f377c955c15cffc9b4d4744a787d667c7b1a53db85443c0835fef1daab05b57d

Resubmissions

09/08/2026, 11:10

260809-m9qsjawgpe8

09/08/2026, 10:38

09/08/2026, 10:38

09/08/2026, 10:23

09/08/2026, 10:23

09/08/2026, 10:11

Analysis

user interaction
yes
max time kernel
899s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FILES.html
Size 253KB
Sample260809-mex85adn5v
SHA256 f377c955c15cffc9b4d4744a787d667c7b1a53db85443c0835fef1daab05b57d
MD5 f5110de3e1e906c747a31cf0018d5452
SHA1 58a94c590ea51d78c5ed19ecf6bf021fc4c9954d
SHA512 c4f924c2abb0aedd7a778e94fe987b1e39d3233eccb37ab0c7f538ae073f181a7e7ae336fc658240a36a1ec54592efa63e7cc5d6e3cfb71ff11edd9d015fc1b6
SSDEEP 6144:QKUeWC8M7kNUREMP82ZitwKl3p3ZWJ4X4j1crVyoJSyPbsTQa/5dn3BQ/y1ma1/A:nUeWC8M7+UREMP82ZitwKl3p3ZWJ4X4Y
TLSH
T12D44D7B1B075E23D025F269AF0B09754C3D7A39BC64969E2813FC7E842D2CD8FAA3155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
119	1624	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x96dbg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	x96dbg.exe

Executes dropped EXE 6 IoCs

pid	Process
740	x96dbg.exe
5656	x96dbg.exe
5932	x64dbg.exe
2924	x96dbg.exe
5356	x64dbg.exe
6100	Loader.exe

Loads dropped DLL 64 IoCs

pid	Process
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
5932	x64dbg.exe
2924	x96dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
117	raw.githubusercontent.com
118	raw.githubusercontent.com
119	raw.githubusercontent.com

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	218	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a2860c96af88946a	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1624	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307446118857123"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon	x96dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\ = "x64dbg_db"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\release\\x32\\x32dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6CD08DB2-02DD-4B36-9D5F-9F60677B3DCB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\ = "x64dbg_db"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\release\\x64\\x64dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5932	x64dbg.exe
5356	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1108	msedge.exe
1108	msedge.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe
5356	x64dbg.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5932	x64dbg.exe
5356	x64dbg.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1360	7zG.exe
Token: 35	1360	7zG.exe
Token: SeSecurityPrivilege	1360	7zG.exe
Token: SeSecurityPrivilege	1360	7zG.exe
Token: SeDebugPrivilege	5932	x64dbg.exe
Token: SeDebugPrivilege	5932	x64dbg.exe
Token: SeDebugPrivilege	5356	x64dbg.exe
Token: SeDebugPrivilege	5356	x64dbg.exe
Token: SeDebugPrivilege	5356	x64dbg.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
1360	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5932	x64dbg.exe
5356	x64dbg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3036	3100	msedge.exe	85
PID 3100 wrote to memory of 1624	3100	msedge.exe	86
PID 3100 wrote to memory of 1916	3100	msedge.exe	87
PID 3100 wrote to memory of 1916	3100	msedge.exe	87
PID 3100 wrote to memory of 1916	3100	msedge.exe	87
PID 3100 wrote to memory of 1104	3100	msedge.exe	88
PID 3100 wrote to memory of 1104	3100	msedge.exe	88
PID 3100 wrote to memory of 1816	3100	msedge.exe	89
PID 3100 wrote to memory of 1816	3100	msedge.exe	89
PID 3100 wrote to memory of 5088	3100	msedge.exe	90
PID 3100 wrote to memory of 1816	3100	msedge.exe	89
PID 3100 wrote to memory of 5088	3100	msedge.exe	90
PID 3100 wrote to memory of 5088	3100	msedge.exe	90
PID 3100 wrote to memory of 1028	3100	msedge.exe	92
PID 3100 wrote to memory of 1028	3100	msedge.exe	92
PID 3100 wrote to memory of 1028	3100	msedge.exe	92
PID 3100 wrote to memory of 756	3100	msedge.exe	93
PID 3100 wrote to memory of 756	3100	msedge.exe	93
PID 3100 wrote to memory of 756	3100	msedge.exe	93
PID 3100 wrote to memory of 5068	3100	msedge.exe	97
PID 3100 wrote to memory of 852	3100	msedge.exe	98
PID 3100 wrote to memory of 5068	3100	msedge.exe	97
PID 3100 wrote to memory of 852	3100	msedge.exe	98
PID 3100 wrote to memory of 4920	3100	msedge.exe	99
PID 3100 wrote to memory of 4920	3100	msedge.exe	99
PID 3100 wrote to memory of 4920	3100	msedge.exe	99
PID 3100 wrote to memory of 4624	3100	msedge.exe	101
PID 3100 wrote to memory of 4408	3100	msedge.exe	107
PID 3100 wrote to memory of 4408	3100	msedge.exe	107
PID 3100 wrote to memory of 4408	3100	msedge.exe	107
PID 3100 wrote to memory of 888	3100	msedge.exe	113
PID 3100 wrote to memory of 888	3100	msedge.exe	113
PID 3100 wrote to memory of 888	3100	msedge.exe	113
PID 3100 wrote to memory of 1948	3100	msedge.exe	114
PID 3100 wrote to memory of 1948	3100	msedge.exe	114
PID 3100 wrote to memory of 1084	3100	msedge.exe	115
PID 3100 wrote to memory of 412	3100	msedge.exe	116
PID 3100 wrote to memory of 412	3100	msedge.exe	116
PID 3100 wrote to memory of 212	3100	msedge.exe	117
PID 3100 wrote to memory of 212	3100	msedge.exe	117
PID 3100 wrote to memory of 212	3100	msedge.exe	117
PID 3100 wrote to memory of 4276	3100	msedge.exe	122
PID 3100 wrote to memory of 3324	3100	msedge.exe	123
PID 3100 wrote to memory of 3224	3100	msedge.exe	124
PID 3100 wrote to memory of 1196	3100	msedge.exe	125
PID 3100 wrote to memory of 1196	3100	msedge.exe	125
PID 3100 wrote to memory of 3384	3100	msedge.exe	126
PID 3100 wrote to memory of 3384	3100	msedge.exe	126
PID 3100 wrote to memory of 3384	3100	msedge.exe	126
PID 3100 wrote to memory of 2180	3100	msedge.exe	127
PID 3100 wrote to memory of 2180	3100	msedge.exe	127
PID 3100 wrote to memory of 2180	3100	msedge.exe	127
PID 3100 wrote to memory of 1360	3100	msedge.exe	128
PID 3100 wrote to memory of 1360	3100	msedge.exe	128
PID 3100 wrote to memory of 1360	3100	msedge.exe	128
PID 3100 wrote to memory of 3432	3100	msedge.exe	129
PID 3100 wrote to memory of 3432	3100	msedge.exe	129
PID 3100 wrote to memory of 3432	3100	msedge.exe	129
PID 3100 wrote to memory of 2888	3100	msedge.exe	130
PID 3100 wrote to memory of 2888	3100	msedge.exe	130
PID 3100 wrote to memory of 2888	3100	msedge.exe	130
PID 3100 wrote to memory of 1288	3100	msedge.exe	131
PID 3100 wrote to memory of 1288	3100	msedge.exe	131
PID 3100 wrote to memory of 1288	3100	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FILES.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc04f7c188,0x7ffc04f7c194,0x7ffc04f7c1a0
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,365810747059254311,17983980349516532316,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,10510855732927319464,963212242064280961,262144 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,10476826821697485476,1451483708651243113,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14627810964681642586,14807906805868827628,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,10508035764165430926,7686870704095925519,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,10462834981054124086,12123263085951452442,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,1336458871929986205,9810190657538800132,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,7490199528702782703,18289870919576166033,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,3901649330461391341,10834985948289546209,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5676,i,6471564130417187528,15616520127177143400,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,135758986453098160,15738289322546616470,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,135758986453098160,15738289322546616470,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4152,i,7607645572677715843,4847706331418060968,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4176,i,18139478786018424221,3331922110187132470,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,77854732594658321,16778998835949718336,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,13631338631279648532,8007357748513200534,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,13116399749388640142,17676130269963139486,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4252,i,12189401790831876718,17915838968366220936,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5086781072937700660,6787737116199663703,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14216969793155415877,1563061853329032238,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,16692762216628442533,9146218169097018324,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,8790017199686098491,13525457944869039865,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4532,i,10171635940232971654,3561868459810723687,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4172,i,16534459452834945960,11232400859319447100,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7052,i,6662380297889190612,1544031244825945491,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7264,i,17216092712230462889,6859803168540200594,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6808,i,13409087748848602652,17241752532132951416,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7076,i,12698002668621673655,9256903580906473886,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7196,i,17905040511348221842,6680944538399537012,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7644,i,17677399546869338834,1933792233594107163,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7636,i,14675611518413275225,1229633544651452570,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7336,i,3311584740425013424,12035185944864446113,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12526470157189511114,12266141823965535203,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7868,i,8933573221796881220,14834889863671176880,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8404,i,4143797431868647502,3520013990185094410,2097152 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2748,i,16965992431418572010,5952435350785896721,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,1984729107008811332,18322640153343837886,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4992,i,13777950607005023648,7241630025609989607,262144 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4701010107642939490,14814595305560841693,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12653397851908884728,2045249215473947748,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8708,i,13041479270433391741,7607286089153861043,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,15237331081033788532,257591075619114160,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,3551881780684614004,2388503402525034764,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:8
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,5384757829226417745,158207351471726315,524288 --field-trial-handle=2288,i,9017987352580236146,13950597077386778518,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:8
  2⤵
  PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3752

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap19317:112:7zEvent23427
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1360

C:\Users\Admin\Downloads\release\x96dbg.exe
"C:\Users\Admin\Downloads\release\x96dbg.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740
- C:\Users\Admin\Downloads\release\x96dbg.exe
  "C:\Users\Admin\Downloads\release\x96dbg.exe" ::install
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5656
- C:\Users\Admin\Downloads\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\release\x64\x64dbg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5932

C:\Users\Admin\Downloads\release\x96dbg.exe
"C:\Users\Admin\Downloads\release\x96dbg.exe" "C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2924
- C:\Users\Admin\Downloads\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\release\x64\x64dbg.exe" C:\Users\Admin\Downloads\Loader.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5356
- - C:\Users\Admin\Downloads\Loader.exe
    "C:\Users\Admin\Downloads\Loader.exe"
    3⤵
    - Executes dropped EXE
    PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f102d98965064c744395abd5324e88822ecbf74476a436b3dd1b82dedba03150
MD5 97436585e50d5af267582f6798050922
SHA1 69371bf8520a4664005429afe150150a9f6ffc19
SHA512 495651198da5cafa3e71b17c65c5ce9a130dde49201ed6200acafd6b242c565f37e884e18c45cce0bd51c3af04303e6b4f689c6405d88ac9c989d42fcb9662e7
TLSH
T182E026C808C9C62EB601788761B8774CC2C0364FDBD8F9AA1B0888857306040F2EEAB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d7ef4092df4cbbdb0fe161d240e75cdbb103cf75cc6edda64250960de6f6c050
MD5 4fecbb3f3fffdee09c4cb48d88e0803e
SHA1 a59fe2c0b3e41d414dca880a08598a012505952a
SHA512 70d36b6fa216d78b371db404512a155d291c013a593b685445f75fe47e3deaca3e273eb426c778d1a58229da8d549b4065db429b3e1e6d9f72d220a75eb2371c
TLSH
T1F8E020D905C4C23D5600AC8BD17C5B0CC6C0360ED7D4E9D92B248C447145644B6CB971
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 633d07f988d38772e559e6b3237405586a84f67cdc0813306f4d14fbffe07762
MD5 12e9907fc06f7dfd8c7ae3fded48a16f
SHA1 6154258520fcd3ee817a6030ebc759fb8f9f8594
SHA512 bd92c74ff1fe9769604bbcb4255bcfb5e765ffef144a3dc481196fec65d577f88feffc427257211ae062df0d15d1724087368793e9ea7552be5101a6bfb00b09
TLSH
T14FE026CC04D8C22FA60074475B7C670CC2C0360E9AD9E9EB2B198884B282840E2C6EB0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 21KB
SHA256 6f32da94d4f26e98cb6ccd97034d306aa38945322c816f54a93c7d15dc0905b8
MD5 2c20035257a126aec473203c38baf276
SHA1 cea71b90976aab1ed5d2c1324bb4b09be960e15d
SHA512 c94fb11cae0ed5a7870ac53453e1917fa4e09dde68048a48071798b03c395e97efbd55b45a0360775525bbfd2a24e6d81ea0cb9ccf0569716735ea4d02b50465
SSDEEP 384:X7cRxmywBqrZEV4zWI1TdquIrkzoCu6DzCgpGhH7P2kqwV3fofML:X7cRYdMWI11gZC/o72kqwV3fofML
TLSH
T1D0A2D055FBA8B200E768257A25EC85D9C8B83F318599BF0DCA6B40C60D73DBF06CD192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 22KB
SHA256 9c4f02f38678f2628292d66c4f7a1a6a06af7ffac4d279359b09074e7d0f1fe0
MD5 9e38e04780525a20f28d6c455901b2cf
SHA1 9a8514b5e462d06a2b6a4f31e60b97c48272f58c
SHA512 15efa4e8efdb92442e270606f13948aecbf4902a7ccba2fd186bb0bea52feb59530fc922eb4ab603c70cb8cdd26b5d5b2d8318d0cf61f26a96099df38dc694dd
SSDEEP 384:Wnkgg5ugJYnmChrWRPP8mVjX23owWnt4Powv5/cwR2TkqOOCjc/V:WkgY2mcmVzhwK6AAkwRbpeV
TLSH
T18FA2D0EF49DFF985CA334058F4FF0CB982365178E7AA60EF1194969660888F24432BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 77KB
SHA256 ca9b4be6c3a282e6232cf37636a470c91b3ec83cae37bec36e17a0ad788d1cd4
MD5 c92e93928cd42b74c9dafda355e4acb4
SHA1 f232ac48fb226ad169cbd2f3f5b60586749f0047
SHA512 4721a62b682c38e86b14ef2f7bae074d763b23dfec8e22b60a8155641dfbac5d4ea9ad7befbb10bed0600e17f542d59113737c5b6704a60a142347fda30bf5d4
SSDEEP 1536:NP2s5OqoTWINBvmdLFrHaVwftMUh+xTPVg6+mLN/NmDQMeU/DPgJcQkE/3:N95ObiI/+dL9awf/hITPVtHtNKDeKScG
TLSH
T1C2731228726196FD73E72C4A660EFAC5FD7B17602CF84E1C70663E604A0D269D8F80E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 fa803fa42731fe32c12d30a8dd218836a56984404d7bdb69cd10e51e97787bf5
MD5 2bf4ee9022d8aa7f7329bd0d242e9523
SHA1 3018557670a71428b008b6c8b93e653059382e68
SHA512 0a1fcd172ca97e9f76ba4f25d1705ad273b2ebb54d36d4f6de5e58b27973ae78b5c9a114d3d1b295d3fc62eea4b587cd0c561f8ca7c225602cf3893b31461d56
SSDEEP 96:KcHHGewaEfUiTRVfysOzYtS5xzyzJoKRgOKeByE+FcezkOQfv21QlwPVk:inX8Y/a3zKyxROKeBLUcoo21QlwP6
TLSH
T169229674BD8979A1FFA0243397EF8C25313441EBF4031EAB439A3D781656390AB8E1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0f53.TMP
Size 2KB
SHA256 8599b09fa64e575a02bbc911066cbccaeea9d0cd4b950942443b65b2a1bcfedc
MD5 a6b3576eedc849ad440cdc7513af197c
SHA1 adf55f6d7d8f4653ba8d198b47067e6c3cb20711
SHA512 ed8bc3cd533687c93ca063059b7b29b8a47a28786037c42d9776f5d1ebd37ef53732d3faeee4b6c675e8b225c4bcf79beeb741f1afd3aad517325aedeac5303f
TLSH
T141516E3C1A110862EB900433F0FB8A54B17985DDFA13AE73C5B35D7A1B0A321C00D389
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 6d289ec935c0cb780423f6027f2f5f67638d6443c1702f6564dca8bbe5d2a272
MD5 bc53c05a39b26db643543f43f103e980
SHA1 c1d4eb322aafb74af170fde5e39db2c051caa714
SHA512 8d7dd3901f3fde455f68b5f8a137fd7b9d77674def4a9ecde20cbc47b06a7755e8d12b9bd74f60a06447787fab55cf3962db95f7d681c5df2c9509b370db617c
SSDEEP 384:DJhemLL1vcrxIt+llBw03G1/eTmDmzmBmtmDmjxikSD/r/kfIVpdWWvmBfhitNsm:fFiSQ8iYIKFh
TLSH
T17152CCF787E9C62DC92255F19B146E1ACE5C0518831C3DBAC9E5BE4BA3E3071E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 17e60d2c428264b2c57ebea3625f7f8cc39d865320a961a7e5e9fa87be8ddfcd
MD5 062a26db2b84a028c078ec083b250a50
SHA1 2de6aec4bcebc36049a422fe2df605f169ad7f45
SHA512 1109629b9c31b0feb01ea2ad7164c3689718626412d384c097cd09eb0dddf9333314ff5a7188f68caea9c46715fe415c07a6297324553571e41b44d4a1853d1c
SSDEEP 384:DJhemLL1vcrxIt+llBw03uNiRX1/eTmDmzmBmtmDmjxiSD/r/kfIVpdWWvmCYspI:fSiSQ8iXIGlA
TLSH
T1BD62EDF787E9C62DC92255F19A247F1ACE5C0918831C3D6AC9E5BF4BA3E3071E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 bd5fa3890565bf0a7449b97d622578cb5b614c976b65b9ba695cb580cc84d266
MD5 bbbc8747d756b55f8e06c33c99e1952d
SHA1 951e171e458892a1808db229483a2b961bb80119
SHA512 3ff932f6b4e8a3aca5b8e17ad94a87d8b7b640d8cfa384a09a035ec86a4f72594b0bb3e46fa6153d18501c32a6c8b67a57709cd45e98e229676779cf42a2c137
SSDEEP 384:DW6Dmvyu+Hm9tnM70SYMv+5f6X1/cPmDmzmBmtmDmgxiSD/ik9sVpXYgvmrYsplr:kAiSQ8iPafKQv
TLSH
T1C142BBF747F5C66DCA2256F1DA146E1BCE9C0514831C39BA89E1BE4BA3E3071E141B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 8f46bcb49af73818aebdb8074517590d6269d67b37dd69035adaa1bc39b3f757
MD5 74f8a1a5957f1a364d163b78f78e9aec
SHA1 2425642e989766a6b6c86dc80313895928af263d
SHA512 7639c4be1cd37ba690ee6e6c849f9e709584c9936fc783df65b9e79823367348c66be40142cec9548909818fad1c908fcbe93bb92ffbd88cbaac5c0f3a8882dd
TLSH
T1F1D022A3178030B9A66CFEA180AFEC8FC32690A08862DDEE71E0989C053286D1607644
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5939d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5939d3.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a70b3515bc84514f4f11abd095524669adff338209a85beae0d575f432695fdb
MD5 c16af91c1f783f455476beb12fa6f83f
SHA1 0eb706a51e47da4290c7b396b076e4315091b781
SHA512 77b58f850c7b812a2ac5486c545dbaf748ff2daf5df485865451af3b32c5fc087466601482c64465e0944d08562f6a204702fe010f78c6a9eed5967beded985a
SSDEEP 192:sxZglkS/fQsqOZMIdpdJHW6+WNGY9IKIvhIgrJ:sxZguS/fQsqOfTHbGp9
TLSH
T12322C9526E38A47B8CCBD20DBB19BF13D6F95032A1951E58E6FC961C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 77ccb2a653f1c7861718cf74a420f0ff003241a2f7a028e72a26874ad81ff474
MD5 3cd7cb149f934f806c4b52aad330cbd2
SHA1 32845ebc54a8450270c4ac0adda9828d256ad10c
SHA512 10a2ef6c93645658670aa3ec3d1cde1e631e56ab53b37fe47fe34cc0aec44ee61dcdd5e5b29837f0a0f6bc2a05d10b8c1bd591992058e64f99f2710dceea3946
SSDEEP 192:sxZVl0cB4S/fQsvoYjU/dpvVF8/IJuhyHW6+WNyjmsqQXqsyHW9/Y9IOLvhIg50s:sxZVWm4S/fQsvoJpHbiNIE/4XNwG
TLSH
T15662D892692499778EC6D619BE25BF13E7F90032C9856E5CEAFCC51C04EB7ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f1db4d8cbfa0ec1819ba17fb90fefe4b8901421756223bdba034ef75a8ce1778
MD5 f9b59e33c271b3c4627d32baaeea39e8
SHA1 d0491974eef193620df6cab5577eec29d16fa7bb
SHA512 962336876329d806f8efebdc17ade43612043bab63444946ae05e376a7193cfa20ecc6f33d3781e776916e5696559ff67ef4ed397ce8ca016a96cc3f0b8bd21a
SSDEEP 192:sxZVl0cB4S/fQsvoXjU/dpvVF8/IJubyHW6+WNyjmsqQXqsyHW9/Y9IOLvhIg50s:sxZVWm4S/fQsvomHHbiNIE/4XNwG
TLSH
T12E62D892692499774EC6D619BE25BF13E6F90032C9856E5CEAFCC51C04EB7ED2207C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4e4d71e22a663a645fef1b3e5f951436c3d3e2630282107942eae29e774c99fc
MD5 c7378c5b56a159cabd51ab62745d3b2c
SHA1 371f21dac5422260d430892cf40b24009751853a
SHA512 ae633f959249a35ab6866f6e028653579c3491175e561d686bd303203d5f4bfc72b6c23275a27fa8ab656fc119592acf9a31340ff3f2531a007cc9283e9de144
SSDEEP 192:sxZglkS/fQsvOdMIdpdJXHW6+WNYms/Y9IeIvhIg5SJ:sxZguS/fQsvOrDHb2/t8
TLSH
T1BA22E8126E38A87B8CCBD20DBA19BF13E6F9503191951E58EAFC861C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8e5645490e93623a1cbf8e58a9bbbd1ddfa0d1d6b0971f47faea795dc8106244
MD5 d75b1529a6d1c14addfe4e6e6cd1b670
SHA1 6021d8003fc9dfff80575183a95f36fed5f18961
SHA512 78ff8323891a9c3bab321fa2ab91096704ba8f41176f176945377ff6b5a61d6ecba6eb8b163f4d89b76d49590e516a67ed5e4a6ba13b951116fcaf47bb994d4e
SSDEEP 192:sxZVlWPS/fQsvodMJdp9VLJXHW6+WNYmsqQX/Y9IhcvhIg50J:sxZV0PS/fQsvoilHb2N/4O
TLSH
T1D232D7526D38697B8DC7E219BA55BF13E2F5003291952E58EAFC962C00E7BDD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 195875faf66cee091b98049c1937b74637176f651a63fd4198f094e54853644e
MD5 e15f6eb090217495fab29a4226b47352
SHA1 0ad6dd03ffc830235a921f5f0ded04f646b7cfad
SHA512 454de27a972391393e33cc7b11ed704a11b1d51b66c03b0e9a20d7e3724af9c495d7333cfdc69805a666d223c2df440eb877328253e95d0d4b5f21bd78590a07
SSDEEP 192:sxZVl0cB4S/fQsvo/4dp9Vw8/IJueyHW6+WNyjmsqQXHW9/Y9IncvhIg50SNwG:sxZVWm4S/fQsvogtHbiNE/SXNwG
TLSH
T17362D992692495774EC6D609BE35BF13D7F5003299866E5CEAFCC51C04EB6ED320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5992e10d71c306823e97a63c52c932f6c80379fb4b86563577788b735063c1d7
MD5 3fced7c60d5c24b483c8cfeb5b22a435
SHA1 5b8f61544ca886f2877866166cf389748e974005
SHA512 4a7277fc995d1037e14d7dd949e51038df60fbc529943fe337868dbfcc71d2faec6acd95d30bfc97b075b4b8b38788ed56748376bb563b0891bb19011b588723
SSDEEP 192:sxZVl0cB4S/fQsvocv4dp9Vw8/IJuRyHW6+WNyjmsqQXHW9/Y9IncvhIg50SNwG:sxZVWm4S/fQsvocQQHbiNE/SXNwG
TLSH
T13462C892692495774ECAD609BE35BF13E7F5003299866E5CEAFCC51C04EB6ED320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a998192c561b3fa523e47f5c47ee765db3bb2076d1af11477c2cb9b45d296254
MD5 bb8048f032a2df8b1a4e9d1c04f57100
SHA1 aeeac0c87a7f85d8ebc42d2d1cae40be05a6166d
SHA512 81a7c3642708bbd15abf5007e3fb652e36b105a0e7f7ad04892f36de9125fed75094dfac56d8729c51b448fef3a60c39946f8cc301e93e42d47912525f54f365
SSDEEP 192:sxZVl0cB4S/fQsvomjU/dpvVF8/IJumyHW6+WNyjmsqQXqsyHW9/Y9IOLvhIg50s:sxZVWm4S/fQsvoDoHbiNIE/4XNwG
TLSH
T1E972F892292499774EC6D619BE25BF13E7F90032D9816E5CEAFCC51C04EB7ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 17d78e9f8680b9f6876c42f64a4cba59beb2ac060e014abe2c658effce142be3
MD5 76a8747bceeb3067c6a077b874a71d0e
SHA1 568b2b976a01efd3d59e4a8c65797203e36c739f
SHA512 762fa03c1d23bcd79225bde7e8381f93299f70d7c6fad6684a60554a13cf6d8662ebe7131bfe5d0e9704ebde1e0fefc2c545c73a47730e612fac56396cf58905
SSDEEP 384:sxZVWm4S/fQsvg66s8qMpRiYnazAW8pZS15posJWeT+qmHHbiNIE/HXNwG:stWm4S/fbg4Mnc7WeT+qoHb23eG
TLSH
T12AD209426824C8779FC39D18683D7E33EAAC406256C5DEEE5AECC91C019E1FDAB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4392c406bb04a358346dff165129cc69f017368c48bab20aa86a7cf1589e8286
MD5 69154190241f370f542a1e40771fea0d
SHA1 173b018233a3784c640005259af585f057101311
SHA512 4138b14ab2cabe608c74443c9bec80a353d9bf19075ef025b0c761bdf9249168b2342fbb1da506b4cef0b4a95dafe491feac7c032c74b4f5ca27bd1376706f34
SSDEEP 768:ZjyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7WrombqI:ZjyvIZwWvu+Q+u1jamFLeR7tml
TLSH
T1F8C2E92B240CCB7E5F801E9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0cf7a7dd-42cf-44c9-93cf-50ba652a19e8\index-dir\the-real-index
Size 3KB
SHA256 ee3476c997eae3ea59a1b7ab22c8109552e2e3ed653b24173cf07aa3242c5882
MD5 8a8697309071003176200029892c0d9b
SHA1 c3859def0a589c3d644c8bdce7ad84c426257979
SHA512 1a2827828942d22f760fba79469d47672bd786a5250af33b66bace0a2d3f4f5cdbdcf1fe72ed9c489a9e0087991eda4b3b067fc09f3ccae171d9a23839ab2bb8
TLSH
T1C4511A8E8C461D5DD8AD14B25CFA2441B77A68EE97859A0B2B9CA4307CC333E1D55254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59edc1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0cf7a7dd-42cf-44c9-93cf-50ba652a19e8\index-dir\the-real-index~RFe59edc1.TMP
Size 48B
SHA256 7821dfeb3c09081a8ec5f22e20ea964b98b7148850e77f244e1c9eea504b9f09
MD5 82724123312485dce544d88e5472eb38
SHA1 874d5a486b3a435f86448fa3376ba9b42e656636
SHA512 1a2165a75988d65185fb55a41ac3c317c347841b86e1ebd069e80795765960f7948745c92dfc7a2fa5550ba73380a85a3468e88813c7f2e543516d3d19ebcda1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 99f3e687af045e313a506ea05cd1782ca6260cdd45fbdf4a920d016c3aa1c730
MD5 7f21070283d8aee865b3f67561a4ca98
SHA1 51c7c2a2d6ef69d51fc5444f9baa665a141aa6a5
SHA512 8d49c6a1752a55c62809355f8209b49005bdda7c777b83e9871f3ed7a7d93470af82468565060c4a5a732c9ef667b586c6059925c3a8533b3ef7a5ef32c18dcb
TLSH
T14EE0687628F314309DAF97D654B210D804097C54CD84FC4F209773C311B02562816C21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 369B
SHA256 70a0c26c71ae7cd9efac3a0e395ac98cbede1f2f9a6c1b9a2fdd77c2e05d3595
MD5 25a9a1b23147d9c9d93bf9023bf75802
SHA1 2d1bdadd17f4df5968a60d7fbe3fea6be9a81f97
SHA512 a257f5f3af726d542fff15a4a3a51d7c7a27277da3d858220460b9dca53425c0f3caab8ee3b47908c429e1061958801ea1e307aee813677c1aae5a77cd8c7581
TLSH
T116E0C0B628F314309CEF97D614B110E8040D3454CD84FC4F209753C341A03552807C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 70993f5f11f80402eab254a9d2b93730418a2046109acb4c60d430fe0cd1a1bc
MD5 c155ab155f9a45172d50149884384684
SHA1 a2e9459070a95464bcb8ffacacbdf6c17160d808
SHA512 9ab73f4963ece11d2050954795726aae1d61f55a93ce1c1bc50377a307ecbfeed2c2561ccc4fa3b75deda5eba5cbe6fa0cc6ce8ff25391c5df2c14cff3dc39ce
TLSH
T115A002B8CF4BA181C94003B021B242CD6B10CE9B85052321D8F9205AC86754062C2564
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d0e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59d0e3.TMP
Size 48B
SHA256 8b9457fa1b0d7e3876157c3be88b0aa25cca6928a33ee5f717dca805bc0217e3
MD5 209098929850341114cd2e64041501af
SHA1 df598c760deb602cb64c8ffc3d339850b400f13b
SHA512 5f6b7bc8e02a19a03d13ce57064ea42233e2874e5e72f2f4f32af2549459d9c917554d0565651a78fc1b1e931b92a964dc1f34be7f98cf149da66c90bebc8a18
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 825c8010e15a9c9d7298efe2f2d68303dc5adca10b9a412fa347523fbf44271a
MD5 f69dc455944bcc1713f0ef1f1d303c12
SHA1 4345a3c81166ce98008a6d29067896e40e45a3b8
SHA512 a4813fce95a800148036f0b4e68c528bbe0c836b6960cbd604e005aa43a9f1a61ac38a2162d81251776a4ce7a0d03109afe00632016cb10ba5f44e1aa4c246ac
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDidb+KIcyKKgKnK+:mTTN3p
TLSH
T179916546307E42913D7EA80CA3A5952ACE453062741CE97FBFA810A25FA7E155CFCCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595d68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595d68.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ac307dd5de46e5f74a9aa4652808739cc495b30ee1d488539adc732e41acbef3
MD5 f046300569aecb430f7cccb7efe913d4
SHA1 af8f85b9efdfd69f003c71c793f7338fbff3b692
SHA512 27cf4c54aeccad72268f472396d14fc1fee512a5386882ad08b80822e40323d6b51899b2b87cc6139dce27a4e55a4333331ddecea18c9e6fe54d60df86485567
SSDEEP 384:GZcIhsNTjkukzimTGdJe+C9d6NXellnTKwBODNZOClKDA:Uh3dLGdQFzlnewBKZOuz
TLSH
T1F2927D756C381C6B9FE2E505F44B35079EF891B3E6C93B64A5ECAB1C01EA698130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f31c6dde35f67561fc76f16c23e5c3b2c871c310f8e2019524dc9bf7f24fe18a
MD5 d3fefaaf4c52b097bb113a278a140bae
SHA1 df8057633c8663bc67f2e455028d7bbfe056dc90
SHA512 8dc94d664b170389bb32f0cc26fcee785ecb80e5a0b03b9ab03340a12813a35ab9aeadbf8d757d9404026821698ff39f737d0aa6cd59fa0d9561de5d5e50c3b5
SSDEEP 192:JONWS6v+YLNQmiUy9X9yZh+CGX+FdeNNmusYpU6:JONT6vz/atyZh+C9d6NIMU6
TLSH
T19002D835AD382CAB9BF2AE05F48737135FA4117BE9962B94DAD82F1C01D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad33e340955ee53694a548b6067b35d779187444b0921356e4fa540c351bf524
MD5 56e72b163d2f3b78aa81d3597d722c94
SHA1 a3c1bc97006495115900d323bfbd6eba00548957
SHA512 986b4ad48e116f3e8f6fc1a55fae7e47e46e93076c69730faf28bafc6b29779329ccdcf7ea3b682d0fb4fd135e3f9188c0ff5f062013e42ab83fba4713e2ad38
SSDEEP 384:OiFiZcI3zsNt8TUNTUlIlST9ukzivT1d9e+C9d6NXeelnTKwBODNZOClKDA:lFQjcwgodM1dcFIlnewBKZOuz
TLSH
T148D22AF248E7487ADAAE9707E73E2D034EBCC063B5856A50B3D85A0CCD961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b11338d4ebf9d6a14841e132d5791be9b61c5599f61bdcd216d8848eee4d6e89
MD5 c253b2c414dcbe66b440c1c8c1ca6e4f
SHA1 91470927745ef91139ae732d823a7c628bb2dc73
SHA512 3ecdaebf991513550ac2d7bc26d661245b67b25548f03d9e9cd97cacf0658551894cb6ebc4b2423eedb444e4ac0eb2a2a3f9c66eacef87aa256da91b02f3f4f4
SSDEEP 384:OiFjZcI3JsNu8TUNTUlIlOT9ukzivT1d9e+C9d6NXeQlnTKwBODNZOClKDA:lF7ZlwgYdM1dcFWlnewBKZOuz
TLSH
T119D22BF248E7487ADAAE9707E73E2D035EBCC063B5856A50B3D85A0CCD961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 22405dcb97eb60ccaf00403ed4cffac30f6d05f9111a29fe1fdfb0027054100f
MD5 794bbe6df804357708b8035263fa8d28
SHA1 033b7c707d40e9d7e8156e07e70473366f5cfa72
SHA512 b449530d73d2f2aee499545075c36148fa23bcbb4a9eaa7b942f349f6f1203aeee966aac269a65bd4886246bfccc6547317260cbdc89ab947bb98ad1ef8a7f68
SSDEEP 384:UZcIhsNTST9ukzivTkd9e+C9d6NXellnTKwBODNZOClKDA:Sh1dMkdcFzlnewBKZOuz
TLSH
T1E7927D756C381C6B9FE6E505F44B35039EF891B3E6C93F64A5ECAB1D01EA698130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62a9b01c4ad6b197d13626b1a0eeed9d4240cfdda84ee8a4494262025dc6ea19
MD5 2b24eb969892d8066f03f54b3cc12ae8
SHA1 a334fa86a9fcd666384bbb25abd3793e021d2894
SHA512 f9a988ff5f2a98e025de9c3772e7703098ead07e98e134fd7e2b3657ad5c99fcc7fb2ae058c500366c07cbacc6adf9df9ebbb76d95241b1696627fe0878aed08
SSDEEP 192:3ONu6v+YL1QmiUy9v9yrh+CGX+FdeNNkGQNBCHhqAU6:3ONu6vzna1yrh+C9d6NXeGlU6
TLSH
T1DD120B36AC785C6B5FE2A941F48736135EA49177EE8A3F90E5DC2F1C01EF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98a28e0be53ccacc84049105d2f3c2c6db212c8af64ff1cd5cff42f9670e83b6
MD5 4a5c2bf25fd6d2d7173cefd89865e3a5
SHA1 81d06cfb98a4052dbc188b57df18a5ef77753a1e
SHA512 afa4937109269d1dc9a5e566d279f7d65f85720984173fab4f4cac375c13a52481b122887fa14be8153d16ed579211d1101215efe033f81939a634bcfabec864
TLSH
T12CE00142628544BEC0BD5330008B5F345DD2416513F701668B31096C0CB33653B30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 16aa68844481d55aeebf6f46afb04299150373865b545f8652fb0d1a6c34f46f
MD5 ca8be891e1eac4c6c89b5189d2e0d439
SHA1 b1af9522d7c39088867c5e9fec3486fb41b51abe
SHA512 6deb739068ac01835d857a5d9b5bac6426bb3ffa57db6115e77a2738ff44fe6a61baf1f99526b3dbd1d5d355b2ab5924a6de5904f58eb68ec4cd4930ccf1e76a
TLSH
T13CE0095AA28544BFC0BC673044DB5A346DE2617513F702558B6105789CB37A13B31EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1aba4eddb3f062662e502c67974c1dbe7fc1e346a30bea2c00747773b1d14477
MD5 a2cd2a0279e07d3405a7e64ee64339ee
SHA1 b2a9bd11494eb44ebb686953df43ed7383057b37
SHA512 768600b2eb2455210b6fed3fcb0199736cfd9bad1f0f036766b471ee589e77e7e4d831cfcadbbc01e49a2dea0ccebc41f73ae72d426f9f17ca8ed90cd2307450
TLSH
T1DAE0095AA28954BFC0BC573044DB5E347DF2617923F702568B610978ADA37A13B30EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 df8a724799684e48223fe8fcf796798f10f567a25a36f88ed61850efb0c73f1e
MD5 5a4de32e886018790d0f3a738918339b
SHA1 1e3aa5646218262422a5324035e2cfe580b53bf1
SHA512 0ecd63e4fada09a66304b431182623389606e7f4e5229462018af182394398cd815439b4438d1e59dc12cbe140aa2e6d9b283da3d5bc2dd6eb9e75a5f95d9f21
TLSH
T133E00242620414BEC07C5330008B5F345DD1411103F70155CF31056C0C733513B30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f5d60bdbb2d4687261e78d270606bc3d37ef7a9d8d240068550dc5999e256976
MD5 96a48b11b93a2ec34bbfe5fc43d4984a
SHA1 861e574894ccc0e3f9a37fab49743bd193d0c5b7
SHA512 52b0bfb6f3525d2beb884e371fcd53132b47e3a70d1a46cb983f4b86dfba6efa7e0999bbaba35cbff9189921106b2bdd5e934ddb722d4488a89f982a922af429
TLSH
T1AAE00142A28544BFC0BC633044DB5F346DE2416503F701568B31096C8CB37613B31FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6db065016d9fa7e3a29b7d78696401e10a147924827738122dda90a5d18365b6
MD5 57ed0b23d3f8ad24ef5fc08979b3615c
SHA1 e6dae74129e7152f9102a3e970da7804ea76d80c
SHA512 f8264021ac4c05198b255fc4cd75ccc8d2738df582346b3e7466cafcfc3d4553b97048c62fd9620165c75e55d6a95192958970f07646da57671826085fe041c0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58f3b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f3b2.TMP
Size 392B
SHA256 3ce25b127448b685953bc8f4e14de72d72ee8eea1bf56b5385a538bea67cfd39
MD5 6a0f9fb171753fccd77b26fd153767b3
SHA1 91414a25e4b1e145720394925009a1fdf900a097
SHA512 e9dc8cf0632cce3456247d0a7441a6ab75fb17cfc00ee75fa3c111c1532b17507f078fcb61f230d0dccf6483467f25f54e81ae7ec512b1b0d155500aa5cd9846
MD5 SHA1 SHA512

Submit Download

d4c6cbdb-728f-4d88-9411-f752fc1fb7dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d4c6cbdb-728f-4d88-9411-f752fc1fb7dc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\Loader.exe
Size 4.2MB
SHA256 bd96be99c8d53726d7eaff6a929ac42b0aad1650a353c6c68eaca382ae36c30e
MD5 790a271b0603fa43e917bea9fa578fc7
SHA1 3554780f8bd0373a9a698f4d202ee9ab46e9a703
SHA512 06b9044ad3273cce5484753b0aa457df600bc0e8a066d873519daaf16db469b9d524729aa8137621c90859b16508513fef9fb05ae77caf06ad4c508103063d97
SSDEEP 98304:NAv4jg8Y/kz+htchELLP/jruat6JjEkor2Co4HRmjWH:2v4PY/kz+htchEfXjru86BGrdJ0jO
TLSH
T18416CE4BA6BD00F4C5B6D1389142621BFAF27C5943349FEB67D04E5A0BA37E0A97E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x32dbg.exe

Path C:\Users\Admin\Downloads\release\x32\x32dbg.exe
Size 162KB
SHA256 822028f0755dba773e445eaf57fdb3dba84c9550ac7bdad2afa449912b5fba41
MD5 d30cd1d8d018f4de50069f66825c187a
SHA1 f34cea0623fb7f878132f3fd010855378d87e3eb
SHA512 bc143b3497876b0890f832a47a1142fa82c440f13ff32d4d58b2697030aa3461fda8f6786ddf6d028cc9b76d9dfbc4bf86f389a26144c7efd6454e8e9e37a687
SSDEEP 3072:vjJNPJa9cEcMAHguUCqdDURszP+g+z2JFmUcY1kGIYhW8fV:VNxaHQgTC3szShUcYrhfV
TLSH
T1E1F36B01BBD1D832DAA5083189A2DFA18E39FC557FA0EDD763C40DEE09206D1EB36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceNameResolver.dll

Path C:\Users\Admin\Downloads\release\x64\DeviceNameResolver.dll
Size 74KB
SHA256 c6702029a705fb5db2775f31331b8314566dd84d9702b0c6ff513515c160629c
MD5 1a4a1e71f2e948608ba80e901bb2b969
SHA1 6dbd88b0dd59ea30647ccda1830d33d454044990
SHA512 a285f2ae8d9021da5c2e05ecef5b62945e442cf62c234fb748a8644f77d55462b129c6583e290cc6e7aa43055509c9d75f6eafa2a76bdd324fac1d8b5a07ee8a
SSDEEP 1536:TZBMWi6zZbz0eZdTQIijtFe4TPRmoXuXOqH1NIEk672iD3:TZBc6t/VZdTfixw4TPRXuXOqVNIEk22c
TLSH
T178736C5A33A800B5E5679239C8E38E17E7B2F48663B552CF5378429E5F633C15A39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LLVMDemangle.dll

Path C:\Users\Admin\Downloads\release\x64\LLVMDemangle.dll
Size 593KB
SHA256 8de391f11ceeafa007badf71b62560368f8c71623486ff1c2e4c5373fe482834
MD5 1228e59df447f4e6476546ae24638071
SHA1 7ec87e01e60f8f571684cc929fec414c224156e9
SHA512 acccedd27f10123e9f572d868fe11cd5d600b4f1a45a9e38fc263dd4d75cde022eb0d3c74fc3700148b4cfba7146c45d4591cda5fcbef8814427980658975c60
SSDEEP 12288:jo0iiwc1oIuS1jRPhvaIsUag9pbYggoFKQZELWpzizUqZX0aqlyT6kcrZ21ribar:niiwc1oIuS1jRPhvaIsUag9pbYggoFKj
TLSH
T1E1D45A2A77A40279E17BE13CDA934A64EA72B8450721A7CF13A453AB0F133E1573F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TitanEngine.dll

Path C:\Users\Admin\Downloads\release\x64\TitanEngine.dll
Size 401KB
SHA256 0f4f992b51218b4bca6a0a8aaf7d1044b56666634c9d62948a8e7873736200d0
MD5 00b08ecb2b9722781137e2e46ea4a508
SHA1 0006d992b3541b5972d3ad3bf2aed6f2f4d377ed
SHA512 a5f77efc48205cfca9d3263437d6debc176c356ca8a168795dbd9c8da570465109b5a220407e361c552122da36b2ff83b4be355fed57ce185ff20d40803cd9fa
SSDEEP 6144:BiqeDykJCv8McwZSZys6mj42G7VsOPxj9QeQjtHVy:oVNtbwZSoRuC9I1Vy
TLSH
T154947D2BE76954F8C56FD13C8B679627F6B2345C0310ABEB06704E566B13BE17A3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XEDParse.dll

Path C:\Users\Admin\Downloads\release\x64\XEDParse.dll
Size 1.4MB
SHA256 7237ace651d8ae8e3285c9a0256bf34d50e7a4c9722ce016bbcf74e80c3071d6
MD5 e9d2d4b4e5c2eaed37f9e27232339858
SHA1 b6ef7424c927b788e5875198c690e96be1f23f99
SHA512 5444f5516c74a96cd3152039469ea79f0e7d9262f21410a8e92593e4f870c2da3b8c67a4c85c742338ee6af582fc905ecb4f3704096dca3a791377e48aa1dd2a
SSDEEP 24576:ZpoHrP3dUN26xvJ9TkdQbgbBO1uGaWAXIcbsYV1tM8o+gxUOKPClk:ntI1O8o+gxTi
TLSH
T1F765D549EEF2AE96C441C2B8948FDFA7FBB4A0050B15CB97029434F56D4279729BB334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jansson.dll

Path C:\Users\Admin\Downloads\release\x64\jansson.dll
Size 146KB
SHA256 eb704b761c638dc9cc4690941dd0de71e4f0575280d41243a5b0d40ebd38f4e8
MD5 89d701f3bcd052251e023441d5fdf97f
SHA1 3771038e2de2135d9bfb62254fe83e5c996a9e53
SHA512 ea377bb175ba51a63625352156ed4c848868def18af9bfdcb0eb76bab6b4b63ef091ef5ece49f47de652d508bd437f2f113766b86fe53ca1174fb1c13cd4b122
SSDEEP 3072:jvxRwyqpVmfBbIaLbhBTFp0pwxgBUmameJ9qDx61PlEk22t:j7ecfBbTZBTj0pQMJasCPlt2Y
TLSH
T15FE36C4B739400BBE5B3963889E78516D7B2785203719BCF17A442AA5F237D09E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lz4.dll

Path C:\Users\Admin\Downloads\release\x64\lz4.dll
Size 96KB
SHA256 5cfae56f5319dc343799ac7e9738bc367f9843ce4bf4e795d2ee2ca268fa9c5d
MD5 be36901afd7394b0355d787c407d2d5f
SHA1 1d9c3bb6d06efd4b56a55140361f747e0b40d475
SHA512 1356c7cc6ab1625d0fa055ed57fb79e4009fd354b72c4e4357d07a9c8c40e8dc2389cc9134638daea4a6f065d5457d60985a9c378fd9d53748621a4c9a14c019
SSDEEP 3072:expC15SOPYC2TFUNnWyH2L+xqfbQTkx2fEk221:Oo5aT6wyH2CE/Gt2w
TLSH
T1F6A37B5A33A400FBD8968678C9E79A0AE3B17827033457CF63A4466A4F537D25D3E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\Downloads\release\x64\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Downloads\release\x64\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\Downloads\release\x64\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64bridge.dll

Path C:\Users\Admin\Downloads\release\x64\x64bridge.dll
Size 89KB
SHA256 39730aea3509e275bc2d69d8d27f22695821b7caffa30943fa0dcf36f9f558cd
MD5 6e4475c143495f41e36b3e4860ee0fb1
SHA1 d38da90c57eb25434c7021ee2fbbca7484d6f8d9
SHA512 f2eadca04a156fec4bd5b5440133bacb0cd38a6ac18e7a9d015d1277a5da610c90713f26a3a1164e71279ef891d363875d287ea9599212bfec48e49217ae7ef5
SSDEEP 1536:Hhs69Looud/uWb5het238pLmMmMdcmAnV:Bs69Loou96g1MdEV
TLSH
T1B0935C36BE15907EE26A89B8DA574982CB72F8469B9157CF43500CD50E36BE44F3E383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64dbg.exe

Path C:\Users\Admin\Downloads\release\x64\x64dbg.exe
Size 202KB
SHA256 68d6afc2cc5a5bfd74a1b4066c0651254661355a0e384524cd1a8772adb95092
MD5 7b593b1acaad3e6c32c5dee37bad668c
SHA1 5c7a22d4566d1720325445c7db43ae5c20ae9862
SHA512 08dbca787b3b12bda8ce1a2c593c14cbfdef1cfce9bef4080c1567eff760625d57d5428b20ef078968947748097ffe9bd6ea57befd86d9047908ed771df1cfe8
SSDEEP 3072:FZlFX9Inkz2iLOPvXs9GKlazxB7NKwNrPY+hgWnESBf/rWXSbV:FZlFX9IkqiynmGzxNrQgJ/rWIV
TLSH
T1FF144B47A7A1E0F9D966853886924F05DB717C6277A0EEDF47D00AED0E227E09E39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.exe

Path C:\Users\Admin\Downloads\release\x96dbg.exe
Size 194KB
SHA256 7473d96b13c350643fc8f471a2e840494f8ab771b35e3e316ebf8a66660df158
MD5 550ca69da5d9c92a5287456220c4e1cf
SHA1 c5095ca3c2d7b5f1b51ca47f8e52ffbeafa523eb
SHA512 b06bc32977418d1dbeaf0a927683ed153b8132afd875b3429ac464d793cbbaad2d90057c22a365ca73377ab91e313b5b2ac3d8ac1b289e8336c64015393d30eb
SSDEEP 3072:NqVO3SCNXhEnDl+dUc/+Bc5Ja9taJlJHPHqy9dF6JNq6oIo4iFk04sZVc:BUwK3c5JStaR/1+DRiN4qVc
TLSH
T14B144A117BC1D933D796093149A18BB1893DBC603B91EEDBA7C40EFD0960AF0DA3A657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.ini

Path C:\Users\Admin\Downloads\release\x96dbg.ini
Size 122B
SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
MD5 45c1e010baaeb6b086b93c73cbfa1433
SHA1 6570b66b77103aac30dc7cccfacde1e42413890a
SHA512 6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50
TLSH
T1E7B0022A0DD3515E3769D195C2B095A03702F4167C595B2C8DC0574958EB6096442C92
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_2026-05-27_12-11.zip

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip
Size 30.1MB
SHA256 d41966dfc5b435a372798245300ca0ab7bb8e48bdbf48512c6fb20fcca427697
MD5 92f0d724a9b174c161e23a95f19a54c6
SHA1 4f70bf300e79e0a88d59ab3bfe68d22daf003cea
SHA512 4acb68e66fd10d6a1a582e38bd92e13e8f30a21b717ea6b6225e691a959062500ccd78ade0c022106e75caf4c0f324c90d6d24bf9b80ac727758eb98385f15c2
SSDEEP 786432:7tNbaw+FcDCi5hL4PLxZiFOhbJjcg74hw9NoiBDm67fv3aH1nbmHFvH:7i+DrjgNZiFQdJqwUGDmEfvKH1bml/
TLSH
T12B67334EE2ADB50ACF4F7B7366F2A115CA8DE560607CF32E46E6340D49EC5F4A46E240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5356-2120-0x00007FFBF9C40000-0x00007FFBFA195000-memory.dmp

Download

memory/5356-2132-0x0000000058F50000-0x0000000058F65000-memory.dmp

Download

memory/5932-2122-0x0000000058F50000-0x0000000058F65000-memory.dmp

Download

memory/5932-2117-0x00007FFBF9C40000-0x00007FFBFA195000-memory.dmp

Download