killmbr | e2a146a9e16946ac2d1a0e888065c16ea9d22e3747bac5e59be81a5f9e482c08

Analysis

user interaction
yes
max time kernel
496s
max time network
606s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
index.html
Size 2KB
Sample260808-vdwynsed97
SHA256 e2a146a9e16946ac2d1a0e888065c16ea9d22e3747bac5e59be81a5f9e482c08
MD5 0513db9a4a603188c34b934a2e83da10
SHA1 8ad0799cd39ff8b33e31cdbfa1a4671e74fd9a05
SHA512 5cd9d0b04dd21b9d09e53101f20d2f609122fda8fb1fd2f429db94bbdecce5ccdee5c94c7d376cad0ba814489261e6b22e47d8ef7d8e9284877f4622f620bc05
TLSH
T13D514367869054610370813028D7F196DB65858FC32EE86279AC259D6FC2F7186B75F2
MD5 SHA1 SHA512 TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024648-1844.dat	family_killmbr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
5784	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6788	MEMZ.exe
7520	MEMZ.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com
19	discord.com
25	discord.com

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7596_934953510\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7596_2043526220\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping7596_2043526220\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe

System Time Discovery 1 TTPs 10 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe
7848	msedge.exe
1228	msedge.exe
7124	msedge.exe
7364	msedge.exe
7716	msedge.exe
4876	chrome.exe
3028	msedge.exe
5500	msedge.exe
1868	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 30 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306816022483419"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{7B75C655-1FFD-4C9B-B4ED-4E01C85E7F1D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{3E2566CE-1563-4CC1-971E-F923BC98B339}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{13F80BBC-9E3D-4809-894D-63EBE4AE660A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000004fe594f939e3dc012dec285b47e3dc012a8646265727dd0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{5A3C2F51-15EA-428E-A316-473D92564751}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "10"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{53469A57-4FED-4FDF-8FC8-CAF0AB61B736}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F501A3AB-A1F0-4EC8-96BE-2F65EE9FB94B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{050F5BFA-6724-4928-AA2E-5C833D7B2908}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{79B47E13-23FD-4FD5-9D2B-77C49E983860}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{0B4E498D-E050-415C-96CC-0242B03A1824}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\MEMZDestructiveBatch-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MEMZ.4.0.Clean.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
5272	chrome.exe
5272	chrome.exe
6464	MEMZ.exe
6464	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6448	MEMZ.exe
6464	MEMZ.exe
6464	MEMZ.exe
6448	MEMZ.exe
4172	MEMZ.exe
4172	MEMZ.exe
6448	MEMZ.exe
4172	MEMZ.exe
6448	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6448	MEMZ.exe
7516	MEMZ.exe
6788	MEMZ.exe
6788	MEMZ.exe
7516	MEMZ.exe
6788	MEMZ.exe
7516	MEMZ.exe
6788	MEMZ.exe
6448	MEMZ.exe
6448	MEMZ.exe
6464	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe
4172	MEMZ.exe
4172	MEMZ.exe
6464	MEMZ.exe
6464	MEMZ.exe
4172	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6116	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
7596	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
4492	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
7672	msedge.exe
7672	msedge.exe
7672	msedge.exe
7672	msedge.exe
7672	msedge.exe
2288	msedge.exe
2288	msedge.exe
2288	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
7096	msedge.exe
7096	msedge.exe
7096	msedge.exe
7096	msedge.exe
7096	msedge.exe
7096	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeDebugPrivilege	4980	firefox.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe
Token: SeShutdownPrivilege	2404	chrome.exe
Token: SeCreatePagefilePrivilege	2404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe
2404	chrome.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
4980	firefox.exe
7520	MEMZ.exe
5824	SystemSettingsAdminFlows.exe
6308	msedge.exe
7520	MEMZ.exe
7520	MEMZ.exe
3916	wordpad.exe
3916	wordpad.exe
3916	wordpad.exe
3916	wordpad.exe
3916	wordpad.exe
3916	wordpad.exe
7520	MEMZ.exe
2696	wordpad.exe
2696	wordpad.exe
2696	wordpad.exe
2696	wordpad.exe
2696	wordpad.exe
2696	wordpad.exe
7520	MEMZ.exe
7520	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3236	1080	msedge.exe	86
PID 1080 wrote to memory of 4716	1080	msedge.exe	89
PID 1080 wrote to memory of 5116	1080	msedge.exe	88
PID 1080 wrote to memory of 4716	1080	msedge.exe	89
PID 1080 wrote to memory of 4716	1080	msedge.exe	89
PID 1080 wrote to memory of 4960	1080	msedge.exe	90
PID 1080 wrote to memory of 4960	1080	msedge.exe	90
PID 1080 wrote to memory of 4968	1080	msedge.exe	92
PID 1080 wrote to memory of 1704	1080	msedge.exe	91
PID 1080 wrote to memory of 4968	1080	msedge.exe	92
PID 1080 wrote to memory of 4968	1080	msedge.exe	92
PID 1080 wrote to memory of 1704	1080	msedge.exe	91
PID 1080 wrote to memory of 1704	1080	msedge.exe	91
PID 1080 wrote to memory of 4664	1080	msedge.exe	93
PID 1080 wrote to memory of 4440	1080	msedge.exe	94
PID 1080 wrote to memory of 4664	1080	msedge.exe	93
PID 1080 wrote to memory of 4664	1080	msedge.exe	93
PID 1080 wrote to memory of 4440	1080	msedge.exe	94
PID 1080 wrote to memory of 4440	1080	msedge.exe	94
PID 2404 wrote to memory of 2792	2404	chrome.exe	103
PID 2404 wrote to memory of 3596	2404	chrome.exe	104
PID 2404 wrote to memory of 3596	2404	chrome.exe	104
PID 2404 wrote to memory of 4876	2404	chrome.exe	105
PID 2404 wrote to memory of 464	2404	chrome.exe	106
PID 2404 wrote to memory of 464	2404	chrome.exe	106
PID 2404 wrote to memory of 4268	2404	chrome.exe	108
PID 2404 wrote to memory of 4268	2404	chrome.exe	108
PID 2404 wrote to memory of 3664	2404	chrome.exe	109
PID 2404 wrote to memory of 3664	2404	chrome.exe	109
PID 2404 wrote to memory of 3944	2404	chrome.exe	110
PID 2404 wrote to memory of 3944	2404	chrome.exe	110
PID 2404 wrote to memory of 4240	2404	chrome.exe	111
PID 2404 wrote to memory of 4240	2404	chrome.exe	111
PID 2404 wrote to memory of 1836	2404	chrome.exe	112
PID 2404 wrote to memory of 1712	2404	chrome.exe	115
PID 2404 wrote to memory of 1712	2404	chrome.exe	115
PID 4848 wrote to memory of 4980	4848	firefox.exe	118
PID 4848 wrote to memory of 4980	4848	firefox.exe	118
PID 4980 wrote to memory of 816	4980	firefox.exe	119
PID 4980 wrote to memory of 816	4980	firefox.exe	119
PID 4980 wrote to memory of 816	4980	firefox.exe	119
PID 4980 wrote to memory of 3160	4980	firefox.exe	120
PID 4980 wrote to memory of 3160	4980	firefox.exe	120
PID 4980 wrote to memory of 3160	4980	firefox.exe	120
PID 4980 wrote to memory of 3160	4980	firefox.exe	120
PID 4980 wrote to memory of 3652	4980	firefox.exe	121
PID 4980 wrote to memory of 3652	4980	firefox.exe	121
PID 4980 wrote to memory of 3652	4980	firefox.exe	121
PID 4980 wrote to memory of 3652	4980	firefox.exe	121
PID 4980 wrote to memory of 4264	4980	firefox.exe	122
PID 4980 wrote to memory of 4264	4980	firefox.exe	122
PID 4980 wrote to memory of 4264	4980	firefox.exe	122
PID 4980 wrote to memory of 5348	4980	firefox.exe	123
PID 4980 wrote to memory of 5348	4980	firefox.exe	123
PID 4980 wrote to memory of 5348	4980	firefox.exe	123
PID 4980 wrote to memory of 5348	4980	firefox.exe	123
PID 4980 wrote to memory of 6484	4980	firefox.exe	124
PID 4980 wrote to memory of 6484	4980	firefox.exe	124
PID 4980 wrote to memory of 6484	4980	firefox.exe	124
PID 4980 wrote to memory of 6484	4980	firefox.exe	124
PID 4980 wrote to memory of 6516	4980	firefox.exe	125
PID 4980 wrote to memory of 6516	4980	firefox.exe	125
PID 4980 wrote to memory of 6516	4980	firefox.exe	125
PID 4980 wrote to memory of 6516	4980	firefox.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,7186974717302973021,7572731437942746537,524288 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,14435730942232060509,4391529639360007718,262144 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,11029127255265592009,16180654233649633989,524288 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,1623150159618801256,16945759297599020890,2097152 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,383407918518830230,10171056018675001526,2097152 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,10826155533324003624,10151447510714083243,2097152 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,14990276377018054228,2623148970271668900,2097152 --field-trial-handle=2880,i,8747836930374042188,11909900500696805480,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb75f0c728,0x7ffb75f0c734,0x7ffb75f0c740
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,686379308738120592,7117350022002493967,262144 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,6116031058113445023,5796739433568284465,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,3017390510453020198,8224193164834609331,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,12361364292281170306,7263545269390279193,2097152 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,1151184850243545033,11056851782637819687,2097152 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4508,i,3888399983028005065,3046566008066084488,2097152 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,11859612545834799599,17885190878342654262,2097152 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14947890008954644256,9818800463716599012,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5744,i,7058281412536557008,12945837653641988125,2097152 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,17956927381195025326,15666664965011742847,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:6960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,3020875111178718659,2741460383703671547,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:6968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,211111265693244388,9343362345017550125,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3940,i,14233171318665289880,11791922383779045765,262144 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3984,i,2646750285341915471,15341334789693860278,524288 --field-trial-handle=2016,i,12552858628191123070,16280243743330628827,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:7468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {03b2c619-4f6c-4941-9394-efa8b5ba7170} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {2ccd6e06-eefa-4d7e-bb6e-f10530ca820c} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112 -prefsLen 27276 -prefMapHandle 3096 -prefMapSize 270279 -jsInitHandle 3100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3076 -initialChannelId {30d24afb-8156-4e85-966e-a1b192937111} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27276 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3976 -initialChannelId {63dc80d1-5a18-42ef-8e1e-21effff2f79c} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4416 -prefsLen 34775 -prefMapHandle 4420 -prefMapSize 270279 -jsInitHandle 4424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4432 -initialChannelId {a1e36d6e-94e0-4f5d-8caf-07aca96e2521} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4912 -prefsLen 35012 -prefMapHandle 4904 -prefMapSize 270279 -ipcHandle 4908 -initialChannelId {d59e36f5-90cb-409d-9b00-d158c808ba47} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 32900 -prefMapHandle 5080 -prefMapSize 270279 -jsInitHandle 5084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {1e95442b-b5f0-4705-a4f7-5426c9bc9309} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {6b584296-5329-4248-9de6-213ac8ba71a3} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {8c2f8c24-6945-4454-b58c-2fcf9ea7050e} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4224 -prefsLen 33071 -prefMapHandle 4228 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {48bdfc8d-3b7d-493c-b31b-edd85b1d23d9} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5744 -prefsLen 33071 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {4229e857-7aa2-48d7-96ef-182da521586a} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 33071 -prefMapHandle 5444 -prefMapSize 270279 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5984 -initialChannelId {9d751cfc-6e13-42c4-a1bb-bfb7de2e385a} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:3572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2792 -prefsLen 36798 -prefMapHandle 1464 -prefMapSize 270279 -jsInitHandle 1660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7396 -initialChannelId {66672d5f-de99-4b13-9744-d7a662f0187c} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:6332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7380 -prefsLen 36798 -prefMapHandle 6220 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5468 -initialChannelId {e63919cd-e49f-442b-b3e8-31cc14d5dc57} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6232 -prefsLen 36798 -prefMapHandle 6188 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {3ba49463-2fcf-4dff-a5e2-c077ef4d2b5a} -parentPid 4980 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4980" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3700

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZ.4.0.Clean\" -ad -an -ai#7zMap19043:90:7zEvent30019
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:6116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\" -ad -an -ai#7zMap19573:116:7zEvent15904
1⤵
PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\MEMZ-Destructive.bat" "
1⤵
- Executes a command shell one-liner
PID:1436
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:3168
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5784
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6464
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4172
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6448
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:7516
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6788
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:7520
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:7176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
        5⤵
        
        PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:7960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
        5⤵
        
        PID:7636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:7220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
        5⤵
        
        PID:6676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      PID:4964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+download+memz
        5⤵
        
        PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:5168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=the+memz+are+real
        5⤵
        
        PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:3828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://pcoptimizerpro.com/
        5⤵
        
        PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
      4⤵
      PID:2968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
        5⤵
        
        PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:7820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
        5⤵
        
        PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:4168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:2436
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:60
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:5904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:7444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:6440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
        5⤵
        
        PID:6612
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      PID:7040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
        5⤵
        
        PID:5668
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:4256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
        5⤵
        
        PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      PID:7600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        5⤵
        
        PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:5728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
        5⤵
        
        PID:7952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf9daa90ch794dh43ffh966eh511b0b593baa
1⤵
PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf9daa90ch794dh43ffh966eh511b0b593baa --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,302255892354844367,13341923709405054502,524288 --field-trial-handle=2224,i,12208314844101122882,99949335681927147,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8640228324110576426,4837888642176634151,262144 --field-trial-handle=2224,i,12208314844101122882,99949335681927147,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,14867617066408291123,13089588861082042477,524288 --field-trial-handle=2224,i,12208314844101122882,99949335681927147,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:6360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
  2⤵
  PID:7628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,17127646528337835926,14869361064012155501,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:7848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,17677060727765786305,1518251240512159972,262144 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:7860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,6112529735533348620,14975981883411420224,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:7880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,16517372489179079384,7789734929116680199,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,16517372489179079384,7789734929116680199,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
  2⤵
  PID:6760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,2514563672917517576,302631543640402662,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:7348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,7796604179661517505,15617494075212813473,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:7504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16329060048871802953,1032936253315035738,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:7532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9877341361526781116,7591757103755354792,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12113386281994545935,4495855894244953649,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:7128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,1353071062894891341,11872990134372818957,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1299906851038600736,16490970871659585982,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:7364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,11307356120820029531,8519102374759790341,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:7560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,7184928594458068361,9311727796623515168,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:7680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,14924401044080622304,8893966240673406121,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:7640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4728,i,4942109667029791301,3915162695511932903,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:7172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5264,i,3406043276852176022,8862905149497739118,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:7236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11283548088917280287,3823438026194909571,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:7416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4853134087731686960,9710008461337068444,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:7432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5940,i,762601629914090444,4569033662416265337,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6104,i,8022980496848232527,11457804792335680635,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,15356535712992722260,3351809001437256058,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,14503327180638609382,83825029166982000,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,4873507514327707133,15505746251699226332,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:7248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,15130290581812701269,12398775023592445701,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6716,i,10452686830124628781,2421586200540779197,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:7928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6956,i,3771540221917255547,2607867475260241053,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:6608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7148,i,18131642197801498440,10423972294111794839,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:7356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,3467073338827169044,13721876188063054700,524288 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:7924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6180,i,15589835491671986126,11841993983530558530,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=4192,i,208831360632999289,3101100086985581952,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7432,i,11085876081845277600,6934010072777674065,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:7316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7536,i,12664414735103818597,9914166963840124821,2097152 --field-trial-handle=2316,i,18052709586396874392,17997275402502684321,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,8645896688495015036,13479101003793568772,262144 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,16782132558350788512,16145138294978488156,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17344076704207683075,4411368356347949383,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:8
    3⤵
    PID:7280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,8611654602872916231,8697616742742438532,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
    3⤵
    PID:8100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,8611654602872916231,8697616742742438532,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,12734574157554870998,14942240173671438209,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4900,i,12275363724863656992,12325897564620536229,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,16868070325332004109,6902968335023587113,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
    3⤵
    PID:8180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,523095280290099141,5973992729118703170,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5848,i,2441414463211901266,15383788919752953969,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4900,i,11919562830520479340,1102929352693867512,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,2149727826597964770,7140717035187764432,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,376261288931767274,16065842927889116171,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
    3⤵
    PID:6760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,10340334676992167624,844120991868303901,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6436,i,170352250124012547,15539751609249647425,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5545397231830901468,2991669042451577416,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
    3⤵
    - Modifies registry class
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15643639491764556647,6048643410154879593,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6680,i,9332812252378969090,1108718028104415695,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
    3⤵
    PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5920,i,12705733673678147474,8926791211412575708,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6868,i,1534109313755561919,5593514714690838017,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,16884990927454289935,8716926715982577357,524288 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6792,i,1084777784122066238,1290273634702701435,2097152 --field-trial-handle=2276,i,11689270620561669563,13882380667967994553,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
      4⤵
      PID:7416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6754497628614475127,18348757440423970671,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:3
      4⤵
      System Time Discovery
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6512439132575131549,17573651067155363435,262144 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,2664589629336859422,6128638077868642217,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:8
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,6069426657119435278,12409933221116851446,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
      4⤵
      PID:6808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,6069426657119435278,12409933221116851446,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4984,i,9281774201576054448,11385604631794364777,2097152 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4956,i,13928600265988199502,892800612597846282,2097152 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,11711481720437059605,15225776131123915410,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
      4⤵
      PID:7384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,4757100934277672978,11170212685371753535,524288 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
      4⤵
      PID:7708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6044,i,11281309551906813508,5702528620157928602,2097152 --field-trial-handle=2836,i,18073889364023229873,9517903630209742728,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
      4⤵
      PID:8116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:7672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
        5⤵
        
        PID:7020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,506386525311417452,3649819332726861007,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,192907264928022805,1463670716009488979,262144 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:2
        5⤵
        
        PID:7468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,14559710505249979498,8985120573242621929,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
        5⤵
        
        PID:7860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8835215353639404577,15705320136662667090,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
        5⤵
        
        PID:224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8835215353639404577,15705320136662667090,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
        5⤵
        
        PID:820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,17077398585793895086,5837744668706591507,2097152 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
        5⤵
        
        PID:3624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4888,i,5616159103664911055,14181057345934282516,2097152 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
        5⤵
        
        PID:7500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,18308395733939997274,2556138594372607568,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
        5⤵
        
        PID:7992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,2345410875632638718,4825742359276477165,524288 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5876,i,7671281146309698275,11342755323380936322,2097152 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,3082870232026783460,18175030063845774560,2097152 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6168,i,12404969908719674266,9959884141445518553,2097152 --field-trial-handle=3588,i,234244047887262187,14207444107060193929,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x24c,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
        6⤵
        
        PID:7428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,9347865138857586592,18318923918982304639,262144 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
        6⤵
        
        PID:7268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2063442678028346946,14024445355381854775,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:7364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,13731025789269376093,16147051324987822769,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
        6⤵
        
        PID:2568
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15318265009000372866,12906070393373167193,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
        6⤵
        
        PID:7944
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,15318265009000372866,12906070393373167193,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
        6⤵
        
        PID:2616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,218381114927384233,7618218085336527292,2097152 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
        6⤵
        
        PID:4120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4900,i,10980731807101720904,1407785699117867768,2097152 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        6⤵
        
        PID:6768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,8936126504506799873,10304236475960075400,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
        6⤵
        
        PID:5468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6590424269977597992,15475358670347846692,524288 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        6⤵
        
        PID:5140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5848,i,4111875153443553628,2521504768869219335,2097152 --field-trial-handle=3044,i,11153638080056821089,6169938124460552633,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
        6⤵
        
        PID:6680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
        7⤵
        
        PID:5180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,13499865115163580004,10667937432701714925,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:7716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3048118039975351375,2977048095989754334,262144 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
        7⤵
        
        PID:2852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,166559396917748463,13337290208080903517,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:8
        7⤵
        
        PID:7976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,444483821003033117,3864452622178888407,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
        7⤵
        
        PID:2336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,444483821003033117,3864452622178888407,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
        7⤵
        
        PID:2668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4936,i,15433474694663619903,15492116404674196864,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
        7⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4956,i,2086595351535565002,12037797964071405823,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
        7⤵
        
        PID:4264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,4700840666070316029,10040496190339232184,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
        7⤵
        
        PID:7964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,10590089313429221439,6857823321640134610,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        7⤵
        
        PID:7724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5928,i,12872125196668245311,13209285433786538518,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        7⤵
        
        PID:2340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4892,i,7504387377783099951,11907806900986598355,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
        7⤵
        
        PID:6944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,8147544558420928611,8539030474149926160,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        7⤵
        
        PID:8088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,14237032082033794339,6777658622659703612,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
        7⤵
        Modifies registry class
        
        PID:6840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6520,i,13554764186207859621,1689572743579656807,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
        7⤵
        
        PID:6664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6768,i,14112677999205895271,16965434684222141687,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
        7⤵
        
        PID:3748
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6852,i,1889534676410573659,12101533343590489125,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
        7⤵
        
        PID:7368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,17085715542429712778,10455297684047879272,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
        7⤵
        
        PID:3496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,10086316349985960162,9709740758555931219,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
        7⤵
        
        PID:4864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,127372172151725130,17903229890780804418,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
        7⤵
        
        PID:2636
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,4936544120523726141,10984247919963571154,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
        7⤵
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2800,i,5637488405760695330,14174964638105254046,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
        7⤵
        
        PID:5708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7788,i,15973233061872904605,8293394065623641039,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
        7⤵
        
        PID:4508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,5389590037247213099,13050984406554573943,524288 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
        7⤵
        
        PID:624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7832,i,2006929283704323567,8254648420453109828,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
        7⤵
        
        PID:3332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8112,i,3032638508132327548,4113508831159608308,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
        7⤵
        
        PID:5468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8280,i,17428782184483536334,8257956416844900863,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:1
        7⤵
        
        PID:3620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8484,i,8973701318074587095,16788424587400881463,2097152 --field-trial-handle=2316,i,10124963819033715852,5455408955779615326,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:1
        7⤵
        
        PID:6900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:7096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb81efc188,0x7ffb81efc194,0x7ffb81efc1a0
        8⤵
        
        PID:3932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,8365052852353693866,4062680418314294352,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:1868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,424411238888001632,14408645972896568735,262144 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
        8⤵
        
        PID:6076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16498445106362834981,16662109134693172294,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
        8⤵
        
        PID:8016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3960,i,1360591292541127923,4542839549612246899,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
        8⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3968,i,791779209785103352,11769813811642726515,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
        8⤵
        
        PID:1316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,3699390792386683803,9958538304999964323,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
        8⤵
        
        PID:1908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,14747267418199460038,13403864545924260930,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
        8⤵
        
        PID:3608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4652,i,9848492949741106141,3246404796045799827,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
        8⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5576,i,4768767376646868953,6232854427356880808,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
        8⤵
        
        PID:5696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5580,i,6552488147815424949,10240969199663446703,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
        8⤵
        
        PID:8160
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5768,i,6927171025725441419,17693283444725114898,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
        8⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3119990890788694001,2166094021953783053,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
        8⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3119990890788694001,2166094021953783053,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
        8⤵
        
        PID:3384
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2495432012094206957,5010632797792251201,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
        8⤵
        
        PID:3244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,17796405810267419868,10414337636537414667,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
        8⤵
        
        PID:3444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,2519532930403296953,5690936234399908168,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
        8⤵
        
        PID:5448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16246546300572457872,14216112574184433698,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
        8⤵
        
        PID:6260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,17752203856024203648,1353238691143267269,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
        8⤵
        
        PID:6004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3920,i,4815135589320244036,4305923166479013696,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
        8⤵
        
        PID:4188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7400,i,13214696387816423620,16129859055500517390,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
        8⤵
        
        PID:7784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,8395839777111591817,15180014564569673103,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
        8⤵
        
        PID:3444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7720,i,9509883177504134417,17560485520078813404,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
        8⤵
        
        PID:7112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7840,i,5063537310497817335,1219821871272705333,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
        8⤵
        
        PID:5132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7860,i,12544219105274611844,6208755517881438671,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        8⤵
        
        PID:816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7872,i,9194864384928895092,17213449570119743817,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
        8⤵
        
        PID:2108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,1503836065544888914,7056140769029315362,524288 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
        8⤵
        
        PID:8036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7832,i,8584691530458138178,17644817219475594426,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
        8⤵
        
        PID:6828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7260,i,4333573348918477368,1268224204738145250,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
        8⤵
        
        PID:7976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=2160,i,5273690349292735103,4794118159539539763,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
        8⤵
        
        PID:2744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=2156,i,14924865722495883100,15194138404360030069,2097152 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
        8⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8124,i,11954749216509232307,96223694816663365,262144 --field-trial-handle=2408,i,5465819873586845913,2884749785395354959,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:8
        8⤵
        
        PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultfb60df8ch1fbdh481fhae9fhad77bfe4f5b7
1⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1a7ef939h0b7ch4e07hb18ahac72f23d4318
1⤵
PID:7276

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:5824

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:7220

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:7840

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7692

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2c8 0x150
1⤵
PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:5520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6132

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5980

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6428

C:\Windows\system32\SysResetErr.exe
C:\Windows\system32\sysreseterr.exe
1⤵
PID:6896

C:\Windows\System32\ResetEngine.exe
C:\Windows\System32\ResetEngine.exe
1⤵
PID:8052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3827855 /state1:0x41c64e6d
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setupact.log

Path C:\$SysReset\Logs\setupact.log
Size 110KB
SHA256 8f5f70dd3d231a6f3c0700986506f5f9437afc64194c18ec28a55a4e2befb5fd
MD5 0333e9f92deab06d56bef4955a85ee3a
SHA1 36ab3783a1a1064b13b937c061e572c00d334680
SHA512 8fd1dda2c9a3915c43416bd291960d280668a0b52fffde3a1f3480e390fc32f582b94f45e591e94ca06b3beb2a8746572f8e326a3dd9380ed1a800c60a5c705c
SSDEEP 384:fiLzt6B3YEcNOstx61qaCDhautBdYicrcp6mTb0y/AU7MB6u0bYh1iV9MGrObYhd:6tMsO+thakBd7IYYKY0bPVTObP6gz4
TLSH
T174B37C212AFC41E5AE1B486BBFB54A1D3156745132CEA83FF67E10427FC0B82D56CE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\$SysReset\Logs\setuperr.log
Size 749B
SHA256 5715737185140c8cbf92f1429a296219e3ec365200d880120f1fd9ede05f5bcf
MD5 17c9ff5aae0afb0638f657c2eb694a71
SHA1 90f0a1f21f003e09150a42581fd58b673fcd4997
SHA512 573bf7f94f67eafcc511d6426c59d451853a2bd5c2b6bed5d13d208eaeea974e3783c5df6fe9838fee15d2d2e59b2d53d8fd2b1e1f1000f877dce4c1b849533b
TLSH
T19E019E566CE9059BCDB121257C51B9282DC134F350C9C83EB3AD1AD5FB854E0B97B18E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping7596_2043526220\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping7596_934953510\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 399d6bb176381d1f42ea1b38893df6836a918c8477b376f56a88aa181ffadcb1
MD5 5255600d3a71c0814a2b47691a741730
SHA1 e94e4aa12b2d9c2814703d3815d889bba0100e67
SHA512 40b009767716b5d993069ebefdb8a60f4ef13c608262eeaa966cf2c3a6c3a18fa305b3b8c15606e40a68110e841b64161dfe24b8fc0766d59c61b3354c9cc330
TLSH
T1DCE02BA9C861AC2718FA2B2C20600646E75003163F90C85F3E3DD3088FB5B3B456682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d333971fa3639dffee0f47b2c1f7e727644171d43dc6aa8acec316430ffb666e
MD5 096f27a971b59b1512e4a831d86e170a
SHA1 db747795dac17c164a51c655ab1d0816c0558159
SHA512 8f06863e9cca8d4480cb6e9b52ae7c31e3fd8d4936e5a1a1a7e578ac80a9fdd2787c3fa437a2e4de5226ecc826b3848b72c1dfd05cf67a1a3320084584fbd2d1
TLSH
T142C0924880C8557AFBAC46BE0AB2188025E26A2201EB459242E05D9E9D22AB9611B881
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 614f4afb6195c0816044598b3aa37147bf97b1833c54c3e6489fa6b0162383e5
MD5 a1933070c8b641d1489aa3ccaec99abf
SHA1 5a58312dcc9adb594b51a5324b54b26b7e1917c6
SHA512 7693a9ddaff05d34dca6eed361e8d0149fda5f5aacaaa9b9598f0cfd9ea8b8e5a90b8ecbfeeeafe633c6b3f143493f21f394789764f1a8753dd9d759acb5366a
TLSH
T128718FF7C3D4C52D895156F49725AF2FCE6A0A14431C3C66C8E4AE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 744bef166bcfc5d7055b1b8d936c4a88042d871f161f54620b354f0796684326
MD5 270fe824e293f19b0c2bc9abcaec68fa
SHA1 c21cb787794281a8720f7a89a902ae0f132969b9
SHA512 5c10efe70fdd711e52cf14f7209d616a2f2409e4ea551b8d3aac3427772e405be5568f964bfd62dad40511f1f975e6114dbe36e90fbb79490c70e7927234aba7
SSDEEP 48:YALlqTqI9h8hOhXqhFaXYfoKszgmzs8fsV1osU/Ks9oqzs9zts90csj+s0qsQla:Dk59CIU7aIgTSk/DodzQ0HGuE
TLSH
T1DD8190F7C3D4C52DC95156F49725AF2FCE2A0A28432C3C66C8D4AE5B93E2472D21178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f0d79270e50e5d8a6a6e7db6cc719ac6e4db4b67cb6a33dd94d1a81794bab2e5
MD5 e1b1ba4f9dfb726451816885ac3b9c03
SHA1 6f181bca9e4a011b2c0ffe3a2fb2dd2250065ce2
SHA512 498004d981efa1c87f79d32e1d56d5750a75dce23df641eaf09ed056eb3df05ebd7a109aaa6775c5ef1690daf122b0ef0baf4e0b4c92eee20f7502c738cc0581
TLSH
T179818FF7C3D4C52D895156F49B15AF2FCE2A0A14431C3C66C8E4AE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e7d56b8b2c542ca517b819d3066c561ffd672d3e76f638ed28218d877e9bf5e5
MD5 fa9eaeb69d26932e3b408fe3627f997d
SHA1 fdd4dced3122f048f54b83081cfb07be586d09bd
SHA512 2383aefc7ca7c697bd80089720c0d7bd34e71784c0ca46f3e0309ccd0f81bc067bbe2dd53a1bab2e346d4d42f7352c6323059e3ac3b570e011e45d3eb14dadf8
SSDEEP 48:YALlqTqI9h8hOhXqhFaXYfoKszgmzs8fsV1osU/Ks9oqzs9zts90cs9v4sj+s0ja:Dk59CIU7aIgTSk/DodzQ0hvjGW
TLSH
T1518190F7C3D4C52DC95156F49725AF2FCE2A0A24432C3C66C8E4AE5B93E2872D21178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 fb93528c7fd80f5036dca3e3be31b22dd3fab5c0f447767e5b495d1978030913
MD5 d27cfabac765753cd0fe0b6f42db518b
SHA1 2f7c17520fab8bd6de01d962c68212ce742bd6ed
SHA512 018bf3b1d2004ccaee055fe79599e0df23f8cbc34fb22f6b8895dcc7d5e78e3c3ae398c9781b89cbfdd72b10b6b17818dedb646f1c26352d53c81177b67f1e1f
TLSH
T141F05967A6BD743750B904BB1E087C0D79BAB43402C168F8CF6A426CE1E19F71B02463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06b2768c5be034342529da754d83e333b3a7e3666eb0aa9cb944f1ca161d8543
MD5 3915c9bd3972e24972dfd3c92d7ec63c
SHA1 f45f39e10fc62c9bf916982fa738b8cbdef45c3e
SHA512 8d979504d6af4809a925326a2d4c39ab677a0f0cd967f966c75f3792e2fc135d7aed141fb4f3783246dfc5b1e86d8935ff9a6cb638d62acf5efa1d4360b31675
SSDEEP 192:1R/Brwkx43Xv7cpAPRp2qg9BHsb+WNn8T0m1we8EaJ4/VyIsnAUgtaJ:1R/BcH/wUXlgrww06amZ8
TLSH
T13442E82EAD10797B5CE7D22DF9267B53D7F5102121942D84EAFC8A6C28E76CC231B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 40421d75bee2f8934a1a74711b85a3d0a77a4ca6b8d22a3c2425490a25b81133
MD5 a2f7c3937497770194a1210a0b6f2faf
SHA1 19d289363df0587937bb06dd1abf005506165429
SHA512 c51251470cda298d35f2b8774d8017be8774685658185dd7c559b237ec0972645242dfab2d1b41d7d1e48c83691a8a5f793ac16d784e6b6bd9f1852c894676c5
TLSH
T17BB012E0C401D602C00202F425521498B3549F15960A170153F4FB2288292908014290
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e7ea.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e7ea.TMP
Size 96B
SHA256 4d94c90510840e162df6cd2cc54106235450b1ba19d38e002108fd2ac76b5b90
MD5 394235298add1d5e8d1389c663542bba
SHA1 ecbb1d0cbf67b225ce5355f163f43787618be82e
SHA512 1667988c013cc1b355ba0bb1819299e8e3bf3b304dd57d4dafde3e67a15b0bcedf403e6609c9726f5b76941dcf7be69c0150ad0b097ae3bd2fe140b8e0f9a75e
TLSH
T1B4B02202C0022A02C00303B028C882C83020FF30C203030282F00E3ACC282A08030A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 ac0bc0019c3679696a6323a9c96ff9b36a1f6cca6162bd2b435418d2f982aaea
MD5 16d99e789f22a9e4249fd508d23f95ac
SHA1 0670747f0d9850e3bbdfa65b90aab0e785acbcc0
SHA512 e6980b5c9193154ab75b191713a883458610f54028715968132e2fb26e3b401dea9b49d832fb7ad3ffb6e06b8d3975e2c611038f4f2f23460c779ca13afd5762
SSDEEP 6144:bQhxNPRW2PYddqmY7U52FMFmUi21rSm8uUVNSlzYS:0XPRW4Kq97UAyfi21b8j8zn
TLSH
T1A43423207CE2B9B59C4E744832CF3D285EE98EC191D4DEC1D522AF061D5F141ABB7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 fc546fb34c73e5d81095bcc156fd1d1c80f38e81d3cf45cb3b15bbd7a1e03dbb
MD5 27910bfbbe31e3d14b8522680808f563
SHA1 324a6ac4a37e934e33a9e7fa5e1745550b248636
SHA512 21de78be1d21f34255d4f63ebb60b69ffb1c34473678ebb5bc642633ed8ca4cb1ddcd1c008319707441c141128de22637e889646eddfb2b7cf748bdea07765e4
SSDEEP 6144:ZhxNPRW2PYddqmY7U52FMFmUi21rSm8uUVNSlzYS:PXPRW4Kq97UAyfi21b8j8zn
TLSH
T12934230079E6BAB49C4D745C32DF3C299EE98EC050D4DEC1D623AE061D9F1816BB7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1c6503da4eae6b01b918b8a526b58483f24d1523cfccf57d335b9296b6813ab4
MD5 a08b24ed0d6ebcbcb4d7ca58ae10aaa1
SHA1 c48693bca3768f63a83a8f75fb6bd9d341a20483
SHA512 e1501994ace84bc691c994eb98b0f8a44c73e92e72c113f3ff0a2eb72cb67aaf4c40ad7b6878b3c3a296ea63139aeb6557dadfc15e5420e42ea84724d00b199c
SSDEEP 3072:ScFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:FFmUi21rSm8uUVNSlzY/
TLSH
T1A9C313007AE3E8F2EE5930447BEE2A149D6C4D818191C6415673AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ef3b3cf965fbd3bca6462b5ac24fd821efcae80f03b302caca691158f8ae227b
MD5 30907927f6ed86e438562be9d1d532c2
SHA1 6049c023b740ab0d7d48157c338b8cfdb3633122
SHA512 3a180dc0a0cdc24bae9b81a138eaf5b1b33ced074a5d4766e62249a070a121ba23cdcff4358283af970b177027d19eaab6ca9ef7deff1c811bee550f442596f9
SSDEEP 6144:ChxNPRW2PYddqmY7U52FMFmUi21rSm8uUVNSlzYS:GXPRW4Kq97UAyfi21b8j8zn
TLSH
T1AF34230079E6BAB49C4D745C32DF3C299EE98EC050D4DEC1D622AE061D9F1816BB7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3b26c95726afa7da8827c27ec9e8ca2eff372e289e758962739af10e12fc4efd
MD5 3b6fb1156489ef4e724121fffe5faaa7
SHA1 e1401b94b8a86ef6ec928891ac122f75cf4cad92
SHA512 7f3fbb6f6dccc3e7f4eb3343c9d9061747c73e7e88455d491b93653d86b1a4d29aaebd2deca8d5957888e3b69a9d3f9309c63c56509f24e355003f1b50dd8eae
SSDEEP 6144:TQhxNPRW2PYddqmY7U52FMFmUi21rSm8uUVNSlzYS:cXPRW4Kq97UAyfi21b8j8zn
TLSH
T1023423207CE2B9B59C4E744C32CF3D285EE98EC191D4DE81D522AF061D9F141ABB7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f073244f-a4dd-49cd-a6b7-832419662df5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f073244f-a4dd-49cd-a6b7-832419662df5.tmp
Size 237KB
SHA256 ca0b54b19a50da5ad26eec3bf9c9cca2629128ca35b4193268115d09d27ab20b
MD5 da141c7ab7a4cc9e61a094b324f42924
SHA1 8a3db09c3d425083d8d22ec85374e787c0ebb219
SHA512 26d42fc3eba6dca1260952106942111476870977e5f912f6df1b58bc66bfdd8cf864b5ca69c864f412cc94f72751dbbf263945b824db128a3aa5e185a7291660
SSDEEP 6144:/KhxNPRW2PYddqmY7U52FMFmUi21rSm8uUVNSlzYS:WXPRW4Kq97UAyfi21b8j8zn
TLSH
T1893423207DE2B9B49C4E744C32CE3D285EE98EC191D4DE81D522AF061D5F142ABB7E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b28890deba12e067fc4d2feb5580d3c41c440f03564bf57389061fc95e34ffb4
MD5 f56c99096ebca93d541e848019c50ce7
SHA1 f05cdd26283c3ad72be6c76d2723c8b2921e76a5
SHA512 5f6ed4ff674ddb4d1011c58252766c4de17dfb0ffe6567503e473bba4084104b233e51b1258ea50f5fe88fab251a8396460e5f289a7770b4a20b08cef23589a2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7t:fwUQC5VwBIiElEd2K57P7t
TLSH
T186B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 971426b5cb649f9285fbc2cf5d5d760bf74b0b3c0f4c8d71dbfce004f2062cb0
MD5 4e8dc3127894c49f97130983d8f76633
SHA1 568159b5be3ad44edcf4f8c7e65f6104d28977b7
SHA512 499d42b8957996298030624784b765cc341a8796554303574afd45b569da45cec37ebe0ee51c58b5eb72d5fdb99a78056756fe33cdd9bd5b7d93dbd97221d82b
TLSH
T12DD0A7326A5DBC95E66D0270D56287016EAA45AA25935B06B208C81D88B42D176C65D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c23b333e977062e84698f210574ef0b942da1954edda27b011aa0bfe81fa6a2
MD5 3ee00f8b88667133db80af0cb1e0423e
SHA1 c320e91e7f0345b536dd0bdd49ab2bfbd1a4ccc3
SHA512 d6f243a7a766b6108797b2eab3ffffcc2ccad41857d8caed3399c38e4ac9bbefc7086630c51031b1859876fe3f30f4c3d3ca2fb908911d8ef922a7580ff71f45
TLSH
T149D0237075B9ADA0C82C0034803002016E66867530DB9B032045D81D88B02C0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 07a0cc1cf8224b3263806cd4e9574c22aae4234947f78ecbde4fa46299d578c9
MD5 44902253f1a78cbe5c3fcd9035410e14
SHA1 830c05df0bed4f7ae3d7ac087381879cc2fb2518
SHA512 dc958792f53627fa9000fc926f479f883a0b3b87ccaed88fce639faa8731d734fecb0aea4cab8daf2a6cb0a372d5183203caccb2491f0aef31b713b120217ee5
TLSH
T1BED0237075A9AEA0C82C0030803002016E76867534DB9B032045980D88B02C0F2DF8FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c09327f64651909d5ec2f150de946fef2276f496771ddfefa21cbc28aa753bf1
MD5 59b13dd31b0cefbd7397589df2151baa
SHA1 815e2bc0c8e8a94b27bb25501a659e8171ce69a5
SHA512 2937ad9154c3d5eea47679e5fa0256e440964ccb5fe6d662f808209d421d74d5e8086162374a91332e4667e6e76d1ac9dcc64fb155c8fe66bb2a33e602d3152e
TLSH
T1E5D0237075A9ADA0C83C0030803002116E66867530DB9B032045880D88B02C0F3DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83fee416d8d0279c506b4c8d327e7e98b05cfbcf5049e6254260444486708b0c
MD5 9c7153c09ca6c2bbb2912ab5660716d4
SHA1 61178c7306eca5ff274829465abef4c8fee2d258
SHA512 fd4a7d1370545319be493e8487733b33ec8d5827ad71b92a3ba88f27b5d525bc52add268aa0e3e153a0bf2dc1d4adfa48677dd19afd55d56b8f4159abfc8b91f
TLSH
T15BD0237075A9ADB0C82C0030803002016F76867530DF9F033049880D8CB02C0F2DF9F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6cb65dc45a2598291eef6dcbb1aa8f52b9d83c2ec023b4d1e5982b24cb109592
MD5 e69ce8aa5f23cc150182e80f757f6b32
SHA1 de1b7dd4c99f0c23cd2dc27e796d0aae5351ad43
SHA512 3b16f7cb66307d8ff8a2a100d0044b09f3a4432c32ed34a21522ac278fed182b710f9a9394ebd9eaf028c81604223a04ed96fbcb5f27a2a0381c1f978fdd90dc
TLSH
T172D0237079A9ADA0C82C0030807002017F76867530DB9B032085881D88F02C0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8fde4542497484fb039f8e53617ba7914841930d82d0aced4a61df9352f2fbdb
MD5 db8d3e9993c211adb4f559e3f669164d
SHA1 0980287cde4f2d3d2355f9fc6687f7a2a26eb438
SHA512 7d192e5fe21b8a71fca76cc87049c45899610e662a9d3a3a9ded0ef23097b6e8eea3151e10a44980ded97a3a074b787290eb9e2db357c45b62c58de3e97a0a68
TLSH
T19DD0237075ADBDA0C83C0030803002016E668A7530DB9B032045880D88B02C0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8096425106c4cdbf20d789a799bf8b2673d35665bc886cce0ddcdc7282c2be7e
MD5 32e5334a0465c76781d2f8a0f3da6109
SHA1 eecb2f9cc13cc178b633dd245bd08513e4d91aff
SHA512 7ba76ab1d6d198afb47a9a2f8bdfbd8c91019dd80e44615bf44f19cbc5356c0911e08f102fe651ea0ebf6d6858ee94e63ce629aa6c7075062013c03fdb42887c
TLSH
T166D0237075A9AEA0C82C0030807002016E66867630DB9B072045880DA8B02D0F2DF8F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d8cba27ca2a613dbb43bd3ed61dd68b02f787d94a2ac1e9a01079f2afb7720a
MD5 fb73b286a191aaff5505f3d1fa56e53b
SHA1 d675dd4f63f152b50074c3e01d47e56df2dad292
SHA512 4dc8074e478bb3705398faa290420b1189a494a7735f7dd72abbe20a61eef89f58ae7fabab510f3d416880ce585b27a422cecc73b7e863e8cefe334e3ed1f8b9
TLSH
T172D023336A5D7C95F67D0270D16387015FAA45A625D35B07B204CC1D98B42D176C75D3
MD5 SHA1 SHA512 TLSH

Submit Download

1aebd33f-7e8f-4e6a-8d8d-a7235ea5cd10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1aebd33f-7e8f-4e6a-8d8d-a7235ea5cd10.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

25754c8f-5f18-439e-ae06-ed67fd08acda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25754c8f-5f18-439e-ae06-ed67fd08acda.tmp
Size 414B
SHA256 6756e752548b31d6391e450c6fb23210b9964bdd8eb67837d911984dd05b6ece
MD5 1a4b86a8669470c45a56521c84791357
SHA1 161676a4fd1f8c83c802c34a7b21eac44c4e2a4f
SHA512 a32406fb2502ad1bac4d391ffc5720f1851c0f1e316cb778070ffb1ddb6a14c1cae423f410612af3bfc23dfa3e46cd43b8e2f6f20e2a96a4d5797ba9937bb814
TLSH
T19AE022A9CD22EC7708F9175C20288606EB80131B6B90892F3A3C830D8FB463646D68AC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 510KB
SHA256 04022d2b2d0a8d1751775335439bf8f36631dbe236d4aec9470c747a683b5f82
MD5 ca10b2f27d72d79d986e363ced6a58a8
SHA1 d8b0ee1fd42ca63880f311f18dccce771e858bc4
SHA512 49e97ddbdb3d2d3c6e5b2206fcbcc6cb84c119a6071e38e7a2569ad75640c562c3a5cfde5c2a0b25570bcfa3edfa55debeed61d881bc95f3cb8c24678c47ea5b
SSDEEP 12288:Bhy9BxSA1oW2G/EFGcCeYR+aaOUpxDwzgeOr/P:BhKBIACfCbRaOGxDwMr/P
TLSH
T156B423B900FEFD347F6E3A5C1B518D8C2FE9B2152ADE08C194E83DA6DC6551E84E49B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 85KB
SHA256 1871a974a521e4855d5222ed08616658bc9d91cbe639a7a10a5c5178eaa442eb
MD5 f6925a19d4a88b0f8a7175959bc9f8ec
SHA1 32bee3e7ccd95dca7fc51ebf4ef303fc564efb30
SHA512 71c24aaf8545095880883bb9b706f9a7af88be26f202bd29b45505ba7335b742bba04a81b5bdcf51110330837e52ab2321274c3f013932917fce31517869f037
SSDEEP 1536:Ue+cmalJP+GyhHtSqGrV85qFEWSMGWmzLaxjNjbh70WgfCwrIv7FC:UlalJ2GywHOqGW7K2xpjeWACwrSFC
TLSH
T13F83121209CB660ABF974DD63A47B71BAB8ECC021192088CF41F514EF97A81B52B5F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 436KB
SHA256 0b320d2cf00e9215763a5377904e2301b2edb7a5d299bd319259714cf8bcd9a9
MD5 38e965609b7e0769e6754549cfa3c2fd
SHA1 8ef9e62fa3ae6d8b371f5a9e9344a6cdf31515fe
SHA512 18cff962b979abf3e3d06261422f35502463a0e196aa0cf801cadcff8833a83f20c9e9f22fb3133041e406fdf2304088a0a5eaa4bbb8aff07ab15a0c1b46b0e4
SSDEEP 6144:HT+7EhQjYpz+XUGr9+7Km54TxcjJJEWv6p0qOJ7kuKtAiDL6GnkES7+S8HBWzDi2:6vj0iUI9EKFEJdU0p7riDxw7L8oviJ3c
TLSH
T147942367DF08D99BDA158361EA30EBDD1158EB6EE00A3CC844BB462CE54C0F9F6913C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 61KB
SHA256 349f35604535b842f119864583f53daf40044219162f81a20c414e81d6cee8ae
MD5 de32652065f025df77d69931e094242f
SHA1 2162ca3f80d6e83615a99a46b71bd1ae0e779c84
SHA512 dd74877f787758dd6a4acc501fb032f6a82a337ede576d72c8e9e5e0a7f013fcb1b9a59893fe538d2157809e98e15bb1444bfa0e1df922b404e923eb41c83542
SSDEEP 1536:p8+lMX3oblCab8YfihNzTMiP9UXQcQfGCUTLl:KDX3OAYir43QeCUTh
TLSH
T13E5312810280D995A8719271AD8E1D4EBF2702BD789FF0ED2D85C714DE7EA2352DB487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 51KB
SHA256 95af27e55f69727d771047ff78cb33e15c5c8c00249224cc7929ddf27376b988
MD5 28b7b49da53662bcbeeac32ef48ac3c0
SHA1 a62f6b5aafd52eeb2f8c6809c715bd44a9a66fee
SHA512 264365e64e5c43ad20ab9165639939ecf2db88dbebecfa1fbd213cf51d1248cbe9a5c9089a9c3f15e509ecc115369925027bb7345012d6ff41ca278cd985ac01
SSDEEP 1536:NJe4yATvLB8xiQ81kliOe4V0nJLJb4H1Try6Mbye:vPykvNHQ81k4J4V6JLR4Z+D2e
TLSH
T1A133F19C524D8692991EAC90FE17384A4CD2FA1EBE7E0B3A2017BB52F16824CD38D645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 57KB
SHA256 945c23eaa85c54b259652cb71ace3af91b6e24eeb2d126c2f511eff23fa4f382
MD5 a8ff639ab87b49cfe9b3b72fa5229655
SHA1 bbf8cf84d499bc65f190dc56c1ab8bfeda4629fc
SHA512 b6872d2ed2f062c999a224bfed80f1d3ee7c47a25a526370fa91d5b908818306bb54ba68e911f1700fb9ed6b8f14f1eb80651da5869bc83280f8a17b62942f83
SSDEEP 1536:6zyRZjOWAceutp8TzyCbMxdU3Aag/9m55zCVGhYgGTh5:EyRZjOWAjx3yldN99GWn95
TLSH
T1CD430272C5653C500AEA734D28C566748A1FAAF61F95F713B3ED8225CFF12A0E6D9380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 71KB
SHA256 69841d9d7ce6d1e1cc6732bb8066bda43546e50ac6c45f331a49e315dfb5b6fa
MD5 dcd129f79f935911dee6938d4dda2e95
SHA1 bdb2165478963360526bab88cfc326bfcff489a9
SHA512 2edcd25c1954327103fd470b828abcf03ca6b2c4c43c9568c7358ec5f2cea2061a7204b4411424909447e2115d9c275dd15fbebf6b476eb708919b014e8730e4
SSDEEP 1536:KW5uWcEaJ3+kdu4xxNnh/iv6dVbf7gWyKxT89NnaGxWNrpIvsbtcb6R8nW:KW5unhJ3+kI4h/ieTMWFxs5aGxsrpIip
TLSH
T13E730262E1B14B27720514EDD8A69FCAF8B4775A12FA758483005F747E3CDE076E844E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 88KB
SHA256 8fd0dc3f698c8e41e771c5de6422b4f2cd373cb05643d2ca2b51872f16afadbe
MD5 4c7c64e2840e6078d5552e8b1641ecd9
SHA1 85b901e181daae0a870b2dc65863976da27e63ab
SHA512 036f0976f427ce220bcaf224ab08c9fff95e8cc5ec755fdd3972c191502130b6555cfcab44dc8b81d2e9e49287575dbf705783de360e32e1ca876a542f77c83a
SSDEEP 1536:yedRUMrNYpp76gbD0YrSEGnzUa4Ti9qWDImgKViCMAcptdXij/D6rKEFxSJFiF+3:vR9rNMJP0Yr8A3TiggImg0rM3bXijcr8
TLSH
T1EE930263AA3937FFD02E36F878DDC6B595464CD412360F1A7F6550A2728EC752E080B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 17KB
SHA256 cc110c5595359e7792788a646cf9713efddfa292e4e17844b25552914257369a
MD5 010f300db6d50a4df11a874cf82e1651
SHA1 bc06c7518e0b79d56e1f59105f7d803c95e70db4
SHA512 be8baa626a4b679012766faf773ea6c6f0fe201d40cef6efad93ba4fb9ee15f80cc84dd4a814f65af6216b0fa80d7d6b414367b88fcc57e7212f5b24033646f7
SSDEEP 384:yra/Fz6sGuuDmh1OXCNHnTFjIU1HorrDl0PHYUyb4nTKJIn:4aFLuDcqCJnTFUHePHYv+TKo
TLSH
T12772C0FEB14F806BDD13C7641AB2E36E41A03AEAC10A5FC494A27F89F05714F47418B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 54KB
SHA256 4efdc55078c4da206bd839b09839db956ff1a7367c2626b88fb055ec760b3547
MD5 66d5a1f5a9a5f054759181970675249c
SHA1 39425998be118029c4a53075cfbad6b0dde3fd10
SHA512 fd5af062a1420d47d2cc5b7abfbe3b4e95a599e9c62e4606c4ab3acd32d4ff7a11863f4fccfcd3aaf1b0fd6b26bd3e8b1e0eb78d5009a6cd0334ab84f164becf
SSDEEP 1536:UcLobQAiXrI8vWj3kJ6hzJUtwbVT3hczBkUbw:UX8A6/69JUtONGBkZ
TLSH
T17C430136D38783B096DFBD61576B92C63C0EEAFC1BBD2531591A2CD387DA946C583120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 21KB
SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
MD5 484fcc38f9b75715d8be172de22421be
SHA1 08855b74ef006dc76b4163c833f40451e11a36de
SHA512 806be7ca2beb27ec54d30a2142f3b89abda341e703c335f3c0096c0b8e4160388d5841e71e6f9f0eab53a70a1fc0f6fe6933ba3fa0970a20d5a835259b252e31
SSDEEP 384:SNscoqwsdhvFdy7BDe9pk88eVL7MFEQpwsioMQuSmPTHefTSoNpLg:bTelvABDe9pk8zVLgEQyHvvbHerZNhg
TLSH
T164A2D122B93C414615F2C3E4334F82CBAD84D826EECE767F49EA93901D8C6AB535D457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 429KB
SHA256 54474991b25976316302f8fee1540e94179b0c6b0d0b7294ab0b8d0df5cfb628
MD5 05d111d20ccc2ba4b0a2f934655ce1e2
SHA1 f3a04765efe1152c623d609c52147ded0d4c2ccc
SHA512 1fdcd1390fb5bacbd5fa4127b0fe3858deabce82d15ecbc19d2eab69230bdd93f4fbceebabc5a23d52898b211cf62d04f6dbb7c40d332064ac1141924ed8a415
SSDEEP 12288:h/L4sHYYH2ukJecL2fiSDy6GDwJzLhXLaW6p4k1Zbp:lpHYYHyecsvGj8Jzdmfrbp
TLSH
T125943339418DC6DEF7FC821F64861B1C2CA395D8AF32FE06673B4F6340A92719955862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 73KB
SHA256 3813faa72bffa1288595bc5986bb76242cb943feb916d83962a0272360473a32
MD5 72c5fe6435cb7adde13d5ebb908ac16d
SHA1 a3e2dbdba3e2d02f34df806611eb0e7db768ae5b
SHA512 67083e15f34420644da033cef66c8daf2818f1f75c4435fe08eead1dce02ff67d580ed845f81a981e9d12f12659e4c7644912f48a57df5e6eb44209ccd1e87b9
SSDEEP 1536:mcfh+X0jrxcAFQ6QGc7eG1TRuU4CBKwE7H3zMrNi/Vnu:mcZlDc7L54JLTPNnu
TLSH
T1C1730290F4BBE28F937AE840350E59B733E771CB75EB17404278412DA8178EABD61936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 72KB
SHA256 a030b61a68d76bf9c345772d377cebda2fbed7cc13b49439c99a3fbe7dc904a6
MD5 29e4391a6ceb6b6d62563e659875c60b
SHA1 de5a7f1f8d79832ed5fd990712a72271e7f28c65
SHA512 27937bfa4c3df764ca8d103cb2fdc3c2f4e5525ec92d483858e4a6635df57702ec0cc42b1a58803ddca7c3eeb33460c0784c0ebd99a8e603439c176a8d91d326
SSDEEP 768:L2kxDWaMKbDMef8LB4VGiWp5sQuKO3sR3DtlS6t81u9pSl1zn1vVujTEbGEY+121:tSa9rEB4V6sQ2at0SfEDrgM7KSfq+LKt
TLSH
T1EE7302A2A3E8EDECC7F4A599110DCB3358C707B6934F546A26614808C6ADC897F11763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000df
Size 68KB
SHA256 096265551a5ee356be7ccefaa40a7de3929105288e029cda15c965cb65b55eaa
MD5 f6709d44783ca7b4b921437ca7dd2727
SHA1 a0c6e731ea03274fd0420c360b5f8079ca719138
SHA512 34b45e20793f4de99caac1c28fca40953d4bc2902ddf4dac70c55bc28ae28cf01632095b20317c8c661832fc1b971fdc2eb05450ef8fcdafe74a5084589ad52a
SSDEEP 1536:GeXJHPV3M/Ib+Npon9pSlmtHf+SxQBEnhB35LsKMCoNx5p1WFK:GYV8xNan/rp+SxQSnhB3aKMCix5fWM
TLSH
T10C6302D8DB1C78A3B3A11891398B31876F920AD1DB0C79167D7F521E5B623EF4071B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 406KB
SHA256 c9ec15f6b284850a9e9c19a7e64a22154929e0f9e15a44f9f7e394111739fb9d
MD5 9216d5af8ede8d6bad7e05785c4f1536
SHA1 6196a652118779feec14a3c1d560d8a85fb296ac
SHA512 4707760777c417037805268bcd345cea67cdbf895ea01a002a157f9442c81520dbff93cee7047922e1513321e90db2bbc4d62365a5cbe51f308f484d7aedbec3
SSDEEP 12288:O+3o7mAmn/5Y8dgX4V+1iOF8MB/noCWnm3LMZT7LDkwFdqM:OrKAmxDgoV+YlMVn3kKLMZTbkwh
TLSH
T1879423FE7405ADD11AAB541F91A0DF9284D045E178637B997EBF4CE8A84CA27C4C8ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015a
Size 58KB
SHA256 4f4ce5538ce809ebb7cb6c9b3dc5e1d0337270cd73943e3eae749b18625eda15
MD5 b930ea1d70f60b9422ec0f0d1070a78c
SHA1 1494e4054648e7ae007a07a8ea5606a64cdee853
SHA512 6ad6c5a494f75b396513ef36b10aee24110a2b70f45ef1546dd0a25559bb51e9340ba6c26f72d85f983bad0f4677945912196f1ee3f9bebf24ca480d6352d3f8
SSDEEP 1536:RT4B93NXFOl37tsbNGYuHDNCvh6f4JA5NU:RTu9NFOl37t4GPN0hRcNU
TLSH
T10143019706421979DA871E3C60F9F35822BE4CF8D672D1873F6D36832A729CD18812D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015b
Size 61KB
SHA256 25d854b309e305444a5d509da796e7fa75be66267bfa7ac7c11571e2670836d6
MD5 7f2668cb387c0f76dffd52e401950536
SHA1 bf9426627ff47bf0ac84ac9d80888d6220f64deb
SHA512 290ac17e2b996d10d08d05239ca78ded5b367a237ea455384592f1171db115e60417af5ab587c4a976fd59b6c3b22a57ce7aebdd2ff549429f7017ef63894ae2
SSDEEP 1536:7f3jLKZw5Ls02rv6MFUpCseNunVvVBpmlqcvHw:zjLvVWmMy9eNOjpmo4Q
TLSH
T1B453028F7AD81EC1D170737CBE21394DD2064353C82E6142ABE63EB38A61D56985FDB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00015f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00015f
Size 80KB
SHA256 ebc721950348bae35fca33cb4def473baa943392b70e381bc51f2fba4589f208
MD5 7b774eec7d0fc407c90189fc39d26496
SHA1 2d8e84f91a0982039b5b70bc004c2b57b84605d1
SHA512 8dcb66371586ba9e8160485eb8ad90ef60dd49738a44d746f5577d26b1493b3aa9e7061b2e1ed4daa1de460bdd98c42495c17d409232c48a23c627dfdf016c01
SSDEEP 1536:JAk/XCyparh1ahbE/Ps+qYTiRhTWSck3hjntUmWMPZ31N6vT52lVBj1zLI:JvXVEUE/UThlcUjntUDMlZNZM
TLSH
T13A8302F12281FBA8E5A3FFB7AE3AFA45D07D944038FF079590A5890003D00147AD6AE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000161

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000161
Size 66KB
SHA256 386400176d014d580a8ab8adf9cb138ff538a2f79e29e8e0295382e0620f0af3
MD5 da247bc03a3231a9bf7161716ad95c84
SHA1 5c69d5d055e0f0d41bd079bf84f30bfcc48039fe
SHA512 e859c81723a10fc946496b84efc4617d8933bf09981ecea13f63fd82fe9eea76b21eb79fe2a214535c8b81e9cfc53edf95626ffd6239af7e13bfcde5d70e416c
SSDEEP 1536:D6ubmQ5ls2HMCi43OaYYvtqr9dyd5FjX0D3xqmHTi:lPl1H3i4eatwKfYxq0i
TLSH
T1576302554FD9CD48DEAAC3BB2DC5BBB7A6D0D9369730127566A5BE0820F29E9C800CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000163

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000163
Size 92KB
SHA256 321094cc03f6387da2ec139190e239545c129d9fce0413bac570f5d202f94b4f
MD5 0f0233f148496e6c2f1938f020bd96ed
SHA1 6f7801bdd5283e7102e9f3369142696a1e15fc97
SHA512 c3cb4ab2045fcf710c2cacaf00cbefdabdbf615fdae75c233919d853bd331803788460a3013b046607fed91ca385650e67775140fa5cb61962a93f8bc673cdbf
SSDEEP 1536:G4rw4B0A2cSoNXZwjX0CjuYGrhnxZoj1r/gBqh+C5Q:GUB0oS2ZDCoZAFI/iQ
TLSH
T1E99312DC371E93099359333FB884794EA9459BB3572DA24BE78E1188BBD2031F6267C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000166

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000166
Size 378KB
SHA256 c62da19a188da6b016c00811a929667469f9d4de64a05d6476a59520fad20a4e
MD5 f1eca6b889a37ff8230e6c011c951e7c
SHA1 be4bf796ec25837e8b5116f37edc31ae5a169ace
SHA512 a6859b02dff22fe0accd830d800081efa12f502a3a71d5fea888e29a6d59882663b94296ad3201e860a8d54337b5c0fe60f110a7d92a98e34542fbb1fc76dfaf
SSDEEP 6144:oElXM2wwgUY4n3nK4uta0tWRLguLL8xkuA8LfAwxAu4IjtAE1KgLCPpc7dI:G2rA4Xr6aykgu38485GIJK2AR
TLSH
T1F484225AD321C669FF120F39F2AFA74AA961F06DAA07054637B8C552C4E58F40C0FD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00017b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00017b
Size 49KB
SHA256 32276b92c025b4bca01261aea74f70be21ad73efd66063b8de4497b211bb47bc
MD5 c27afea97d5c24a7451be1581be8e212
SHA1 7bbeae8699203a20539f0abe0fa4e4ebb0d9bae6
SHA512 aa332f80ef107e69c25c807845379d8f9e7cc2c9a5664b564fae9ab00c55cea054d94b1886d24f3ded57866a26fa52634b369956dca79d2a121212796b0cacea
SSDEEP 768:eDI///SkMt+6HSLJPCh1Cfkv6jpRuNQ8JCslFdWM9Bw6JD6XDqN7cKwveOTG5:sAM9IJPCh1CfkiknpPP807cKwv9q5
TLSH
T1B233F25C7DD72593C46DAABE88B548EB14B202F06F4F3E8602A7E87EC470C9FC549808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000180

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000180
Size 52KB
SHA256 04215dce713e4cafd41c2d02df5a22d49ca5bbdcc730b2c0665fbaf922a1f5b5
MD5 36f73a10c6426caa40adab2c2c7a8a3e
SHA1 58a52ad1c46148e9e8794cc26d4748b58ff1305f
SHA512 6de9a4184650b09bbaccd125516b2b2b68eb36fb589efec0a54c58a0970a89c8ca3f5b553b5a703bac6ce790924720b1f7705823bbdcddfec46d1e41833697ec
SSDEEP 1536:/h0KDlvrPChxJDQCKIGdWB6csUdcKft8O:/hTv7An0CKIGoB6cpqKaO
TLSH
T1AE33D060594F326EEF5FA403A803DF37F9A22331317BD4116CBD9ADB6D511B28592B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 25135a75fa875f678bd841972246793bbbf68e7e99fe642acccbf36b7e918c09
MD5 603d86b091daab00b5ca87c2ea7fdafb
SHA1 5a48fc1c1c93ffc70199a8eaea9571ab7ea4cac8
SHA512 26a5bf832b2c7717eb29294e447ebd81f5f1c5f4bf3b0a2c18e591dd0845c26f96e221915eb66b54d3a109f49dbd4f2676598580455a552d6d2a352ea969a46c
TLSH
T18461605A03C240FDEB301378D5E00D013571CFBA2ACBBD9452A498FF7E06B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 fba0e935c39eb852d9d8efb3d632705a6f5bcf727c6b6a087e3a872943c9cd3c
MD5 941a62cb77176a71d99001d120f179a0
SHA1 49b8d465e432bb66dd4712d2ff8b3456cc24d82c
SHA512 a950c2d04cf73712b5f1ebe22996e6bc2be6f24f0132333736535ef830fe6cdaa5906573fda5829ad6cb99536fce129c932d9565999ff2cdf399a26468c38ed7
SSDEEP 96:zUPaJoK9XTpGovP5ghWi0czQDqgeisV+5yCaes3HPejdK8pcbGw:QSJ9T0ovP5TiMs5gAC8XWwgQGw
TLSH
T106E1214522D2A0FDFBB113B4DDF10C522029CBAA66DB7EA443A0DDBE7E12377095905D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 1ed572909ed934454ebb151aa8c6f4863b2916a2b2487390115169626bdac45e
MD5 1168fc74b723315fe87e8ff59910b6ae
SHA1 98681d856a3486635280669bee77a9a91d073719
SHA512 9d2e4d987096919d9e547ab9d11a60d073688911007a0aab3d80228bd9ecdee21fbe0525d37d11051ccc983f6617dd83c4b893bb3c365a13cd7e2f4fca20024f
SSDEEP 96:hlUJmeUsM4sJdfGYq9kI0ViobNk1TOTO/wNdHtybE4mVzMhppWbz2:0UWz4dGYqK8PTulNq44mVzMRWG
TLSH
T18EE12D4526D280FCFB7422F0ECE108553026CBAA26CB7E686360DDBF7E16736096995C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 9fadc4734a2b66c2455eeee7e311f191e81c0f1c801dd56b5c81b07d1b03c825
MD5 5f04d77d7b64357d2ea3ee462d3e6334
SHA1 64866036d0d1f6c582014ce0b008f135dcb81632
SHA512 f48fa33d49b36941c907a9a6a8c362dce07482c8ae4d606f0089d9f7bf5ceb58e8c43c7f3798813fa03c97b7609a7b163da0b9e481282dc29f6e956f0b5a03d3
SSDEEP 96:s0ooyf+YsxpUetQuSvUkFc7+ftxOyW84PKozDz1eE34OWecRxf:63YUEKMgc7+fLjWj5zteE3pWnf
TLSH
T1A6E1234522D2A0FDFBB113B4DDF10C422029DBAA26CB7EA443A0DDBE7E12777095905D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b534a391a99f12bbdd72e0e2aa472bc4864a06511ed5353cc645d5288145738c
MD5 eb3a535c52986bd230baa93fcf094d25
SHA1 e1b81f897f5f3ff0a60b24c7447017852e38e3b0
SHA512 5bdf5adcbb886f7f371b80b710301576e175b5c69e3c8a1b79d9605472d405714d35d7046cd51547eab8db5d34dcf1a8af32e5ea9939545a254dd2277b3eb172
SSDEEP 96:uKwpnM5GjCo0Ls9Ts7yIUl1VPo1zZo1nEvm2C0dR4krNdS5rSfBl:uZnMwC3FGTDaEEvmP0try5ufBl
TLSH
T1C7E11C8526D290FCFB7412F4DCF109522026CB6A26CB6E684360DDBF7E1673219A986D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 138bca288a437ed8bdf3f9baf77e8fee3bbc6bba0855e7601936f4ad79fbade0
MD5 4045b45cf3d7a01e452fe65d09983631
SHA1 69574f046bb2d8ee8984ebef1c91331c15175684
SHA512 c77e07d0fa4d10b4b1fe565108ea744bea1ce996b317d492419dd43284daa81419a8eeee5b89cce65fb9f7d2b72f66f4303c397ba6031181777267a66b4d87f7
SSDEEP 192:YKAV2yxscZEAff+N7tYP3pzEVcoeoL1im1v2MVyEN5JfRU0Y:YKAVJZEAHyaP3pIeM1im1PVLNjRU0Y
TLSH
T1E54282485AC690FCFF312AB0E8E10C192526D7AB05CF2F1A83049DBE3E4B7F29555309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 76ed789aad8e64fac82d05a7eaa93d06acd17891000e229d02553178a1882632
MD5 5b4cec7da3fe13609c0e53cafb63ac48
SHA1 497cb55ab117fb3f1230b25c801128b4a574af58
SHA512 281abf44a4b11d756d27b117774505dcc4ec28015dbfcf66e9c50af00074f2f31594b1bd5e03bdbf72ed5d933c2e704e5059cb93199c75b8dc1653e83db535ff
SSDEEP 96:ucmQp/rKAmcnhLBT0fijrayP23QhzlQO/v6H:uRc/ur41BT0fq/u0QOS
TLSH
T135B1EA4902D280FDFB751378D0F14D823076CBAA269B6EA45360ECBE3E277630999095
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe587337.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587337.TMP
Size 3KB
SHA256 72bae00143a96aa604a7a4d111ed5f790694e4d2fda56aebf15c288c42037236
MD5 baa282d6aabbdb1f6c73ae18ecb70d2c
SHA1 17e6ccd90b9fffb42ef80096c3d3d10802c5d0cd
SHA512 cdbf5351b570103adbf139eb526b0fd1a1242dec799a4d450243977c181234983e6d97adc75f9240cfe4358df4255eb8a2277e2e5aabf9e532d82e60a0180d6a
TLSH
T14F615F5A03C240FDEB301378D5E00D013571CFBA2ACBBD9452A499FF7E16B634D6952A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 130e33786bab2d8723a965534e64394436091a051e22c5eb2f09345d11d22ceb
MD5 02de6d973c3a6be959dcf1aaaaf72cef
SHA1 0b53e1188a9440baf1d34fc6dd50c8be6002ca46
SHA512 9e003c1199bcc23b5e2e4fcc0bdbf22567a182e740c4c5a4bbab20ed882085b3c94055ce5ccc22fe0d7e9479c4c98671c7ba312b3ab0d2a9cf974b231011ba9a
TLSH
T102E0D8D868C6C16D6E54388761A87718C2C53483DFC6AD0BD7048CC0BA06801F6D2956
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 17a9aeb7bfde20009c44ca55f18c66c3793a00cd0b107b7d9f8aefaebd35a945
MD5 d18d103776f3e0dfb358901c1a60bba2
SHA1 9f54b3b9bffb9fa2a8898df311ad0cec3f544d19
SHA512 12f12e5a6c7145ffe5877f8fe022cceef7e6ade04d5d9c22531d23b67c5558b1d44ab15b777ce7d5d6dfd19b56fa60b2d9c991e00b557d9e5d840dce8aeaabfc
TLSH
T174E0264429C8C16A995A6C9BC6AD770882D03412BFC8B9072B0A8C407141A43F3E7690
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 1148daf57c22d925068eb78d434ec7c59e774a11dda090dbdb4277558d857113
MD5 bbf81ed6f05f8e403795db4f9785a352
SHA1 a4ed1bb3d44f54d895c45c79c3cff2dbfd1d9ad2
SHA512 614b0f61e0ccc43938fa3eb080d9aa9be288f7c107533064144b6c4b5ce4acc5d0e9ea9b4dd657e3f9883b3155d7c80ff7ab86c9759b5cc05dee289e873b4381
SSDEEP 96:n21IU+bGz83uy3+u4tgp4DLjGQLBze9z3m3jBHMsDEuspU0wbtqrOQpPfR4J+MCT:n6f+G83uy3Ct7XBBKoH7DXspU3iV
TLSH
T12814210E4F243721CDBD917669E744B35D7CF03FCB1266CA686114B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 17431733720226b297fd0557a2a2fced8292a0e8fe3f1d0e44bcc7ca7dc59047
MD5 2215f92155d672928fe0ebfa21b4ef61
SHA1 28b178d54990ec34326296a9b66ac6294aa2b693
SHA512 80d12310695c37b6d6a03ac9a0811a27f391e72009ebf0dba4158bba5d253f4ef074222ccd00ce381d2611c75288e0db08262007dedaec58cb137e37f056f80d
TLSH
T1D5E0DF6464DDC2EF6B48384B92ACB708C3F03406EFC97A061B059C84B941944A6826D2
MD5 SHA1 SHA512 TLSH

Submit Download

69ceec4b-dabc-48eb-9c12-dc0214c24e00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\69ceec4b-dabc-48eb-9c12-dc0214c24e00.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 33eb3d7cc6bde30ed2fbb74e3fc35c20d50ba7d16fe0963f25997cac649b1709
MD5 d0dcf6691dd223a3d36a72634ecf482b
SHA1 6df7202b2caaa002e3b4c948fc35b0e3f8585bb5
SHA512 ae77dd23d496e5037393613001596d54b4180dfe9a588e7fae8d7049a91c1fbe7b95b25bbf554d352a6778dc319a2ef05e450995b9dbcd3764bdac7ab6bcbdf5
SSDEEP 192:DMDbXDh2RAJYJsZnXdDAW4kslWtnVLndbDP+nGnM8a1QPouHMPl:DMDbXDh2RAJEsZnXdDAW4kslWtnVLndq
TLSH
T1CCF1DEF7C2E8952DCC5116F4AB267B2FCD1E0918422C3E5BC4EAAE5B93D2871D24454F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2dfdda9523c7d70e4ba244647aac8cc054fb1fa58860a87c802b0199a7ccd4db
MD5 aa1086c47611d1b35c6dffb92c08b811
SHA1 e3b7bc97c0cea3c2c49b057c3e3c9dd3962e7502
SHA512 a07e2408959601823a22200482af85e48e97d77e27a0a4194592236057b6cea0f73efb361ae2c05e74fd312218c832b66ed5f7a8b83eaaa75875e2bb38506c2b
SSDEEP 192:DMDbXDh2RYJsZJrJB2z8OgreRXHilH1JJJeJUJ0JCJuJn0JnOJvJ+JinGnWJOJ+G:DMDbXDh2REsZJrJB2z8OgreRXHilHfb5
TLSH
T1D7329AB7C3D8963ECC5116F4AB267B2FCD1E192842283E1BC9EA9E5B93D1871D20454F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 724B
SHA256 70591bfd8d285797861e5383c7083af0bdd01cac2df298cd12eac329330658f6
MD5 307e796f02d98902667d684ee3d8c886
SHA1 b863f48c30e7fbd59594a0bbf814a1db3fd0e930
SHA512 fa85aa1d5e84d8d5956370d7e010515b261e5f82bbc26322b866d6794dafb6b27bcacb65297f0b9e84249befcc0c3de42f5d487b56da29a3b81564473e171203
TLSH
T12E01C0F7C3E4897E8A0456F05A149E2BCE2C0507431C3C66C9E4BE2B93B3475E10149F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 0d7d585ab5d816fd15f7886a85c4669131613809ddfb0423d2103144373c1e92
MD5 b91bcabf1a3c65cc7ce4bce6d9ba0eee
SHA1 0bfc3f5a2827106e1a44e0b49d8f57e5c6c05304
SHA512 4a195a8b24f2c001da4f3945255b341c4294d0b5c5d3887efd8e6ea5c7e401d6f549cde3ee41013da9f29fbe26b0002afa33e24a9c024821f0a138f38fb0f892
SSDEEP 384:DxCGQGYZMJXZJyJCrm/RLye2HG4/TgZe5ZCZCkxIe4SMGC2G8Xl+pHWXHiFg7Fky:XsnpUW85ClNLjHDtVx
TLSH
T19FB28AB7C3E8862DCC5126F49B257B2BCE1D1918432C3D1AC5EAAF4BA7E14B1D24464F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 7656bf3565ab34464ef43b42aac134fa63247f681370796ccf87bb33c15b50dc
MD5 997ea8bbf8be0d3bae4f674e84a8962e
SHA1 cc06815210f82f4e543e36e2c5bb2eb3129f9590
SHA512 21015a1158e3b9dd64b6f80ed8157162c7d15466f8aa6699ca0f20a936666923b5c8cee7ffc8792746384133dd80655f836955321f4a278e48a63715c1d50d13
SSDEEP 192:DMDbXDh2RYJsZJrJB2z8OgrerABJXHih+onBQNeJOJ+rZJCbGO0JCn5hDPeMn8ZC:DMDbXDh2REsZJrJB2z8OgrerABJXHioR
TLSH
T19842ABB6C3D8963ECC5116F49B263B2FCD1E191C42283E1BC9EAAE5B93D1871D20564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 714af97a19ef8f7a67cc09a8cb01647853a81eaac389bc9cafca39a087ca5f54
MD5 a4d6750091c77389df23483990fb8350
SHA1 034d9ac15ccf37688afebba3c7c969fc1243ba7e
SHA512 aadbc9ce4e5a770cbc4427ae0289ca026300e41423cd1cc5fd2baa89884c9dab4f7107412e099034368e9631e01416e53520d99b50a3914a246942b259ef937c
TLSH
T11AC012A282F9E472106855791D84B881A77ED834008068E4DAB7D73CA1911FB9B1203A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 371c44fec942e4350019ce8b578c21836138570a6b993e5787b6ff41f14fd054
MD5 c6e3ba23ec1df524c7df32b85ceac394
SHA1 6167b815c38ca2fe4653c03d50c5fab91d5b6c77
SHA512 a3d6276a23b184eaad51a7ecf4a8ba7d4395765964da756be1f54194a19b61c398724aad746d629215b2f83813551ec75dffac5befbbffeb25e08ac88d732cc5
TLSH
T144516AA781FFB47B5038A8BF0E0978056DBAA436419178F8DB5681ADF0C95F70707067
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 853B
SHA256 1ebea3c6b837a7d7e28d67fef1d68b46f714b2db73c9a177252cae5d8f80a261
MD5 1dfc1114e83c002a1a65cb917daea682
SHA1 297ebc087b486bd0227669035717549c8432861b
SHA512 3c125bee2af37495a605a8ca590c1df2167989afa977e96bcd0a16aa38dde5e73775bb11ec25e6e822cde38dc7a33bcfb1123fd29b8d16e50d7cf8d26c9c9e5e
TLSH
T178016BEB41FAB43B10295A7E1D41780519BBA83900A178E9DBA7C2BCB0C22F71B12022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 685B
SHA256 0922d314769f62546061d28639b87dc37b69be0cb1c3e0734af5746b2f077b29
MD5 45efb0981ccdfbd461772f8677e21ba8
SHA1 c4536281c8be46b7bff8cdee409c632e71b2f724
SHA512 a9e7aeef4d7c2bc282011255fdcaead0eca007909f393c634549c4b1936e90165cd93b17cda9bd02576174bd2bc5cc8d04ff44569b4ee40d991e956da6b66608
TLSH
T12A014EEB41FDB43710385A7E1D41780519BFAC79046178F9DB96C27CA0C21FB1712026
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 b9b2ec7206a4c9eb9d3d0aed280b51303e3a77e0a14877870853276d717306b3
MD5 ca04fa99e54ab5f4ebdf8699009a5230
SHA1 cb3ecce4f9a3d4c072ccf6af64319f7f7746837a
SHA512 7380988d8105ccbb53963d9270c0851148cd73ccc4850953938e1af6522d1c2f0f044381a0078c017a8409ff4353d5d5fccd2081ab95325d3db3c626ba402321
TLSH
T14C0126EB86FAF42B542C597E1E457815AD7AA834149178F8DB96817CA0C11FB4B12027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 90d90e1f0b67dd17eecbe63c518e39b62e888c82a882dbf2d64a50a379b417eb
MD5 e484e260e75150487e4da19bf2864479
SHA1 9c92b9c87f98e7d446360d39c2f3855e366bef81
SHA512 317f14a114ed2e4e33b14dc6ae01032dc0edbc3eb67bd700ee9406fbeee8c75ededf1b4cea720b1bbfff6c49d0ea8e462085e25ebc64f148da1e117360e99917
TLSH
T1DB516CA781FFB47B5438A8BF0E4978096DBEA436419178F8DB9681ADB0886F70707057
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 859B
SHA256 699992d18a40cf7e68c836f791d29b8f4c81c2226fa5e81fabd0f675ecfb0ac5
MD5 69b92c8437b669bab921a85b64b855fa
SHA1 289e962f94c662dd0ec043615b1f6ca5b6b7e151
SHA512 0e997f3a6060028a6f7e73d5d416512e6e90d5368f405d45f25eeaee73b51a68c31dd5fb1ef95e849bda30d664f1d7dfba2d7dfcd842d3315af977d275441688
TLSH
T175112BE741FEF437107969BF1E417855997BA839459178E4DBA7927CB0C26FB0B02032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 853B
SHA256 e096cf5cac984f59d2cdc29fbdb91a2373a9be086ca90477430692bce4d942eb
MD5 30899d5095638befe456ee86ff98591a
SHA1 90b6dfb00e72992ffdb507b41578bb783a89376e
SHA512 79736d9ba2f5d9bb790ae3cde566eaee3b0e191a2d27791592d105153874bca6bbb15bb8d6348cf2adc117932b10b1cd174859b4c112845b75478f6f046cfb9a
TLSH
T1B20148E741FAB437103959BE1E417C156976A834019178E9DFA391ACF0C26F70B12032
MD5 SHA1 SHA512 TLSH

Submit Download

f5f906cb-eac2-48e3-b333-e320826c87af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f5f906cb-eac2-48e3-b333-e320826c87af.tmp
Size 25KB
SHA256 d81af3c37f0e385c8fbfe2e14e47c24caaaacf72faabc2531a882b94dcf98149
MD5 9cc894cb686087089c38f4c2e085293f
SHA1 d4d9e169cc13ab9c64b106eae1f6d3f10ecf9328
SHA512 f4f08efe629d4779593f2ce9cf5b92e4f6a5f50eebf24d00b833172136f02a16dda2c429036cb18cfa8852f68f798fc3c643281c3b30342c184f43b1d0def401
SSDEEP 384:D17SCrm/RLye2HG4/TgZe5ZCZCkxIe4SMGC2G8Xl+pHwHsABjQeJQeJJwnXaiIkl:UTquvARVCenRQo/md+R
TLSH
T18DC29AB7C3E8862DCC5162F49B256F2BCE1D0928432C3D5AC5D9AF4BA7E18B1D24464F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56635f9d3268603ad4ff71b51c73ca47d70f0a3f1b6c06f3ac90f8363849d560
MD5 5e95789867ea56f72294bf7a139079d4
SHA1 b6fa142013897dac271245118496576ef843d928
SHA512 af765e16791d91680707ee25541f581d13171003831013a418ea468ca51f9296205262c17113badd0546e0eddc0839b692d54eaa14ff9387ede9c08aa70e00dd
SSDEEP 192:sxZ9RnyM/jK1Ml8LkH/fcsVWpVsjrEdpyVHW6+WNGYILAhIgFJ:sxZ9nJH/fcsVWvsjoKHbGWv
TLSH
T17642E941AB34A97BCCDBD20DFA517F53D6F90422A2900E54A9FCDA1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7180d19f5d7e9ad8ea2ee210547ecc28c5e2db01721173a1d7422fac89e6a681
MD5 044a08b6f821bc47df7ccf684b4e1677
SHA1 4de788277c19e06280076bf87f6d7740833aee2c
SHA512 c6fdb3594fd5edd3b516cbee720b2d0ccb9ed73f0da8965132ee3f92b968c0d31813e53ea7a3d306011c5970c03d85d7b4d72ea4bf329c77174b08c84f45d20f
SSDEEP 192:sxZ9RnyM/jK1hl8LyH/fcsxWpViWrVPzkdpVs+fHW6+WN8Hj/YInjgV1IgkJ:sxZ9GPH/fcsxWviWRYnHb4/6no
TLSH
T1AD62D941AA24997BCCDBD20DFA557F63D6F9042392950E449EFCDA1C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bff045d83cb07b1c3d6d516a26900b1ced398ca6d9540aac11d2134d22172377
MD5 0006688be7287c83715ca92d8a9f7d3c
SHA1 88dabd67aa7576911da9c0ad215a809a17134911
SHA512 0dac3dd96cfceb08bab1d83c011876eb4fecb5da4bebafab0f74473de312120ac4546b73869bf71fc0b16ea380868982512652c42c0309ee62a64d287f45c08b
SSDEEP 192:sxZ9RnyM/jK1hl8skH/fcsxWpViWrVpzkdpP7d+OHW6+WNmXCoJZYMJ0fDugkHIv:sxZ9GGH/fcsxWviWRCTLHbnaZRkRIm
TLSH
T15372D941AA34997BCCDBD21CF955BF63D6F9042291914E449EFC9E1C05E7BED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4a9f7bb1ccbf9a0b9dd2f82d50e659c5d00f4729aefbc4fbef5a98d76b2c5256
MD5 74745040a6589c650a56556b79b49dcc
SHA1 2dbeacc06bab209acaefccb492afa580fff7ed24
SHA512 dad901d85161c08e904655f6aea8695e3260a5f5f6ddd32e252ebc46ef0c4c7436b04e9377cfd195ffaf441cdcd945b682263a707ff939abd153b4c1d6a727a3
SSDEEP 192:sxZ9RnyM/jK1Wl8skH/fcsBWpVil+rVfoQmrzkdpPP+7HW6+WNmX4+ZYMJ0DugFU:sxZ93GH/fcsBWvil+RfoDMsHbGZROXm
TLSH
T18472E941AA24597BCCDBD20CF955BF63D6F9152391814E44AEFCDA1C05E7BED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8a883b2c559bcec0b98b943c44618873d25b12001e51323439311d2263ab068b
MD5 b72f988c642b63cb996dde94fe7f2ca1
SHA1 5bfeef7ae42d341494463f7bda267278726c74ab
SHA512 aa8f1ac4b062d38461caa41020b42bd6cabd600996bae6f52d8d4fd42920334e90bc8b20c65b4074385ab315175d40d997e91bbe0d0da261cfb31ee85385c838
SSDEEP 384:sxZ94DH/fcs9WvivPfoDNEHbJN/R62no9:sVIH/fNYivIDaHbv4D
TLSH
T16282D845AA24597BCCEBD21CF955BB63D7F9142291814E44AEFCCE1C15E7BEC220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1f28550c575c431c248dcc84a869819a6a3bffe4fad61c0ffb3119383357920d
MD5 6472ea4af6b38ab46f4bf1287004ddb7
SHA1 06cd2d2dbf0a7ac430e718e747afd4135cb5de9d
SHA512 e33c36d7d4d4881e35d56a50f7ca9ba0ffd7db5ae5e72c45852db0a97b6f0a63528b43c47eaf8a9095c03dd0c152f81f333328eb019e566f62015c073bbb17ab
SSDEEP 384:sxZ91PH/fcs7WvinvPfoD2dHb8VNR0xno9:sV5H/fLYinvIDWHbCSG
TLSH
T19F82E845A924597BCCEBD20CF952BF63D7F8142291814E44AEFC9E1C15E7AED220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 a3dc592bbac4a558f1abef23d9aee1b1cf368a38f03b2166ef5ec707580a4cd8
MD5 93dddb7b825214d76794a8e47e167e0c
SHA1 556ecbd3c94f831a4ba05b6eb2fa8053d178aa52
SHA512 62bc82d9b03679a82bcbc4ba1a4d51a191c89d446df4b8356448cdc0bbc93c602396458a31236bc2feff96c5401e8fa32a339e8a13076dd8c74c75faf61c0467
SSDEEP 384:sxZ9SnH/fcsoWvimPfoD/AHbft1RIwTno9:sVaH/f4YimIDIHb32wg
TLSH
T1CE82E745A934597BCCEBD21CF956BB63D7F8142391814E44AEFC9E1C15E7AEC220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 ccbd7866848eff97590bf85477ca496ab07d29573d6bdc2fbd23f2c9543d6ebe
MD5 e6f6f09948d7813d8e84b9ac3d64b167
SHA1 01f8b55cef5f0f9cfc28202b2ab4aadeafce81a3
SHA512 2a701228198a1edcb04c610928c6759ce3b52322bd3a27ab2e309c6ecd895c09fab8c274cde86e536f80dea8afd631b775db48cb4dc201986051a0ffb86918a0
SSDEEP 384:sxZ9bFOH/fcsnWviuPfoDDPHbR4qfpRvwMno9:sVMH/fXYiuIDzHbRXlwh
TLSH
T11B82F745A934997B8DEBD21CF952BB63D7F8142391814E44AEFC8D1C14E7BEC220382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 06b10b3ce88513d712661b659911d3101e01b8f3c030a2bc9241a0697e9688c8
MD5 fdafed90fe6100b5fcd9669ad7bda18e
SHA1 00cc0ec1a1a3b09a679e88a81556560e7a631453
SHA512 34d137d8ac8c2061e1a81c1d687d324d40e4ec6fba588944ab39daf3e45b4e68750281972535fbd39537338881af4b174f5b58705e85e55920dae6f19611708e
SSDEEP 384:sxZun7bnH/fcsnWviuPfoDBSvHby4qfY/pMVXfwMno9:sg7jH/fXYiuIDsHbyspMhwh
TLSH
T1D5A20A46A974497B8DE7D618F912BB77D6F8142385804E94AEFC9D1C14E7BEC320382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eb4761bfa152e726a30a06b6f96ed85ce3cf0e06e2502bf72da7378a008e55ea
MD5 9f6e7f95be7c53305959770fa663ba3a
SHA1 908a496d6366882b0efb76f39165882cbc09395a
SHA512 6d263b6a620f1e9d1519c7f9610ab5c5a6f1f16847dc023cda233b804835417fdc7f1a9c4c78d654005520433f5d4a9dfe848c0f52b8b57221d2ce1fe6d68668
SSDEEP 192:sxZ9RnyM/jK1hl8LkH/fcsxWpViWrVZzkdpP7d+OHW6+WN8CoJZYMJ0SDRgV1Igm:sxZ9GJH/fcsxWviWRyTLHb7aZRPinm
TLSH
T1FB62E941AA24997BCCDBD20CF955BF63D6F9042392910E449EFCDA1C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eb9fd5e4eee08ff2cedeabb8670d25276c327c69e599dc55078984035f48855b
MD5 8fa50e34bbe49b0ac1b1a06ccc57f06b
SHA1 7d2d0fbe0b143775401607de422dd07e9b5dc070
SHA512 3ea24ddc35263c5c86122222ea1bc6a93d48dbad067ec9389f7d248f337837503d3e2d1b8ff4b0c3ee4ef3b3f292ab3503f1cc8e187f6b0930d3f9b72c991106
SSDEEP 192:sxZ9RnyM/jK1Ml8LkH/fcsVWpVijrEdpyVHW6+WNGYILgWvIgFJ:sxZ9nJH/fcsVWvijoKHbGS8v
TLSH
T18352E841AB34A97BCCDBD20DFA517F53D6F90423A2900E54A9FCDA1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 441fb7a83ac182372041b437edf95d5405869a46bf6891cb56085e45bda6c209
MD5 f4b208b90f09748e5c58cbc191dfc5b5
SHA1 1db9cacb711cad2f53dab51bf5bdfa84edc2f973
SHA512 70cf49ac98eb76cfecffb831853b5913c1a07b0122070283078a151e177e256b277101bfb2e95afb877e88370b2270debe50f2091e1ba747a3513ed6a9a22aa1
SSDEEP 384:sxZ933H/fcsBWvil+PfoDNtHb+/RJVno9:sVnH/fxYil+ID7Hb0bC
TLSH
T12A72D745AA24997BCCDBD21CF951BF63D7F9142291814E44AEFCDA1C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 e649f97c5897dfb1a44056032c2be9ddf04c87c9640e3e6ccb8782a1bb54327d
MD5 a2a2c45db869b92963e4b9b3db8f6afe
SHA1 f1110753b980a2279c984dfef64f4351890df415
SHA512 d1beee21af58b501eb2ef8de7e9aa42d0c90d668847e0dff2e4f03e54871562d29851b7c2aa6d68121dd6643a3d5f2775899a5c180f60b92f41ebfa55be98eeb
SSDEEP 384:sxZun70AH/fcsOWvimPfoDMSWCHbX4qIPUfLDMVMUNVwen7:sg7fH/feYimID3HbXLnMzwk
TLSH
T1F5B20B42A9700A7B8DF7D218F952B777D6F8152385804E94AAFC9D2C14E7BED3202C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1814426839b7cab4b2160c2973884b29f260ca80d5b1132011ecb8f33bf25c9c
MD5 27035bd1aaaa697122f7d1dda6bff535
SHA1 9b007662cd3f9063f25ac824d0abc3dc2d40cd37
SHA512 3451f773d2ed02c3094f285ef2d2559253cf8fe5a91ee3f944d50c89be83732cc7ab95249b11f51ec7736d5533015f0103f3c1854e46595b057bcd3728b1fc00
SSDEEP 768:k94jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dnroh+cEaI:k94jeXmWvmKLEu1jacPLZQd07o
TLSH
T1A4D20A3B280CCB7E4F844E5CED26AE976ED801CB6A584D5447FA894C03C77EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 5746d6f5eeffe73366adefcdf6a5bb678ad56edfb2faf5e1cd5207446a78894d
MD5 bf5af77c8abf3f60b95922f02757ac68
SHA1 81ed2746bf610651d60d820fce299d8d409eef89
SHA512 4756d4a1bbe1362a6ab0a3b38afc641f1e320182b4ae8d4ba9941d924aacb7fc9f6831a10b4f6ddec3e3273e11a31dbc7c76e089217a5b48e086312c93851dd6
TLSH
T18A31A74A8E94ED5FF8540472147374FC7370C9CC4620A3234C6C21357E1635E0A9B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 2KB
SHA256 2699c340a954ff7e92255397773be799198f26e837851e99758f91aab9f3026a
MD5 d3e6fa5d1c2b565febe604db6d1da971
SHA1 0ca7449a2e134c6aa87c4713bdc86be3009aeacb
SHA512 d7d9ad3ba0e372f22a14453e238b4cdeda66075cd1ebc800a7e00e81544debb28b98e0302b239b18b03b338ae1f09b3ae49641d0d3fcf388859602cb291c588e
TLSH
T15041B55E8C81EDAFEC4408B2087778A87270C5CD4611E723886C20317E5635E0A9B29C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 2KB
SHA256 c5dcbf1c2b4a4ac95dee8a8097e818e07f50f7c5ede397a90fe326e832c5d5d3
MD5 604cb777f8002bf57e447cb4736ca354
SHA1 b140aae194e5d162282a3285ba5f1e0cf12e61e6
SHA512 5bd469fd8b5b62bd42bdae59573e20025be3d29d32ff283c56dce969f3a1ccc4c6decd3544b02e56dbe167bdefef1019021e75331cb36fe66bb1fc370ed49d5d
TLSH
T14441A85E8D81AD6FFC4508B7187778B8327084CD8211E223886C60757D6234D199B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eb266.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5eb266.TMP
Size 1KB
SHA256 613baf1b826fdc5c95f9caef1ac1ab0091de0cac7082cd1abbf261a71fc9f0ce
MD5 2a1538124a909997b8d578c743166e66
SHA1 aaff308986a42930ed2044eea0eb03b5da27568f
SHA512 650825b6624e23caaa04705f165dd5fccb7eb4d3cb074452edf6963ee18f3f9a3cb4410d853511170296f41694eaffdb05f8a14fe13498ddd948938aace80979
TLSH
T19031664B8A808D1AF884507709A6B4B8737698408311B783987C6139BD31BAE1F5E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 b775b3acdb1ad375998f4ed32d70a317812f74fa01625df70e16be4bbf690b20
MD5 127908431f6ecdbd653f624f67dc4f22
SHA1 4ac789f67a387132ccf835fb9c4fc3a8fe1b1da8
SHA512 85ab749897a8aaec73bacb42c5e7cd02f8e807d90a19f7a4705fb0b392b2add1e057024d2395d2fb26b6b5489e7f8c57c57ab2c8f26a913029b8669c4a7a5c84
TLSH
T163A002108B91110EC01711F655631741B341C8902184133781D58058CC605448E4904C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 3070c3c452abe83a95879373a241fd7f3d833bec4e9dd3b7bdc237dec58c9953
MD5 d2240e59af31c3815bffac8926e27af7
SHA1 6f0c3d401b8cb99cfb75545467cf356cbd2c1210
SHA512 061a95b8812753c64d01befabf91dcd19592811c9c534399bbe1ed5048e863f61a45bb5ed55f2ff479713f3735134c65641a164073752df9a98d2b522b9501cb
TLSH
T15DA002143BC06057E05A67B12AD601A163104A50A609630642A1036CC860975494715D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bb22aead2f792f3081aed895242e16a66e8a2fb8e506062712437318388b84ff
MD5 8a76af78d827b66b95c6745daa68979a
SHA1 4b075e756da739b7f138f320fd8cdf7a1899aa5c
SHA512 f6d37e452d24774f63347a660f5eabfe914eee2e03a17c5a8e9109df19183c2361fefc2886c4a0055351387a0f38cdb69688055edeba7dddd147f3e13345f71e
TLSH
T108E0D8F62DD72D20AC7F97E628B245A84146B5688555EC8E2416A2E751B03692016C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4d54b608d7430ae88a9913e8826171ec8764cc93977218adf69b23073f3a1b2d
MD5 4b3de893de8f2a2bff3792d372df39d1
SHA1 845f8a9e295509c54b302a1e8127eff621075519
SHA512 086c7becbdf2e46b8a2c80d7fb7ab791ad812b80dcbd8ba74b14164b0dee8bddc639bc37a1821dd143f5221bd18f3c3a5375c0c1eba9d6ef9431f1b7f17791a8
TLSH
T12BE0D8F62DD72D20AC7F87E628B245A44146B4688555ED8E2416A2E751B02682016C71
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 9643ef8bccceff46e018d11fd97c9a517d2be793367b9922baf98beb25fa3b1c
MD5 df66b59d169f305cb252063edb6ae9b7
SHA1 8595e833fda8dfb39116a9e3457206675a83bb1c
SHA512 54725a2419841e870877c94d5f96aa9fb3cad0639e508610654dbb10ec4950be0c04e3458357b5c96377a5a8bee7e4b1b3429e1ba648fa8e9645a9a56565aaca
TLSH
T13FE0269415C8C17DBA99249786ACA30C82E87447DFCCBD076F80D840B947904B1D3590
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 52ec8148011edc8f3220a65adb3a63acab592502687160e266ac628378261038
MD5 4e536be817f50e00ace365e758af941f
SHA1 7413990a5dcd9714341b26138786bc9fc734b96c
SHA512 289f200329c9c86ad3c0fc16829d5765d8717735fea5af3db2e3f481236ed6ecd68af732d5a9cb63777d779dd9978036b89d39828527b3a1dd881020263e13c0
TLSH
T1FFA002ACCF8DC041D8990278126606CD6F189CA81659130659EC0044DDFA54451D5161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 ae54782d49fcb55c379a8f263e4aa5ba9f025455dc56119d779dac641d0c868a
MD5 d81ec08682faef8061336e462ffcc0c0
SHA1 8716649cbc70c86c05b58e2778eee44004bf8bc9
SHA512 c6f54d7fbb4adc1bfdeacc23ef1c3bc4fbca66a104c45181b9668651d3e0d5649f747802bd2f923d604342ee90d8700d3bb5a44b937fcd822e7aaaf0d5fe12cc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3dc57e81dfa2d54433a98e9d853cdedaa8271b497cf0acd4b3318e3157769059
MD5 8abe0b8932bcf3399d93535039a22356
SHA1 fb24bf49a4c2f60c76816a8b7d972f7c21818291
SHA512 46fb265b8c9570728800edbfee697ebf73acdf730a91b9a59e66cbf77529a8e14a5e274bd3a70451f24056e4486973ca04f5bfc7d8984125ab73f95b6995fbd3
TLSH
T110A00229CF5E8051D10007B49065158C7E10DC98460D63268CEC00648C6E1448996234
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f08d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f08d3.TMP
Size 48B
SHA256 4bc2d973b1088b8731ef6f86acfe9548dcef1806f36ae00f1d09668307ad9778
MD5 ba2985e129cbc52561f454557d63cdd6
SHA1 1f0f65ac68e5099247409e1a5ece71a9d4a06fef
SHA512 112d5e7e8495e7aeca58f7c2f49267602b0a78dc8f29151265c852a46b9564a867aaa8dd71a4749c0e19fb68aa300812011a4113f9c4d4a0559c1b8c71e6613b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 10KB
SHA256 6a65ffe487234eb3bcdc72daf05ef1a4ee42faa16cf972af58685a4a30153a68
MD5 6b81585e6b1d591515dccb0ad772329e
SHA1 96bb7c1e5f7207e197d026db4df04c34d1da1d9f
SHA512 c561aaef40b9432750c71aae61c3ab1dfcb8000c1afd2e752ec351366c79a7dc70dcba8b92619cb4b28fe0c8e239c325b031a831631c1967c41c7e97fe04e2b2
SSDEEP 192:SEe3XPmGg51jf03xO/G0PkQxALeToC62Pe0yXkNvGpqrBpXvOQT:ZenPmGgXjf03xO/BcAToCdyXkN1ft
TLSH
T1C72255F739D4A537EDB9C6B1BCF1713EA93639890945888E93A11FCE0113763A85205F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7ab6d55342b1ccb7332bf36f7e553be8b7ba61f849c725ac1a239197c598550f
MD5 4f556ed2009f719e6b9ad3a5f460d4aa
SHA1 66f5baaa06b0fa385fb50cddb825c375361ba407
SHA512 07b71356cebdd52ac12cfcd30cf3779bebecdd082c94c58e63a689f450ac0a15262956def5d92bda5075f423a1097c69bf95edfdd57cd9613b71113e9f5dfc32
TLSH
T154A0022447905421D0486272A0DD22C572144AD04285830584D4804799515568222804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 8809515d183f2cafe17f74d4ec0b980b3b2be6b10944b1b0e471a2b7d7c61212
MD5 d3b4a3ca763e1080e3a6cca3290311f1
SHA1 9353a544b066f1e50f3f1325aa5d237b6a635852
SHA512 e9efc2f4dbaa7bcef7bb20c36a39b1aa0b406c7706afedc7698f44bafaa4d6da6f61e67ed31626f4de910b2ee45b42a0909313a0ba8eae62130ad426a15ff679
TLSH
T17CB0025C72E02C65DF8413B351DDEDD2B7227ED4A9C6DD16A6ECC0578856AB182D2440
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 112d6b3e51f8e2f62b48a05667f393395ed4616b32dce73984ebf26eec39b114
MD5 56deb15310ef1ed5c139eec30abab130
SHA1 6eb9d954ec79166243292331136f31d3db7c3747
SHA512 c987094d2cf086423f39a6a2839f87e39e70bd0a36f1fb9df3a5fa8d3dd2765d6b6b40805bc60df5d147c5e5801f9291058432bd8017fe25a3552cbceda737de
TLSH
T11AE0D86425C9C62EB6C924DBD26CF30C81E27442DFCDA9266B08A440B60B5407283550
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 34c10dfc7e7c7aafbd3f9a01b172fcf5bf66a28dea6877afbf7bca1501e46cac
MD5 0faa089fdec4f473e6962d6d9bd71353
SHA1 9a5873dc473472abba3d0008bb75196a2ddbe53b
SHA512 e4841d6d043948fb6b972b58c2ab432deca33f0443bd63e34943b43e40d2dd6f40403c2aca86340bd6f073ff71736a04f9d50086661014c7ef1d714c3f364e6d
TLSH
T1B9E026B066CAC73D594864E782B8B74C82F07C0A9FC93A0B97095440F602508B3A79D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 106693bfe6ee348cd137f15ad27c5ea5fe3899442dae1f31c15c44349a27e2de
MD5 28231f4d09d76c609eef53c8705c5b93
SHA1 bd7dd0621df1aea2b50f1ed7c5a62bec8c0aa720
SHA512 45f1046749fbb84b7cfa455545856f797a63876f48d229e8a9a43fba51641efe6f1c89b994089ea445aa167d9ffd4728524ac9ed89fab909fc0377b7c3d3a763
SSDEEP 48:K8mIfKji0vyWmTKGQ44+GItlInm+KYLA0+suu1Fk5GIHKfKYvyM:K8mQKjiWe9eKmwNGMKfKy/
TLSH
T1CB91920574BB52412C3E2E4D8694866A6A82B663352CB42F7FEC44B35E66F108DFDCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\3e1b1d84-5628-417c-af3b-a7e1b8c7b220\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 fe8c9c26feeaf16dd47f23e5acf9d9420c9c1eb4a12b444e5d1473d5ce5cff13
MD5 f875747d2ac9909a497b265c9b074768
SHA1 9370f8b65cf51d832d4ff534daf9e9fac48c30d0
SHA512 f17845214bc841612ac4e9cdab9257538806b98e79da499d4f8cca63aec147cd8c2f0f37140f11c0cec22d669847b31706b4919a0dd2bab8e9c0112a0da38218
TLSH
T10CD0A7EB4530491A66B09E942434322D961A4E05CCC4CCD4CD04759334B890B8103EB4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 4016f18c9891dea9776b3be1cd6f3e0b084dedb9ee734781dc3a38c5d83b6e35
MD5 bbf2f1581f469fb2bd51a519403f6c0e
SHA1 934fce4f68043cc136477dd44ca99a6973f8c5cc
SHA512 5a885cdb312de8564316a4ab28b4d66ed3164e9fbbcdd7ee426bcb2b96b817814a4df80637185260afa3f2c8d2483da820f171da735ec13c9d84dca24e6f86c1
TLSH
T121D0A7E711744A9722B0ADD46024336E811A4E05DCD8ECE8C844BA5331B49028407EB8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 23b0cf79b4b051c756e225d43c111cb371077464248594f9c1f21259475f1e40
MD5 ff73d359d05db1d0ca3bacb72c10fe9c
SHA1 1d3a22f139e3602f8b003200b2bf6d49eff44836
SHA512 83e83036d686034d5ee03f38916b0843b5650b1d1ed57ddd89ade3c06e243542c0f7689cb73c17e29a5f3559ea95e403724ac65789d525bd9828857e628e0af4
TLSH
T1C3D0A7EF11708A5623B099C55028323DD11E8E09CCC4DCD48844758735B56028003FB4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 f88249af98a51d95a2e87a66aab53b78a81d032e7008afc5976563de6b55d655
MD5 1c20a0044b3d30159ae5a1353ce0babd
SHA1 6cf403331f47a45d5cd512cb4214251b2ae192ae
SHA512 9fad7f49d3fb7bbfdc9d7cfe42371b208ae635ae6b73d66e231bdcfa0d48b1f41662c2013b73e9e0400930228caee485dfb81f48e274bf9adb1c812dfa98f33d
TLSH
T1C4D0A7EB01744B5713B0DA915024323DD01A5D088DD4CCD4DD44B59335B8B068007D74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 75dc5c80ff0ab4d961df43d69e25a994e2c4e803d6dc8229e5d36d0b964bbb92
MD5 33cdb3eca2e94a9ec88bf2052d10a371
SHA1 cff4f595b90f824039e31e5d6f1dd0ec6edb06fb
SHA512 21dc057b30f65045fdc0f4a60dc6c4e11c5995ec9778f7e2ded9295e23c2c0599a5dfa9088608c127a2d0b96da03fe9fc642f1f9dcdf093d02f7e1364df0dd06
TLSH
T1BBD0A7E746744A572A749EA55024322DC01A5D18CDE8DCD49D04768334B4613C003E74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 596b44ac29239374a4dffb9e223efde41ca62adfbe4609b1b893a6dad59e13b7
MD5 d6b1c96d7d0e19827664f173a65f6f04
SHA1 fd38ae8b2b9a84164a07efcb75bff673b0651c69
SHA512 b6210809317e520696f8e1196226037e67efef07e04a0756f76b45b9067a795da88389500553bd263fe7c86279f6e976bb7cd6da849a572bc68ac36ba4a4b067
TLSH
T173D0A7FB03704A1B57B49A862138322D811E9E05DDD4DCD4884875E334F85028003E74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 152B
SHA256 998e326f0f5aa18be86245281eeea091ad596392c0fe15283e7a3820d079d324
MD5 ba3f04183518708b1ea180162707af3a
SHA1 53ef674f67a9a1d5b723868832a79d225ef8048a
SHA512 7b90f8e235bbb1336dd09c11ef38ebb2c1a1cb9c9fa7ed203e3f717960a4bfbc2aea186960ef4620a3c9767dafb58d50009cc2f7cce1a7aa13ff6aee90097a41
TLSH
T15DC08CE70410465B06B09AC42020333DD10F86088CD4CCE4D408484331749120003E74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 440d1dc0bb8b27a6bd223d72f4a626437c8d6b7a448bb775375a71d51d236bcf
MD5 3d0c2242dd8ec7a0eeffeeab95970761
SHA1 69ab887f0cb722a485c22eeb3ed1eb5a1ba4f91f
SHA512 b102ae2753449ccd625878be35c44d7d4d233152e68bf55f30a74c490678d750ee5324ed2310758e7463567e509489395734b15a681775a098e5ef4e36bc7ab8
TLSH
T19DD097DB1A300A6752B0DAC01020313DC02F4C088DC0CCD0DC00788335B46138003DB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 2c6540ab6c737a5cae1d2a3006aaeca3558156d860645b08ca13371b926caa63
MD5 78e47e3bab1e75b61a5b95a398cb6953
SHA1 227c6668e30ff814f03728f103402449dfcc7848
SHA512 568cd734068c57552113a006a0c6eef0ae3d6e065ecff560e4d1ce9b89c9230b356d278a01b0253e15d3ee556465b950c5a9334aaf50dbe745e7a8f52d6ac79a
TLSH
T153D0A7DB81706AD757B0EED13020312E901A4E088DD5ECE4C844F65730B45128103E74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ccc6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5ccc6f.TMP
Size 159B
SHA256 18754eb24aceff056836ecac3288dd2d0f2d8cd6316412c9c41ae52f31a47dc0
MD5 fb0fead208830fbf1dd931ee5b0a7da3
SHA1 bf9fcc233dad9a27c8334f7083c15cd3c73a9565
SHA512 95b684b5089f4ba271864b73d93644a021fd843cbd0152123a7f322ca3252773824e5f0f9191636554eb07ff01f59efde1600864b5144e4b91bf29005014ef78
TLSH
T1A2C08CE70420465707B09AC52020333DD12F8D088CC4CCE4D408B84330748134003E74
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000003.log
Size 119KB
SHA256 6e8dfc7e6ed392d54691b95c5f7591a6a3a3deaf0e1d7f288c563d5078228bd0
MD5 26263aaab397c8599dc701dab0ca0a74
SHA1 8fb66de09688dd2a798b74692dc266fdbc412cd9
SHA512 cd4cd2c3695ae01163012255bce9d0ac2e6111603ba9681ab3ce0c9f36b9d5580d23ee32321fb58cf6a8ad543124523966270ffcfea8d2fd18af20a4f24a4cde
SSDEEP 3072:7+fS6YSvRIWhq+LES9SiUpSdbSWHkK8QF6kh3ek8kP+mWkovkU+XZI+z+Cp+Sdpc:2SFSZIWhqlS9SiEStSOkEgkQk8kP+ZkQ
TLSH
T152C30924612264F4F936033767959F4ACB318ED69B456022FCB26A1C3AF7B443D972BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 3aa4d8ce282261ec843f8575f13d3a611417aad6f1a032c206446bdd97cc4aac
MD5 dc204af138228dfda3ad49803884296e
SHA1 cbae2d42ea603b48ab1d76f40c2ebceb9524e4c4
SHA512 a59688949f022f82c5c779eed6d72af96f6218f79492ecad58a702dac73b70dee37765709b7213a3d300ef8bf9a5f262c0a173a72c77f21b6e0826cb81c71ee8
TLSH
T1EEE02610BCC8C2AFAA5A248F51AD6708C2C03803FFDA2D0B1F02C884B4015C1F2E7591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 610B
SHA256 def3eb5f947060e0bd7b945a29645a70ff8ca81c023fcfb2956641a25fc5f027
MD5 141eaa8cff9e5b6b665b1d172d3c493f
SHA1 16cca079e2a6a6f6b6286b8abaf63e4a94860b99
SHA512 08064d985ccb77ef9eab25ee8f62f848a653b97869e3a847570601281090c2781e65f52378dff87f53c43ebf6c478732c18b9f0210b45ddbdd694912b3bde4a9
TLSH
T108F01211F324D014E04A927A54279B262328D8569BBCDD0F593934611E76A580E8BBE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 1a45e6311c3c633b2850f7aa1cf78d1023d47f90d590f6594e7714d63c8c7465
MD5 dc08e1cac7ee7effa001833847c1a7de
SHA1 d40a6edcbe41aa4ade9aa86eb65cbe38696ff486
SHA512 6e3249058425be7443e52e2ee8abaa5123cbd6543cbfe44b1b198cfe9336767fc69ed63430c4ea09d67756ce8d9848ff277a5de8d7b5e9fb68ce63619e18ce59
TLSH
T1DDE0D81078C8C29F5656248B41ADA74882D13802FFE42E071F098C846501582B2B7651
MD5 SHA1 SHA512 TLSH

Submit Download

b5f3b443-7056-415e-80f4-330c438322a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b5f3b443-7056-415e-80f4-330c438322a4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 9c196da97a27d1e616cce604efdf8e132d1f91990cde5df1dd8735ae3d8bd509
MD5 d35fd12006aca5dc7c19cf16fe85293a
SHA1 cd18252d7d33a2fdfcb494d132572a3bec059372
SHA512 5b940a1bccb6a9b93adc1ded43b5a34ec33a55d5fa711c6363b65896477be965e2d150a88facb9e956ea0e19841c86d66196b45fd59348e3bc3a9299c0040d62
SSDEEP 384:nAZcIxsNUF74ApVAf+g8GYZX4+2fdze8ZF7Izu:+xRxoU4lhe8F
TLSH
T10D826C705C28EC7798E7F649F49A26239EF85037A9C45F58E6FC5F1D00866A8270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 92371e07a2c923496e7de2f3b118b284e3f95452c51575a930af6d3cc7a20910
MD5 424b704130340a9e701db1ad8cea2ea4
SHA1 dfdfa1c6d212ab91cf04ec502765adb04e1b0ffc
SHA512 ca199925caec2040ef362a3a93957e9b52d6fa5b2765fa35a9aaabc4f2d9df5aa1f91475f8e98c01fc0757cd35551d50c15c97afa2e6dd49ea0da64e68d4bcef
SSDEEP 384:nJZcIgsNUC74ApvAf+g8GYZX4+2fVze8ZF7Izu:Bgo3oU4l5e8F
TLSH
T1B3826C705C28EC3799F7F649F49626239EF81027AAC45F58E6FC9F1D04866A8170AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 81ab9b04aebe0096459e56985677de812ceb6c8732cad2e985ab64ba57d78ef2
MD5 1db5445d6bc98d9bfc0ad53f9997112c
SHA1 4ace53bcfc6b90f6793ac8a654dd524972019fcf
SHA512 bbc5d254ca72d93912c3f7bbe7ebf78a9474ad52cc9414d05975d5722b3a201c248f679069e8b0d6ceb0af11004423367b56a6483cfdbcaedc25a807646be081
SSDEEP 384:nEiFxZcIS2sN/8TUNTUlIUu74Ap2ArDf0x+g8GYZX4+2fCze8ZF7Izu:fFZruwgPunxU4lKe8F
TLSH
T1DAD270F198D78936E8AE5787A33E2D529EFCC05375885984B7D85E0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6fb6b6700203ea74713feaf60f847ce60f5dfd42b9c1f1dea3c6569af6ad7d71
MD5 40a8ef070e91577df64666d0253de71f
SHA1 9ab28324268d6161491dbb27096e9731bd157b2c
SHA512 63fc68935d145e54b432a7ff96fa721a3a22d280ed885b50d07f310c7d34cb51f040c8d471256601de5380c979c1f33f702fefb2e22199e0e72cbd189ef89308
SSDEEP 384:nEiFAZcISEsNY8TUNTUlIUu74Ajfx2rDfVx+g8GYZX4+2fHze8ZF7Izu:fF+tHwgPlxIxU4lbe8F
TLSH
T1AED26FF198D78936E8AE5787A37E2D529EFCC05375885994B7D85E0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e01f8a21fab6b99af184b53b69196ccb30c01db94bbaf3fea5de378afba95e08
MD5 8b40d70477422b3c79858144b9ea30f5
SHA1 0a8327495bdcf469af952127e56e800137f48d97
SHA512 d72b65eca635db18f044e6f5282fe1673cb8f41547e180fff22a79e978042327833fad331a8b9e2872ffa6f5476af4752e10b16c8296211f764ea053ffc2d92f
SSDEEP 384:nEiFPZcISxsN+8TUNTUlIUS74AOIsrUfVx+g8GYZX4+2fiCvsASci/8C9mkBp8ZL:fFHMdwgX/TxU4lrjSyC9Jp8F
TLSH
T10FF26FF184D38DB6D8AE97C7633DAD0259BCC123B5885598B7E8692DEC4B4BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e7d4396e8c3c2015e3ae4f179926661b24f89ac279918b495e733385bbd9074b
MD5 586a655448db7206472d51099e770008
SHA1 21ffa1195a2cf940bb1860551bc591ec18b09c58
SHA512 b7ab3e10eb6545fbaed46fa04cb20be65ff943ada4b23132feae9a6013fbba2b4d2fc5c3cd4ab6c9f90184caff705ef7f62fdc3b5325de3bcd7630c1c09db771
SSDEEP 384:nEiF+ZcISQsNp8TUNTUlIUS74Al6srUfVx+g8GYZX4+2fAp71A82No/QdxKeclM7:fF8dewgXyTxU4lyG8p/QjKecqcT8F
TLSH
T17EF26FF088D78DB6D8AE9BC7973DAD1259BCC123B5884548B7E8292DEC4B5BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b05b555e5d12686c4cb128c5ff3d3fb2a5907bb2b876a6cd28f57255a2f959a6
MD5 9866e71611031eb1a8c391b13c5f5fba
SHA1 16a2ede388d8ea464c59d397782efe6744ebdd5a
SHA512 b2fce79cac29841bcaeeb864370cd46a3e75baa52a541c761e49e44253185e4000d8662a8bc97a826472250b62c4a346b5f93a565cf78af6659b30228752ba99
SSDEEP 384:nNiFPZcISjsNa8TUNTUlIUoT64ANoorUfVx+g8GYZX4+2f1VT8ZF7Izu:EFH2NwgYM/xU4ljT8F
TLSH
T1ADD281F198D79936E8AE5787A37D2D528DFCC053B5885994B7D85E0CCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 290a68768f75bd61743915f41fc123edf2756a46395d7b52d3a36cfea2b74366
MD5 201d1042c32573316eb2f352d68e3bd3
SHA1 6593fa202ac739fbc8ed292f84adbc96851bcefc
SHA512 6534ecd62e617669ab355160b25c36d94bcd62a77eeeb72e1708ec459b581f5c123734079b516c057cb0ee936767b846ca287846abd46457fbf21205197d20af
SSDEEP 384:nNiFvZcISGsN/8TUNTUlIUYT64AxkorUfVx+g8GYZX4+2fjSf8ZF7Izu:EFnzQwgkY/xU4l2f8F
TLSH
T17FD280F198D79936E8AE9787A37D2E528DFCC053B5885994F7985E0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 05e06def40d00984f006d4d0689c666f1150c4261d46b901c79e25187f7b3268
MD5 f9a0b53d2abda729fe004f7d8f8acab4
SHA1 2c5741d007b40942cb3208d5e6c7c7c54a640a55
SHA512 b74d24e94ac3e1329211f0a801950a20996245dfa7fdaa0a50243662035e3945e48173d998a065db28281f327d199cccf9de512fdd144fb599360314ced27871
SSDEEP 384:nwiFvZcISGsN/8TUNTUlIUYT64AxkorUfVx+g8GYZX4+2fDSf8ZF7Izu:LFnzQwgkY/xU4lGf8F
TLSH
T1DED280F198D79936E8AE9787A37D6E528DFCC053B5885994B7985E0CCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 357c92dce44a1c2f49a6d8fc3095e6f51c05b45b2033a60e38d4de2c0775d0f0
MD5 a95911e0e2e89fe2e531cddc81f7f623
SHA1 2657ef9a2ec555fb1bbe4ace576bc1615fdc307b
SHA512 91d94aad14e72ff0842f065c15411389d72e6976515166009356c701f12e29fb1242e2c6f377528dce505c72169a35468b2e8459890481cf74ed41241a107510
SSDEEP 384:nwiFPZcISGsN/8TUNTUlIUYT64AAxorUfVx+g8GYZX4+2fESf8ZF7Izu:LFHzQwgkq/xU4lnf8F
TLSH
T17CD280F198D79936E8AE9787A37D6D528DFCC053B5885994B7D85E0CCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 544cfe19eb32066756aefd093a83121f4516ed7939f09dff37b49972a6eaac51
MD5 c0db1782db1296740ea142c7109efde6
SHA1 b5683c4239aa49bee3a951148c574ef3ff0103e1
SHA512 8f78e9f07f17c6b3b5a36ad0bae4444844c4bb5d7a82276650d78930728408a2e8e8f0ada094e4465c9254a8e5eea982fdcbfd05b4cda9d21d6f02ab5e3ca1ec
SSDEEP 384:zmsNlO74ApThf+g8GYZX4+2fm6e8ZF7Izk:yBvJU4lze8R
TLSH
T189423B746828EC7398E7F649F05B26639EF811679DC46F54EAE81F1D00866EC270B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7dd5082354ced6c1cc15c2bf6706559665a4efe8abf660ec2671c070eef4970e
MD5 206ae8f4da6cb80baae25b88c506dcac
SHA1 ac866ae959828cf239c02b124912f531883e060d
SHA512 0b8950daacce7aa1d2e3465fa43e80d79af02fb7126ba39a287b7105e1f94a151c4e95e3e3765445c3bc9fb53fc4ca3c7c614d0e72934b30d541e5ba4c2eef78
SSDEEP 384:OsNIO74ApNhf+g8GYZX4+2fjd98ZF7Izk:Og5JU4lB98R
TLSH
T18A422B756C28EC779DE3B649F01B26239EF441179AC96F94DAEC2F1D00DA6EC134A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 49fe1b5e2b8d49d6245bfbea8ef68f1bb6d2f62c34618deca502305c098ef997
MD5 1d238b6adddfa14f46f9b516d7a39982
SHA1 269eb0b36c78be792bb8808a02664f3907913d93
SHA512 35d4ce5089f0d7d7f293d9af047c54e19e0842eea31a6845b719a3e13d18cbeeadd6db86ee024dccbd27f962661fa96d48e5f20b7a38c9e3fe06cf6539eba13a
SSDEEP 384:nEiFPZcISEsNY8TUNTUlIUu74A0IsrUfVx+g8GYZX4+2fQze8ZF7Izu:fFHtHwgPrTxU4lYe8F
TLSH
T1F5D27FF198D78936E8AE5787A37E2D529EFCC05375885994B7D85E0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 78fb6332678942b0a131c224b3beaa2f3ea1c4ed6951b54a2481132568433911
MD5 7ca4b9e107e203c1998d26b6ca568eca
SHA1 9ba35aa447c794bb4aebdde50ce149ba2de16c56
SHA512 afafff3410d43e6f9f5d3b5a07bb56c266af8a3fda0461f5d0ba557da89702a8402da99170ba11c48af7591d1722ce4475d4851bfdc07cccaef63b0eb8a6e330
SSDEEP 384:nEiFZZcIS+sNd8TUNTUlIUS74AycsrUfVx+g8GYZX4+2fA4JtnASsNk/QdxKecln:fFxDuwgXzTxU4lTJCS7/QjKecqF8F
TLSH
T1DAF270F088D78DB6D8AE9BC7973DAD1259BCC123B5884548B7E8292DEC4B1BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b40d4968165f164ad215e1ef3b6432f3c0502ba8ceeff34923d81fbe917e79e3
MD5 9e6e0a19b49ebd9897975589445bba43
SHA1 683bb208c3f3165b0493387b441bf33ce71aa3cf
SHA512 f74a97f87c6b4a25f6faf22b24f1266755c036f01f1ddf16508b6c4656129d189053777507bf7106a0334539ba363b90630c4da96f2a9f82e8dc442841ba5384
SSDEEP 384:nEiFyZcISIsNJ8TUNTUlIUS74AomsrUfVx+g8GYZX4+2f/0HBASqNk/QdxKeclMF:fFApqwgXvTxU4l0eS5/QjKecqq8F
TLSH
T14EF270F088D78DB6D8AE9BC7673DAD1259BCC123B5884548B7E8292DEC4B5BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1176a90425d51fb19ea05c941c2b052a4ae97fb543bcde807030ab1f4f6f1867
MD5 2404ed5f097be41437daa4e51482a6df
SHA1 9efa5bc4fd507d5b2104dad2a0d3ea4fd7d89a4b
SHA512 2abfd65603f1132b5b31f3d89cc09f3420bf93228f293f29baad0f031a1945773859bdf59ad7fd1059aa67ee49f0ee5a39c361501597ae1a38e4e25ebe1931e1
SSDEEP 384:nNiFyZcIS6sNa8TUNTUlIUoT64Aa/MrUfVx+g8GYZX4+2fCVT8ZF7Izu:EFAjNwgYKzxU4leT8F
TLSH
T141D280F198D79936E8AE5787A37D2E528DFCC053B5885994B7D85E0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2a5fbe15ac59371def9b868868efc92297461734afb1d45dd73a236c967b1cb7
MD5 850843d4aced4245c903f71a432ef03a
SHA1 02822f7b699854b0163c95af994214f28214df19
SHA512 1e06f7c0475ad63d8750a7274f7ba8a19622496ed8953e8fd06761804e7dddcb3df47b369ae5adab7206e63afe1447b8927b3e0ba2004e2ef882fa2bb10a282c
SSDEEP 384:nNiFZZcISVsNa8TUNTUlIUoT64AYjorUfVx+g8GYZX4+2f1V/SASA8/ShkC9mkBK:EFxgNwgYi/xU4ljdSZC9Jv8F
TLSH
T1F2F25EF188D68DB6D8AE97C7533DAD0259BCC123B5884598B7F8692CEC4B4BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4eb6cb8a9f7e2b84ddff316485f24db4e324630513c0f80e37af8c36b01c3f76
MD5 b932fc0afa14488c3b25754702398b91
SHA1 5c36070e24e298a0ff15ee9f5c3b462ea3eea179
SHA512 b6d8f0f9e0bb010a5802a3a7242ee1c30e32cc1c96f280fb4f495c543b5c8f742386e2a46c1c6cee3ee287adf4fc5d2d370f5a2685ee45383a1a422477b168fb
SSDEEP 192:EONl6hZ0QmiUyiTpc/+jVWjzorGYW5wOZtlnU6:EONl6oppu+g8GYV2znU6
TLSH
T18F02DB35AC786C779EF2AE45F48727235FE4112BAD952F84DAE81F1C00C765C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 971f98b8c7f132e3fb6cfc81dec4d2aa7c15196a225adc9f9e3340c7af7749f4
MD5 4bee217b02e63bb28e69f8f72667cf59
SHA1 3c3b29d73baaedd764b89a02ddba7378f922da5f
SHA512 2dc6572472009141b67e3e5857aa043eaf41d219fdf5d759579e6f87bb425e7a4bc838343eb02c35023709b22bfd36da468c2c85046cff4f82d8b99e6c546acc
SSDEEP 384:nLZcIxsNUK74ApVAf+g8GYZX4+2fdze8ZF7Izu:Tx4xoU4lhe8F
TLSH
T161826C705C28EC7798E7F649F49A26239EF81037A9C45F58E5FC5F1D00866A8270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 515b43ed41abfd0949d3d74d5981aec37d0e9f8ba853cf0985d6c32f9f5a7ef1
MD5 7de28c429e5c8769f2cab7e9f92dc7b0
SHA1 e8b8baf77ad48661fc67ce979f67c06dc83480a1
SHA512 d9aa6a51e3dd4a670833e691e613bbdcbda2713efe938b155e42bcbf0959d2092dc5a9f8145a73cab6149bb45d934c509e3f59dddfed4c47f19a9ef90122baae
SSDEEP 384:nEiFcZcISl3sNk8TUNTUlIUu74A0ysrUfVx+g8GYZX4+2fQz2sASv/8C9mkBVH8F:fFKG33wgP/TxU4lY4ScC9Jx8F
TLSH
T12BF25FF084D78DB6D4AE9BC7633DAD0259BCC123B5884598B7E8692DEC4B5BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 42450964047a167822660ecd0922449cee330e8f578dd4d317847d3403ce2c5b
MD5 2ed0d580a7a3c784c4f4bc7437bed17b
SHA1 e6667f859d4d029e994fadda2e4f5358263624f1
SHA512 5e71fd9bb30244d66e544ac6ec9e0ac8ab7f86eae3eef73b93ffe07db2466a4cb57b1f482fef41706733e5c122f976ec58e7ee67df93f89f48e20d45a0af13c2
SSDEEP 384:OsN1O74Ap4hf+g8GYZX4+2fUcbpHA8tvY1ozQn96MS87:O1MJU4lXba8RzQn9hS87
TLSH
T1D68219B0D8689CE744E2E6C9A546E1231DF801378D899E1CE6F87B3A309F5FC2756813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 81afde52ebf57ad3b6dfeb17c3a9b05aa2d9b0814c18986c5b56116d65ee7676
MD5 24a1714dfdeaa248e4c88dc07cd50d94
SHA1 94a2e90f9600f5cb1c7170b9b97e8d13f3d75051
SHA512 878aabe5584ba0cce4b462aa6d93d5000f8ce2ca17066160ecbb5613f7fa657d0a69aecf9766749e2ed778bc07cfffd653bf56cc19b1df3721484cdd9fe51520
SSDEEP 384:nNiFCZcISzjsN/8TUNTUlIUoT64AG/orUfVx+g8GYZX4+2f1Sf8ZF7Izu:EFwkjQwgYy/xU4lEf8F
TLSH
T123D280F198D79936E8AE5787A33D2E529DFCC05375885994F7985E0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 acf98a7a7e42d4d4f1f05787546098780daf54011bff28fe40853ae91e2614cc
MD5 de643530c0ff2e640f5ef90d1dd5f78d
SHA1 24232280f008f96a05c150a4b9b0b3875d770e6d
SHA512 15138f225a162dd128c147b69ba9c45d22b403a7ed5192ae38a37fc3aa213a388997c5c7f896f6452569db1c262f4783b124c70904a70537672986694df39186
SSDEEP 192:7ON46hZ5QmiUyqTgc/+jVWjzorGYZX4+2fQ5cOqjqEU6:7ON46j1gu+g8GYZX4+2fr9nU6
TLSH
T1ED12F936A968AC375DE2A655F08732235EE5511BEEC57B94D6EC1F1C00DF6AC130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 4fa9837e69d0ff8ce5e131df520f369df46253183a3ae04934344cd926ab9067
MD5 e172ae010694e40033cba41f3ac5891d
SHA1 8085a575de08f7f70af8f41a8d22324b4e978bd9
SHA512 d9f3e867af7ab52948d3a5c144a8118a46080b5adb2a767c54b392b5a6228dc27c9a9830f36c296097a4088c0e71c4530ae063ed71e53a0d641b3d4a36f01475
SSDEEP 384:OsN1O74Apvhf+g8GYZX4+2fUcbpHA8tvY1ozQn96MS87:O1jJU4lXba8RzQn9hS87
TLSH
T1E88208B0D8689CE744E2E6C9A546E1231DF8013789899E1CE6F87F3A309F5F82756813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 386ef1489d035b7f6e4100632ec9f210e9d86a3d25274942419c82eb5b826512
MD5 676fd315838dcafdbec58c77dcc4f132
SHA1 2f9e6d71fe856ad8e9c4840483fa0d1df0dc5539
SHA512 6fed1f189f4665cdcc88f2cd0fd10cdc9c5e4bf151111135b5f6e9ef8bad5d47f6f68550a1a7a1eb4401f8c4124e0c877133dcb114aabfc2a55518654784d023
SSDEEP 384:zmsNIO74Apuhf+g8GYZX4+2fjdF8ZF7Izk:ygiJU4lBF8R
TLSH
T137422B356868AC779DE3B649F01B26235EF841179AC86F94DAEC2F1D00DA6EC134A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d564f305d35f8bf016cf1a7f4ed0389142ed1bb069aff399599e6970f60977c1
MD5 56c5c78a1ff2c8c242d0337f3b52cf41
SHA1 2e8345157ce6cc6ac6564b2cf6cebf55b1857a3a
SHA512 1f51eb6e03bddb42b8b4510702bd43f014f3094cdc8873a9d72b6280526cf64449bbd1e75f46ca5a302fa00c9ce008e95cfd5e2e61dbbd40f7b7eedce3a07b4c
SSDEEP 384:nNiFuZcISssN/8TUNTUlIUYT64Aq/orUfVx+g8GYZX4+2fySf8ZF7Izu:EFMhQwgku/xU4lxf8F
TLSH
T1F7D280F198D79936E8AE9787A37D2E528DFCC053B5885994B7D85E0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f7242b6d9cab49e9aa30f90edb7c080f9edf118706930894e9bf532a0cd80afb
MD5 d7f606bec53b9f5fc71489dd109c0310
SHA1 83022cbe900a3a339a584442c9c304ded03abc80
SHA512 6418f8f40c4f3adc9a7ba7b8cdec2ad79a0343ca4041b19d006a8f03a05e03ca9b962d024c233d3257b0d171ffbd3731f9e0441cb5eaf49c49dbb14edfe359cb
TLSH
T1D8E0EA13E34580BAC029033600EB1B363BE2D06456B6432B1E265A682DA27253F30B85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0a15fac80bf83587c486336caf6944080f7157eba1d31e3f81cc2c0f7d61bf02
MD5 f2a3757f9ca420bf539c25539e45e7ab
SHA1 ab798f4b36a5317f2cbd71df6aaac1a2f357d551
SHA512 e27466ef53e96cb06e5a3cc5190e3b86a541fde4b845e6845f3a0b86705065b79a464c9dd8a4c7094669899cd63375bcb41e4684ef9b9ce2a28be192851cf108
TLSH
T18DE00202630440A3C159133000D717183BB2D02003A31307461021744C71B002E20905
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6ed6542e991c95e2447ed2418ec7013de3bb60c4d8d9993bcd293077659aee05
MD5 b2b767d76ef860a738f63f9265222aeb
SHA1 d86cd44648a1c5efb12d4df874c639768e193b6b
SHA512 4f9db76a6add8822f52b6a6c4bc90158c81e528bf757495bf1ea200e7433607e03fc4fd99d7674ebad6a8c18856ababbceb63428bc45d601d718b594c5eaa8f2
TLSH
T10FE00203630440F3C15D233400DB17183BB3D03003E313474E1031744C71B012E30D05
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7aba13f815c8bd004facd39d5ea898b4e2173f9af675f9c0628b846ef81ad642
MD5 224904f2670c3798aa46502bfdf5f346
SHA1 82d128ea79078dc6154f696253c93b57083f6c2d
SHA512 1d77078eb53270e66a97790bfd3786e888dc7d944c3920e33044269b24a6d8bd4fa6d557487dc142d260b2086d5b790147dbeec9307cc9a9defdae454ccfdcd3
TLSH
T1F7E00103A30440EBC16D233400DB2B283FB3D03003A313574E2026786D71B013E20D45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e5e0640885dc5ab880100b34a95c1f36f63ae72a57132cbe8bec9a5ceca4a4ff
MD5 0c9dce5aca8b6eb953e8d22c1d7ce09b
SHA1 9a1b961d749c304e5c124bb83dfb9597b25333e2
SHA512 e46fe3b0b90a5432886b1c0ea6b9b58155f03c2b4c5dde033a54c512c1a446d123ff81167d6f691c45ef303ae6fa74045fee974638d252dbeef6a54754bea8ad
TLSH
T1C5E00802931440ABC16D533550D71B643FE2D17043B2135B4E2055686D737463F60B45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54419c61f2282e084dcab6c06c90d7d59631ba89623c8993d6cc1b7851263d35
MD5 546d7361e6abc6642481745bbb89eddf
SHA1 0e3ba811bc4acc523ddedfe96fde33de012c07cb
SHA512 2e70f53ad026b45518fcc9912b415f8253a5210a24498fb4d06bffcc077652b3033d14eac1575b65b374db95771dfce17f2499176dd10912a1de12a71e44f2b2
TLSH
T12BE00112D31440AAC169533544D71B752AE2917442B2535B4A2055686D637463F60A45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5a8688a0e7ebdfc993bc35b240382bc17bdf85ee52b3b2a8327a041aaa073a6d
MD5 2922b57307460fc4344112fcc5c6c62a
SHA1 74a5d19781523e084cb138555f56123d11388a72
SHA512 0b41b8b1eda621c24aed91e78180ed2b5626b42880ca053480b600b0021a68927e6ea459be4fcca5f1af1123e32aa83b463065916f6d6798fd59ff68a662e672
TLSH
T1C8E00103E34440BAC12E033600EB1B363BE3D0B816B6836B5E2569583DA275A3F30B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4d217fe0bc94e19c5f745657424650e2dd880b210f56776c900c282b16e9b366
MD5 7f3afd911bba98b396d6b778152ff7d1
SHA1 955aec407079f0f2bcd97cc7b9e7310f29ea6811
SHA512 29f95f83132d423faf6104ba2ea7a8754bc09ba590f4c3756c02e1553a3a66af4e6245848c87671aa523575a979bf5a23e056e622218493cf3d35a7a043b7e4a
TLSH
T163E00213E34480BAC12D033600EB1B353BE2D07446B6837B5E2559583DB37653F30B85
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d4c74ad5bbbef3e2475946a699df5feba297306f0040bde48874238a1deda645
MD5 72adb946d1cb1c4b5288075471a5e778
SHA1 7dd399d5d7eea07362292d85866ae57f60446a4b
SHA512 02b8b673ae16fa3cc8628f0e7c4e392fcc902ed32f89f27f6ec37ffb5e4ec8f76eecc648e4a4a72910fff768c2c86b668d5748bcaef63291b2c4641f95de2da9
TLSH
T120E00103E30400BAC029133600D71B363BE3D13402B2839B4E20196C3CA374A3F30B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ef590a113378dc96b7195762773f1802bd85f5e970453520ab540afe66f885fc
MD5 7b34420c65cc36ece7c2a150a3f447ce
SHA1 2f3d136188593652be0bf7448d8cc0b85b3b8b41
SHA512 734a068c5a6099d10896311d2ccca2bb4e75e3bcf472acf47a0feacd4b1eff76e61cfc6e1e3d22d93e36dee2bb8cd82426cbc853a390b7723af002e6bc0b0691
TLSH
T104E00103E30440BAC12E033600DB1B363BE3E17402BA875B5E2829683CA274A3F30B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5cb84b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5cb84b.TMP
Size 392B
SHA256 0f5c5c8643ba7a384c8f8d9bbc261178afd299e3e6e927d18ebe22beb0eb3673
MD5 cf99768f312397a3cab9dedd0dcf6c8a
SHA1 f332d75d55d5e5daaac27731b7a9aa072419550d
SHA512 68cc8fb218fb180ac4ceca672dff25da2e810ee4df976ddd2a0a9fb1273f2dc89aa20ff2644a9b9326f4e4557b421ad25b4afe5d19b1f42c0fb499a616794503
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

97374bb3-ffaa-49ce-ac9f-d77262bd65b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97374bb3-ffaa-49ce-ac9f-d77262bd65b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 981c5a606f985bd0cdeddcd704120bc4c9089fd0dea36e871a9831bc01fa5af0
MD5 449938214e0f8676535333c0379c6b31
SHA1 4c6ace58f9910ae87a75f5dd0a03e1210c54109c
SHA512 edd6dea3ddbfc2b1712ad96094a9b90cbc868f5261d0444268f7d3497d21914d1ce7f9385e49ab6a91d46403e3dddfbb3b8b4292e3a42ed8f98d34ed931d7628
SSDEEP 96:9fWnxdq7+aWzALTeaHikSh3T0IgV8fcT/OI5/o89:9enm0zA+aCkG3T0IgVWcTP9
TLSH
T14AD23C92BD71C640D44A943C6CAFDFEE2D68BDC8DC19026736F1FBAF49B88139518218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 741edf3067df35920afc86c26478a86ff95855ac28bb9e08ad6496fb88f6b387
MD5 3691c6dded9b2d8141948f1d2d196c0b
SHA1 20c478234d33aac756edfe065207f4f90db87621
SHA512 ea2ca7423cb3a4823f5481bb2605dc2c143745a45b2f550978b8f8ff0f2b6c55594f0a553e6b312fee0c247281fea8ce585779f42f61f7a288e5ae754fdfb2bf
SSDEEP 384:HwCe7iO024YHDL84KKDL849B7SOEAd9KVRaAcP+AWRMASAG:QqZYHDL8lKDL8CB7S/AmVAf+hRMJAG
TLSH
T1C4729E7D9F413CAC19A7C0E8C0F842D94D1976A7CFE6806D21683D0DCB98969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 7af46847fddaecdb47dc49d597004ac0a7c448ce34dd900c1db8eab63ce3ab81
MD5 09c33afecd2ac3e44cff9c9e138a5afb
SHA1 2bdecd551c3a51588408aec2be848c5023eef71c
SHA512 ac32c8be64a5e7002c4ec5f792a01b31b4f6eb17c2ddb54fc617ed45d3f0e3867f3fc300e617f4d75a24d3cb7752cbf51f9ce35c4108bd60ceae4b4d3c1003f5
SSDEEP 384:HXkRyiO024YnbwDL84KKDL849B7SOEAd9KVRaAcP+AWRMA2:3mZY8DL8lKDL8CB7S/AmVAf+hRMD
TLSH
T1DE727E3D5F003CBC1567C0E8C5A5929A4D18B7A7DFE680AD21183D0DC79896DB5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

287cfb53-6fc1-4dd6-92f9-d0d41e97d620.tmp

Path C:\Users\Admin\AppData\Local\Temp\287cfb53-6fc1-4dd6-92f9-d0d41e97d620.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf18d0e3-9fdb-44be-a847-63292f96d00c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7596_1883183316\cf18d0e3-9fdb-44be-a847-63292f96d00c.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7596_1959575557\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 21KB
SHA256 b648c1f04bd1b5c9f7618bd258f3d19675b98d30fbfd3f5381e9a1883379af7f
MD5 59b6c4e9d51b1446ac4c4ed7caeb2e0c
SHA1 c3722b263d61dfaa12f8114a3786858b27c8b572
SHA512 421a01615005bc119ad120a8f0d2be80a6b370b998578e3bf20eb06d90816752f13bb2cb6df6f56e9a201f9294bee768cc697c598daf92c2c5273fdda9e7f3c5
SSDEEP 384:afEqfLcfdNYfaPfcPfTIPfqyAfJPfjPfUWniuG:a8qjcluCPUP0PCyABPbP8WniuG
TLSH
T1C1A242010BF71595F5F38E30BA72A3567BB3FD126A06862E8182924D0972F50D879F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 21KB
SHA256 919f613e350a5d9f6990b87ebaf45d52e7f1e0a7c42bdce17bdef78b0b8a18ba
MD5 154e089fba2ffc45799507695d71fd44
SHA1 c13251223ddf97bfdb65a692107edda841024956
SHA512 3f83a0764d0cfeac2fd068d6f7d0723842c51fef3359a8061d9af34709edb1bb2b50d306d1d112c0a47660eda11e0e87af3f61cdb5d6b02fd74b8d755796b205
SSDEEP 384:WfEnfLBfdNlfaSfcSfTISfqytfJSfjSfUWniuG:W8njBlfCSUS0SCytBSbS8WniuG
TLSH
T1D1A240011FFB1595F5F38A317A727346BBB3F9126A078A2E8181924D0932F50C939F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 17KB
SHA256 08e27cb4522c3c998fceb5d89315aa524a4095bafcd95cfbdaf82da185629899
MD5 52235956f90877e9eebc7166458b34ae
SHA1 fd74a8a6bb061ee573a5deb47ad769258348d49f
SHA512 915d757821bb2e13d6063e0a6e0852c0c00897afb1e22aef0773a295991899f9a443e2e872fb682be089f708b250af3c2d0081c0e54fbc7ad859827102a8d072
SSDEEP 96:o1NVZpvBNYI56In1JvPr/M/pU9yx2JkyuZWGy8tWu4LOMX4:uQu22uZZvFt
TLSH
T1FF824DF72BF16462F4628FB4809972AC9C331329446C95C8CB5490E642C5FD991BFFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 17KB
SHA256 325b49ea2c4249afb3663b63773111f7dd6c272167a519ed7e39e471966d5f91
MD5 cef0005f54563ae48a698c2e4b05b76b
SHA1 e2b8e3d62654923196f95f2171a4c087f1bcff2b
SHA512 fe26c4f15ff38c727a18126373dff696dd2351b4163addf47720f91b6237eb756d4b361315e5acecc16c23625cd51168d689a0ff16f86ca146360aa77b69d1e4
SSDEEP 24:kuhMZtl9Bbhz0WN9VxWAlS1RqhBTReRae+lzQ:UP9hoM/plSb4LOae4Q
TLSH
T1B8824CF766F21472E5529FB9845531EC8C3313198428D9C88B6090E246D1FD990BEFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\AlternateServices.bin
Size 10KB
SHA256 13c293408a830748dfe321eb8e6d94781fb0fb81519d8ceee7827ece78d7c8c7
MD5 53dfc905f16ba9193d29f55f6bfd7c98
SHA1 d473a4f7822241aab49a0778401b569a4e34d5b8
SHA512 c8d33479ebe25911d20740f4521588c5f27ddc4bfaf59681f800427ab38fab0fc3db0cbb37c0dae9776923636739bf6c7b6f0f2a66fcf703e1c0216aef0a371a
SSDEEP 24:ZuhMZO91jc9xjATA9BXAY9VvlAz5q9F55A5IAg9lNAZ9BbB:Q5OmGiSBe9I56Jq879B
TLSH
T1142250E36BB2A472F0628FF4805A729C9C331325156D95C4C70490F306C6FA9907EBF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 78KB
SHA256 066d32ec5ae6ad10875b4078555c4129267f819aec345ad89518712deacf818a
MD5 2eaf2485ce70c13bda92e41176f140e8
SHA1 6950ca24f316006f0d33b8e6e9010bb566fd9131
SHA512 03954341acd347969eac4c808ebf9e93207bbccd9579c4ac72b382ce48281552cdde7a6288d26e53c6e393907d97b5f24ff9a854e976ce7faa81e5ff1911310f
SSDEEP 1536:CIqIVxZ9ewVoPRpdLP1058RnyQ4f6OtbO7gCOCJ1ENDxRl3ptkp5k5:CIjVJ5VovdhQsyV6+CgCUNDn6pO5
TLSH
T1CE73FF44EB1A553BD92803BA9CD21B103F79F8899A1A2B67371C54383D873DD3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 77KB
SHA256 e60767133d89136f70e8eac22510bd35d25075329900e3bd7578caa52b460f36
MD5 1d95bc1d35dc6b066bcd4903ec1a2f11
SHA1 6284a376960ae42397ef860ec77afc7fa1bf33ac
SHA512 fda59b605142796edffcb5073f0f8f3a6c6913397b06f8e48a4ad4eef79ff7454ae7d876d22f406f872ef09a6809389b7cae1877fae5e6cce8a0964d143da099
SSDEEP 1536:AIqIB2eLdgazrAFHLP1058RnyQ4fXjVZOX1INc7ElCJbqp3cbkWAu:AIjBVqazeHhQsyVX5cUcOCciYWf
TLSH
T17F73FF44EB1A553BD928037A9CD21B003F79F4899A1A2B67371C64387D873DC3D9E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 37b89ffa0c28db1891e5f223b4613e08a029e627d56fa0019760824de0b46a38
MD5 0ffc5dbd722affc6fdd7a853f656411e
SHA1 fd48feaf26e8b08c7b8c321b784307c2a40606e8
SHA512 631694dd801c6d9cdad1f044b869a16f7f6a652929acbc5ba63dda4fad43e0a7821f37a61b7272b6ad66e1d83a8a1db4805491349819faf0b6b452875bae0119
SSDEEP 192:MQcOv5zbowbxLpyjO1cW1d66JozGzgCl6mc0dz:JbowbNpyjMd66JozGzgC1jd
TLSH
T16CD12D64EA28463FC848123BCCA51B414F36355BEC4E3F2935ED64092C9B69E778D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 6f0e2a697900e7212429875e26c0ea9d6fc126f4f008efa7520a9e265e1fbf74
MD5 75999450aa030a4a5732bf59d9e22532
SHA1 74eda285483908068437129a29c96cc4eb0516a1
SHA512 6cb6645ce612e7c5ffa6bab14856be22ab9a6de5f94026192ee5f0b5ec27f673f9d9275187b87839e348371fe8cac9ff279e24c286247a856b1cfd2938f3f46c
TLSH
T17161D958F2298A3FE845413ACC961F411F347456A8AF3F2A34AC604D1E5B2CD778E43E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0afce6db5a7fca8f5f9d1451833b1995e5d154ed699c8d6abac8722ff2d514c9
MD5 df5b4504624afe006b4de31a0383dffd
SHA1 551cdd3e0d6f2de2a5f57433c712ff5a97e75b42
SHA512 4174b48b42ca006a2f770338c200c5d17ed1c72c1ccfb375a61597708987bc84c9535d914b7e2766748c0f6b4e6f59d9db08b657f6a1db85407237d225a22172
SSDEEP 192:AQcOv5zbowZxLpyjO1cz1d66JozGzgCl6mc0dz:VbowZNpyjtd66JozGzgC1jd
TLSH
T1CFE12D64EA28463FC408027BDCA21B414F39399A9C4E3F2931AD741D2C9B6DE778E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 5KB
SHA256 f41e4acc649410393a12001d0689f7ecda89793b94d7b505fc4493e82ce1e042
MD5 6b4c4327030a4cb89001a7a1a1465d1b
SHA1 1c3c3bb8675f962bb4b5747a515020acd62810f2
SHA512 89211f5f75fa167c12b29ff39b654cf49678812be7090d48086ac4158529660deafa76ca9a16e8384261dc13e0b51214df3f9bb3e8b62cc2af5bd87300094b98
SSDEEP 48:Yph2Fz6RXEht24W5Q/E5aNsahGnXURd+FK4BBj1QO2dJXYXYwlddLW2X+0RcnEJf:xvo0NsnsL4BBCdx8NddthcEtXMQH2csQ
TLSH
T187B1F52D75F90C7F1D97E29CB881439D86E8470694872C4B8DD7EE89CD45ADA321F03A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3af6e13a5c2fa36cb7bcf5ca0918853ef71eac56d89673684bc12213d3a268e5
MD5 08f426299794f1be0653abd74e199a3b
SHA1 4bce8f67023af9f2fc973acf1a1b829d20672d49
SHA512 6fd4201fbda6b45f52e4f98809f4d48559512f3d0ed617c4c149cf0b172645106c4e5ee1d749142dbccc551eb2a9901df8d252ed2ae823946aba49c87c65be1c
TLSH
T105112B6C39F98D7A5D8BF29C7442138E57654A0605871D874E12EECCCE81EDA326A42E
MD5 SHA1 SHA512 TLSH

Submit Download

92fd2b88-b3ce-4bdd-b749-c0a522696b4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\92fd2b88-b3ce-4bdd-b749-c0a522696b4c
Size 883B
SHA256 bb1bf510d0a1f05a171618fb6165c0b80ea9498fef20000f915f9c0fb50fceb3
MD5 61e4799dfd3c2f87143cb81525702901
SHA1 1fc20d8476e3109a8018616778789a68e3005869
SHA512 1b0c1de26543bfd04aaf38ea00e4f2e2907b3ef4ad76c8106e10c9f16dd71881ded4cbe3286631a26ff3723be8ab41342fb62aa0d6983809bd14c07bfd72312d
TLSH
T1DC112381A635B5B2CC7CD24FC59537428BF4771380C954243CB19A280CBF91E936B30B
MD5 SHA1 SHA512 TLSH

Submit Download

a9f0d52b-259a-49bb-ac4c-ae8adf925e52

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\a9f0d52b-259a-49bb-ac4c-ae8adf925e52
Size 16KB
SHA256 1166aa75419dd927e7dda1d9094f9db0b23e8c611b34a480f98a41645e910d02
MD5 0af2760c4fc058e2452d72470450fdae
SHA1 1bfcbc27df5cd6ede2269ad689531ec285eaa050
SHA512 0427dbfa754355d4b695277b5c48defa88b6ff532bbdd8f82587f4760758aa4eeb4e0e54b7dc04888f204c19d532f2b73d09e408efd32f0f59e225a1e1d6ae3e
SSDEEP 192:qwBQQN13ieoz1aEWubh2SRzYap76j4ADGmY37MLd/MI6QDhX1nz6MML88pHa9yRD:qwycya1ubh2SR0m76jxDP9CIS0In
TLSH
T12A72E856243045BA8651E7A8D8F8BFC3E1F528CB4C019FCA9BE4BD086DDE06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc35b20a-7244-4207-a2ad-0bd6c0ea2564

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\bc35b20a-7244-4207-a2ad-0bd6c0ea2564
Size 2KB
SHA256 c60a6d36558db547e41441604f9daaf43913c35721d5a9efcf78b1a8229ea54e
MD5 dd4fa89aeb7c1f29db5779902c8bf1ad
SHA1 8e0541e3e812d54ddcb68d3bc08590003b22af1c
SHA512 043f18ca351622ee832150eb895a41dcbb0035042b64ae12263578a7f66ce64ac136552a50c870504c5129922c3077d2e3d610e2b89793d4712c78c9d38758cb
TLSH
T11941245C3678CD7B9CDAF19DD092338E5BA48A0340C618532D61EF0DCCD6A99736B52B
MD5 SHA1 SHA512 TLSH

Submit Download

be239449-26c2-4138-bc51-f633388e239b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\be239449-26c2-4138-bc51-f633388e239b
Size 235B
SHA256 5f31da9c2cfaea13c0e51ce20b7d4af5db1311550cb0652030e17820464a00ce
MD5 d8b1c1ba8e210bc349eaf4ce517f75c7
SHA1 d4035eea814b4618a6fb91980df929a49d4bbfe2
SHA512 2a46efc4634f2f8ccfd0a847d5204a9d7b588c218354c24761ead8ccd7452a95f973565a322be87da332ba10cac27256955caf634e368e7bb63ecf31a1d4049e
TLSH
T1B5D0979024C8A72C0C080F62F0A56DC630C88C3718A09C10967045B4EAFEFC94152866
MD5 SHA1 SHA512 TLSH

Submit Download

e7cf0d6c-fcf4-4934-8620-ba4436af3186

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e7cf0d6c-fcf4-4934-8620-ba4436af3186
Size 235B
SHA256 4d6109d2bb3aefab1339e4f2280b5796cede156599c9cdb09613711f073e0e00
MD5 286b444338ae9d1beb668f21f1d8999c
SHA1 a89bda05f6009edd456355450a98b80de8d2347a
SHA512 1eaa89a229921de5fcc2b73281ef2d650cffc0d771fb8f4549d49d75ccf4c38bbb4097275e94a0da6e65c813fa4cfa8493796a0c5bd662763143a38dc1fbc0ba
TLSH
T130D0A792289C6B5D08280F17B0E0AAD770458C371464AC20D675497CEEBEEC94252D2B
MD5 SHA1 SHA512 TLSH

Submit Download

e7f8f5d1-0041-4a79-8764-0c9ce1290e4b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\e7f8f5d1-0041-4a79-8764-0c9ce1290e4b
Size 886B
SHA256 e5a2161cfa90758774da25a0a7bf8b86a89cb705263e2e361d103bb62bdf2742
MD5 c965409b0c699302e7764faf7a9aaf5d
SHA1 a0cc8f905a0a84c8ad5ba07531881b051b218163
SHA512 53f1b7a73c9e8fe009d6120bb92684de70a8a01bf9f0479dee3da1f1c3d3fca1b0360f58f03484f215d9403136464beb3088b7d415eab024859d354ec67129d5
TLSH
T1D61100C05A34B9718CA8C25F94A5B7428BF4711384C519387DA1AB2C4DFF81E937B70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
Size 16KB
SHA256 88e0a56339e429cf77975285fc8a37d09ba8269649b99fc2628dc067e82152b5
MD5 51727fa6ed0700bfbab2e3b44a3665ad
SHA1 8a0dd137ffd2f0f16b1b5f5d4b55b585421eab9f
SHA512 762d3cca1ff142c732e1c53a2ca7106d58999c4e25f426ed094a9754ace5277e213a40a042245c5d41ca36abf2cfcc2265089481034442dce9c1e8a7b5e96bc1
SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4H9V4hM:TI4vRf2XZ4D634q4V4c4D4X4i
TLSH
T17A72511545049EB8294EA79BAA367E01C37D473B60845C78F4DD8FC802FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 2279e5257bb4c10e2d8df5cfcdd3cc07e1c749142a42e83c18158d80b5f17858
MD5 db307bbb7bc1eff2d993071bd6b881f2
SHA1 b8fcb97abd267b09dfd4a0b76dbeaeda28cb2462
SHA512 07bb876b530d4fbf05954da75b8d9bfdcb4de5c3eb4b7f8adb20079ed2cdc6e3eef13cdbde79afb85517ac268dafa4f629b32a6e55e220a041bbe6c79f02bd6b
SSDEEP 96:xHi+UTUHqGqgaf0ywkzSaSSlmdv9jUnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0yw4SSM5lfWTBw88qO
TLSH
T18CE11F7891088B7F64B676ACAC688C716AB2013B77BF68D750B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 7KB
SHA256 6f2bb119ec0977b4d68f62139c0eaa3f36aadd0515d078c2a4697118b4154ab9
MD5 ba0217dd3f47d06680d85e52b0f0ae91
SHA1 ec25b06d416075c5f3f430bed5923c056b600bdf
SHA512 c6197429c9a9388b23dca89af4fdd7ad82928b17ad39fb91f05530da8105b9440888b22215a606e25dcb8a516ac682d8c4fb4ffa86af31367175da714c98f141
SSDEEP 96:xHi+tTUqPqGqgaf8ywNbzSaSSlmdv9jUnuWR1U9lNdHWw6iuBw884i8L4cn3XHA9:k+fCRgaf8ywvSS5RIlfWliuBw884lO
TLSH
T1DEF10C7891448B7F68B6766CAC6888315AB2023BB7BF68DB50B694C5014CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
Size 6KB
SHA256 e0025243eb504b6479193f8f71f7fae6fe76ec846ea3b94a9123acac8668c908
MD5 d21daf24e821a45049dfa3604d040c18
SHA1 3b63e7b83e03dc8147e58f931c2e5e2d55395c32
SHA512 d8730d45b9ec885df35208d7d87588c36929eacf8cca19a8ccd948a831a9bba77ff5342260399f2dc59375f751e720318cdb5df4ebe66b5820584d686a1be369
SSDEEP 96:xHi+UTUHqGqgaf0yw1zSaSSlmdv9jUnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ywbSSM5lfWTBw88qV
TLSH
T1BDE12E7890088B7F74B677ACAC688C716AB2013BB7BF68D750B59485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 6ebbacfe213831c9f777864e5e975fb68e3fa0450ed0db0f4df3de117b03f999
MD5 aa7ccd44d92cdbe318f69e391a4e55a1
SHA1 6e53e8f4a67ee63b20dc53cd3975db6165bb0edd
SHA512 88774db18eb96fffae991d01c33c804ffab370f49c281c9cf60293e4fe7c5c5f8ee7b898a03b84f91bfa88eb379648fbb35da177e87e640754ae4f05f284ee04
SSDEEP 96:xHi+UTUHqGqgaf0ywNbzSaSSlmdv9jUnuH5lNdHWTBw88n8L4cn3XHAGS:k+aRgaf0ywvSSM5lfWTBw88qO
TLSH
T154E1207891088F7F68B6766CAC688C716AB2013B7BBF68D750B594C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 12KB
SHA256 8af83abe96852a40d1ae2973fe4970fd785b6643037edfac3d732978e9b1531c
MD5 32ae30f25c0e650a371dbbd00088b45b
SHA1 1259a34a058f0da3ae26bae4384b07b06bf0adb9
SHA512 42dbb1b9975e8cee463b9dcfae070323000cae70253d06ef03872127ff270d411282d028bd9d4d69c3f126044fe83fe53793205bfc75755a8c3f599a3e9063d9
SSDEEP 192:k+fCRgaf8ywUSSQLRIlfWjgpOBw884lYve/LJO:k0akRcmwd2A
TLSH
T1AB42DF3851808F3F28B2327DAC6949B05D6142277BBFBCDB06F995C2444CF6451E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 7KB
SHA256 8211bf184a70cd17390d08e163f4828f4745b2524558843045dac834e13cc39d
MD5 7a19c0b1878e39f9ad9ba4123846ed81
SHA1 45afdacfca45caac853444cb9b3aa58e42f4b216
SHA512 92302b75edb9af36abcc9f7ec11e9046abc31ee215a66dfda733c2c64bd7685df096aebb65f4916c72127ed7d39b1e65f581e86dbc9b2a2ec276cf4862328301
SSDEEP 96:xHi+UTUqPqGqgaf0ywNbzSaSSlmdv9jUnuH5lNdHWTBw88n8L4cn3XHAGS:k+aCRgaf0ywvSSM5lfWTBw88qO
TLSH
T14FE11F7891088F7F68B6766CAC688C716AB2013B7BBF68D750B594C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
Size 6KB
SHA256 017fc1ebf48eac61f3187bdd3b816bdff293b4f3e7a3c62501c4873d27d7292f
MD5 34f146b983da3706ade93400f27887b1
SHA1 7c7b47653a025e6cf0ede9250d0ea94275910eab
SHA512 70d6b891f42ed3674c649936eece8afee87927b1d09942a9ca68825219e5669f89be704d459ed2e5765c9617cec967e18389ac263018706e51eb86a1a46b8db6
SSDEEP 96:xHi+UTUHqGqgaf0io1zSaSSlmdv9jvnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0iobSSn5lfWTBw88qV
TLSH
T157E12F7894088B7F74B677ACAC688C716AB2013B77BF68D750B55485014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
TLSH
T18ED02E83C209507ACE836E68B39CBB508E3F00F372240202B2AC888C183F023418F803
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 6ae97e2f045162fc8b94b4987e3d25f7c8af2235c7e76d1bc920dd5fed01fce2
MD5 e320b3130b5af512564eb061dacc28ba
SHA1 c9fb015c8cdb987d4d3310439c41ac03a65ac3bd
SHA512 fa85ef3ddae30a86648198aa80ee0489f724915aa3f808e08eaebcd50915c26e1c2d6aa90fc3b701450b7849a3cb66a4f31b4bea1b4ad06e0304fe21c9aceab6
SSDEEP 96:i2+kuRMmJjjSu9x4GwkM+9lAjaotTO+AVSx2OiIv60T763NRJb:ijUWj99WN+9lods+WX6v921
TLSH
T107C16C9FF42FACB68955744984CC2F4D32DF18ABCAF11682DB38AF9940A0705366D39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 e4989246d4eadd13c3327d644ba649989695dc109ebec9b49e674c7564850a56
MD5 bb6b3c8e146326de3d54b8043379db90
SHA1 d7af3305607ecef252e1646904ccee9ef74aa5d6
SHA512 8ccf777db3c94ca920484903fbc1bb119f1112e4c57d3c0404f13a60f3d9b973ead76ed7cb9e5132759fa6115ffa25801864cc02f3c33cf7340152a86e9d47ae
SSDEEP 96:i2+kuRMmJjjSu9x4GwkM+9lAjaotTOBMAVSx2OiIv60J763NRJb:ijUWj99WN+9lodsmWX6v9s1
TLSH
T1E4C16C9FF42FACB688557449C4CC2F4D32DF189B8AF11682DB38AF9940E0705266D35D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 7f90813e842a15b803dcf2408b4dbde945da6d6925a08ed232723c25e999448d
MD5 d1da46ef5d7f4cb32486e61adf74efc0
SHA1 d7a31def6bd8dc6b234df443cf2b36eb5fdcf5b7
SHA512 7474212abb0c47df4f2a3a2b33383e8daa962ec86f9ea0a92bc9de4af0e7993ea50c1a60af0a3c58b2c52ba494ffafc1f56510a924c0de22058d87456d038c16
TLSH
T139312B46ED6F18B3D985930EC0C81F59FBD11453821DA5E4DE34798520C4A98718E34F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 66319565cf4f8774d3638ead4a89908d27a4737d07131c5fd24726caffbe4652
MD5 7e05f23701c3b701891cd87bb5f473ca
SHA1 a9c316efda15a2ee51d0f611f4bdf16dfadadfd3
SHA512 4129f62da530c8b84ae124460567a6c23d2837b042d87dc09e83398cd298a70d7072a35c61694659eb750ad20a0e4db8fbd82d56b3734a1a374e9e4f4b86f9aa
TLSH
T1BC21CA82DE3F0DF16D605329D0C94FB7C65C3832847E24F09179660722DA55D638665D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.6MB
SHA256 f1fa31cf67f8882c526c5b2f3a5e2525015c399d15fbc7f96b69d27e0af9227c
MD5 8f130ab2d67712e55c76c77ff47cc9d6
SHA1 a714cb540f21a8041556adcd2108daf9d26e73d5
SHA512 6806334e076bbdf06c9be740cc93c4d59476dcef5f20a326af294fc39f55471c9aad473a2704c0b3fc60e7c5b3672df9364d087317d02b5ec04fc050af638ec2
SSDEEP 49152:eC6bTavnfQAQCVUTjgYsA5rI1QndD9hpJHkdak4RJsFXe:97aTlndD9hnHkdeRJH
TLSH
T17A264AE420D1A257F3818073B64553EB21FFD00C5437DA484BE956E9A0B8CEF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 632a60617400079aa2267b9e56b7d822040135f05a89772db914ea6c70b02116
MD5 45b905f6330435f511e997338fc32f17
SHA1 dd23b3f5c6b40dc71c0878477723f6a37382cefa
SHA512 e1daf3f9011f26714f8f0d6398340d0664e3bab30cb1c3b55a9db1d211f3577c4fd0dbf786c5a3d66072206097687d797ec335baf9d1dcadf9efd6b9107710f7
SSDEEP 49152:fLRLyBaeUShmSJ9NlbRT1v6QC5zYY9ylmhOqDjEpAlWn8YAQC/dZjgYsA5rITx4H:OqFZ+4H7TmqGNqIyFN8m
TLSH
T1FF667DE860E29252F34244B3719953EB10EFC00C6077CE44579496FAA9B8CEB8D97B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZDestructiveBatch-master.hJfOEN97.zip.part

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master.hJfOEN97.zip.part
Size 9KB
SHA256 66213d3ac48f8630f671269585e120ae68b0fe990afe4b090988fe193582934c
MD5 60aed47799ca7b60f9d0481e825b3015
SHA1 a3efe4803a5b4f635a1ab894f9c8201947792c36
SHA512 e7b4b9a6bddf514a481588fb4d2d8913951369b816207bf47ad0a4f25c482cada945b8f0f694c69122b1250c452bfc7a95f10e62f9822a25a6d5af67dfd347d3
SSDEEP 192:MorJgBeLXIPo1dJ2MvK1lJpyMe2B0yiRqdG+kqbFnJFkt8usOb:hrJgBeLXVJ3vK7vyw0yMlqb5zosi
TLSH
T11E22AF4432B849B1C998B7B61485ECE452DD6AD8EC8673E2DB098E304FC8E8F735D649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ-Destructive.bat

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\MEMZ-Destructive.bat
Size 13KB
SHA256 17b1f1e3f6235008152f64ba8b8b4af4abbbeb0150db3ef32eabf04ee3bdc5f4
MD5 508ccebebaefb2fb833bf8e7febfa209
SHA1 bc55c719df63e3ebaedb280f25fc1bee5fce9ce0
SHA512 8bc9bfda22a4548c8c445267af32b61f85b663db3cb6fa7cdb5a721964cf36d0b8fe6f07b51451b4bfea16da3c58abf1facf5674638ccb1794707fc10ea91f0a
SSDEEP 192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXJ:E85qwc35O1+7y/LphxxGtHAhubXJ
TLSH
T132528D3236784E132D3026C99C0AD246FCE463F7362A5E62E413C9FA50AAED3725F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\x
Size 4KB
SHA256 d6a4b048b5f28963aeac2e56db9ceeb4607c068cbe06c041631b9c878964330e
MD5 1c604b4fef887029e9a3fa342fa908fa
SHA1 27bd3753c25ea4ea49c7c7b564a1fd641bd0eb23
SHA512 ff804c5b76e5aeb6efbd6a7650d5614e922ab605a45873aaeec0ae898e1a7275dc4ec862cd0bef20998e1b741b2add2846e4cfa9c0fcaaf197c4c50aa934cdf8
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGo:Ljafl1gt6iUq/l0ZQjGo
TLSH
T13F91AFB295B89D03674133F59D2B345F6CD8A53B7D4596494810CCBA04FFC4A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\Downloads\MEMZDestructiveBatch-master\MEMZDestructiveBatch-master\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XDkwBC5g.zip.part

Path C:\Users\Admin\Downloads\XDkwBC5g.zip.part
Size 12KB
SHA256 15ef265d305f4a1eac11fc0e65515b94b115cf6cbb498597125fa3a8a1af44f5
MD5 8ce8fc61248ec439225bdd3a71ad4be9
SHA1 881d4c3f400b74fdde172df440a2eddb22eb90f6
SHA512 fe66db34bde67304091281872510354c8381f2d1cf053b91dcd2ff16839e6e58969b2c4cb8f70544f5ddef2e7898af18aaaacb074fb2d51883687034ec18cdd9
SSDEEP 384:BcN/xi5gj09+WA0dUHsTCkUdn5Q9IpIhkQ:KZoi4+MdTWkUd5Q9IphQ
TLSH
T15D42CF47445C827ACB3FDAB83C604058BE45F881917CF3459C9B2E6A4BB29D39B215FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetSession.xml

Path C:\Windows\Logs\PBR\ResetSession.xml
Size 7KB
SHA256 6e5b71b1b5f96e86c71dfa3016335af7865afe9b0d010287e333e7af4a79fd02
MD5 222ba784c6e7180c6f134137c1526281
SHA1 c003ac3968554dc5c98164ad4b2c89e1f4c2a352
SHA512 0ab43722f924e1485fb0be379dfaf0b85aa459394347a5cf425b003cec3e3a7dc06e073c0d875155fb215d19d5b5b18ba850f0487e2eae48faa5440e876c295e
SSDEEP 96:BytyyqHmlvrT72WNrCFSe3G47nUaMkR/jXAC7V7x79IB8MGRIyy/eZQpg:4yySmx/rCFSe3GOnULajwyZNWBrkOuQq
TLSH
T104E1ED44F1515B72D2229B7E9AAAF894557D7B98CAC8C22DE84C7E52B0C3D1B033B3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionID.xml

Path C:\Windows\Logs\PBR\SessionID.xml
Size 106B
SHA256 c90501d8579f4b32f27822fad338446c2d5ae21fca919de9949fd62e44be03cf
MD5 072947692c68f25ac2844d11d23128a6
SHA1 4d3fc2b95e11ef32bea4eeaba21d8a3fd92e9f8c
SHA512 ca87d42ec126103f730cac874c0dfe138cf78bf4e19366cdedf31027298b73d2737df02080d163aedd73d9b7456152260a3425cc8cf1203ae30123ce2a3afe5a
TLSH
T1E9B0124100391261512E482722E535141B98F8B99A7491C5FDB8964A12CE79533A420C
MD5 SHA1 SHA512 TLSH

Submit Download

Timestamp.xml

Path C:\Windows\Logs\PBR\Timestamp.xml
Size 43B
SHA256 0cac2c92f2ef4b5bebe70035d38a7a0cc2a299857c353de1952fb9e54a5901c3
MD5 8c8764fae424113a1ea620736e5e053c
SHA1 6c0bbf940125bcd11ae9618c7942eb155b39db45
SHA512 9ea8048a8d277989cf0af53ba4ff58f9bd03c488befd5a32f18d1b89a9d8a28cc5afa6ca38c2821d115328150cb05f0bb5e56849400ebb86baa82d896a858f5c
MD5 SHA1 SHA512

Submit Download

bootstat.dat

Path C:\Windows\Logs\PBR\WinRE\bootstat.dat
Size 66KB
SHA256 b7bbc3f2463000f52eadcce2e262512dc79bbbb3355c62c734f18db57e0fba82
MD5 3c08dea20e350ea34f7309e856576428
SHA1 d7a048ccc07b4d16afc4d778d5601a067fb151b9
SHA512 1c1cdd554cbf98dcb7358808cfa2682bd09a596e24a3708ab73e379e5f8ae7dc394b8e88824589327e2f67487ca19dacba9e3288993e2e92463dc32aaef67f9d
SSDEEP 3:dlE/71tCl2:y1tCU
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 9KB
SHA256 35d66d80352ea77ddab275e0656bb5870bed7b7d60db2e6dc6d7626f63eceb7d
MD5 4f157b5055b21ae34028756156c332f4
SHA1 d9c1427ea79fcfb6187b32f206ff796c539e6f67
SHA512 5afd347c51f1176b9d2b7e98d2748e14a1c52751c1734e5b2c753a45c9b1e0f032aa0f4277cdb02712e29cf47b4d01a95d3677e854d936391f82ea13c362d71b
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnt:53gbq3gbq3gbY3gbq3gbt
TLSH
T15F126229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 8263f6969fd62ca3ffb17635adf70e257fd4c18dc20f9b8669364f2bee699ab0
MD5 fbe4aa10ed83c946f32ee24c847649bb
SHA1 abd479b69a4cc6ce25764337c8d6ba9fc9fd405f
SHA512 43fef3351727cf45adf986e1ad8bf428aef2f4200986cc0757e597e5d98c4495b6e314634f156717da5a294ad772f2f6e4ea7979bb74cbf210847d16a723a3da
SSDEEP 192:53gbq3gbE7cRmDy/3gbY3gbq3gbERSxQ1qF4Q1lLyWQ1q:53Iq3IScJ3IY3Iq3Iuo
TLSH
T14B524B38B1942EB75C9002F8DFD038C26B80AB794116A03795C5FEABB279442F9B57DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 b1188e455aa4a65571899fd3a153574ceab6bdddd79b6c684bd629b757cdec4c
MD5 7d1abd74f8a895401f66a5f2620c81bf
SHA1 4035b1c24348e567485f07faf39e4b18f2ccb594
SHA512 ec9a70a5600be1a5bae4e2bc0359b36aff321293e17facc99ef9adbf2d1ac508bdb3a3988cc58ff4b5f31d943862985722d0abfb118237a91e2ecfcb556d399c
TLSH
T19921E74681B818B6D7B1D366F1F8BD60463FF1DD02E08A5CA029F6E394474528B5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/60-5887-0x0000000003DC0000-0x000000000407C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads