salatstealer | hxxp://youtube[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youtube.com
Sample260804-tk67jsthrb

Score

10^/10

defense_evasion discovery salatstealer stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/6016-2676-0x0000000000530000-0x000000000117F000-memory.dmp	family_salatstealer
behavioral1/memory/6468-2678-0x00000000006D0000-0x000000000131F000-memory.dmp	family_salatstealer
behavioral1/memory/6468-2677-0x00000000006D0000-0x000000000131F000-memory.dmp	family_salatstealer

Windows security bypass 2 TTPs 5 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local = "0"	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local = "0"	Launcher_x64_v2.5.15a.exe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	Launcher_x64_v2.5.15a.exe.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\dellpwr.sys)ÂÍ	Launcher_x64_v2.5.15a.exe.exe
File created	C:\Windows\system32\drivers\dellpwr.sys)ÂÍ	Launcher_x64_v2.5.15a.exe.exe

Executes dropped EXE 4 IoCs

pid	Process
6080	Launcher_x64_v2.5.15a.exe.exe
6048	Launcher_x64_v2.5.15a.exe.exe
6468	240798640.exe
6016	240803265.exe

Windows security modification 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local = "0"	Launcher_x64_v2.5.15a.exe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Launcher_x64_v2.5.15a.exe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming = "0"	Launcher_x64_v2.5.15a.exe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local = "0"	Launcher_x64_v2.5.15a.exe.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000247f0-2639.dat	upx
behavioral1/memory/6468-2641-0x00000000006D0000-0x000000000131F000-memory.dmp	upx
behavioral1/memory/6016-2675-0x0000000000530000-0x000000000117F000-memory.dmp	upx
behavioral1/memory/6016-2676-0x0000000000530000-0x000000000117F000-memory.dmp	upx
behavioral1/memory/6468-2678-0x00000000006D0000-0x000000000131F000-memory.dmp	upx
behavioral1/memory/6468-2677-0x00000000006D0000-0x000000000131F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240798640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240803265.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3024	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303333099529961"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{AD4A09EF-5949-4DD0-B514-4AD71C69B297}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{FBFF13CC-8B8C-446A-AC2A-0156DD8A6E1B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	5632	7zG.exe
Token: 35	5632	7zG.exe
Token: SeSecurityPrivilege	5632	7zG.exe
Token: SeSecurityPrivilege	5632	7zG.exe
Token: SeDebugPrivilege	7132	taskmgr.exe
Token: SeSystemProfilePrivilege	7132	taskmgr.exe
Token: SeCreateGlobalPrivilege	7132	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
5632	7zG.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe
7132	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 956	3644	msedge.exe	85
PID 3644 wrote to memory of 3024	3644	msedge.exe	86
PID 3644 wrote to memory of 4856	3644	msedge.exe	87
PID 3644 wrote to memory of 4856	3644	msedge.exe	87
PID 3644 wrote to memory of 4856	3644	msedge.exe	87
PID 3644 wrote to memory of 3440	3644	msedge.exe	88
PID 3644 wrote to memory of 3440	3644	msedge.exe	88
PID 3644 wrote to memory of 1352	3644	msedge.exe	89
PID 3644 wrote to memory of 1352	3644	msedge.exe	89
PID 3644 wrote to memory of 1352	3644	msedge.exe	89
PID 3644 wrote to memory of 5036	3644	msedge.exe	90
PID 3644 wrote to memory of 5036	3644	msedge.exe	90
PID 3644 wrote to memory of 5036	3644	msedge.exe	90
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 532	3644	msedge.exe	96
PID 3644 wrote to memory of 532	3644	msedge.exe	96
PID 3644 wrote to memory of 532	3644	msedge.exe	96
PID 3644 wrote to memory of 2188	3644	msedge.exe	98
PID 3644 wrote to memory of 2188	3644	msedge.exe	98
PID 3644 wrote to memory of 2188	3644	msedge.exe	98
PID 3644 wrote to memory of 2128	3644	msedge.exe	99
PID 3644 wrote to memory of 2128	3644	msedge.exe	99
PID 3644 wrote to memory of 2128	3644	msedge.exe	99
PID 3644 wrote to memory of 1012	3644	msedge.exe	100
PID 3644 wrote to memory of 4892	3644	msedge.exe	101
PID 3644 wrote to memory of 1012	3644	msedge.exe	100
PID 3644 wrote to memory of 4892	3644	msedge.exe	101
PID 3644 wrote to memory of 3584	3644	msedge.exe	105
PID 3644 wrote to memory of 3584	3644	msedge.exe	105
PID 3644 wrote to memory of 2956	3644	msedge.exe	106
PID 3644 wrote to memory of 4200	3644	msedge.exe	107
PID 3644 wrote to memory of 4200	3644	msedge.exe	107
PID 3644 wrote to memory of 3680	3644	msedge.exe	113
PID 3644 wrote to memory of 5184	3644	msedge.exe	122
PID 3644 wrote to memory of 5196	3644	msedge.exe	123
PID 3644 wrote to memory of 5208	3644	msedge.exe	124
PID 3644 wrote to memory of 4348	3644	msedge.exe	131
PID 3644 wrote to memory of 4348	3644	msedge.exe	131
PID 3644 wrote to memory of 4348	3644	msedge.exe	131
PID 3644 wrote to memory of 6072	3644	msedge.exe	132
PID 3644 wrote to memory of 6072	3644	msedge.exe	132
PID 3644 wrote to memory of 6072	3644	msedge.exe	132
PID 3644 wrote to memory of 5304	3644	msedge.exe	133
PID 3644 wrote to memory of 5304	3644	msedge.exe	133
PID 3644 wrote to memory of 5304	3644	msedge.exe	133
PID 3644 wrote to memory of 4896	3644	msedge.exe	134
PID 3644 wrote to memory of 4896	3644	msedge.exe	134
PID 3644 wrote to memory of 4896	3644	msedge.exe	134
PID 3644 wrote to memory of 6104	3644	msedge.exe	135
PID 3644 wrote to memory of 6104	3644	msedge.exe	135
PID 3644 wrote to memory of 6104	3644	msedge.exe	135
PID 3644 wrote to memory of 1036	3644	msedge.exe	136
PID 3644 wrote to memory of 1036	3644	msedge.exe	136
PID 3644 wrote to memory of 1036	3644	msedge.exe	136
PID 3644 wrote to memory of 4228	3644	msedge.exe	137
PID 3644 wrote to memory of 4228	3644	msedge.exe	137
PID 3644 wrote to memory of 4228	3644	msedge.exe	137
PID 3644 wrote to memory of 4088	3644	msedge.exe	138
PID 3644 wrote to memory of 4088	3644	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://youtube.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcf538c188,0x7ffcf538c194,0x7ffcf538c1a0
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3510342519563816654,5802567426702928940,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,3311496823232650834,15436667069941519716,262144 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,12705948772793134440,6469649561397713535,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7202885884193660682,1328568277977740703,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,6386332042355740247,4348433014414836060,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,18117167822185847695,3475555844132295242,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,18374821984760202260,6324418094158483716,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4828,i,16185286432874860611,17260418514542524477,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5256,i,7134763615722200044,2761781929644639717,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5372,i,7233068654232802944,16268163872311339056,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,17961968780837357000,3091697626494577162,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,4140227747321481188,7085959897150887007,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,11216392706903820856,12722859021503513672,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,5572048498495236204,9800250440778259443,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14263223071796330723,4698282844282752037,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,13356385542077384548,5068474195780490683,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,13356385542077384548,5068474195780490683,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,12630648772254485920,4417855284842655437,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,14441237596961571437,495467909373856186,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,3646431243614004448,14175149723461624658,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5192,i,14943637053535287287,5541172209765902527,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7200,i,11571839395898367451,5232636932579644398,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7232,i,2104718622732015648,5735064602214362941,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3604,i,8874069867168649437,12536720428676471322,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7236,i,11912796029469456364,13603907935187239932,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7604,i,13562178152639397013,397666431920801526,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7768,i,3361884964160188878,1651899924276481022,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8052,i,1567402422526899651,8971943171412036069,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8200,i,544127742006712407,9187754325891149435,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8372,i,1207589618632150544,13016245708038381381,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8508,i,15882230490658415187,9001562483543823396,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8728,i,15769369610084671730,3080620668604347899,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8784,i,612929522489989421,5718801526810591401,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,1110395925581967196,12760825754155306842,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
  2⤵
  PID:6180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8516,i,14409360592637921778,13291472624862371774,2097152 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:6524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7112,i,5129345665096254166,13011043356603246644,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:6684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14855783507273911162,16237577115973611125,524288 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5832,i,7980281339388709335,6202863247194978555,262144 --field-trial-handle=2344,i,5905824848518546247,4752248559533030915,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\" -ad -an -ai#7zMap25103:118:7zEvent603
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5632

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\readme.txt
1⤵
PID:6312

C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\Launcher_x64_v2.5.15a.exe.exe
"C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\Launcher_x64_v2.5.15a.exe.exe"
1⤵
- Windows security bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Windows security modification
PID:6080
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\240798640.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\240798640.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6468

C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\Launcher_x64_v2.5.15a.exe.exe
"C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\Launcher_x64_v2.5.15a.exe.exe"
1⤵
- Windows security bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Windows security modification
PID:6048
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\240803265.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\240803265.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6016

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

4C2971467249DD37365644C101166CAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C2971467249DD37365644C101166CAF
Size 120KB
SHA256 54212241ec9675758461c5b1d8fc912f06b5ade7dcf24ea33dc5ec74f4f35aa1
MD5 2d1adf5a3d7ea45a209cea5ed7cfa742
SHA1 f3ec9c789692b0060f926821aeb6068283da2109
SHA512 c0eae69ea6b9ff73c0a9b7171a216c7427fd0bdb05bc89e8a53d5fe9cf66a6838c939b58ab254c2f492481891a734f02cee00056e881e2a13cb88f73035cebe7
SSDEEP 1536:oRLhlSs5lCKQkKjgf7VhZIrh1+o16hd2o0qPhfHcIo5TfDqVImM:YLGMlbjKjghhZIrhayuhf864
TLSH
T1EDC34FA8BC37B961AD4B8F654DAED696D2F611D72F02832E0E337D509C13A9BDB17040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f0c12d7cfe261969f57d2ce27ed1f1a57dfcbd4c3354ca2c77aa712565813b3c
MD5 37feb7af41ae73c18f60ae9f45394743
SHA1 a0066de5ebb5d374f264b9a3986fa4febd284208
SHA512 69256f1d992e87df6102bf6cd0d0e19071cea0938877b140a7588a62f4551ba83289bdd05af5c66edbe891af687bb4e10dc5f55b6c53142dd4c6cbd36b1aacd1
TLSH
T1FAC08C2C1AA60A0AF2A843BC02D179039B208152E3418F151BF12A08C996B163978C2A
MD5 SHA1 SHA512 TLSH

Submit Download

4C2971467249DD37365644C101166CAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C2971467249DD37365644C101166CAF
Size 246B
SHA256 bb66a70adf3b94a4188e51723af9ccfb49c31df40a17865cbc0cbb5323dcee10
MD5 76329bbf931048230cb42604d82ef487
SHA1 7ba31f4d3f4a5f7127cd62d994343026e89328fd
SHA512 3211b754556c65bb1bc9d41a51786cd3adbed83d8494dfb4762d6feec896b8348d905196f02d8daa10c37542afb351df667aecee49067440425ca6432d6d1813
TLSH
T146D0227853A8033AF03B92B9093043188EA0790491828B0E2BE702D88C3CF012DA3C8C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 49c6d78b127b36228c80dd6b8611b44e638d3461280c8e2982841510f10eae90
MD5 42ece275c84cb4647cb19a0385f3f0d0
SHA1 897bbf7dd7694d62dc3b7b916d0ddf4cb3b6cf01
SHA512 30b32eae4cd469297e998ba6211565bfc541b6b42d24957234324616792e35868e87351454a57f9d256547c8bed3a0407e349c1bcc9dd5c819f3b36e1e379a5a
TLSH
T153C08C1C46660A0AF2A893B812C229838A218510F382AF2527B16A08CD24F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f31958a9f88ab83ef9eb882a1d00f7b191313ae64a3c057fbc415f921327422
MD5 86c6709bdeb053434e06d60aa7b93493
SHA1 9c5f19485db08b787b153d866a884ece23427d9d
SHA512 0f7e6ee72e2e58c1696fa8ef07684bae4fef596e9ea448e5d321a94666c2950d0c14178c040c88cd06e619cfbab7274ae6bc6e60dd5d99f5ba705e014fb677f7
TLSH
T121E0268408C8DAFEAE48A557927C534DC2E0370E9FCCFDDA27109A8CB001840A293AE4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 17KB
SHA256 ce83192a06afab5ecb50741023496477f6242c24201d8f25dffb4e52117f6abc
MD5 cd21fc6dc77cabbda4f5ace875b147e6
SHA1 daace7b6604408c87c51e0b35009694e27348e11
SHA512 37a70397be01e6b45d58124ba1a996422b3843ce3ebf40a1340889189b22af9404a970ccc5655b0f5ac0fd97e206a093c175e452bcb21ea6e991f5d9df6cafd5
SSDEEP 384:979cSNMOuvoEAvky8nmH5+XByEi7k1du32ovQ1:BiSmOuv+l8mH5+Xseru32ovq
TLSH
T13382E1AC730552ED1A829801355B28D0E517D7B50B6C562E6768312E8324F3D6FC6F7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 56KB
SHA256 6bb3eaaf89b581bfc357bb3b7a265519adf2fef016ee7885c6ac98fc9d059075
MD5 4b056da9a552fe32cb006b4e259a9f5a
SHA1 48dbc5c2a16931fbe52e14beea06f194a0c903d4
SHA512 e0818715ca1cc2c9e82662d55228f96c925826d3a72eb85d643b7f1a4e2dbd10495b4df15bf560a95f9d6b5f3c48a09b556914485b14bc3655cc025d91eb72b5
SSDEEP 1536:8jqxL7wpWuOgobvdwYnWzr0NK+g4BSvXsYjDPIoCoPR:fxfgWuItUND48vXhDPjCoR
TLSH
T19043F163DEE36160C5C6F680B8835994F5FA2ECF1DA77A50440DF8BA07246689B3C9F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 670KB
SHA256 4326ea24d8caf70c5e5288876af131b4efd8bb5dfeb07041ac0601625cb88565
MD5 ff0788401087986bbe902e3a99a2cdb1
SHA1 6b0911678052ec7742649ebe064e81fe4aa57d3f
SHA512 285ef45d5509b11bcf06c8790befe77a36e91ed11cbbaaff4ad53656546490a73771dae611e0d82de29370cc4dd2137303348073d258b3577ab585496001840b
SSDEEP 12288:xmQUxgeUWgxERD9VCjsBBPre5k+142aqILT+mMDOyuB4qNr/VrrUfU:xBUvgk9Vasqk+1vaBT+xM+gjVrUc
TLSH
T1A8E423D4B9D52784622A0D94E10B0B9FC4C17AF9BB4BE98EBF1E1F9D093CB5B701015A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 22KB
SHA256 a908970523071775176ca3775fe68c58a99f8de0d4b6ecd9a9c2a2b3671a30b4
MD5 d6e325b8d43bb78e7c20294cc66f5f3e
SHA1 5d44f206c796cad9cfbd9d73f29e7d9adc078a09
SHA512 761389631a4e65c97165cc769a6c22b9b7df559b60e5d666bf23da02eb2c6269939d5ba94c09b51f4ea9cd275618db0ae9734f9a4c8c4ced1af161af1d22ca7a
SSDEEP 384:I7eYsT+Ob//XKUQTsuiUPKlExsXqsljTwd/GY5NbzA3b/UiqXceMsNNzWLr+njT:I7HsT/bnrQTs6Six0qqwVGYDMA5swWmn
TLSH
T1FDB2E1A6AEDE1EAD43A1FECB5365C0625B4AC07852C3178FB8A11511C7332613EEB816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 34KB
SHA256 b15c302f2cfd4476de8460512a655b34cc984b0459a1930bcc8297732d0c6dcd
MD5 ad517ad8c28f2a6663c6db81d8b8a6dd
SHA1 7351adb2bf97809716d351099259a0300f7508c0
SHA512 4483640b22aa6c4f78238be9c6ead09e2c6cdd16ab3d8a014663fd89d265c5b65df483ce64d2c7276df6c7eec9dd2a9ea902c4137461ddb5736c346cac04a160
SSDEEP 768:1LOvo91PCK55NZaqq/z5r1bDVD0A5bNs9YALc2zEiorYnZMAlz:1aNK55NJS1bhHj0Yqc2zEiWYZVz
TLSH
T19DF2F13985F9769DF8E28B50E3A568EB5D00FC8082191B29DE9E38301CE19339DCD756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 283KB
SHA256 0f739fafc6015a876ae70b668144bdb47f432ae3261acaa4f95d2333206d6968
MD5 d02e2c79372297f2feabd31526f619c8
SHA1 9ed8098a767d11b059984c68fddcc536009c3c0f
SHA512 6bec976a9947e3dead2acb2bbca0f365f2f9299c9b95eac53a8a8217e88d5f8fdbf834a815fde56d78952098da70d659ef6349b3f73bf3172f91848782346964
SSDEEP 6144:bBPj90ygn2pydv1IuhoI3JZddut5Cc8DesyLhNOKAT273V5GhX78W:990yg7deSoWJMt5CcdsyLh87TCyz
TLSH
T1885423C1EC3D8DA6F33E47792605484EB6EE9235E4440C9ACAAF5847C506CF59A079CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 ca5888c6fa1aabb67d1ed87c7db428293625062cf27676bb59979df02ca1d00a
MD5 5cb61787363906233a28beafa50fae60
SHA1 1f6115a718fdc006d42ba76d605ade19e40639b4
SHA512 2148c5bed756985d4ac0dffeca92af02080559ecd7733d7a4c9bd49fe3e6cb9ee3011dd789f32ce3a5c78d477bb17a2bd70b8229eb41f44dce165f91cbd0d552
SSDEEP 192:JxVxGCZ4EODNW0Cw2FDhcO2mSsOsfGdQtzmNxLuFTG7YHzZaRX5Xl4Q:LV0CZ4EODNW0CZVhcO2P3sfGdmzmruF4
TLSH
T18B1251FC86BA0462FB640AB177D14F49313A97DAF167BEFB83045BB0781B38D6295008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 35561c2591be98b9b561382cde867ca0624850ac9f239785de94fb2a7a83c91d
MD5 fd963e67dac516e4e3f6b0df769ce9d2
SHA1 e81699079fa4d7499a7719104576519dd5f76bda
SHA512 5aae6ba2fb57241d39b50c4c5756b0070b88919315fc0016de5944169ec4e717e2f77d4699d2b33dcb1ae63a2fa26b548a85eb437c4f7d5dd05e22f1f6e7f9ab
SSDEEP 192:exVxGCZ4EODNW0Cw2FDNcO2mSsOsfGdQtzmNxRuXTG7YHzsaRH5Xlr/:cV0CZ4EODNW0CZVNcO2P3sfGdmzmxuXD
TLSH
T142123EFC86BA0461FB240AB177D18F49313993DAF567BEFB83045BB1781B38D6294008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe599793.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599793.TMP
Size 3KB
SHA256 99684ae3b8de1d036d2198e3882fa296aa0a75ea87db9430bc42f28dcfc35ead
MD5 2c2f311dcaf00fd295a2cc9489ee9db0
SHA1 894d1581515758dfe41434eb068bf80fa8b759fd
SHA512 d2747faf209539294634988cb168872b8556019586b8bb01827dc26efb63c22614c2b0b755775904addcc72b6c98c3d0e40e04d5ebd2be281da85e23b7898bec
TLSH
T18D81A8380E6F00B4F3711FF1B3D14B45347E82EBF997BD9652816A74790A761B2C9504
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 226KB
SHA256 a8db897ebedee2d4bf0c38960a44bdb7243642a65713270495dff522e9320ace
MD5 84775ba03f6ed69f69599cd1373c7358
SHA1 195e3716ce1212c1e6cf743dc83232093a811c99
SHA512 3d42dba13e29b8cdd755c451b46aff65c5a8295c5a45a01a62919127552d2fc350f6393cdacbe7475c6689c5a02997462c62167006e1197f8ad1fc32699582e7
SSDEEP 3072:7nFZ3EdzqDilfYmZc8DlSpIC5V5ekrlbBOpPtrZm3MmbB2:LDjWzU+
TLSH
T12434E72435E962D6E23A837708424D12C3765EC8964E30AAB8E17E0D66F7FC53F15B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000004.log
Size 39KB
SHA256 7de52e4bacbb61e20057abcea23567257cfc9cd41eb99c8c16bc597483384de8
MD5 de6bd6002ab3eb8e2fb8ce4aaf8114f3
SHA1 2cea02b9d856c13863e9e2cb802e38bfd0f913c9
SHA512 e9366b9629a59683e2d0f9813f2aecec459907265df0843194a991ea4cf54762e8d516149e401fc25e8ed1e74d0a8ffe5c4f16950668bb9cb36579469b93ccc9
SSDEEP 384:E17qka4jUilT4Uqmj3I3WLOH1klkHaY0UilTNUilT/nNk4wLTL64G:E1OXgT4x43I3uOV0gxATzT/NHwH5G
TLSH
T10603532F81D486DBC700D5F58D6D4B565F3E1C0628E860FEF08A7A0EF93A2605B71D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000005.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000005.ldb
Size 130KB
SHA256 65a76a5ab930995f5d3937a6a326f339510dad548b62c652d9b35bf3c789c0bb
MD5 af1a8ab85c34503075fc2774bbe20af5
SHA1 e196b4d7e655ca4f673f17dbaae446fd84923570
SHA512 921db4974756cc84069178a41bd74a8ce2ec33764ace3fc55335d1f8ec73defe57005faac89a8f1ce8245e2298b4f6cc3a5c1bbecf4c870da28bd62d5b70960d
SSDEEP 3072:x0QiTQR1g2qPpNbOE5vwYwHmztJLf3t3BrkMz:aQiTWIhNx5CGzDjd3KMz
TLSH
T1AAD3BF145DBF9055C93253BFECFA43CEE7E8E0CC67F9B7A13A44910862C862D11D9A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 85dfb0ca7aafce2bf7d6b8e213fcb19ddd99983d7109637a5e3b61e55df314f0
MD5 5ac274d41a9017a61f21d201cee960c9
SHA1 79b630b8be86418dc7814e2a52db423713cfbe67
SHA512 addd2137f66b8f4aa8eae199f66bb597609f69062bcd635aa6e8a69ceac320325ce1c22ecf049f57a674a0b31370d8b418ae989cf3e26caaf784abf7ba6f2971
TLSH
T11AE06828C8C8C56F252425F710347B0ED1A7630E9BCCBD910E04DD007046488902E150
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 1KB
SHA256 aaeeafe2df189886eac1f4c7152048903a11036656b49e33871a5fd921d10a3a
MD5 d5a0f86a08f519bfda46749ae0919568
SHA1 53c1cc6fd6e506405b79ddfbaadd54566adf621a
SHA512 a8745b94ea5f71b269b5d0b62ffc40154006c1bbf69dd1289954a786f00da1b922e52b79d74d1faf9a9b0857ce9fd7bcafd3cc959da3282354c0e99cb3154f8b
TLSH
T13731AFCB8A4958F454C6D0B3963C3286CDDC52184F4CBB64AA28E7CF17F191BE11B479
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 122B
SHA256 4dc5c046cc15b5319bff7e95b32e100f499229142fe2097abbce6df738c864eb
MD5 20f18dadb528a49a297dfae9447f2275
SHA1 ad04b3745ba4751f0b6a2a9e2d608378a46e0a2d
SHA512 b1a067ff0b2f63e8e5ecbf621e2186edae53ef8b76213ffae18b79ca701548d306292df1da3b9149bb28bc805ad8e36ca80384e3e3ba9580aa6bdb28edfe1e2e
TLSH
T10EB09275AAC50492D6790D34067E2182DA5378880C93EA4EA249122A8192E808D39A2E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 33KB
SHA256 e42b6d302e7d562f3203d0d3065429492f63a5ea755a5f4c89f63f26a5ed1080
MD5 85fe0474e12e57794a08f88b3d842262
SHA1 45e4f326ae91451382768d40f806199a36091841
SHA512 675d478938b34ceb4914445e12f68ff514171775fb08345bcd812d00116f55ee0365b9a833e7765b510edbf71813a96a372791e1997069da443008ce71a73e70
SSDEEP 384:DHCNnL80gO5m6oe4dW454oUAm0b8IWsFmdHmo9eueP2eYzJ6TSfMZ8tG57At/qv/:yurpq6MoEVbfq+DcooWeVk1E
TLSH
T113F29BF383E5C66ED91157F49A146E1BCE1D0A25432C3C26C9D5BE8BE3E2032E15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 abe04d6150e5d970885014f5b9fa0958111074421e1c14a0d46b71dd94d0a6df
MD5 a2cb73ead80a8b81dd4b6183459e420d
SHA1 8c76405b474cee7c098bae1408788b9f17ac2f6c
SHA512 7ad256f0c9e1728fe6e1aca5b29f6a726238e8cd8cef98a89d8e062e3404423d016254aa36e51afd75636fb1232aaafc9465dd6cd1b373129e86bf73d40a24e0
SSDEEP 192:sxZdRMyM/jK1Ml8MWOQ/f6sy0aySH0bNIdpmlatxNHW6+WNBd7UTT/YzTz+IgrJ:sxZd2uOQ/f6syRfIorNHbvE/V9
TLSH
T12162F8026A34697B8CDBD218F911BB93D6F9146396944E98AAFCCD4C04E2ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 252221fec576f6df91584c3a765ae1fb20972260e0e9e80b1199c14a3e58e740
MD5 528a490e1a98939839066338a41a9177
SHA1 99d133873821db31d886ff674a49e03a59a8aebd
SHA512 ae406f4f932269eafd6a934e06d7f1ed1540e95a2243e5a558f106ff0b8c69c8f20d458935ec9d17756d4f385ea3f0291318f72a4fadddc6ade1e2d769a7baa6
SSDEEP 192:sxZJQUneRMyM/jK1MlnMkQ/f6sw0vaSa0bNndp0blutfHW6+WNBd7UpGZYzVA7ya:sxZBne2JQ/f6swEaITxHbvxZeQl
TLSH
T16D7209026634597BCCDBD218F941BB93E6F9106396908E58AAFCDD0C04E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c734ef833efac80c952762719df6fd66898870dc6148df718f7b5bcabc48d841
MD5 2234d0534dc48eb2d76d230c1cb21d6e
SHA1 da52bc148e80d255174cf5a1c6d5a9e13ef7dfd7
SHA512 68224f385786199ba51f96ec0950d4d28d8a51a0fdd614c9fd5d2c0163c1cbd59174e919da944521bb01d16848cdbe8a2fc4b6dec010f61ee65977e644044fc7
SSDEEP 192:sxZJRMyM/jK1Ml8MkQ/f6sw0aaSa0bNZdp0blutfHW6+WNBd7UTT/YzTz+Ig5DJ:sxZJ2MQ/f6swRaIdxHbvE/V7
TLSH
T1F8620A026A34597B8CDBC258F941BB93D6F91463D6944E98AAFCDD0C04E6BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 120ab6ee0c0f01592323257d3d9dfca16b92e3e1c2d3d8598d90b5520cac58c1
MD5 765b802829cd0663bbdf9129dc244dc8
SHA1 cfd9534d6ca1339775ef5b885064ae9b40827e3d
SHA512 ddfa7381ba67b8cc458c8f533a84110c0ad06663a78f36801f273625ede8f948180bf7d303ea3e41b3dc64883f40cfc751400d6ef7839b8bdc013646202c2d03
SSDEEP 192:sxZJQUnxRMyM/jK1MlnM9Q/f6sw0vTvSa0bNndp7N0flLU1fyHW6+WNBd7UGIbdY:sxZBnx2MQ/f6swETPIT1yHbvrUdzMQm
TLSH
T15A82F8526924597BDDD7D218F941BB93E5F91063A6808E98AAFCDD0C00E6BED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 4f6ffa44da424c43de3b3934a0b61089f2420e273012edb74492c067d3d4e92c
MD5 53b6dee20959d90f83759c199c268cd5
SHA1 68cef0fade67ab9f9d09df87cad7c849cbc6839b
SHA512 46cc91d63957b58beaae880a2d49738545a925adfc3102628d17c061ef37050ccd970d85e7f9fba66aa292983b02f3c36def1aeb058b40b5fda15139dd7082d6
SSDEEP 384:sxZBnx2byQ/f6swETPITfyHb1TrUdzn4m:spxAyQ/fKELdHb1Uzn/
TLSH
T108820942A534597BCDD7D219F941BB53E5F92463A5908E98AAFCDD0C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 44e1dc3f4fc1e60052f310e60ce99d8e0f4b06df4da9ee79ee55f5c36adb2180
MD5 1570627015c827be8ab5cb8f9629c1aa
SHA1 54fe1d924b86cab6258724972e4aab7843e369b4
SHA512 8f70cfb5f51efe91e46975fe3fe9ed2b7e3fe920191cd75f604065c5dc91033d56b5b3b689ee15b00f4e1d8ed9e4cf07db139a75b697bb46caabfa33e3ea0cc6
SSDEEP 768:NkW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjqroIZi3Y3:NkW7kf0Wvqidau1jaa5LA3jBa3
TLSH
T110D20B3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\41d9dc55-fa4c-485b-8788-c0f26e9a8583\index-dir\the-real-index
Size 576B
SHA256 f5c88a77cfc780c40c0864e6710dec8f9382c931757238c570c8e6e299bb76f2
MD5 5a435d85f275c2a19ac6b0b36a380df3
SHA1 67982525040e7bbc104ef9dd4e21686156e3708d
SHA512 aa1a2cfce5fd2ad666eb01a277044e367e926341da7163922ba25c9ec86d579f79c05a7956253b8b88eea80d13b6b633c1e8e5c5a36d4aae6d8460ebd8eda123
TLSH
T1CEF0F111FED86D9BDF198974416FE46131F9E06419AA1BA37A85817B792F2520FD0200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\41d9dc55-fa4c-485b-8788-c0f26e9a8583\index-dir\the-real-index~RFe58f1cd.TMP
Size 48B
SHA256 338b07b9be26a0da00e4b41a2c9654e0b2c7e26d5c0e10cca72fe33e81c6946e
MD5 2c9aef49574f0183a3d2d8e061af64ea
SHA1 030b91fe6ee276ba660ecac75eb5cc6317c072fe
SHA512 748df01ade10f8256a0da7c75450bde7bc29c83a91c81f6adaf8a17bba4192434d296beed4d1eb319f08877865ecb4b509202b64f7f6e1e0ab47ac2c42dbdab5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a3aa09e6-dc1e-44a2-818c-032f208967f8\index-dir\the-real-index
Size 2KB
SHA256 76cab3f70f0e942e5980e613c40510d4ac74d86f8a9708affd2c0df72835272c
MD5 951c9db486f0a5c66eaec3cfc05012af
SHA1 eb1af35bd99ff6d8189152b6f8d25950e7a8a6ca
SHA512 ba869490ee48f4117c167d6ee1f944ecf8b806d6ad0b5b208098d1b8f6c9ad3c1ffa16c3288500cc7ed3632bf7122ed6912045074cdbd6f0ed142564eddf9b44
TLSH
T13B41868CCC809BADECB451BE2D9815F647762C28FC58C2524594B2B13403AB81B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588cab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a3aa09e6-dc1e-44a2-818c-032f208967f8\index-dir\the-real-index~RFe588cab.TMP
Size 48B
SHA256 ad017b2e438898527558f0e2ad2ba8197223586a0744a29803747b12523ae1c5
MD5 60a1ac1368bc8353d86bea4bf97c6680
SHA1 99b06f4d57a63a55922980fd0febfe0f1c326c00
SHA512 7974cda1d2f219df5b63c9c39f3492d47c248d0690805001e92ab915ab664a1469a2bc32ec5e2104b1569e0ad5c098ea74cab9bffd1572fd8c3d8f92a966058a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bbabb72a-fdd9-4226-8c3f-9adf9394c3aa\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bbabb72a-fdd9-4226-8c3f-9adf9394c3aa\index-dir\the-real-index
Size 2KB
SHA256 d01333500557693f86d97fed4323aca09cf47e0919c6cfbafffa66e1fde1d344
MD5 c67db147d1026f371ccec9ea7009555c
SHA1 75dfffa78f79598fd54df14e6bec94be427f064b
SHA512 86ccf5f63383554e91805f27f98bc2e7d89d91f2960e5c8ed1e41ca244903b06270840a1ccc723e6923c91b1ede87a39058bd374d9d32fa327e528a7632afd12
TLSH
T18551838CCC90A7ADEC71A0FE299818B257752D34FC69C382C1A4B2B134532B41B878FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595634.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bbabb72a-fdd9-4226-8c3f-9adf9394c3aa\index-dir\the-real-index~RFe595634.TMP
Size 48B
SHA256 9049b9d62f1c1b02d6fe8d242f57412bf92b64b503791d6c2716853c577d4815
MD5 f8ee1f4a7ce531e0f0ed0943341605a6
SHA1 92a13fc358086735f1763ff8187b482651380c1f
SHA512 57d61d61e880954c32df5c6e6a8523b1e4881d1477b02564d42f770b327ceb888f1188dea74a6470f8b38f9207632ffc92be9a5a639ea1ac5a447d890d436f63
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 467B
SHA256 f72b3dde8a242abac6b46587819900e943cd9e0eb1a210747fa5d1cc7e364356
MD5 ab76096d26ad9852151f1847e7aa8f0b
SHA1 86d9ed0fdf2c3922651c13107e57ed9b9e3b2d05
SHA512 ef1dc27a48c93bb6582d57c5d60075d7c3cf39ea057087e0b7d193cc669321231d7ea97361516feec1386e000128a85813475b4c6f5d13994de6912fc17f62ea
TLSH
T13DF05C859773184EF6B75FD56838F09E86675A098C41CC985744B36E35F6311E03393A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 aaaeb9bace7e095d8bf932a4b152b8dc944415cf01a7583c881975d0fa1796c4
MD5 c067c7b7b08423bb7a38b958d131e278
SHA1 718175880a1c0acb4bfa7a49011daa4334253616
SHA512 594b78cf551398bb603e0a1e04cfb77d1cee3a9a047b82ae1cdd5daa9772a94c1b23a476a2de4e37cf4e64d1bd9921ade929ca213abff1bf91fc7bec7baa68ff
TLSH
T1AAE068969662044EEABB6FD43838B05FC72B52448C81CCA85784531E31B6715E07393A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 a52eeeebf286380b539fd265445fe3960ccc8c61d52f72007712ea4171f68db7
MD5 e99bf9e0e9681a987364dd1218517154
SHA1 eb0e5bfad5cc08720eb782ed24cc2ff813cb0652
SHA512 cf8ce803ed569f24a940304b2323f6782e798ebccc1a99b8fbfe7caa7e8bf1de2f0826f952c691f8b28f6d4aac28004afbd7aac9604dbd8d31d3da6db46e2010
TLSH
T181D0A9EA81268D676230ABD42434929F800EAC099AA0CCEAA509B06A3878923C116A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 56B
SHA256 c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
MD5 94275bde03760c160b707ba8806ef545
SHA1 aad8d87b0796de7baca00ab000b2b12a26427859
SHA512 2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
TLSH
T1069002F74800819A0E20A9C82038A35DE40F818CD8C0CCF0900890423028A234002851
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 390B
SHA256 28f234d90dbbad268841ad5c065b4f153a38463cbef1f473e3ab7fb0fff6eda7
MD5 a6849d182ac5a52a273f620cae19093a
SHA1 fe91532213da4fc5fde28bbe26f947b926dcba5d
SHA512 e2e0fb063a22b40dad2b44f38e372cdbbfc5b5be276571059120ee1c5865cd7508816edd1bb0b9f996141b3e5e72326bf4bf8046e38a3d5910e391378d6460b2
TLSH
T156E068869662044AEAB76FD5783C709FC66B4A448C85CCA82745631E32B6216E07293A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 140B
SHA256 37af5b6acf22ff8d0779977a5e5f6282154e7be32467171f7e751c52f7472547
MD5 8d66ca65f2c4e0d34314bcda69bc8270
SHA1 ebb380b55272ac8af5b027582c0a8581f5bbc7da
SHA512 0a7bd98d0b6d767682e55bdf46213db2b867ecd12295ddfaef13946b035d5b19b7b617692baea13be3069ad3d8e33eb45e08ca866da2f895e05224d0038ca3d6
TLSH
T1AEC02BE3847242A70A10F8C8253C02BDE1175E18D8C0C8E4580CF0413079333C009930
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 e49d58f77df3c1a8744c4a05558239b72383c3a402084c4ccdb1833bc01e1ec1
MD5 c050c9425ed2742abd63491c02ef9c90
SHA1 894e6c4289160cbb88a19cf04cd6e8a7a3ccb8cf
SHA512 f68e4c4a4b81730f958d0053f96fbf0404fe86667b62803e023b90e76fa074e14df56a322d2b9ae4102edcda3feae35258e7500f1c59e01d3c6f83862fde6dff
TLSH
T1DEC092EB48128AAB8A70BBC92438A76FD60F92489DE0CCF4B14C600734389338447A35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 598359838791c9c7d982123d166011b91eb1a82783a407fa3ca0596189762824
MD5 05c7268110e7758e77e3387254910010
SHA1 7d9ddf0e267630dd60703d849b9f84d3cb0eae0a
SHA512 4f53c59089cd3e5fbf89d9f6c7dd01e73f540675a5d6f7374e7dc616f8cbea5886e7521bf5c49e780b5b94915b45563c498148e130d9406e94240540da17dc5b
TLSH
T1BED022E245364DC79BA5BE88313C12AED6279E18CCC4CCE8B649B0DA307D323C41093A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 22b65ea7231d139c9cf962f20edbc3b52a041c51651d4b3a8fc5e45e6bc561e9
MD5 74f50b32aadbb5ffd35f86bab6a3c69e
SHA1 4433056849e188a9013e6beaef7e7489b8f6bb7f
SHA512 0e31eddcd73a234a8035a6d5c1d4b5f11a652e04ed28f8c6cec8cb3f79a62a30c32d5788ebc47b58ae3e0f37aa74094ccd5639005772ede5cbf3033487cae867
TLSH
T141C09BE3451549CB9B75AFD8303C665D991B414CD8C4CCF4E354528A313D513C411535
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 425cf11a1e41e0d3eceffb5cb0ec5830b24c9731bfc229fd85c7d387b0ca6d4c
MD5 8bb98e040c795e73cc79ead022df7f7d
SHA1 82d8e0f8bc5108aa4144c81465ed9a8166354360
SHA512 ff69f8b43e9af86a24789dacbd4be28e1b52a1ee972016154cd08d9972736148e408ad08412d14a8ff015e1ba044564cad9df98c08aa90f31d4545a89b4ab1e5
TLSH
T1F4D0A7E316A5048A97795ED4303CA55EC61B4F4C8CC6CCE89354B3593179513C062925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 383B
SHA256 806b595daec0a8aa002d9048998bc192e7d309551495ca2e22a946ec1af21479
MD5 1a71bcde4f7cd61a4850e4f6f4ca3359
SHA1 65651e65f4efc7e645c731e64f754dd99bf8a097
SHA512 1650ed6fed08e65086abdb19a907892e706e09f6c37f174a86d36365c6e35411d9178b0d06b09adf50855aad1718a26f9db49e414a47d9c36a223f0611232b34
TLSH
T1B0E068869662044EEABBAFD43838B15FC72B52488C81CCA85784531E31B6715E07293A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe587f9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe587f9b.TMP
Size 137B
SHA256 3df007f80793f498f45334fe3fa325e4ba4bc5fe35672916358ba90d8acd8aec
MD5 639db20089878e960038393ac8139208
SHA1 b8ffa4704e6a6e20274e2a4b6e1b71c3e95515cb
SHA512 90a7473908079929af3b90e19664374f5b87189b7b4ee48bb03c43d777f3a9875e635bfe7ab18ef27a53177a2be59df318dedcc59d3cd2ce3811c97dd3b1da3f
TLSH
T1C0C09BE744115A9787717AC62434975F961F8D589DD4CCF4B14970073038533C546935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 864B
SHA256 d31ef8a6663e860f3d1191d15015f1c252d5e6ddf3797cddf0a2d3ee413416b4
MD5 b7f78bb825ab0b9bc696964160a51c19
SHA1 7bbc1bc69d20774048c6e0c96074c8e11e826573
SHA512 aa0d9b013226b99497b5d56c4dca807d809f45648f78eaca71ed9b450f7b0902104f99ac498b01181b143c623762219132a883304daf017b314ece118efc0745
TLSH
T1391168060EE18D3FD95901F718FAF0E4B33019DC5321E5679C1C1A722C2734968071CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 1da7d461824bbc9739aceb6a91bb7b50ca81c0f0d7ed22696515e543dc57c78b
MD5 11acb3d57b7e30b3b84a7600bf611bdd
SHA1 09bf6b69e1122df1a1f8072f6bfcf78ac69aca91
SHA512 623c01d55b739739f3dfa912efb0d52f7b533ec2db0f59f5c5b591ade12013f0258666beb029e4ef9de4191038bc19274b79c1afbcf9eacdb111793a5af8baba
TLSH
T11C51F84E8C461DAED9AD14B26CFA1045337A68EE4689DA0F669DE0303CC332E2E54105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58627e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe58627e.TMP
Size 864B
SHA256 b5aa847badeafb54ccb6a5b72c2c241f5eb8513e22fe8a9190d5b4a5f67da61f
MD5 865e6ad26cb151cf5f34dfc895b4ce96
SHA1 988b16321cc5b41c765fbdada2e727c787b1f38e
SHA512 b3c8c04d956cb0dc7fe7e7d6ed824bd100a71d8e69d04a835b090568d0e55f8b36d17b3d7a42cef9bd242174e20987a980aa4a163e0b1f9cc7095c7214ef8b5e
TLSH
T17B11A25A8A918E6FE844517B1D95E0B8F3314D009313F7E3A42D197E5D7ABC999170CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 1bbb6496b8f456fce9b4106faa55ccb0c9e085a1d3a752d5a5ce9861788d70d9
MD5 39367ae7bc417fbe940310745183e23f
SHA1 18585d42c12d4ee953719168334380471f52dd42
SHA512 32fef3de8bd7a4896c9f88e73d59db8a26ee518faa3c1aaab003b14ee8ea3a16553bf0b57133c941f3c2b640ad63297af6c2a34fdb4e2454ed1c0d7d466efabf
TLSH
T10AA0025816C81003D41E12B027D715437B208B3612B153054190495CC95476D468154E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 bb949aeac2278f0c4d1cf87b52d7f681f47573101a3d8f4966a819f36a282c48
MD5 4c796927e2d2b7a39a61729af3bce15b
SHA1 716e40bcad45ad48ada0d74f2039b4a432596ff0
SHA512 80c421ae07ff8a2be76a236500a51756ca4a212e49b5821c9393cd09d7f44ac59730b9f1f00016d31c0e58de5e9b74b4b5725c7b6276d25c7db520f25c8fae4f
TLSH
T141A002118BC0821AD01B51F2165317511304C8902100574740D15084CC544918E4510C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5bbfa783ba2d863effc2c25b84416e5bbbcdee9a5e1b746918e64912826152e6
MD5 904304b32b04e02161d846e49d7ab440
SHA1 b13d59c3a834361633eec1459a396a7afa274b23
SHA512 f348c63f6418c2e47303a0610ac50a6e0b29bd8171a5ae5a72af3ffb556c60feb66a804a64fd205ef997ca15047932c1836ea3279a6f46b3a6f2b58003bd727f
TLSH
T10CE068BB2DFF1824AC6F87C138B064A0818539188500EC4E3427B28730F2351280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3fdacc9d8b230d77f3bf5b2ec1940e4add08f3537c75704b9b20a3b110174e8f
MD5 f2fb26e446a311275006903233ba20b7
SHA1 7ab3fbf686cbd61103f6b1f32353e44530a7b19f
SHA512 edf558804dcff99fe0d56385f1b912df5eafde2a22af727b04f224a0d541a30c6de48cee4547cd4e22d9e69f287ce401fded486abec6ded4d71f9ba084087551
TLSH
T1A4B012A1890D8241C808033096544008721048B04509375680B901FAE07B290504F205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e4ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e4ec.TMP
Size 48B
SHA256 dbf33dea3443b6ce33f23810b0d34b0123790fdb1f6186f258d44edf835518c7
MD5 941f6dd5f5fa2cc93e50653cc0a026dc
SHA1 7b3677797f4385b8d396de46560e4e638b073d47
SHA512 d88e997badd8d4d8f4383b4ad3e51683645f1fc7782fa278098b99e64943ab42477dba5b0826d05d242e33ce8640c06952a03a6b6aed38661fb3d8b9956b5f92
MD5 SHA1 SHA512

Submit Download

5b7fb7eeb7060388_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\5b7fb7eeb7060388_0
Size 63KB
SHA256 bd15f3394244dd3cc42e7a5b2c568e43a17eed921fa4bf1a3a2bc17505bb7f8b
MD5 f20fb4042d9502d10b4d8078c84409a8
SHA1 d4313beabbf5f00711a5d22e18b57423ed889752
SHA512 de21a8c07556ab8ee3b53e0d5bba97112f5538a2a4fd06e2a21016d5a826f0a3c1a1e6f6ff90209f8f694442865b44b28e8117848e76729a40057885acf23cb4
SSDEEP 768:DoVD6c5Ec/1ieEFfgo59dWhrJTt9/5TijHUyWxOBXSiICd74rD8OiGwG8Nz0mjtl:w5EcNyqtR5ryWxcXTIS40OiRhNGL3i
TLSH
T134535B96337174B3827BA2F1909F130B713EE567F40484F8A194EEE54A44AAA1277F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 074a42fe602c0904fc5eb31afb0ee459d98a111736736e4f7ce523d98b892cea
MD5 ea566600d5f700bed30c2b40cb8e1751
SHA1 2d60a3b1a91dfe5092563c71a8181b7cd496d255
SHA512 7fef7f07089f0b6c7578fc55c12811922e7ce4b5d60325d4d83efd812a820fb7a7d7806999817259eecfd331e48cd1e88974951d690f0711bf771b12bd5df98a
TLSH
T128A002D551621812F04457F4198329402A15C82C0223DE1783934556EA5AA80A111154
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5327787f56efc95bade19766294542ad92f17798b7b20fd635eed3771eae8964
MD5 3d0a01b8e41d11d094059ede7958685e
SHA1 fd1b554954478188d68c7359eb87e7d0feadf47c
SHA512 d3ae8bdcd0f91e8e585d5cb0336566cb2f5fc3dc897a6cf3529f658c96950fff3db3158f915d048b0b079612c6ac551231d2ab4c94dbb049006c3f4fa674037d
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcHOYKril:sCFp3e
TLSH
T127910F01713F060238BE38499665CA279E4271573518A4EFBBB914A30E66E214EFFDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e71a2996-0474-4e8f-830d-529072c71245.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e71a2996-0474-4e8f-830d-529072c71245.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3d8a984df777136db154f2fb699e8c571e0957b7c366b7ad031811824f581796
MD5 597b4a3ba4dec29d3cf75489d8cf7810
SHA1 607f51c4330f629f8c291b59bd8f4084459501ed
SHA512 256656ca55edd01afdba99574bfc42cdee27deb3b22f1bff4c65cf3f096f64add6fcbe300a12aa9443197e106197ce36dc097b9a09a3074825065dd4f23c5666
SSDEEP 384:GZcIhsNNGTpwNcnb2uJ2IdEaACEJr2qBeRs9JKgqijU8UQe:UhTwKlJLyh2qTjKgqmUp
TLSH
T148929E3098756D379AE6B541F48636135FF88037E7C06ED8E1FCAF1D01A7A88131A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 faf216c1cc890bfd807275c8123454e10cc50553a3b71a03b924e4a5eb27b5be
MD5 73decee708a33785ccd839860fadbb36
SHA1 f6c820706fe737b346824b791b6af5be615a7899
SHA512 adef58de79ea5105fb3e5ce8eeb08bdcf68100b76a63141bd278dbae9f93f0c5ce21d7f90b1ca9f3b21338973f0a38c71c7dcdcbedf61bae2685e2fdb2b6ac98
SSDEEP 384:RZcIhsNN3TpwNcnb2uJ2IdEaACEJr2qBeRs9JKgqijU8UQe:5hmwKlJLyh2qTjKgqmUp
TLSH
T1F0929D3498756D379AE6B541F4863A135FF88037F7C06ED8A1FCAF1D01A7A88131A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4cee8d03c53c900ed87e03e755123f50bd81cf878823e063ca42bdf9a971574
MD5 d1b1124e05b21f2bf85546c37ef8c86e
SHA1 555e297ecce9c48bf845d971ef97e3be430d9fd3
SHA512 b3c801afb1b68991c2745df47e273d742c0e8b57ff2f93711bc6c134d364cf6de7a70a9048d5e0487918188eb025975b9a8a04d0c9f1ac130da814ed3025ca7b
SSDEEP 192:MON664BAQmiUyz1OW5GBPKXo+FdGJaraDrhLU6:MON66eAYgWTdEaQ9LU6
TLSH
T15902E934AC786C7B9EA2AE45F58737175FD8117BAAC45F84EAE85F1C009764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 95a8988f63962056e0b764eb27ca37c60ed8104a210103452803319fccf3f957
MD5 33e63e7dcb681c1de0c03842748ba0a2
SHA1 1e3b324bcc1409166734a21ceca02c583e0f571c
SHA512 67fd0695704684ab4ba71c4b7cbf9388ed41769356be7f0dc30cf82326b516ceee4daeb5eb10d51abd43373ec2cbbf436801b3043645fa8ccc4829952c22a640
SSDEEP 192:ZLsNNiT0GwNc/xBbmCfLmiU1MNJ8BaGBPKXo+FdGJaV6FC1SJr7dNIqYBp:FsNNiTpwNcnb2sJ2IdEaACEJrjqL
TLSH
T1A4422B35AC756C375DA26241F58736139FB8416BABC46F94A6EC6F1C01EB2DC130681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a9d01b9b05d8581322982460cb1fa3013cfbf65d75279937ce800d38cae3872f
MD5 2f8da04dfc837492b4ec3a7700798f1e
SHA1 9c16c225eb6927d5670cf41abf770dfc4ebd9fe7
SHA512 6979648a7d6f28c734cd1e8d2c63c595c93b527cdbbffa5d1fcfe13f099350ce906fa83be8fb46e40eda391709fe38b02c7daa3b12c14fe66fb0f3944125ef1e
SSDEEP 384:RZcIbsNNYTpwNcnbIamIdEaACEJr2qBeRs9JKgqijU8UQe:5blwKj7yh2qTjKgqmUp
TLSH
T17A928D3498756D3799E6B541F5863A135FF88027F7C06ED8A2ECAF1D01A7A88131A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0952216356c44ff48cc9231ee7e927b4571f415b2b2440fcbfaa03eb6e863c90
MD5 d95fcade7cd2707ff60d0fe3264749b8
SHA1 b4f1f6175ff164a3c2e774a60f520b79a9db954b
SHA512 d64e0b66a81c14dfcfd888ac71abd8721d68bc3ece5c1b1c49a216ed519ddd2d84fab485d318ba83f0002e120f2a682339e8b41c97e2edc68811a078c9db20fa
SSDEEP 192:QONI64BPQmiUyhOI5GBPKXo+FdGJaV6FC1SJreWwIqYU6:QONI6eRZITdEaACEJrcqU6
TLSH
T1F6122A35AC646C3B5E92B541F48737135EE9412BEAC46F94E6EC6F1C01EF69C230681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 afde88aefbedadfbd08addc83ebeacaf7f597062795f4b710df0d442a17f7428
MD5 7db22f6be56fb334af5f50b7f6595777
SHA1 e5e422608277cd6d44e0e44be608e760e97a293c
SHA512 4fd1e365027d3529a400b5aaad34161e0b9cbeaff3d30e29d1a5638656fd8239a292ee7bcf8236290e482fcbb551df3a78dd5193b6f5cbf29cbe26be42a1ef48
SSDEEP 384:UiF2ZcI3gsNX8TUNTUlIl0TpwNcnbGamIdEaACEJrhqBeRs9JKgqijU8UQe:vFkwSwgMwKd7yhhqTjKgqmUp
TLSH
T169B26D368C64993BEEB6AB45F58636178FF44067E6C0AEA4F3ECAE1D01575CC130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8bf087acce33df9de1b5d73d282aa94beb63461fa0007bb7eb3de6cec8fb2adc
MD5 73310d40e71ae5452c93c6e37b989106
SHA1 1dab97a0d286ba762a1796ca50e2e653ae662f56
SHA512 cf59b2f243f37de7457c19de345c7380e2f4faa885cdd2578631529c041dd38496b93ab06775714d4e5539dc59a13c18b0f5cb99768622961d94b8398124ab23
TLSH
T191E00903930100FAE07C13B0004B1B651CE3557042F211045E2001693D223512F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e4f00ece5b03af104634f393b891c05824ee7c561456c69d976062115f52036
MD5 a67bf06141a794701b2b9b0b484187b9
SHA1 e27e033fd6b80a756a9c8d9de8defe8157067f4d
SHA512 8f9796438070cff7270b48430307ee3f0462acb99fc2969309a0a9f79243fb27a65d61720d5334724485d69000e7bd36346d8ff131e95e06c8f56ecc65177ab4
TLSH
T1DDE00103930100FEE03C1370008B1B3528F3417103F211045D2001693D233512F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591478.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591478.TMP
Size 392B
SHA256 e408c35a4a24002267544da114d269e1c84c35cd26ff5809a50d15ca79756473
MD5 6f8eeaf8f192f1d106a56c5e5eea8ce8
SHA1 2adaada48c89a2d86329a6892ed008e58fdd913b
SHA512 09a0b9ec358bfb470d1e3cc0eb9aa29059fdaf08640b5246b4af15f19a00346186470df418c6c928170f7b774799509f11eb6ad047715446f5198fcb60e15a00
MD5 SHA1 SHA512

Submit Download

99cd974b-619c-4d50-86a6-3021380d49df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\99cd974b-619c-4d50-86a6-3021380d49df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ce3277f735fec14e0f7941946acf5eb9837d9dc3c77b3f83dbcab00ae0d301a5
MD5 6c1493e69c8a902aeb1f7b6e2b5e7947
SHA1 20518b503011126f5c50a6443eecda5fc1223984
SHA512 fbdd2958358a4fce1e042a4512f8979e349c0d0e2f5ed3aba6d2fd66104c0bd9cefcc253b8cee39dd736f6ae9d9aaf25bac622b4988cf7325e7805dea0ea633f
TLSH
T127411858BAF91158B3B76E5AABF6A8AD887AB8773E06C15E10010D4F0676B01C871737
MD5 SHA1 SHA512 TLSH

Submit Download

ntkrnlmp.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb
Size 8.2MB
SHA256 e1be7b013e71142ebfb160edead2642bf0e632a9e714540555aea2de9c23e90a
MD5 53c9a74200005b59e327f1bfb5e54723
SHA1 1b0a06b5ba246846277718332d9df61018feaa8a
SHA512 fcf3adb46e408522fbd424feb5d3ddb015588614e2986f0dca1a2e2b0d739be5a4fd764664454ad64c41a22af4484a0fc05b42d8a4552a5e3bb76d1d0449b21b
SSDEEP 49152:lHqZ7pecPpUFnQ/6/NBSOLKQCmtN4fReM/pclAoCIZ99e:liAcuv0d/KE
TLSH
T1CC861815BA83BEF6CD4A437FA022032DF7F296C5039947E77446B2A52DC26119FAE341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240798640.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\240798640.exe
Size 3.4MB
SHA256 c36f47c42ac27cc278c600662baf12c54ffb78b03f8effd33de0bdd21e2d4656
MD5 d52f2f0270ffac527d089d3cad1f45fa
SHA1 e33298296cfbe3ea753bdd6a4e257a3290ede69f
SHA512 0dddb3be0b27d5fd33da8de11bc7c24e380658b0a445e53eab840d1cefc5de6c7ded4222b2774cc03dbb5395368cb4c08da19bd6e77cb2dc45a5d19c71dd26fb
SSDEEP 98304:QWcpvab8djsMTBmGggLTgWVjpXWtAKO9MHqAAY9yjC:Kbw8BmGggPPV0tLO9MHqoIjC
TLSH
T1DCF5332E53303289F437FCF7948894B8F2EF4817515FF643E02E9F52A9B659211CA4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Boostsraprer V2.95.5-updated.zip

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated.zip
Size 7.3MB
SHA256 a3a8f55cc78fd66ff596bca7bafe253ecfa4e24290274bb27bc0de1ec02c2562
MD5 8db67762e6c78a442c3f7b1f9f171690
SHA1 85f649732a923455507f368cef83c38d6c8a6727
SHA512 ab77de094fc00a54075c13a27d2d2e10d17ae7cd58126a2bd471817f9b305ec786e5e4580f43759e822d6fc192a8fd809e33391f325251b9e41fbdfc7811ff60
SSDEEP 196608:SGVcZF3VwOXzGpPpoEe+oECBb9Q+TxNLMJAeY:/qZFFwOqa+oECF9Q+DMJQ
TLSH
T1BE76336483879080DAB77332B34C2E9ED7D03D311BDDA2261CD501945D6BEBABB2CE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Launcher_x64_v2.5.15a.exe.exe

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\Launcher_x64_v2.5.15a.exe.exe
Size 7.1MB
SHA256 96e6f9aafd49676aa9674a02320843bcead7c78ee077b47cb05d1b252e02f6fb
MD5 94767672fe0d9f5546c4d099ec5efeda
SHA1 be09663a5dba9267076698c42dfe0330ee2f45e2
SHA512 fcc16e0e89430095c2d7c0061a43c125612c6935dba7560681e4a3607493d7d0319f3336f47c0096ed2eceeff7785fec55b545de2b245ad52cf89d8decb027c8
SSDEEP 49152:GfbdgF+h43+vit7NhC3sEQn89ufZOTXIaDDYFOV1rjmtVyNEM2Kj7Rs6m:GSFj3rgt9uf0TYaDTV1EwVPjds
TLSH
T12C76C025392FE2A1DDE42C76DE5D7A8DC153AE8ECD292103B10EA326417737672F8B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libevent.dll

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\bin\release\libevent.dll
Size 235KB
SHA256 28cb5ccac916a27931776095e123847007d968f70d04079b15102fbbdd6d3e41
MD5 6e570d69d5c38d1408ff8964c331f9cd
SHA1 6e0cb2cb408140278dd8d11d7ba6ec2f3af757d3
SHA512 9e7ec950bd66edbc26e4669cf96eb7af009dadfae582787750f6ecff0878d51e9fbe2d26a39ee42b999f541e923b45e328171852534673d4e6d818843e1deeef
SSDEEP 3:Wltgl+:i2
MD5 SHA1 SHA512 SSDEEP

Submit Download

tunnel.json

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\bin\startup\tunnel.json
Size 351KB
SHA256 a92db72f7bfa85b90b0fe9777d9bab0afe6535092cab7757d335720c7baad9a8
MD5 4e74b691dddfd63a50c1190ed121ab50
SHA1 4a7716c1a46336f11c2555aaba7d12f83c28b2eb
SHA512 cb3a28435e4a40321dc4bdbbf703220a42f32fd6f3ddf588f604ea7e33c80a5255530de6abe2d71d6808be23c79eec96ce626fdc88a6257e91cd808f638bdf4f
SSDEEP 1536:KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY:p
TLSH
T101741B0DA62314E7476F4450F43674416BF9485647D9004D053BC7D8DC540A5BF5F6F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_6152.dat

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\core\cache\data_6152.dat
Size 133KB
SHA256 cc7b9bd97228a30129e79f51188f1ae45f0a9b391a688f69c8d4be89c378d75b
MD5 f3b432cc9eeb127c564cbdf2a81961b9
SHA1 2ee09f0e43ec1f2e996bd6014d0153cf481414ea
SHA512 220a2d43e253370d45fa04721db7931f96f536e718de21159a19b63b3bcedf3157fb7924588f95126cb5fd0dd643f2351619e13f978da0a41c8ffb41f132cdfd
SSDEEP 12:KAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcAcb:K
MD5 SHA1 SHA512 SSDEEP

Submit Download

system.log

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\Launcher_x64_v2.5.15a\data\modules\system.log
Size 273KB
SHA256 001bbba9b6af896162692c4225e0ac00f825f391f355ab3dee7c463a3b6c41cd
MD5 153d2b0446f5e0685acf399fe0d784f9
SHA1 df92c02c7f15ed275460e2e4c0ad5e15d27e32b4
SHA512 4d34f94f9f6b2ba7dcb5bcbcf12ce1317a0ea3a853528d5e9567ea250e03803b3a2d7fe9dcc03daf395feb3cee6390f32dacfc0ee3a18df6f43603aa452c8d1e
SSDEEP 1536:K++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++5:G
TLSH
T12754222F9A1320F3437B6481F031240A6AB9046BA298104C613787E888040B9EB2A9E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\Downloads\Boostsraprer V2.95.5-updated\readme.txt
Size 31B
SHA256 a36a5ec7c8703f7bfad01d6040e6c2ab7a592d0bc24304fe57a3abf6f3169e36
MD5 84fd3a96edc03a2ac917929bdf8a45fa
SHA1 e593d2376b7c82531c181cd1f9875e79359fd66c
SHA512 dc71dba5e523b8dccf87c6e5feccd01b86e0b686772bd16c45edb4572b072c5cabedd21e69a44bad5243a44ec06b69854d6243db7ba46c0c641155fa186b9811
MD5 SHA1 SHA512

Submit Download

memory/6016-2676-0x0000000000530000-0x000000000117F000-memory.dmp

Download

memory/6016-2675-0x0000000000530000-0x000000000117F000-memory.dmp

Download

memory/6048-2674-0x00007FF668A10000-0x00007FF668A3C000-memory.dmp

Download

memory/6048-2657-0x00007FF668A10000-0x00007FF668A3C000-memory.dmp

Download

memory/6080-2640-0x00007FF668A10000-0x00007FF668A3C000-memory.dmp

Download

memory/6080-2617-0x00007FF668A10000-0x00007FF668A3C000-memory.dmp

Download

memory/6468-2641-0x00000000006D0000-0x000000000131F000-memory.dmp

Download

memory/6468-2677-0x00000000006D0000-0x000000000131F000-memory.dmp

Download

memory/6468-2678-0x00000000006D0000-0x000000000131F000-memory.dmp

Download

memory/7132-2659-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2668-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2666-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2665-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2664-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2669-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2670-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2667-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2660-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download

memory/7132-2658-0x00000209B6BB0000-0x00000209B6BB1000-memory.dmp

Download