be4ac383b9477ba16a58c2da2b03977673fb8b7b096a0236d4f428cfa6b5c584

Resubmissions

09/08/2026, 09:35

260809-lkmtxacp8w8

09/08/2026, 07:28

260809-jas7tstakf8

Analysis

user interaction
yes
max time kernel
81s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AE.exe
Size 51.6MB
Sample260809-jas7tstakf
SHA256 be4ac383b9477ba16a58c2da2b03977673fb8b7b096a0236d4f428cfa6b5c584
MD5 f49e2de70fed79d8511aed2bc15d3fdc
SHA1 f847a5f7ebbfaf1cda83935558e994415680af66
SHA512 2973f2e3c20e32837610f551aa269f57af9977c8b12860d5b87be4ef7f5a51b553c8523ee74cfc7f9dcfe909bfdb240d2e11f5de8a4e4c84a57d2a475d15bc63
SSDEEP 786432:U2sU/7yFaneax9TTfy3iK786wzkyBQFgzTUXeNw8m5lRmRjIjzADhrp3lPOZdG:L3/0+l+RBwXzTUX0w8mxmxGOlGZo
TLSH
T136C7224AF2B810EDC87BC078CA571D27E7B13459132497DB51664AA82F2BBE19F3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	AE.exe

Loads dropped DLL 28 IoCs

pid	Process
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	discord.com
84	discord.com
108	discord.com
55	discord.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3456_360025909\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3456_599175077\_locales\ta\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4240	msedge.exe
4068	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307341672719836"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{510A5373-C6CE-4DF7-BC7B-F8D2FA2B2DF3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{F7FC3FBA-89BC-4142-A723-69BF10C2FFD2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe
3684	AE.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	AE.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3684	AE.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3456	3684	AE.exe	95
PID 3456 wrote to memory of 2156	3456	msedge.exe	96
PID 3456 wrote to memory of 2612	3456	msedge.exe	98
PID 3456 wrote to memory of 4240	3456	msedge.exe	97
PID 3456 wrote to memory of 2612	3456	msedge.exe	98
PID 3456 wrote to memory of 2612	3456	msedge.exe	98
PID 3456 wrote to memory of 6108	3456	msedge.exe	99
PID 3456 wrote to memory of 6108	3456	msedge.exe	99
PID 3456 wrote to memory of 5712	3456	msedge.exe	100
PID 3456 wrote to memory of 5712	3456	msedge.exe	100
PID 3456 wrote to memory of 5112	3456	msedge.exe	101
PID 3456 wrote to memory of 5712	3456	msedge.exe	100
PID 3456 wrote to memory of 5112	3456	msedge.exe	101
PID 3456 wrote to memory of 5112	3456	msedge.exe	101
PID 3456 wrote to memory of 3396	3456	msedge.exe	105
PID 3456 wrote to memory of 3396	3456	msedge.exe	105
PID 3456 wrote to memory of 4556	3456	msedge.exe	106
PID 3456 wrote to memory of 4556	3456	msedge.exe	106
PID 3456 wrote to memory of 5744	3456	msedge.exe	111
PID 3456 wrote to memory of 2688	3456	msedge.exe	114
PID 3456 wrote to memory of 2688	3456	msedge.exe	114
PID 3456 wrote to memory of 2688	3456	msedge.exe	114
PID 3456 wrote to memory of 3764	3456	msedge.exe	121
PID 3456 wrote to memory of 3904	3456	msedge.exe	122
PID 3456 wrote to memory of 5036	3456	msedge.exe	123
PID 3456 wrote to memory of 1204	3456	msedge.exe	124
PID 3456 wrote to memory of 1204	3456	msedge.exe	124
PID 3456 wrote to memory of 5620	3456	msedge.exe	125
PID 3456 wrote to memory of 5620	3456	msedge.exe	125
PID 3456 wrote to memory of 1888	3456	msedge.exe	126
PID 3456 wrote to memory of 3608	3456	msedge.exe	127
PID 3456 wrote to memory of 3608	3456	msedge.exe	127
PID 3456 wrote to memory of 4064	3456	msedge.exe	129
PID 3456 wrote to memory of 4064	3456	msedge.exe	129
PID 3456 wrote to memory of 4064	3456	msedge.exe	129
PID 3456 wrote to memory of 2040	3456	msedge.exe	131
PID 3456 wrote to memory of 2040	3456	msedge.exe	131
PID 3456 wrote to memory of 3804	3456	msedge.exe	135
PID 3804 wrote to memory of 3696	3804	msedge.exe	136
PID 3804 wrote to memory of 3916	3804	msedge.exe	137
PID 3804 wrote to memory of 4068	3804	msedge.exe	138
PID 3804 wrote to memory of 3916	3804	msedge.exe	137
PID 3804 wrote to memory of 3916	3804	msedge.exe	137
PID 3804 wrote to memory of 1592	3804	msedge.exe	140
PID 3804 wrote to memory of 1592	3804	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\AE.exe
"C:\Users\Admin\AppData\Local\Temp\AE.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ae-storefront.vercel.app/api/discord/desktop/connect?installation=5d36a0ee-1e82-435c-bb5d-50a608de7cb9&nonce=aa22d92fbeac653c3e4ed8a878afe1129ea416296ad1f1d9fc27793d6200f02c
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffc723dc188,0x7ffc723dc194,0x7ffc723dc1a0
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8555574085313077431,15362049344180637656,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,6530388453293010130,5466120970546460574,262144 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,8335753143359766197,4448880336981986519,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,5560717755412833233,1324376993115103605,2097152 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8969610881788104587,4671889669833671803,2097152 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,17744926396828888512,13706639363834285127,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,14506515684648194299,5730780747897842714,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3286374469187226993,5542505977188880121,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3286374469187226993,5542505977188880121,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6140,i,1008358132883378492,12980600351029214125,2097152 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,13833184853844275028,7361794628536658002,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,6649052991645312117,8871254632631954223,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,7423425347525080567,7431468382372059815,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,17078551541298671437,3458277399691514712,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,13016238608943858735,14242151756434034481,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,7728321309024448612,8381455171042222662,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
    3⤵
    - Modifies registry class
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,5399251359262923475,15768015730642058742,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6436,i,11759590351200672648,6710823859629444591,2097152 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
    3⤵
    PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,14750454349639679079,10679337655169566876,524288 --field-trial-handle=2936,i,8437052760853759483,3423400771313241135,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffc723dc188,0x7ffc723dc194,0x7ffc723dc1a0
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,3786633266215315481,3121263374486195299,262144 --field-trial-handle=2236,i,14289066909509906192,13944776967629630341,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,14173027071011249927,13790821880139932092,524288 --field-trial-handle=2236,i,14289066909509906192,13944776967629630341,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      System Time Discovery
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,5962268668488424251,4253795642703960016,524288 --field-trial-handle=2236,i,14289066909509906192,13944776967629630341,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,15893899964069114071,13062356913110039352,524288 --field-trial-handle=2236,i,14289066909509906192,13944776967629630341,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,15893899964069114071,13062356913110039352,524288 --field-trial-handle=2236,i,14289066909509906192,13944776967629630341,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
      4⤵
      PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 406e7c7edcfff381dae0011c6c736d968f75ef9fe94379575d6e7d534fef8a28
MD5 79c1fb19453a711f80a76228aa029ddf
SHA1 cc58c6b526aa44fbf712bd49a5b3d6b3629387cd
SHA512 2b533049efc6deefdf16676e9b78ce0a9da1e25ee089a31db9602002415956d2a0ddd2ffd8374c39023ba7a264569a0e38288723c0eecf7fca83f200c19fd673
TLSH
T136D0A7F8A746A260D12E09316824A610B76946A038A7D722D079680DA99D028A2EE189
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 d7efc650f873d3b136f3530842a3e8584dc0792e667c103e5db0cbf8fd9bf5ee
MD5 ff55549134452604406a9767ecd91985
SHA1 3ff8ab7fde3d2ef6682b0ae5f33cca1ec0d9ec87
SHA512 6458601bbb2b002deb21af30d70e8df3d56a5b4e74f4da56b0e726886bef542954094587f0f2563e3f3f66e9e882f1f0fbf6bf7f3640149c5788f670195c71ab
SSDEEP 96:ug6hiwQvcSuPPQoL4PBRYl2QUmQwzpHcDIXN9YAua8ylHxlPXeLObPEecMKlm6Mj:r6houPLL4wtbXvrpbPDcMEmn5p7
TLSH
T1050250B0A903C943EB8E1A3606F9B766F1BA42C6F6038C7D135A4C791CEA3D6C13D604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 08f1c43b23bcfc0a61f113c4f05313985a860310e4e26a339c06b00f2199f9ab
MD5 cb845ccec3ea66aabdef3af2ebf6ea07
SHA1 b73751237a774f533d0daae3a7782c35a5f116f2
SHA512 caa2241c9a1a9267a07eea7b25d7b5a956c152bedcf33dd7fe5b440abf4f9090e7b4313901e836700e4f31a8eee8737020069c53ba1e5e712dc1b0ba70db50ee
SSDEEP 48:IxpZ3toI2r7gctsX6Z0bQqzKk8h8wCw/XKElQ7g2SJclp6cOFiUTWy4lF63wp:UpZ3toIu7gQwQMN8+wP/XfCcBcbmN0Uu
TLSH
T1679171F4B503D465DBDD0E3383C1F630B47982CAFA134D9C22A288BD1D297A6C12E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c232.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c232.TMP
Size 3KB
SHA256 368305ade76821f937c040af82f9a1da79b5b4f5112a4a35bdf19cac56002989
MD5 794a28afd32f90a235b2a27d61a039f5
SHA1 960918cea467f4b009b1d7defe917cfa863ead6f
SHA512 e926d41c20a5495f35e0e9975f1b7cca183731243c431956e9cc9848f28f6dfd58c59f81f611685d81be094b82bd11f15f0ed9311170056e50c223ec1ec2a0d9
TLSH
T1DA71E7F4EA03D9A2DBE90E3383C1F630397185D8FA534D8D226384BD2E59758C10EB05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 60KB
SHA256 a060ff34bd6741b688b942475b013bccb34613f900fc8cdc456bfc8c26a3bec5
MD5 011ed1f5ed0d24e6bcbe31cb74adf561
SHA1 60af92e70beb47b2a466c3feeec45c43643e7553
SHA512 0fc6e71b2d5b9a48440569d7b219d0f167c9bc391b3e8ef891dbde4e1543df50c0f12cc3dfc9390ae711346ce393050b83e4d07a68d2d1434b9f0a08d0a78d96
SSDEEP 768:/XQKQNEbGbt3w+MHTFcyf2Ytj5pUEbGKi3wBMHTFcF+G2YDgJ52s:/zxiipTFcyf2EjTFiGMTFcFl2ygz2
TLSH
T11153D0399F2130C3D3560BB51B9F54BB0F2443C78C984976348680BD9CE9A63766F79A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 51c93e929a96bdcf33cddbcd52745a0b5a9b6489312e11f5cfca9022f90746c9
MD5 3e98158f2ed7c9cb6c709eb99f011010
SHA1 09370b5d8168376f376e8ceaf039fdf3b02815b1
SHA512 c412664dce672ab180d59ab62289c993bb60eae54846e5beccfcebd1f268c50e3368a8072fde27171ca9e0c1cc7bd237374cfeedbc122ca8756004b1d5197187
SSDEEP 192:TmXPvzf+G83uy3Ct7XBBKwyEUbPSH7DXspU3iZ:Tmz/83uICtTBBf7DXspU3iZ
TLSH
T1E114A31F0F602711DD7D81752EEE54A72F7CF03F4B56659A78A104A8DEE2742602C8EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7ad53f441f2684e07fa547741818d2c0d4d05df8e8ac598a7cf5c71aea4c8968
MD5 d39f5299c0c46482b7938825fc88112f
SHA1 c34823a1b6f8b374d34c19b1c103f8db979128ce
SHA512 3386d609ba030eaf94bc768f026ebb3e5dacdbd4b7991786df53e2f5e737a50c8abd87fef8b102b65806e50a20a592e8c8815178006669ab2c19b91cd4c5fdd8
SSDEEP 96:D1COuzuQYu4uptuXSuvuzaij6VszQuj9aqwPuiu6guJuxuC6WusEuM:D1BOdY96jIKaij6VsMW9aq2de6aUW9Ex
TLSH
T181B19DF383E8832DD91156F09A187E1FCE2D1924432C3D3EC9D5AE4B97E2571E182A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7f25fe32ca42b70ece98ea50bd238bc51f118bfbacf3d0b494db8e750eb6bf8c
MD5 74f2702e3b30587ee1b5269e7aeef064
SHA1 0480e7a685060a665ae75a803346f080a02a3c9f
SHA512 061cb0ac37ea9cc2dea1eb7e3a5015871524ef08fd18ac9b0def690d05b73144d3be19759a79b73c8d075e9713bfbd27b2c925a67596be36c5cf29dbd805168c
TLSH
T17531A0F783E8856E8A1195F0B618AE2FDE2D0510436C3D9AC5E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7e2a37012ee09857533e09bbdbc58ba1e0b4cdbeeb7ebd2269261f79b3743a0c
MD5 37b80036b0bf0e8cdf8137153c110653
SHA1 4f2efce75b61816010c59e762c5e56a890edfd36
SHA512 253496569ff408c6474c890b1fef8e6214cf54c67d97e24a71c2fb6ee28273e1d90cfff2e7980a56000e32eb575d28eddea7ca53d5336091e11e07a7d66cdb17
TLSH
T14331B1F783E8856ECA1195F0BA18BE2FDE2D0510436C3D9AC5E4AF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7e336e4ecd04ef17c5e36113bfabc1f1a30aaaeba9187c248e9f86f16cd00a39
MD5 9df2a99d0b9bc6b68f87ee3add2bb62a
SHA1 4866a45ef25f6b5a1fbd298abde2fecc78cc64ca
SHA512 03ca19a4752011cdf25c046c7ec0a4ba3a7f2414c7c9e7d166afdaa004e49aeb639b94518e532ff64336224b8e20c4b8c9cf754f741de3b2dc195b72f838739c
SSDEEP 192:sxZSRc7yMqZjK1Ml8WPY/fysoWpVJ5ZdIaRuv4zodp+5HW6+WNUlbcQfd+q2WdIL:sxZSaSDY/fysoWvJ5zIKYLuHbidV6XT
TLSH
T11682FA06A9385D7B9CDBD619F6457FA3D3F91422A1904E84AAFC8E0C01D7BED220385F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5c926fc4bc7321fdec9ffe4abbfc7ea7c3f5eafdb4aaff7d071bed2567c23b99
MD5 c82bd195e6fc64283eb0995c499d7c71
SHA1 9d01036fc1e85de658b25960c2e4429b23753e02
SHA512 ae406df819229df651aa62fee8aff219709a9a2b09bbab427c59db20f435395441e57e84b52a16a1ad65486a67cab26da23c6c7e23eda9c341130a182722f620
SSDEEP 192:sxZSRc7yMqZjK1Ml8MjY/fysH5ZdIaRuv4zodp+5HW6+WNz4X8oZ+q2WdIvy7Y6H:sxZSaS7Y/fysH5zIKYLuHbUMoZ3LtRT
TLSH
T19672FA16AA385D7B8CDBD619F645BBA3D7F51422E1904E44A9FC8E0C04D7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 59a65a9319e353a32e2887f9fdfc9402b8bfab6dc724a1dcceb7e1853ead8ec2
MD5 97a1e4cf7900212b81f1528eac292e75
SHA1 8869cfac85ea28d353e33bd7b43b71a7140a3f2f
SHA512 a4c2ae202484add8bbf0480841d18a8e6322a8a8d63b209c256fa1af97d62c1492d0facb5c01e6741c083bab0db46010caf014dafe4ca1050391c0df91ce6bbe
SSDEEP 192:sxZ1Rc7yMqZjK1Ml8MjY/fyss0gaZdIaRuv4zodp+GHW6+WNzqB/YviuY6OoIgjl:sxZ1aS7Y/fyss0gazIKYLxHbA/Qtjl
TLSH
T12262F9066A285D7B8DDBD219FA45BF93D3F9052391904E44A9FC8B0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 10ca528b5e29c34e984a436c7888ebc436fd8df596d774f0ed949be8201029b4
MD5 c65dc2d319272cc1f455b6606259b04d
SHA1 083ab3eb18e8bf3106b40b92129acc4a1163eb59
SHA512 6cfb201bbb4ce2ddb55a9db51a2a332a3b0b194b430ce2884ae3dfaaec1787e6ff982156412ea4688992ea2596c2e3b871f952f2ce13b62dc4664bd0cc1266d2
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvysy10LlT:eY8Od/HEnFhWvFvQXu1jabt10Lm2Nu0h
TLSH
T13BF2FB3B6C0CCF7A4F844E9CEC2A6F8A6DE802CB5698895447F9844C02C76EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 61b8b631141bd5cf0927e76858f8fb9c1e27267be5ef9a6ac29732b6cecc315f
MD5 81750824725ed08b737583955088197e
SHA1 6495b40a26f747dd16dbef8fc1302659bf24fba4
SHA512 08182c1446dd5b1b1af7c36842a4cd23b6aab2223a1fd45f7b1db907188e807201705bbf3cd63b0af143b79daf0f2cbfbcbf3ff25d5ac8410149c43cc9c1be51
SSDEEP 768:ZYsv8Od3sp7pLuLfWhWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8ysy10LlEek:eY8Odc/EfWhWvFvQXu1jaEt10Lm2Nu57
TLSH
T109F2FA3B6C0CCF7E4F844E9CED2A6F8A6DE802CB5698895447F9844C02C76EB16175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 776ddc70fbcc9d59a356d6c760b402748e21eab760fae4c65b5e9ddc5cebed6d
MD5 f34ff38254658a3a1dfbad633b4b2484
SHA1 74849f19df8399c5ffe556effefb73d5f95d550e
SHA512 49dc1ad36840ed8de29104dd926e09a5c73c530aafdea17b221866cf47af27fc6fa78b0e0f0d84d285dec22c037ba23865649fab93535fe439668c537d63d9f7
TLSH
T138D09783E8250562C3AA0BC11A2214DA4B223C8C244A984DA4023A2E04F4F53E312E53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 3b7c8d843b0a644f697bb797e9af176983eba9ffd2506a1b2677f5580ba29a8a
MD5 f21d4142d0c5d70f8cd67c54100e4587
SHA1 31779b848c09313341e497fd28c6c2811acb67c0
SHA512 247cb54150841a187632bf9cdabf04ef0c60e6b990ca4658459deada28972eef9bdb47670478751ebf601228868f1a02a556588a53c458a4edb95cdcf5a53aa9
TLSH
T1DAD09793E4280562C2AE0BD00A1214AE4B123C8C605E984D64020A2A08F4F63A202E53
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58d3d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58d3d5.TMP
Size 138B
SHA256 b249895af178b71b6f49b717a7b8eaad44e3689913f28a87cbc9837adf23365f
MD5 83fcfd292161534d23c001d87cb11138
SHA1 24aed2d4f8cd475a2dc1af7fa70e7a322434a2e4
SHA512 8145370463a93bbc4d82f20efea2bcc60f36932a3ca24d0bc80773d58a0294469d35d82e93d7f9933e3f8a4b469bf69b718890983f7aab5b6f769a4933aa0f0f
TLSH
T1A7C08C63B5040429C72806800723048C47032CCCA88A948E640330162075F237141EE2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 370e6d3b532073555829e01c8abfe33ae70c50ec3c6148f1128465d7122de7cc
MD5 d4530c1942934e5006cd8a8027a5af17
SHA1 ed33e28f4088c812e1b853fdf0813bb0a2e82694
SHA512 2b0b84efaaeb12a2d6536f8ecf198244ff93e71310cace3b8ee5507b8ed93fedcfd2d6425abe75a31dd15ae0f7803e420aa7a14b3259efa6297de4bb92e55dbb
TLSH
T144E0865445CEC1BEB715204303A9C71CD3E8796BEAC9BD436F44C9486642558B1EAB91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 b4d768352cdff28b4363a741321bc4e5093e4cdd88a7d968989e984c14dbb0cc
MD5 caa01a529b2ddb5ac6c0eb0dfc2fb134
SHA1 de1143d2ffa4c2144524b7b4040d5c1065c1d3f4
SHA512 eb3c46769c623096200f83c4d9a6971291a8f87cdf9ccbc8e094fb5bb7d6185a7b44d48499cf735754f906638fff685b4a216e99e95d4fdf38b6240d6d1c3a85
TLSH
T182B012E9B710C616C485043207F087C45705F06214959533C81CCFD20F096D83E458D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 411f41fb74fa00478bccad4088c8bb51617ba1fc2d72be82254db67a9716fe27
MD5 65a4ef90d10576c900108d4d6b33a14d
SHA1 f7daf9297316995469fe199bc6328bb675146ed2
SHA512 7484f0a57162769a171de7b0470ceb1ff929b737660d8bf2bb2318fee90d12f002ea9aa6e048fa13a40a7fb556fe365efd48cb1cd07aa6d635d8c1eafcc43597
TLSH
T1B1E0D82455CEC26FB34520875369D70CC3E27956EAC9BD536B0894486306144729BB50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 983c1d392930276fc85225b8befdac862011579e46e845b9690f1e61afd63d32
MD5 5cdc7ecd262353632d42beb48f945512
SHA1 be98d995e69ae5eb5011c135f3f1bd17cf4c7c4e
SHA512 1b9500361e5926f9c8bcc3aa732a2ece7fd188b5667a4c4082fb12ae49b4961a686cda774dd46184d2ce2be03ff00b355e3b4c27f93166c8e55ca2597722a1f0
TLSH
T14DE0867C85CEC27E692460C74375DB9DC2F0BC1AABCBFA969B084448B701558B2EBD90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1468e58147034b8dc64f4d209289531ef20a5e58b5b2eb8d4c29fa5fde191b05
MD5 313f54641fe0e996dff0bfbec8543152
SHA1 1aa37cf854edb4cdad556c9d4be7acb4ea0a1dca
SHA512 0e041aa34d23e06476af9a0716ba02529dba59b901281f115e3fa52cb7030505d528edc80c5303d075f95df41be0cc44ecedc87bb849da48ae80ef9a3d48eee9
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGf:05ppxnY753RNBvRJJdt7p5J9rL9F
TLSH
T16DB27B5A703E0211397E298CB39696364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5929b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5929b6.TMP
Size 178B
SHA256 2c1f5e532fb1ed8b57309b2f48459d9c67aa6d2e21d36c4c82e0d32c301a357d
MD5 d520c235faf88e84618a338f6ab4dd3e
SHA1 90f764d8b4d050a9de7fe3ea6243dca8b0b7fca4
SHA512 6fb920ff99140ff874ad6b2d02cae633772c55fa00671314c95d1cf40e3135b37deb0a41dad437594a4e2e8a356941f70771abd46aaa78dc3b3d62308fad4adc
TLSH
T1B1C012B7508299917A3464EB411A32C9C9AA7FC88DC4AA8C5866308A2334A2B2211D60
MD5 SHA1 SHA512 TLSH

Submit Download

a571954a-0df7-4d83-aa57-be7fab19e80d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a571954a-0df7-4d83-aa57-be7fab19e80d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e2d4efe5-9ecb-4fc9-b5a9-e8389f1d9310.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2d4efe5-9ecb-4fc9-b5a9-e8389f1d9310.tmp
Size 414B
SHA256 0b1e2655dafaff0c11e55c0ca77cc8de6e50f77bf0c4e4db6271414ce57e9d88
MD5 ae8900adcb666917127b806034e584e5
SHA1 ddd762a24a72fe0278ffa464edb8904d0ebe3f2f
SHA512 ebd6204887c42079ef4a52ceb1e06cdffa7760676fafe29130c24f83097ffa0ca65c1c7f267e5c8b78315336f2f0e370969e1b42e45a8ec27b04da0c4598aaf8
TLSH
T148E02B79CC26EC3718FD0768A459465AE74013173A80899F3A3C810C8FB462A96C689C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9e72a48b3bb2f1ba346703a2f29a6e0cd440630caa078ef9bbe2e36b2bfeb664
MD5 9902aecfb8c02490e757eae2dfc7bc94
SHA1 3431d0b700243264392ea8624dedecf95716c8fb
SHA512 8c5e0431b8f2b63b3cf35aebf7e479cbcc056328c9158472240e7a0ab071eaa332a7ea2e23c15633f96dc78955b28917cd948442d526ba0ebfb82aff117d51b7
TLSH
T1EA219D55F320C159E18E863AA46B9B261378E8129FBCEC0F847D24352D72E045E8B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f4d6aca88279b524bf70defc1da9b4951fe468bbd9945883e3cb387477b04aff
MD5 935ffb79dd479a6c82deed46ae40038d
SHA1 0fe8d88d940e507dbc547b08a15a3f503017520f
SHA512 d499932cb700e47535533e2e89be7969ab0256d421d34f1905c8efca108b8470c1d4d4e69ea08eb27d9a9b61e0a587e2be3b9491e5972cc2501ccf33007e5f80
TLSH
T18BE04858A5C5C5AF751420935269D748D2D93C46EEC87E452F04CC4C9706155729A991
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b69f0b9a5761f2498d70e95024a255e6dc66ecdf9c5c64b1945d3a70ecdcdf8b
MD5 03546a6549d0f42b63b0cec01d661f45
SHA1 8ea04d6d9348a8b9fb11acdfb173340624ae535f
SHA512 e55d318da67a1de36fce43813e2e8d80bb66c27ef97160d7aa0112158df12c9cc4e48981718909d926151d922a455d89bbef267e8ccc02de0630dc44867639a0
SSDEEP 768:1FQnpwgFkfojG02I7KgDra16KRmhS2newBKZOm9:Mntd5l7xa16KkhLnevZn
TLSH
T112F23971D8A89DEBA8D6DAC9AB06F502ADE44233858C999CD2F97D3D309F0FD5306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 b566504fa1c0461ce2485aa5cee8765bcf119cb1ef8c9d9e699abe7f94c55aa1
MD5 a95ac716b4a37abebd58fcdc39fd4068
SHA1 1bc04ec7f7f31592e7c0c45589556806f5037ff7
SHA512 8b8466acb2c5aa8a4d3c6a5bd7b0407353e2981151ce56fcbe55f9645b7e700004ccd9e2ac2ae4c2e677c14410d067bdbc8eb341a734c0948408acc3b649409c
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9lVKpvBftG0oDti/7v0pje4KV8p0+HFB:pVFccps3GwgbkUXkjG02I7vOI8p0or
TLSH
T10FB25B36EC68CEBBECE74F99B70E6A07DEE0512785DC99E4DAD81D0D109719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 eec9b600487a848da1277eb8c5bc94d3e5f220f8b0eae6f5a06d162c2ebcaab8
MD5 66a486acefd4b54eaea92c0eac2504be
SHA1 10c32feb80b1a16354d9804290e46f2bb0973606
SHA512 e4fa680012cd2128277a77f78bf74b3a08d727f0cc91364566acb97b64e0070f018322756163459a5e0d91a1c23cc49f4913d3e2a4fc9cb210781eb7f4805600
SSDEEP 384:np5iF9CcmyWC13sNA8TUNTUlI41QckCrVv2pvBftG0oDti/7cLxWnTKwBODNZOC7:pQFccp13pwgUkgojG02I7cWnewBKZOmT
TLSH
T13CD24A31D868DEBBECDB5B99F70A3643DEE041A388D85AE8DAD95E0C00871DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f75375e54c18a600c06f9b37b1a3db5691ad67a6ccf0ad1bc0339634ccb557ab
MD5 75641dc63392eca02f26092287bd894f
SHA1 dea8954978dedb5d97767f6ebcbc9351222da863
SHA512 15d396c28fa6cfe9bc2ee1de136a2cafe56db1b9858084a69428d53bbe0eee8181f2016e11147ceaa0ad8b303f3d274c07f0c178d936738eb3024f228d5a988b
SSDEEP 768:1FQnpwgFk4ojG02I7KgDra16KRmhS2newBKZOm9:MntI5l7xa16KkhLnevZn
TLSH
T1FCF23971D8A89DEBA8D6DAC9AB06F502ADE4423385CC999CD2F97D3D309F0FD4306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7e12edff460ad14d19180f82ca6dfae52fc382346c1bd5250f7bb73eff6bb6ec
MD5 b0cfc7ea20ec5beb7b607527b38f67ae
SHA1 16386d0bebf31080af25e59a7d716a05b935699d
SHA512 e0de6930a005f822e2b6fe5596f492aae0fe496545a4e5a4bfd9c88dc6758cf065e3f57d9e15d8347e2be830d5ff845ab0fd7a3172d37cd87694242e0114d4df
SSDEEP 384:nJiFiZcI73sNA8TUNTUlI4yQckCrRtv2pvBftG0oDti/7cL4WnTKwBODNZOCV56+:gFQ73pwgFkeojG02I7bWnewBKZOm9
TLSH
T133D25A31D868DD7BECEB9B89BB4A36439EE001B398D85AD8E6D95E0C008319D170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 72729dce9d8a46f5537a8abe377678f6983dcbabdd49c27a481e06cca9e2b8f7
MD5 5f77d979c2182dbdeebaa33c40a9b12a
SHA1 62d1142f61b640e108a4b15c718f476567c73ce2
SHA512 399d2758ce6da35d2a7f22c0a454dbbd37df47bb10bf8f0ae075ec7de19062ab8151a6937cdff5a9aeeb40e68c98020dd7be24b0d3aeb5e3489bca0ccfe2393d
SSDEEP 384:np5iFiZcI73sNA8TUNTUlI4yQckCrRtv2pvBftG0oDti/7cL4WnTKwBODNZOCV59:pQFQ73pwgFkeojG02I7bWnewBKZOm9
TLSH
T134D25A31D868DD7BECEB9B89BB4A36439EE001B398D85AD8E6D95E0C008319D170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c51c4ea49b90ddb44f1eafd96afd7bba33530072e8bfb3448d80da426c9a1f9b
MD5 f390b22ebb2bc390c0dfc4535e17a8d7
SHA1 e7e76ce480afccaeac7eca531cfaad97155efa04
SHA512 8b9063f2698ba836d933de360573e2253dcb95da95cfda0bc7a47cba84f0953dddc4659390c42084362bc7015e16fa7880a028aaedf92532b912b67eb0b9e17d
SSDEEP 384:np5iF9CcmyWCs3sNE8TUNTUlIm2QckCr9fT3pvBftG0oDti/7cL/We4KV8p0+HFB:pQFccps35wgbkUL5jG02I7QWI8p0or
TLSH
T1ADC26B31E869CEABECD74B99F74A7643DEE0417389CC9AE4DAD84E0C10971DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 50bb366117a236e15f32086e11099768cf40367621e2da4f211f65639c807286
MD5 36876b40c3d161234dd406e58012ba72
SHA1 0563967e4f52e2cc17b34be0e60db3e6fd2627f3
SHA512 f89e1df1b6c5edd768603267bf7d14e27cab30854d9db8706e1922f8382d48c6ef9964c98f604c4c280309e26ada782489904a7b4e0b6d549fd00002e62fdda6
SSDEEP 12:TLpOPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3is+zAXrdemQQtudbUx58:TL85UOl0afDdWec9sJ+XZq7QB5fc
TLSH
T1D792DC63AD312033E8DF4B36BC5345D10EBC025EC9A7B844DE9048611EB2BC1A2591F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 f564018693fa081a1e2f5ec8f76a053f80ff5b99957d644ca62213e5008a0fba
MD5 d670964959c352cd928e1b4a6affa103
SHA1 1a50d3e65fb3e2c8fd01e3a822af7f48fc7841fc
SHA512 ac457262d2eee7494cfe1fa57baca71c246a84fbf30b424cfc0966118fd10fcaa0b3e61871393e7a947b8a3ef2d76227bc076f850f7d4f192894f0938316b0f9
SSDEEP 3:MsEllllkEthXllkl2zEQ5lX:/M/xT02z5X
TLSH
T140440244AB810606C5041030806193A04376D85105116B47245108127CC55A00C21000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f1aa97e0b65acbf64c585ad2788a20d4c1330cfe7166119561c8906c1eb0b14e
MD5 1bcc616eb5f3f0728acab33ceee09bc2
SHA1 ab60e1a1d68a3a779818339c00483464b0e1d2e9
SHA512 89d6da577e5474f43f68b27b749fa5b1b47202d1d892914a87882b90a4276c3727ee843e341b48a3cdeb421c900911238a401f8dd90209a05b57ec3456849615
TLSH
T126414A68B6F91148B3B76E0A5BF6B86D487FB9732F06D45D10010E8F0A66A40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

AnimeExpeditions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\AnimeExpeditions.dll
Size 8.0MB
SHA256 b60506560a9f8cd9bc2c16b87e1ad1a1bb11305ff939cdca5896fa1088230530
MD5 312be943160cc2a86d08a875b6704960
SHA1 a54653c0463a3b3fcaa6cca1626df2d0398276bd
SHA512 e6e49dcf90ffcd8e16a1f79aca15d18795538b9cb8a6fb6580417603797b72a61b8661b679cb5fdd8fce41020ba62a6c20feb40edf379eb34bc7e2dec459e5bf
SSDEEP 196608:fHyhqn90WDcmWvXg0pBr3iQ0Pne9vjlEu:fYWYm8XdbiPnevxEu
TLSH
T1BB86E09D7260B2DFC857C072DAA81C78EA91B4BA531B4343902715E9EE4D99BCF481F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Collections.Concurrent.dll
Size 269KB
SHA256 6ffcd942293576dbd3ab66ca6ef2ea0428f9e84bdacec63316bc5c069041f37c
MD5 d44f5a7649fa99f886674f33b214462c
SHA1 2cb6f57a33e4b497ce04ab75d2ee3fb860485d1d
SHA512 a51f19f34e07354fac8228e8af6a1abd06619b6ef466f13e9ac239e7ed75d63a129030b64ec895d17c6ef597c19f4316fc2d01f95361d9c0361c17d0f0eec3fc
SSDEEP 6144:hPA2Hvj4tByYOTblcFe4khyO2qIykwXLy:hI2vj4tBypHfhD2qIrE+
TLSH
T174445B2163884F12FC6F897D9593D514E2B6A8530322C2DF0274A9849FDFFD2AB77522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Collections.dll
Size 253KB
SHA256 f0fe3fc9cecf713d5c29a2fecdf6aafc50b41efb8130a56af54b8c9330c1ffc1
MD5 5e013ce9a5a3cb2840b4a0d56f86c849
SHA1 ce783a1bc6c03b5082059d6935cecfed6944da8c
SHA512 8041a3486e1e72079a111c2354f242dd74a43ce1ab4e5dc76b05e24e17bc2654f1ad462358be14e2ea2bcc921e79a17c3ccdfecd2398783f95ed0d499989afcd
SSDEEP 6144:SnxoXLkDXDiKNYX8qTKfAyryS1rIgH3iPt:axCkDXDiQ+jTURrhFXi1
TLSH
T119444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Annotations.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.ComponentModel.Annotations.dll
Size 193KB
SHA256 9f8d4aaea363b146b5484e663d817f0390ff20583b397c124411c50210338ae3
MD5 220f983bea1b739e8377675444638699
SHA1 a2b93348725ceafe8fa7d83c928eedc092a6039e
SHA512 c325b1c959dff345b13a140c20f3103fb7f556ff13b68caf80dfe7f08b26d4e6a2de911b1cfc834b2867a4913a8acc0721295589587b3d281beb1b2de7a44ca6
SSDEEP 3072:fD/LFZEiJ4MxIQdCLlTXqMx3XNpemMWParD5/oE5bF6oaszQBB:bLEPMSt6MfpezWParmszQn
TLSH
T1D4144A3663D80616F7BB0678C9226921CBB3B8966722D6CF9554958E0F537C0FE32362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 3dc8bfbf3b542c45646a7057d3e945374c7b85db69c37f2a16794e88091a5b06
MD5 32ca30c430324b105ded9c880e2e9453
SHA1 1f0945383954c26312190f2059d71ef1591e95a1
SHA512 02c242e540dd9ff34ef8da2cb9f0d33adc17f8fefc7bf804a7d5904789d95bafb96d9dabceba70c92c6029bd2fb92252515315b9af0c12711dfe5120078473d1
SSDEEP 1536:+95/UZMu4zhd+Cv8A/oqevD2olsOnbktXzDv:+w43+S85qKD2omOnIv
TLSH
T114734B1823EC0126FBBD46BC9573A821A575F6831713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 534f82e18158a5bf76019b847a1f91dc8f54fb8075561d7678dfcab89c315382
MD5 7d5b13bd8e7b8911c0829c64e3f96db6
SHA1 a021ea71bed936351d56fdb2cadf8cfe6a8123da
SHA512 8bacb8788691c92f12f3df5910ba30f3228021dafd3f1b34a6203d7f23a86bd1766e1c03e9682bc88a6156a55b4ce54c65b5a3996f2ebcb445372bd22ab5ce1d
SSDEEP 12288:DHbWtrT/lAqmrIofhCXvdb+/ipZ7DvBEFBiXMS/e7QLohk+xLRxo:D7WtrxlmrNfhCXvdb+/ipZBEFBiNeMSW
TLSH
T181F45B559BD84A05DABF8278D672C801D570AC83533A86CB19D5EFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.ComponentModel.dll
Size 29KB
SHA256 d912b7e2d421a49a4eee9730764047f058a8d72c9b3618dcc195d6f427b55ae8
MD5 c561bcd4e57dbe2b16b4e294795c0a40
SHA1 8f3fb4dab0647f8c2245ce6006fc4398437f3bc5
SHA512 bcbfc4a08ae86a8fd4022a54aacc8cd34401dfc7bb1c3905a15588cfd15036fb2349f342356f708def2b96bd1810864bd0cbaa89943153b2db429e4a04bf70ac
SSDEEP 192:CW461WVqhdOk7+ASB7x0Yu7lWF+GBTBWseaAWAvkpTsX01k9z3AZTCJ/0b:CW461WVqhn+J0YMIlNKv6oR9z6GJcb
TLSH
T1DED26EA6CBA88213ED9A5E7056BDCB877D3DB3C54E02866B1196F1090D937C4EB3017E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Diagnostics.DiagnosticSource.dll
Size 405KB
SHA256 8501928426904a1b660447cb5cdeae888ec61a850395910a050fb33ba2541a14
MD5 8e2716fb1500a1dc46b2e03f963026d2
SHA1 756d4e8c141751db68006cfdca6675dcac0e189b
SHA512 c10b56888cbdd5481e833d43adc798b6adab8edb3d6e6100ccba761357badef2fbc10f7f9f5fef20c77f5f3749a73612f9442c79bc9765177fc97b38cf69000d
SSDEEP 6144:GsBTEcoc/FGFasNt2l4ru2jKw6xtQ7/tvjETqCZ03EdZZj4MKkf:dBTf/FGEsNtM4q2jStgjTc4Ml
TLSH
T100946B24E3D40D72CE6B9979C1DBC431C172924257D2DBCBA900ADD8AF1FBC1AD3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Diagnostics.Process.dll
Size 329KB
SHA256 4ca86970668d670a579db1c5733144048d1e52c2bb2e0892c86f665e39883f8d
MD5 897a74aba264763a5dd538d26b6c6473
SHA1 3a11d0853c4833ae9135f07eeee9554307604566
SHA512 1665540bd61d83a4e14652b33150ea2c01143b3237816efeb7b0d06610de70bbfaef2d6aae8d6bcf3d6cbb2d2b81053dcaaf614e467667b508ca3bf937c26b1b
SSDEEP 6144:svkD/qaP75vD9eEIdghrT9jb3b41PlmFEEZTdiX2J9:sMD/qAeDdqJg89
TLSH
T140748D247B980506FE6E96388C63D502EB78949707D1EBD743A0DBDA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Linq.dll
Size 529KB
SHA256 1b81642c1ee4f21ebbb57213c14e50df59aabcd7bf91de2eebdf4c0d9f32845b
MD5 7d69cbd4f96ebaab18b74203e37f5a59
SHA1 23c4ba0ebd3ae3a8e18e43854e1261d682cc6af8
SHA512 c7b3edfe8bf9f85115950da6aa6b010ebc9a1327ab99fbcd9313de89655f1cd8d15ae4f5cb16e2c52ae2da693c9d41a88a23ff98d55948dfda51d86622e2eaa4
SSDEEP 6144:/NYb3/ypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHuYzfhMxjCkoTcK:1Yb36S1hh8rwdh8UxeEvAEImH
TLSH
T173B46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995DEE961E93BC165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Memory.dll
Size 153KB
SHA256 4d6fe7d23c06b4e81748d83a1314218f31bb1e4ce9b6d1ebc7ba8a78a342833c
MD5 4807ee6fb0ab7ed7d308d67657af7ed5
SHA1 c8eb5f273d03097957cd99eb1cd28bd3defa5981
SHA512 15c4cca2bda3fde1de51e2783afe7dcb4f4d430a16d132594cb4fbe46ebde25eddccea27cab9de2a6e5b83d7aaeed6de2c2f7bf5a7cb3d1dcd494227a5a99725
SSDEEP 3072:hsyymN/j+0sbFbqX63vwZuIBo7M5F8966oYdACBuqmwvhtTihdNj:gmCb6oIBo7qDGACBuwh0
TLSH
T12DF35B17E2980657DA3FDAFAAD225302D7B36142672192CB4CE4DA441E53BD0FF738A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Net.Http.dll
Size 1.7MB
SHA256 8a7638d615e37d1b271c526979ee36b56c1b56193a33f5929dbeb29d1fa6d6e5
MD5 9ad75ca671ae18a8608aff8bd7fea9b5
SHA1 4168ec4f395f3ecf040b16297e7ba8930be6eb92
SHA512 51fc0770f8735b22d50f9e6db275245eac332c4cb4cfa22e1549cb91325fb706cb80b61a795399d10a5d86169dccd6b99cb5b6f35468c107ea4d057601275090
SSDEEP 24576:2tbStUEPt/z8tbT0SV+6hFE3iZdf2+QdJuIy616Ub4Pl5:2tb3EPt/z8tbT0SrvE53Et5
TLSH
T1DA858D09A3E88616D72FC67D856B4453C675E0878702D7CF1984FD983E537C2BA3A22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Net.Primitives.dll
Size 225KB
SHA256 ffb439ee971575c80749639eaa2593194de95dfc18eaaaa4011df9a39fb64181
MD5 973a3e46e93102d5c1ba0e1429b88a73
SHA1 2283b2c5d854004650cabc0bfedb4c14e1bea654
SHA512 7bd445d4d45b6f10b1509a2c5980cf6f3d8d812def745dbfe54b328b123836f3b7364f18e577e999483f55b9fffecaf1e553a0f2295c14de5910aaf0786fc06f
SSDEEP 3072:gwtBNI7bgkZrgyBHSchuzeQ4X1Sji6uJQ+Y6MFotKXxloV2O1weRx:X7I7bgkZrB0cgeQ0RJNtc0V2YXn
TLSH
T16D346C2A73D44E03F66DC5BEC657C502D372A9425B11D6CB86A4B78F2F837D1AE32122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Security.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Net.Security.dll
Size 653KB
SHA256 4f471c45207ae53ad01cb0d16798c0cd94fb29a8253989da8c2f771e6db5e7b0
MD5 31a77cb4b0854d94e5530ca07b30665f
SHA1 272180c2f613fa578d5498aa3c766f5ee76784e0
SHA512 b0c15fef7cb7e1581d0cf2a9dac7d11be101b6b2de8a6dbdb249d2431c19fd6932ad45d118d004364fb54b1cfad46c25f98bc1ceb19f24de8794defd3f63d4aa
SSDEEP 12288:b+afG3x4q0UTs4NmHRquQZhaDcscj+Ctk6p9uMmBaYcuS4:b+4GTgfyh3jK6fZsZcM
TLSH
T19BE48D15ABD40B25FAAF873891724461D2B1A887F712D9DF0684C88E6F57FD28739323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Net.Sockets.dll
Size 533KB
SHA256 096c5ca2b8868c50991f183f0cbf8b32326cbf197f9a6cebe132c5ab63513d24
MD5 be82bc91373496b7e66ed884b4dc42c6
SHA1 2bdfcbcf5eb9c14205bf610709e25e8086fe6f5d
SHA512 694b8c80ba239dcc8b4cc90a2deb52611b8bc9de248ad6505d3c0f7a92b4891466a2fdf003c60db53425535da572ff968f0bad3bbc77c85a983df8e074821957
SSDEEP 12288:LZSV7iKFtxaGNUL2Sdr5Nzv0SAu9FWc1APTE/0NYo:LZS9i+txaGDSzxAu9IpEsH
TLSH
T1F4C44A1567E40E06DA2F967CCD134042E7F0A5861B42D6CBC494DADA3F437D3A77A1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ObjectModel.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.ObjectModel.dll
Size 77KB
SHA256 015061c7fea90ceaaabe2669db8b8110249295e19a6a571363c8a581ad9ba7dd
MD5 d10b29dcb31dc4a40d6d4ba7dfbd5547
SHA1 68f2112e206fa2da19e20b8b6dfca1495017abad
SHA512 43ab0eb7b84e9ff279d1cf1c5fb991806fe6bb4554a83a623aec37094be70b221cf6e64de3f94c067dee8b9269fa89cdf701fe248ec194b835ab5fbfb006b5ef
SSDEEP 1536:OXtGEl0XKXrgcCGfN2QSsMWrHGI35uzEl:Ovl0CrqQN0yHGIJug
TLSH
T16E738D18A7C80727EAAD067DD1E25822F135F6E31323CACF45E5D14E0F93BD2663616A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Private.CoreLib.dll
Size 12.6MB
SHA256 7f48a9493a1d9f6c64a51c3ec357cf8534874ea62240a54c2a1570a5913148a4
MD5 3f64c06a7c0a7aaf48e7f95b11e16e59
SHA1 09022ca6e7be1ea52d1cc54af362ec7d915f74a3
SHA512 5214985658e7a6e3dba89154f57fb759884dc962ab70b5e19189cab2d288cdd459e69265f36dfadd64f41fb03f1ae4588e18c1719f360fa8efcfb113388e1b58
SSDEEP 196608:zmhH8mtl5F/v/u5ks5OtsFnyQvoNT/k9B5f:lglb/vG5L5OtsFtoNTaJ
TLSH
T186D69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Private.Uri.dll
Size 253KB
SHA256 7ce81174fdba93a1e12c596ea3e1ad4bcc9e798710292e1629cbe827ee34458b
MD5 fad0d4747aa546861652bcb7d37237aa
SHA1 96c67f217aed07466e4a1b571286939fbab6fa58
SHA512 bf8ba7d5bc35c3b7ef71b7c2d26217485c495a8963c45101e910ac70c4072cc44e019fe0332a10152bca50ed43d5e7f959dc848e7c3c9cecc38b7dd4b38c4bd0
SSDEEP 6144:1fAAcZQInBPKCeDc6Ci9MG3CMeVmtG+FsGu6MyN:aFODciMG3HamtG+fuVi
TLSH
T1A7448C25E3844E67F73DC2B981D3D112EAB270665315F7CB0AB5E1821F177C2AA36863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Runtime.InteropServices.dll
Size 93KB
SHA256 74a2dd12e1c0f3d9aca3f11e160a1de7a5bd4447ed8be3071377217a516f6874
MD5 67e5ef7bb29712cd647c9117ae76e48e
SHA1 0d590615d7d2216ff8a6c6b45f9e15586f4a141d
SHA512 41541cd2bab6517e79e71480289ab85d8c401238d359326267fcbeb25aac928081bd7a9f3e807c8d256b6572ea0eea76647cf71dccd7445e4906d38163914940
SSDEEP 1536:nDA6UupEelCtJfKS6+67NspnSPM+l5+ZkmVUKWH0ozkt:nU6p3lCto+dSPM+rCkm+N0o4t
TLSH
T154935A2437D84666CA2A473C8C375D50D9B2F6C613A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Security.Cryptography.dll
Size 2.0MB
SHA256 a998a46e2379d65412d54bb6f55e0eb5f16c3d856228882311f011c870c668b4
MD5 3aeb519528a9c9261221d8020025ad9e
SHA1 3072366c21d4f244c2f450fb1547d952ba5545ad
SHA512 25ca2f6458932b3a3942723466d84b68865efbdd8dd32c23b024eba8a78c5a0d9f3c52b28c9fd32c7e7f3ca63457650767e0f350e61cbe522ed434f04a5961de
SSDEEP 49152:RmRKWpxajTJDMgmJE2JjdQLxObmpwXa41f:RmR0JQgey41f
TLSH
T177957C18BBE44B5AD52EC57E83234402D570F58397829BCB2689CB592F53BC2C7B6363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Text.Encodings.Web.dll
Size 129KB
SHA256 a6bc1ad954c3213bba9b0e27a3aaae8321adfa0642ec679bf4452f7819c8ad54
MD5 b50bebd09bd1eb336c005e78757812e0
SHA1 c1aad99c5673ab6530fa7a2b0201ae9d8c508052
SHA512 f918bdd5998b7af2a3dab9b86d9396e91060837683b23917258de6dfa10c52daa5682288b5b219d8b72983bb7cae65abd284edf8d194ba506bd9b33e9134b269
SSDEEP 1536:ImTABQlE37y4m3E5T+zpq5D3lhjdPTp8K76+d05HzdyRNXV5pm4+SqUUkzG:ImTOQlZF3E16qvZ5N77uLINl5kSqUUki
TLSH
T161D35D10B3CCDA49DB2D9A749153A2B6E5B6BFF6032293D7156474481FB32C4B2BD0E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Text.Json.dll
Size 1.4MB
SHA256 a5deaf26b38846d1f6e904faf4fc6ce50958b1ffb6369f4505e9f6dfc2b37fe2
MD5 9352bc06014a153db4665c44b9d7d786
SHA1 63fb020d34d4e68441bb7745ac88b154b8842ac7
SHA512 d29e1a180ea97beccf524070e5a1c240b06e4b0fc2b59fdb8e42888602c33ec4e7ccfa7486d9ac237d88a872cb1143f4af32c0cb4cc14b030130e0d90e7d8374
SSDEEP 24576:Ptsm4uebl7dAfc1mK9U5MDv8rwAAjuR5K9Ge6RdWU3IM8cVnMBHlJSuS:1BCmK9U5kv8rwBg5oGT8cd
TLSH
T12A657D05EBD88717C52ED379C0B3C112CAF6E4225B11C3CB1464D9AE2E937C6967B1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Text.RegularExpressions.dll
Size 997KB
SHA256 6989d5ed58e0c9a7c0f1208496f10607240d4af91886026e661ffa879288e617
MD5 2bacea8c6c98c345b5bdf0ccf81f016f
SHA1 38cf36971ab885404dd86cfd0091397610db5473
SHA512 0600725db864c6bc81fa74ca26cb0285b7b5a96c863c289fd397bc0683b48c33ba45035af46bc467f885a358bb0d863014d2eb867ce273a70cc22ab7161f48fb
SSDEEP 24576:Qx/ds+Q+B/b44HO2inDiv67tAEehjonQfR:GQEb44HKivIehjc2
TLSH
T18F256C1593982F42C22FA23EC4978602D7B16C57636987CB4950FAE61F3B7C2E6F6113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\System.Threading.dll
Size 81KB
SHA256 76900e5c96b72e6e74477a90897f86c9f8b78eb2169010298cd4aecec5466ae3
MD5 a512c2446cdc301ba4598d5f5963bfaf
SHA1 7b6a72484dad6c24cb4b3f157bffa4c9b0aa9ebd
SHA512 19f4fe27372e1d4d9373b594013b6557c0fcb74641921c3e47e7ccf5d5a09bd3b5bc5fc0687fe658dbe1d382df5bdcbc458312f0a5ef6c5371c50d9b8bcc319b
SSDEEP 1536:U+goICPLFImrmODZcUBeZ8j0GEH9wdN3SGRm3LGgCRzy:U+go9PLCFtZ8j0GEH9wdN7R4GgI+
TLSH
T1F0835A1A7BE80416FA7B47F9EA729946C472FCD20710C6DF9059900C2E67BC1DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
MD5 e0c86bbd88d6b8f5643c1ab1c050a4ee
SHA1 f6c72b1fd89d0f9e3d7825a0450ae0c0af092c5a
SHA512 023a1054d7516ebb99b46ca3f9a17b1ee00e55a46356586513fdd45c42bd6ccca16139a8e93e7a9bc533afa5abed121cb5fd40474bfb27bca22da3598ebef694
SSDEEP 49152:MG+tDvarn9O+3KVv/s0upzEpOqw8k25Pj4LneMdTaGVW:FS2be5Pp
TLSH
T1E3859E4AF2AA10E9D9BFC074C666950BE7A274050314DFEF65E08A95EF23EF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\libSkiaSharp.dll
Size 9.0MB
SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5 ef1fabce43fe32ca83260481253f5476
SHA1 ad988af9826e5aacc7b8e5ed6d220b229d70060e
SHA512 f73b56742e43b169177ff49f639c50f98a417f91175c70f7348bde1c7570c2838c181a59b628b003eb2618d75da920a449a724cccaec1dae8b9a80d5aac386f6
SSDEEP 98304:4GKXmtfLM9j2KAdTzwlrdyc8HgGTngmY6+o/:cXmlLMvGsIaGjb
TLSH
T19B964A03B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF46F79615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offsets.json

Path C:\Users\Admin\AppData\Local\Temp\.net\AE\QsWmqsRL5dWjAXg3cTM1XPhIp0aCC1M=\values\offsets.json
Size 7KB
SHA256 148f8aca19ad140d3bf223cb7104715b0be6cb5e5de76e0468eae93686eb17ec
MD5 23c958a9530ba6872a8c384a2e2e763f
SHA1 4f9750b7e6829ea99ecc0c9e790fa591990c24c8
SHA512 c781a8dad7f6162d0b8ff47129da2a039f3437da609abc019f49a9468a0cb7bc627777e40f3463984f844a82f2a36abbdb1e520e14a41fc3c9e20bbdc5dc71e4
SSDEEP 192:uWKFNPTCimlrT+NNRRLKyGWmevujwl7eAzOI:uWCPayDRLKyGbevu0l7/OI
TLSH
T17EF19480AFA56DBA1C2AF7751A6F76839CBB747551074F89B0F8C20C20C957E3649A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug_memory.log

Path C:\Users\Admin\AppData\Roaming\AnimeExpeditions\debug_memory.log
Size 4KB
SHA256 ca2046b6d0f8e19fa0996bb1156a52c7be35f6c2f40746c7a0ec414d20e71a60
MD5 ead4ff59ea87a1c6a81b4bd0bd1fe62f
SHA1 e2b0988c30e7d1634a19ca741b95649e5d911129
SHA512 ad573f43975ee5f99d92b2264c30c618e9402312d766852fdc9ef5b4507eda5a4c583f446e237b5cf5dd1a700218f4670a1f585852e899a013ffa730b3307ca3
SSDEEP 12:iVxretK7LuKtx0Vuj72fWfSw7r046KvtjRL5Y52N/26IvNnVg0gtWTel3QLKNQKS:ytfqu140CqZI7ogGBt4iAsjgxw3K
TLSH
T13A91B7F8C36758362777464DB312E172EEB98A8D685E87C4CBA6B09F1F0201D35728B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download