcba2295644562aea8e146343ff60ca05f4fb0565892f58d8115b7c722a7b4573b284751725b4f8f931e84b40c16db0
SSDEEP 196608:9YiIh6kGRBrDLdVdQi4nsoVxOR0tRFld7ptzBh0vD:IJ2DPdQi4nJ8RsD7zlhMD
TLSH
T1A55633E96720957DDD55C32EB0121B5CD0B259C89C8C9FAAB376B2D300AF812977B4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5124-517-0x00007FF846790000-0x00007FF846862000-memory.dmp

Download

memory/5124-531-0x00007FF8442F0000-0x00007FF84433F000-memory.dmp

Download

memory/5124-514-0x000001A89A990000-0x000001A89AD20000-memory.dmp

Download

memory/5124-522-0x00007FF846620000-0x00007FF84664F000-memory.dmp

Download

memory/5124-518-0x00007FF8447A0000-0x00007FF844A36000-memory.dmp

Download

memory/5124-529-0x00007FF8443E0000-0x00007FF8445EB000-memory.dmp

Download

memory/5124-528-0x00007FF8445F0000-0x00007FF844601000-memory.dmp

Download

memory/5124-527-0x00007FF844610000-0x00007FF844621000-memory.dmp

Download

memory/5124-539-0x000001A89AF80000-0x000001A89AF91000-memory.dmp

Download

memory/5124-540-0x00007FF83A350000-0x00007FF83A595000-memory.dmp

Download

memory/5124-538-0x000001A89AF60000-0x000001A89AF71000-memory.dmp

Download

memory/5124-537-0x000001A89AF40000-0x000001A89AF54000-memory.dmp

Download

memory/5124-536-0x000001A89AF20000-0x000001A89AF31000-memory.dmp

Download

memory/5124-535-0x00007FF8441D0000-0x00007FF8441E2000-memory.dmp

Download

memory/5124-534-0x00007FF8441F0000-0x00007FF84420B000-memory.dmp

Download

memory/5124-533-0x00007FF844210000-0x00007FF8442BB000-memory.dmp

Download

memory/5124-532-0x00007FF8442C0000-0x00007FF8442E5000-memory.dmp

Download

memory/5124-515-0x00007FF857080000-0x00007FF857094000-memory.dmp

Download

memory/5124-530-0x00007FF844340000-0x00007FF8443D8000-memory.dmp

Download

memory/5124-526-0x00007FF844630000-0x00007FF84464A000-memory.dmp

Download

memory/5124-525-0x00007FF844650000-0x00007FF84467D000-memory.dmp

Download

memory/5124-524-0x00007FF844680000-0x00007FF8446A6000-memory.dmp

Download

memory/5124-523-0x00007FF8462B0000-0x00007FF8462C8000-memory.dmp

Download

memory/5124-521-0x00007FF846650000-0x00007FF846691000-memory.dmp

Download

memory/5124-520-0x00007FF8446B0000-0x00007FF844793000-memory.dmp

Download

memory/5124-519-0x00007FF8466A0000-0x00007FF846788000-memory.dmp

Download

memory/5124-606-0x00007FF8456A0000-0x00007FF845956000-memory.dmp

Download

memory/5124-516-0x00007FF857060000-0x00007FF857071000-memory.dmp

Download

memory/5124-510-0x00007FF845FB0000-0x00007FF845FC1000-memory.dmp

Download

memory/5124-509-0x00007FF8456A0000-0x00007FF845956000-memory.dmp

Download

memory/5124-512-0x00007FF845560000-0x00007FF845582000-memory.dmp

Download

memory/5124-513-0x00007FF845530000-0x00007FF84555B000-memory.dmp

Download

memory/5124-511-0x00007FF845680000-0x00007FF845699000-memory.dmp

Download

memory/5124-507-0x00007FF612840000-0x00007FF612938000-memory.dmp

Download

memory/5124-508-0x00007FF845960000-0x00007FF845994000-memory.dmp

Download