f377c955c15cffc9b4d4744a787d667c7b1a53db85443c0835fef1daab05b57d

Resubmissions

09/08/2026, 11:10

260809-m9qsjawgpe8

09/08/2026, 10:38

09/08/2026, 10:38

09/08/2026, 10:23

09/08/2026, 10:23

09/08/2026, 10:11

Analysis

user interaction
yes
max time kernel
1799s
max time network
1422s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FILES.html
Size 253KB
Sample260809-mpvwrazsc1
SHA256 f377c955c15cffc9b4d4744a787d667c7b1a53db85443c0835fef1daab05b57d
MD5 f5110de3e1e906c747a31cf0018d5452
SHA1 58a94c590ea51d78c5ed19ecf6bf021fc4c9954d
SHA512 c4f924c2abb0aedd7a778e94fe987b1e39d3233eccb37ab0c7f538ae073f181a7e7ae336fc658240a36a1ec54592efa63e7cc5d6e3cfb71ff11edd9d015fc1b6
SSDEEP 6144:QKUeWC8M7kNUREMP82ZitwKl3p3ZWJ4X4j1crVyoJSyPbsTQa/5dn3BQ/y1ma1/A:nUeWC8M7+UREMP82ZitwKl3p3ZWJ4X4Y
TLSH
T12D44D7B1B075E23D025F269AF0B09754C3D7A39BC64969E2813FC7E842D2CD8FAA3155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
233	5044	msedge.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	x96dbg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	x96dbg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	x96dbg.exe

Executes dropped EXE 11 IoCs

pid	Process
3708	x96dbg.exe
680	x96dbg.exe
5396	x64dbg.exe
3860	x96dbg.exe
5924	x64dbg.exe
4848	Loader.exe
2124	Loader.exe
5288	Loader.exe
3688	x96dbg.exe
3548	x64dbg.exe
752	Loader.exe

Loads dropped DLL 64 IoCs

pid	Process
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
5396	x64dbg.exe
3860	x96dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
323	raw.githubusercontent.com
133	raw.githubusercontent.com
134	raw.githubusercontent.com
213	camo.githubusercontent.com
214	camo.githubusercontent.com
233	raw.githubusercontent.com
234	raw.githubusercontent.com
322	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
317	api.ipify.org
318	api.ipify.org
321	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3024	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307455459699198"	msedge.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32	x96dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\ = "x64dbg_db"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\release\\x64\\x64dbg.exe"	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\ = "x64dbg_db"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\DefaultIcon	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon	x96dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile	x96dbg.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{C674C288-E570-4962-9390-9A4E8886CB70}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\release\\x32\\x32dbg.exe"	x96dbg.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	x64dbg.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5396	x64dbg.exe
5924	x64dbg.exe
3548	x64dbg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
2792	msedge.exe
2792	msedge.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe
5924	x64dbg.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5396	x64dbg.exe
5924	x64dbg.exe
5288	Loader.exe
3548	x64dbg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5808	7zG.exe
Token: 35	5808	7zG.exe
Token: SeSecurityPrivilege	5808	7zG.exe
Token: SeSecurityPrivilege	5808	7zG.exe
Token: SeDebugPrivilege	5396	x64dbg.exe
Token: SeDebugPrivilege	5396	x64dbg.exe
Token: SeDebugPrivilege	5924	x64dbg.exe
Token: SeDebugPrivilege	5924	x64dbg.exe
Token: SeDebugPrivilege	5924	x64dbg.exe
Token: SeIncreaseQuotaPrivilege	3468	wmic.exe
Token: SeSecurityPrivilege	3468	wmic.exe
Token: SeTakeOwnershipPrivilege	3468	wmic.exe
Token: SeLoadDriverPrivilege	3468	wmic.exe
Token: SeSystemProfilePrivilege	3468	wmic.exe
Token: SeSystemtimePrivilege	3468	wmic.exe
Token: SeProfSingleProcessPrivilege	3468	wmic.exe
Token: SeIncBasePriorityPrivilege	3468	wmic.exe
Token: SeCreatePagefilePrivilege	3468	wmic.exe
Token: SeBackupPrivilege	3468	wmic.exe
Token: SeRestorePrivilege	3468	wmic.exe
Token: SeShutdownPrivilege	3468	wmic.exe
Token: SeDebugPrivilege	3468	wmic.exe
Token: SeSystemEnvironmentPrivilege	3468	wmic.exe
Token: SeRemoteShutdownPrivilege	3468	wmic.exe
Token: SeUndockPrivilege	3468	wmic.exe
Token: SeManageVolumePrivilege	3468	wmic.exe
Token: 33	3468	wmic.exe
Token: 34	3468	wmic.exe
Token: 35	3468	wmic.exe
Token: 36	3468	wmic.exe
Token: SeIncreaseQuotaPrivilege	3468	wmic.exe
Token: SeSecurityPrivilege	3468	wmic.exe
Token: SeTakeOwnershipPrivilege	3468	wmic.exe
Token: SeLoadDriverPrivilege	3468	wmic.exe
Token: SeSystemProfilePrivilege	3468	wmic.exe
Token: SeSystemtimePrivilege	3468	wmic.exe
Token: SeProfSingleProcessPrivilege	3468	wmic.exe
Token: SeIncBasePriorityPrivilege	3468	wmic.exe
Token: SeCreatePagefilePrivilege	3468	wmic.exe
Token: SeBackupPrivilege	3468	wmic.exe
Token: SeRestorePrivilege	3468	wmic.exe
Token: SeShutdownPrivilege	3468	wmic.exe
Token: SeDebugPrivilege	3468	wmic.exe
Token: SeSystemEnvironmentPrivilege	3468	wmic.exe
Token: SeRemoteShutdownPrivilege	3468	wmic.exe
Token: SeUndockPrivilege	3468	wmic.exe
Token: SeManageVolumePrivilege	3468	wmic.exe
Token: 33	3468	wmic.exe
Token: 34	3468	wmic.exe
Token: 35	3468	wmic.exe
Token: 36	3468	wmic.exe
Token: SeIncreaseQuotaPrivilege	456	wmic.exe
Token: SeSecurityPrivilege	456	wmic.exe
Token: SeTakeOwnershipPrivilege	456	wmic.exe
Token: SeLoadDriverPrivilege	456	wmic.exe
Token: SeSystemProfilePrivilege	456	wmic.exe
Token: SeSystemtimePrivilege	456	wmic.exe
Token: SeProfSingleProcessPrivilege	456	wmic.exe
Token: SeIncBasePriorityPrivilege	456	wmic.exe
Token: SeCreatePagefilePrivilege	456	wmic.exe
Token: SeBackupPrivilege	456	wmic.exe
Token: SeRestorePrivilege	456	wmic.exe
Token: SeShutdownPrivilege	456	wmic.exe
Token: SeDebugPrivilege	456	wmic.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
5808	7zG.exe
5396	x64dbg.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5396	x64dbg.exe
5924	x64dbg.exe
2124	Loader.exe
5288	Loader.exe
5288	Loader.exe
3548	x64dbg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2376	3424	msedge.exe	86
PID 3424 wrote to memory of 5044	3424	msedge.exe	87
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 1272	3424	msedge.exe	89
PID 3424 wrote to memory of 3088	3424	msedge.exe	88
PID 3424 wrote to memory of 1272	3424	msedge.exe	89
PID 3424 wrote to memory of 1908	3424	msedge.exe	90
PID 3424 wrote to memory of 3936	3424	msedge.exe	91
PID 3424 wrote to memory of 1908	3424	msedge.exe	90
PID 3424 wrote to memory of 1908	3424	msedge.exe	90
PID 3424 wrote to memory of 3936	3424	msedge.exe	91
PID 3424 wrote to memory of 3936	3424	msedge.exe	91
PID 3424 wrote to memory of 3768	3424	msedge.exe	93
PID 3424 wrote to memory of 3768	3424	msedge.exe	93
PID 3424 wrote to memory of 3768	3424	msedge.exe	93
PID 3424 wrote to memory of 3272	3424	msedge.exe	94
PID 3424 wrote to memory of 3272	3424	msedge.exe	94
PID 3424 wrote to memory of 3272	3424	msedge.exe	94
PID 3424 wrote to memory of 3932	3424	msedge.exe	98
PID 3424 wrote to memory of 5012	3424	msedge.exe	99
PID 3424 wrote to memory of 3932	3424	msedge.exe	98
PID 3424 wrote to memory of 5012	3424	msedge.exe	99
PID 3424 wrote to memory of 4872	3424	msedge.exe	101
PID 3424 wrote to memory of 1656	3424	msedge.exe	103
PID 3424 wrote to memory of 1656	3424	msedge.exe	103
PID 3424 wrote to memory of 1656	3424	msedge.exe	103
PID 3424 wrote to memory of 4816	3424	msedge.exe	104
PID 3424 wrote to memory of 4816	3424	msedge.exe	104
PID 3424 wrote to memory of 4816	3424	msedge.exe	104
PID 3424 wrote to memory of 1144	3424	msedge.exe	105
PID 3424 wrote to memory of 1144	3424	msedge.exe	105
PID 3424 wrote to memory of 1144	3424	msedge.exe	105
PID 3424 wrote to memory of 2712	3424	msedge.exe	106
PID 3424 wrote to memory of 2712	3424	msedge.exe	106
PID 3424 wrote to memory of 2712	3424	msedge.exe	106
PID 3424 wrote to memory of 3928	3424	msedge.exe	109
PID 3424 wrote to memory of 4036	3424	msedge.exe	110
PID 3424 wrote to memory of 464	3424	msedge.exe	111
PID 3424 wrote to memory of 700	3424	msedge.exe	115
PID 3424 wrote to memory of 700	3424	msedge.exe	115
PID 3424 wrote to memory of 700	3424	msedge.exe	115
PID 3424 wrote to memory of 1900	3424	msedge.exe	116
PID 3424 wrote to memory of 1900	3424	msedge.exe	116
PID 3424 wrote to memory of 2776	3424	msedge.exe	118
PID 3424 wrote to memory of 2776	3424	msedge.exe	118
PID 3424 wrote to memory of 2776	3424	msedge.exe	118
PID 3424 wrote to memory of 744	3424	msedge.exe	120
PID 3424 wrote to memory of 744	3424	msedge.exe	120
PID 3424 wrote to memory of 744	3424	msedge.exe	120
PID 3424 wrote to memory of 4820	3424	msedge.exe	122
PID 3424 wrote to memory of 4820	3424	msedge.exe	122
PID 3424 wrote to memory of 4820	3424	msedge.exe	122
PID 3424 wrote to memory of 5960	3424	msedge.exe	123
PID 3424 wrote to memory of 5960	3424	msedge.exe	123
PID 3424 wrote to memory of 5960	3424	msedge.exe	123
PID 3424 wrote to memory of 5224	3424	msedge.exe	125
PID 3424 wrote to memory of 5224	3424	msedge.exe	125
PID 3424 wrote to memory of 4052	3424	msedge.exe	126
PID 3424 wrote to memory of 4052	3424	msedge.exe	126
PID 3424 wrote to memory of 4052	3424	msedge.exe	126
PID 3424 wrote to memory of 812	3424	msedge.exe	127
PID 3424 wrote to memory of 5552	3424	msedge.exe	128
PID 3424 wrote to memory of 5552	3424	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\FILES.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff0f64c188,0x7fff0f64c194,0x7fff0f64c1a0
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,9029381348596953692,219084989252869027,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,12286760524089787512,7674748394136072265,262144 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,3781683212159861289,10338152251091185448,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1592709371785017630,13533077246924277803,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10920456819091818392,216933902211238285,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,3889594608906632941,2881472270992877837,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3204848399397877296,16061198192215244110,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11163113568027795990,17055171378056657343,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,2648283947376857032,5429207187906260872,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15379958515058416343,539918023119400409,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15379958515058416343,539918023119400409,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6248,i,9847894675275747176,13587860479058194594,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3436,i,513413630791688681,10170765238972864144,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6168,i,6069713625612918394,2229343801558020590,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3776,i,11117959771498656284,13075714036428589064,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,12393735813233489428,14476281606845502457,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,15202787088697797801,4823114439887887791,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14312316359466084628,17430722584751290015,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5128,i,667387728477167468,17881833475949379106,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,202479338135083628,8788909178858708898,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3508,i,7941979103273289625,18233752520064852175,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6644,i,682112758819815801,7683494069742051992,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6804,i,1742503955162820698,3455264400692373767,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7040,i,4653821753184770343,3715295785193981635,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,16378523407417196501,3890585505905532663,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6920,i,13151692766333309818,5486944532615096998,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,722991563103206291,7465620345596808310,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7084,i,10970057843479749393,3558617577988919232,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,4655399001415037486,2300658316777932540,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7704,i,11544504641908528918,16681810805455904404,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,6672572425619540051,509160567337579905,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7352,i,14784381016781371309,4643962428335302896,262144 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5516,i,7720320388445595331,11994516248127964139,2097152 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,18175276873839679523,10935517191681231036,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,284507570733080714,12078528164088993575,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8052,i,4908268201964481327,16929354105194323302,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,7406979895666134905,14725312486953777873,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,10209653308431175878,15373322959304536603,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,11456105532027316753,3208055568866445356,524288 --field-trial-handle=2856,i,12216776149187145757,6769009196553437593,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5652

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17706:112:7zEvent28785
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5808

C:\Users\Admin\Downloads\release\x96dbg.exe
"C:\Users\Admin\Downloads\release\x96dbg.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3708
- C:\Users\Admin\Downloads\release\x96dbg.exe
  "C:\Users\Admin\Downloads\release\x96dbg.exe" ::install
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:680
- C:\Users\Admin\Downloads\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\release\x64\x64dbg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5396

C:\Users\Admin\Downloads\release\x96dbg.exe
"C:\Users\Admin\Downloads\release\x96dbg.exe" "C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3860
- C:\Users\Admin\Downloads\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\release\x64\x64dbg.exe" C:\Users\Admin\Downloads\Loader.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5924
- - C:\Users\Admin\Downloads\Loader.exe
    "C:\Users\Admin\Downloads\Loader.exe"
    3⤵
    - Executes dropped EXE
    PID:4848

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2124
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3468
- C:\Windows\System32\Wbem\wmic.exe
  wmic PATH Win32_VideoController GET PNPDeviceID
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:456

C:\Users\Admin\Downloads\Loader.exe
"C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5288
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:5636
- C:\Windows\System32\Wbem\wmic.exe
  wmic PATH Win32_VideoController GET PNPDeviceID
  2⤵
  PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  PID:3024
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Downloads\Loader.exe" MD5
    3⤵
    PID:5824
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4228
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2392

C:\Users\Admin\Downloads\release\x96dbg.exe
"C:\Users\Admin\Downloads\release\x96dbg.exe" "C:\Users\Admin\Downloads\Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3688
- C:\Users\Admin\Downloads\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\release\x64\x64dbg.exe" C:\Users\Admin\Downloads\Loader.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3548
- - C:\Users\Admin\Downloads\Loader.exe
    "C:\Users\Admin\Downloads\Loader.exe"
    3⤵
    - Executes dropped EXE
    PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

80e129ce-145d-4f92-a819-8afe1f6f88de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80e129ce-145d-4f92-a819-8afe1f6f88de.tmp
Size 30KB
SHA256 30e872df43efbcdefc42156bfe29217cba0b8d423120b63bb7935a60ce2259a1
MD5 904e4ffc868a37a4ecec1a47bea78f82
SHA1 bc69bb0cdc2fb2178ebaccb7f005695320f45f9a
SHA512 ea7e0d22a096366c2894ced429a290bbe912966cc2674d2bdcc5bcc54f0dadc1902cebda04926bf61380cebc9ab621dd2e45a933dc7e865d24215afa9a855ec3
SSDEEP 768:ir8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV5roY:ir8bqn+WvSCt6u1jaCZLbWVyY
TLSH
T116D20A3B280CCB7E4F845E5DEC26AF966DD801CB67988D4447FA884C03CB6EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cbd4c3f4b830cde97fcbddea1c53ecc1329d52127bbe1523c14a14532e528b18
MD5 ee45984308cae3172079459862be19f1
SHA1 6f8afa2f312d15f0200ecb5cf81c937bb5a5c9b7
SHA512 f6322a17dcc2c753304d36b89dd0024e5cef5d3ae06aa8dacbfaab7ef1747ab01f715e466d11f591b92befaabebef40caa75f230bfad6fe5c8e32ce8b71e5e4e
TLSH
T1B2E020F905C5C37D9701745751749B0CC2D1360F9AC4EF291B149C8C35C3244E7C9A74
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 91cbe126d9cb6e4959a0feb2f1160557e59ecb8deee538efd37fa4e7f7a7d579
MD5 118eb9bc77a8888349b3afa8d8fcf79b
SHA1 68de692b371369f8dc1ada51b8dc337e1bd4f05a
SHA512 323d57360b60d962355f1e3728d9d0837b2c27e95ee4ecfcf299c2afbbe710400a0b558af4ad3114922f70634605c89cef04e37713b75481dec8c399d20fda9f
TLSH
T104E092A813E0C5A82B21A647A07E6754D9D2710FBB4CD86A3B1960C63660480D2D88B5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d70e2f054e6ab18aa1f0ec7ae08f2f211390b783b8cdd4dc472dfe65e4cd6e07
MD5 f6b398503eb08c48e17f9e4d5ae9d2d7
SHA1 8655a03da846a0b4f54e4cf251dd2c088beaede8
SHA512 705df063c3ddc85c3dec4e0701b23bab9df34ecad806a1ac262c0c26c40dade0672675cbdf21aab0c8b9338744058c3ef289f112e4e866178a36d8e7aca5d674
TLSH
T12EE0788C04CCC23D95456C876174570CC1C4361ED7DCFA753F1C8C5939054406ACDB74
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 21KB
SHA256 2acaec886d21bb834a3a775d1191bf06a0fd00c450592118f324a53cfbfaf617
MD5 41f3bfb83df08e44a4a7cde939cbe216
SHA1 616b8a938fe5692913501ea29889535edbbab957
SHA512 e264466ab0d125c4186ad333e5981dd4ae6bd6bf9cf7e0f7d6ce945ba20659216f3870fe48af8b26b5df94b3abe6dca0dc5007d2a30c65dfc3c48e8a9dd30767
SSDEEP 384:QZmkUmaKuSIJyqRRhWsHN5TveU2lAw8759MUm0ihXD3LDtVt1EXU7o9fK+j:QkkVaJ5IqRjWaPSTMujVD7DtVt+UM9ic
TLSH
T1F1A2D0F57D1792F5B55042A8E0F2B65ABFE0128D0F5A3651A1BA6984E620F361FB2028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 39KB
SHA256 7eeb886d182a9b4872d3908cdc2b7d6debf044651e9e9f20ae0d47a99c94cc31
MD5 2ca5bcad18da3c3a0eb4165141b56afa
SHA1 88b7c0b8536fd886c8faecfd08a7829e017f3bf0
SHA512 1ab2c21a4f6f5ccb14ceae47b35e0bc8fe8cacf64eef49850c7a4168a27c60bd17ecc595365087d7d145f9112d14d1910e25e0798f4370e35e5b25f2d5546eff
SSDEEP 768:0Vo3LzQYfxtUhB0jUUuW1jWHpBCC/HCsRo//5/3YoXtWDFbGG+dq:+o7zQYpt+ZU1x6UCqEo//5vYUtWDFbKq
TLSH
T13003F18C3A6D0E16FF41336E2DA5A08B0AB189E655EDA2FEC0D1555D5F028BAC17304E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 25KB
SHA256 b5ff3123c34abe3052771852b4dcaa90711a7f34dd69fac9f9f7c1164f2581c8
MD5 f789716feb1d8945a2af76586cc08e55
SHA1 5e5860d4e3dca152f084c9ae5fe7d1f6a1c3ea96
SHA512 804d86030fa2dd0cb25ca0b99e31b6c4526c58a7b37807fd44a3b02b083869f618b3df0f547c036cc6271f4e7baf8773895fa2aa72b5a531c9e8f75255b19391
SSDEEP 768:kIWDCHq9o7IGvxgy2rNWIvra1wQ3Pd+lRO:VtKq1ZgJrNWITTLO
TLSH
T15EC2F1E08F3EF85F5B56EB78F7A4CA2CAB503DB235860185174D485ABD38F01D658CA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 32KB
SHA256 1415d0b65515e14ab4e8dd5d7f203e01000681e3373a5ab7f6e60e57a3b978d5
MD5 d9c51a4a6bf8b7237adc9a7e8f8bdbfd
SHA1 5e341646813707e03f00ea3baf0a30ea4116c86c
SHA512 204f2755801aa5a660deec49e6f9546c0111837b062612d3df4e0c3b5ad72731ef813fa9288cd1556f683421d75d974dd0fc80fdaf0dbd6b451ff4e648eb9012
SSDEEP 768:TO7sci9ExWyvQfazVlTo0ryGluv/CMgGIIiV37DEGdXPi9:TOE2WYQElTo5GIXcGa7DEGdXP8
TLSH
T1C4E2F210D1D2346C37203AE94F4026E6FC09B05CF055D96984AAC748A50AF5F4B7AAEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 33KB
SHA256 adbeefda3faf8343688a1a8bfdf0650c6ab1fa8d0c0e700feafe2823c8c8bfbd
MD5 c156bfcf3b236bf2585193372e49e6d0
SHA1 53fb2107c580eb5e4d465025a445cfa36d0139fb
SHA512 ac8bfe49f6710257c3c10f9bdbcf62c2704b48d828ffa4a48e3e6d8a576b9cdb64ccfc94390b71ab25166a8ecad4d5c056ee8d844e43118654e75f31c7974baa
SSDEEP 768:NOSQYMEnbLedX5WfnaKB3neHLY6xcdB1bWn/IDcjuciyq7:NOELiX5WPRB381IBgnQ4KR7
TLSH
T1BAF2F29E7D004267BF74B58EE947D749014E32B2C07A6C94A0678FE2DA1C5FCBD0A90D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 42KB
SHA256 e332d5ccddae8ab59a45ea7ec14f535fcbe6bf5f84a62d298171b4dd2c897710
MD5 78aabd35cf86bd700d5787e6dabddf16
SHA1 f7b66f720c186cc9c5c160c37c1a5414555a472d
SHA512 5d3c5b6dc589ae88aa03cacc0e8ef780fcfec427efef086997bee89909e7ee681effaa097066fec36d868a64a1fd303038ed011b7ec8dab5829716d8434fb240
SSDEEP 768:heZP8ym3DbsmYp5D0RmKOgqL81zaXx6R/T08FxrZj8vSKj7cRK5LikcxWL9bfJX5:heZPybsmk5D0w8IkLp1YvSFaXRbfVtrj
TLSH
T1F313F1219FA15DEC4168A065FC803F47F1AEEE0085D4CC67358881C7BD298E61FD66BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 18KB
SHA256 ad2895e897b6c16771512ffa71833897b7f5f1d877ac4f5c966adf8772b5e0e3
MD5 a866eef7e8dd5754dffb17c0e25aabc0
SHA1 0c23c814887291b5d273070c44018596f5102fc6
SHA512 992c98ead81ff20c891e43d43215e93fb3d2b09761acc13baf999f416821525638b078f6cf4313d460d74ddcb4bb027d0a5ea49a70af8d09a104241887a04bd8
SSDEEP 384:DJbVz/pDYG8Qg7qGPD7unGtNjRM8oLLdG6INvSHN/czQNyf/h1n7loOA1:DJbV7gH7uG3lToLLEHNvSHR8syHTV4
TLSH
T16482E0848A6575417A5DF2CEC3469797E20C53BF2C7B8B65F9B1C00D5920CC842AB79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 57KB
SHA256 8ac0d7d9aa3247284605c5961da401128693170cd66e1546c2bd6e76acb62914
MD5 71b72955362147109dde37367ff2513d
SHA1 df8a2224e86d54933144a7b725e73d3935959948
SHA512 1a3544c94a33ecd4e51e48c20b0feffc02b12f09e6510110c4d8fbe9e73da9575c850e1a3d25be48caff6ce2b6e4b9dc40e8b827e4a8b17f949231a2abdf7375
SSDEEP 1536:DkR84mu+oMilQlld8b7asidgaztOuvuIf2:YRdmu+oTaPIvYg4cGne
TLSH
T1774312BC48A2E74D72490D3D42A8510B4F97F98F4ED600BD780CBD1B649AA780DBFC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 16KB
SHA256 7f88b91ce949458c3ce11fc78de0b0ee1414756c45345f4ed86c5d6a2c4ad321
MD5 ded9f7018d82983e4b6f9bf9946dc582
SHA1 b5af1858347e0823dfd492bd88c9e6970f21c441
SHA512 6c20bced9825ccfd4fe62414ea469336b2ef0e1421ddd7fc25444be703aa490cb7ea4539b125a4640c9a08fa74291d527cd2990c763017ff53ad33912982b9a0
SSDEEP 384:dFcJUC21GDfxItqyqOJqnU3Oi01GbXlMvoMoUvZEVcF30N1xu:dOJU9axIt54GbXNUREiau
TLSH
T1EE72D05F3326EB40D39541242C02F1FA1E60DF3F760074A8B1647B8B7C5461A36F6A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 17KB
SHA256 bd777cabafd6cdfcf66cd8ffb921f2c554833b7dd9ffba0474fa6f6a78b977d0
MD5 314b2eebc8f3f1eead046a8ade0b92bf
SHA1 daabda4f5cde69e469bf98674a2c993b33faf94e
SHA512 48f34fe4b689a8de3c61e91d036b34076d7c3a9442b59ec70550a8863277a3bda71001f2f231c33a12ff0199af8e1ef00f4f3411fc10de9992d7ff08b42484ea
SSDEEP 384:EGGx0ZfRvnPP73tyLkozHumSGCxgvigVZN4FkzbE6NeV1:Ix09xrQLFzHJsuvB7EWeV1
TLSH
T18B82D024F983EBFC4F475302A6BE69425B9EE6259F01FB4093771B0B84E795A1A7E000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 16KB
SHA256 6bce2b0a299ef92c7a5400a70b99d8405f44b52a4a4682c2c54687bba43d9cf6
MD5 53739451e86054678d83436a85345d54
SHA1 42535a91b6b94e9b8c95f6fba210cc011dbe0283
SHA512 3d02f9286f45219eb44e059ea0c5a5e4371e059dc0056dc22e089a62e8833fc8b6a3347d14d061aa85ca507d829c914e2be9ff684813077269553a2b6acefb39
SSDEEP 384:ODiEFfZgMxw2O23SeJxo4PxR4Rc+65MoVrgpTCDhVC8Aq6x5MN:OtSMxO23Se7HJR4+Z5MaT56x5A
TLSH
T18C72F161BDF2C584C126FFED23DE024D93A60D1D0BE24900652366919BFAAEC5246EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 20KB
SHA256 265afd4ba46ce0759d9694b15535a1ed11b5f3ad0e49767bab4b8ba1745bf461
MD5 fcb61fd14c6836ef46c6a81a25da9a0b
SHA1 4409eff1b1f829e26922f62866eb1143280e21e2
SHA512 186cdb0e040a9ac53397ffa4a7c93c3123ce2defa5b0dd4de5711b5640f00debfe8307b8089059b32f2d18b5573e6608df50121e1c9c2d610ceea9f966bf0909
SSDEEP 384:Dzw7CPbEVWHyQEGhFl/771IF7W1K3SX1dlkwaHoHBQKVxu:oOwVWSQR71IsK3y1dlkwaHohtxu
TLSH
T11A92D08846F2C84E056480BB576291CEAFDB57350ED037B61C33DB77D6679AA06B2C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 30KB
SHA256 be02e0203bf9bf2ea0dd0e19a1ac31ed7284ab82b2e157ed43c2b12fff0f6cd7
MD5 d81368f517869df89487d96d42746ba6
SHA1 022032d6ea12a52bc4102b99e8e82fd27e321f12
SHA512 d1a23b64150caea4d24080843d12d38a924e7339588313fa37cc2afe6a0bf135fa486d542be716234944747fddc05878210ea7815e3ae08bd064ba39539e35bc
SSDEEP 768:Fc0nYwvMD5JzqOq4OJrAkagvxAY2T5WTkDT:FtYVXWqOHvxG4kDT
TLSH
T1A2E2F1326F29FAC85C12D037E837366C9B3AEDC12FA894538454A543D9566FF74E18C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c7
Size 30KB
SHA256 b08668e7dd7deb70851f49350266f197de11ec54e5d7d94db3062a5071b053f1
MD5 02c2dae8921f5931a8f8d834d0cdc400
SHA1 82075d9062d9ef1c331227df78b7308a3b14f2e6
SHA512 4cc9a083aad51d7c5614a82f7d3899c8570dbf8ade5c618255372f3218e05f3da7774496efcc626a1f9063bb3f08cc38ad136fae748f3b3b9bd0abd6e5b54df6
SSDEEP 768:guJnZzJYKEKIf0SStmFfDJx6DO/UUmaY4dYCkvys:V9tZw0hmFfDeDOcUmmY9ys
TLSH
T156E2F10310C4F9BEDE59C9E96DDB40B5D6094C5E17F88193053B1BB14B31A20EAA9BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 27KB
SHA256 e4cd26e3f3569f684e4775ebd35e44cebb9cc1e4989adc55cc33244dc93197ab
MD5 a0dac482aa4bc265f23a4bf4a5534416
SHA1 5c056f9e79c25af744236a15129f0b7a139cfc12
SHA512 ca6ad779fe946498d47cee3634f8b318383a24ccc4c11c2ee0134432c459787ba3f1bcd31b991cb2f46af49c8221862343684428aff4c076c598319a1702adf7
SSDEEP 768:8AiLrL2q/5DOlC4DEwQhImX1ssQalS9Li:8lXLHxDyC4DEN2gSRi
TLSH
T142D2E1B9B355CE41B4098D56A39BE56FDEB2CA5B30E0DA40250B3F8FE4F3904E1A6425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 25KB
SHA256 4d6353248d2e8a66757fa400ee26cc2396e3b7ee3945f462c4561bc19e35fbe1
MD5 72b5ee6ad4fb0bb45f39efaf1ae164f8
SHA1 636749c6b4fa3695cd069dbae9de7f3a8086f634
SHA512 d0bb013a6d6f1a937cc26024362105bb57c1ac558b833f090c7c8bc31f62bce1dca85cfc2a47d30e964e6434366d302f57721728e5649a070e2f79698a3d8ff0
SSDEEP 768:31a/zYJHIVMDwWfJC27rRcLCOZZxKnYVXvWF:3k7YNIVKzfU0r2GePKYVuF
TLSH
T1E6C2E0F6EE360461D3FD1013EDFE51326ECDE728833909A8389592A937876293C55CE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 56KB
SHA256 e37f100fc677d9b29ec6a9b870c3ad782ad5174557d9aedac05c5bb8c7273934
MD5 d65b35f032cf9f80df5c53f8204c930d
SHA1 e41a1ffcaf699abc84ef357733e6fc8b87c634d8
SHA512 78c67aa83216d554aedeb6ff6bedb808fba79c2fe148947a8c313f9e0b61304509dc4888f4f79a17fc8e310786dcb54213e0c1c0c95686efbca8d957aa34c68f
SSDEEP 768:GyVGe5uMS9U6jh1aQwGcpHPD2sq/JL0wEruyyKdTgVpHRCtlOOpQL7ymefuii:GyYe5K9lyQh0HisqB0layBd0nsOpeC
TLSH
T1CF4302E662823652DE89E637B3C481F40F1656C4D2E90564695FFD0F5139BAC068EFC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 20KB
SHA256 f083c71c5c6b8409e97d2120b407f6186564c583f08ee39d99133e8cfa41eb24
MD5 3d0db08f2a5315d0a020acc5a46f5f16
SHA1 1cca15c7ab4355dcc86a384a7c6c62f639b0b662
SHA512 6977c99f87bc661215efe63076414dbded322efe6e30eed1629e7394ba799e477c520f84067fa2d9e1cfadb3ed9a10f9f41e35203e281fb30fef737648d1d66f
SSDEEP 384:mJ64jLzfdCcljj21mXgG0vk5P0L7UAAxAHkz491uGWmLa1NF+c0hzRpr5ZCxWXh+:mY4jLzjjlwG0vk5QSxdGWfic0hzRB5Z6
TLSH
T1A792D0CB2156B11486F20AC6B15C9C597FCC2D1E76D4BE382C73832D5879FD94891E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cc
Size 79KB
SHA256 f7aa76f8c20464d50beb7a04afd63317c5104e1c22f780d4a59582399caf79f2
MD5 d21df2c5fa62d78128c7391314eed76a
SHA1 0aca02a890bc9fd9689eb8527bfb90659eef6dfb
SHA512 ae6ee68699110f686591ba902537d8f17b52edcd0721cba1868a2ecb7f8435ce75b634d34bc0cee4a15611c18ad74e57adff52b96d256834ffa8e859e2a29370
SSDEEP 1536:ruMrGU/fPMLsru5e+1/pa+U6wIzmFKuo2VJ11tejzuJOTPZqwzur+esTZ:ruoBfasqe+1xtzmYQpejzLPswzuVgZ
TLSH
T1E78312A496CD3F31ABF8E01E558BF3CD6E5BCE6B881253934DD934407A905A429894BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 29KB
SHA256 2a0708be69d8a818b02561e13d624399f11f2fa851de7f651bbc27e1574f7574
MD5 e5dd8dd304fc932dffee712576231025
SHA1 50bc9c847e90e15dc1ab6aea9cc541a53c6e00d3
SHA512 1358fce34a578fc974bdfaf7ec5d74355faa8cedd148b8568b940117ec830d876f27a13487b872fbae27bf34dcc65b6d8db7e7cfe45cd0672acf186e9e9a42cf
SSDEEP 768:0Q0s6c6ZUzt7P6HFxnhYrCnD63e7YNE10wgCtgw2MAIHiLswUUEd0ki:RT6ZUZP8FxnhBnDL7sTwsw2MAIHiLsv6
TLSH
T186D2E1656968ED600C00684BADA34547F302873FC5BCBEDAAFE0A02EF1ADD6145E15FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ce
Size 55KB
SHA256 7a8cd0295f8036baddeda1663e843612e095daff7effa2c1ba21958ac77c3a84
MD5 5d1e98adc8bfeac0d7d6989903ae3e15
SHA1 29058692236832ec879f78310767b8d099efc2df
SHA512 620e4a821faa32657b602ec6dbe6d0864dac2051caaecef3d750aecda8b6ef6b006fc39b6de5b44bf742abf60205353bb020a7aff37a2dc3668ddbeee3aaaa67
SSDEEP 768:LMcdKuDp07/nycbSwhE1v7lTdV2s+LkMg8Fy3i+0b8Ip+ky2sUspqOehewqC+Ox:ocxp07/nyKEtd+U8Fj1bjp+ky2sUjp
TLSH
T1C44302D7A71F467D46A6CC2726F831212AB3BCE22D7D90C392590758D72325B438B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cf
Size 132KB
SHA256 2b7a0c66ca4cb42691740d11676ce1326ef9d512621baeaff491bd0caf38e72c
MD5 156fed9bdd87aa6ba1d0af6ab0257c03
SHA1 f885d08806a2b55aac6cf598a85fa08dc57f190a
SHA512 4928db61dd83275083fcd755ca3dd21834b2e7d4d4ee4c4e22e4ba416d11d63202364cf8f6f19779c39cde7d73c5a83fcf90f8ddd20ce437dc66d5428890ee8e
SSDEEP 3072:90IY8cBxF2Ucg+tVYmsJAzSZ9ThyTa9CBR9jl9+hbAGQD4:GVfcgcP5SZ1hyTaSzeMZ4
TLSH
T139D312A0F8D1C469FA6DE34F170AB2C5931F61963B1D6A701A880E9DB24D074B61BFD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 69KB
SHA256 b8fe0523e265ef8969f5629adc26f5f32814629205b12f303ad837d854766728
MD5 51d1a839e420f9f01d1ddcc1ebc3ae0e
SHA1 1feee248204ff22383ae10d13ec89cdcccdee76b
SHA512 f3fbdaeccb2c16a71bd4e650858e2f1b831505bc11b7312443b4ddc21e2ded5a2a6baf34d3115c44dc150262ab683c0462c2c2c17e571abc957248895a66fef3
SSDEEP 1536:j820MmhAUFSmLOpWvgs3Tew74HQ8WbjTHJNksjqO8PEQXZXFG3NQW:BmhWpWz74nWbjLJGsjO987
TLSH
T1266302019EF1AE0A4923B756237FB1483D94D300219D61538D01FCBCB1AF9BEE657267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 155KB
SHA256 69765dd7e069aa2dcc799695738880aa95d8fbf243608b237a14aa1e63d0417c
MD5 b67fb03a286233355c0ba988e3c39aad
SHA1 b093ea2b013bd49d56e787489ba69dca0d51fdd5
SHA512 3d0f2df243f9ba601148a2e72d98fcef46dc20ad0ea0eceb958e6c0bb1af8d8cf853070f6267d75e5b42af9311e4c426815736c755fd124fc5bed77c3b0db9fa
SSDEEP 3072:G11/zmnq7KUJaNpUdr+TTpN60RsCJHfeMpI+jzNhl7xx:S137upUMl75J/ecj5Zx
TLSH
T1B1F31272C98621A09881B517F4FDC8851C7B94BB227B8D4C0A15AA33873C5D6F69F27D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 17KB
SHA256 0cd49e43a8ad9dccec6bb0ec25f2eb7c81157bf20227b947c1d704991772ff5a
MD5 299bd4976e145652902b236ffb6bd82a
SHA1 09b1b45403d7adfc4cca576921ab905b210a36d1
SHA512 1bda47792548ebd810ba05de6e23709fc3ea618f5f56e8dcab7f01491071a49da7555dca9f2c208f4326a807ec83a95a8dc8c27019aa85ab72361121b88d7c9b
SSDEEP 384:G/HFoLHKmqHc4Noj3b2RUPkFLj4MW9DrUeJad5+wSgr/YPAO19Aa3pu:G/UFh3b2RUPklj/qfUDdQwSenO1ma3pu
TLSH
T1AE82C088C7657E41BAD22CAA8C3580FD47B9CE898B3C3D8485F81AEC19B11D55637E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 1f171003870ddfaebbf65b8160d1bc9442b077ccb62a7535b525c587f4bc2a3b
MD5 1d0f85797bd04b3b78ef36598290a97b
SHA1 1cd2e19f1ea3130b202fb8430c79fe3b38a359c9
SHA512 45952cb988568da7d85c56c5839a884aca484be550a87287ce18512bf25a1e79340801244ef03335e67aa32c91ffaa13c80fe2c1e9d901b7e132238e9c6eff76
SSDEEP 192:zGWL1/uofq38tq+Lt9zCCbfnVWTY7fO3/NqS09//mqp7FxMSmN2L1wwn0lhmmoVS:JYzyfjFrPt0WV6Zck
TLSH
T16222AB358EF1DB64CBB4357118D51EED3D3268FAF14B1E876A639CB29F6EB860244402
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b91da68e1789de690c01a0ec83d711932410264587ac2496972a03bfe6c11dd
MD5 77ae3c80822968d477829d39b02717df
SHA1 b3df7c08035fe00b8a12ec485671db139ffe2c62
SHA512 2922fc7ccfabe7adaecacb40390dafdd99a4082700a6321fbd340001e69c2714e263d9912d3cc0226f7df16e6054348879e92504ca52e730821d2b6eae71a86d
TLSH
T1177127340572C3B1E7EA02B29DD72FCD34728CF9F51B6E933890D8B6A6A8F14464914B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 cb3859ea57903b282362fdfd07d51041ff7ac2f9b4d48a691de525ab80d74ac3
MD5 e9d74fd2382426c430b87adc7b10b4dc
SHA1 536f6a54e201944ee73676ed4ca19cc012fed41f
SHA512 e2d90ac6dedbbad8f45de1f6ca4e3d3e9a7322603c422d496f0b22b43f28e73a47254d75dc506f21e41799758dc13204da8bdbee2a0f32be61b052214eb83240
SSDEEP 192:AJGsL5/uofqT8tQLt22DUsZfnVx/Y70O3/aqS0K///pwFxM4mN76/1wwuBllZFoz:A5MYByfk2CqUwj6Vy8STg
TLSH
T15E22ED354EF1DB64CBB5357158C61EEC3D3168FAF24B1E876A63ACB29F6DB420244412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58273a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58273a.TMP
Size 3KB
SHA256 a56d1f614377c31cd5e155f8c74cdfaa4ee42c0ceacfcaa94046fd1f741ed792
MD5 007fcd2643d6cef44d2ffd3824272a8c
SHA1 cb76520c0f1d46df784e41a60d11e002b5c27ffb
SHA512 c2e0a24c6fd269178374d9b0c06f2490fa50dddb78342c16589bbf8c542e0ce6488f928abca86f7015dfa0bbe2044caec7c8c7603f1df7c021343269d26e2dbd
TLSH
T1C07128340572C3B0E7AA02B19DD72FCD34724DF9F51F6E933891C8B6A6A8F144645147
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 85caf14391dd4dc5bfff7d3f09a6a70000587609333b22831939b1929aa7e2ac
MD5 da47a4c533690b50fda2693ae50cbac0
SHA1 eee8c8bd860a4f1b3ca758bda952deb0a9bf65ff
SHA512 a137b1d6043f0c575ba4195832af94c8b6934728040a95f78f95a0f6508d5148d5032eb5faa6ac27e43f758fda8b4e50f9a61d0cbcbcff9c97ad02accab59709
SSDEEP 192:DtS7mcjvQlLGiPc/zJibjvmrmBmLmDmt0mgmz1yG75TR6fmGck:DtS7mcjvQlLGiPc/zJi/vmrmBmLmDmtU
TLSH
T1F7D1ADF783E5822DCA1155F0AA14AF1BCE2D0556836C3C2989E4BF0BA3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 7f73854fdaa12419916ff434feaeaad65b761d09eda10aef80ab871c870bc28e
MD5 515b4410fe9bdf9cda0ffacbfebffaf8
SHA1 4bb38551776819f440022828d57c1f2e470e1391
SHA512 62cb5754ec15fcc6073ecb7a9e7b019cb17e0cb3210420b5e27c24f907cc37dfed4f9b95e18d70baf9d986bd232d103ba1be5c323af313646d34455f6c092892
SSDEEP 192:DtS7mcjvQlsiPc/k75cZYtzJibjof/mrm3GmLmDmt0tmgme:DtS7mcjvQlsiPc/k75cZYtzJi/8/mrms
TLSH
T125D1ADF783E5822DCA1155F09A18AF1BCE2C0556836C3C6989E47E0BA3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 dcd738fc16bcec5751b1c5f5b7a5f2d911cdb593df5084cf28f04d57320e7aaf
MD5 5f9e899b1767b3c3a73cd047972028cb
SHA1 cd67e1d96df335cd241f794aec8f3eb623b9b236
SHA512 a731bc93ead287e7569fcb40887f5d5aee1502f4270f7e5bb2976c2fa3300aeebaeb1db731d5c02d982f452890a2fe53cbb24ec8f4574b30cdfb21ea4f97d021
SSDEEP 96:D/O9emw76j394KzBPcK+jt/iEBvmrmnBmDmDmt0mgmO+wr84GO5HzRBt/GctGj4v:DW9emw76j39N1Pc/jJigvmrmBmDmDmtu
TLSH
T117B159F743B2466DDA1195F0EE08AE1B8F6C0056836C786985E06E17E3F2471E152B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 fe0af96a0bbf957f348ecf64f9574f1515bdc8857313445db1e10a7b318303a2
MD5 cecbd32ef3332d65196039ffaa920ec0
SHA1 046f9aa694128183c5318926dabad6f4291967eb
SHA512 3dddfeda7ee94531a37dcb977a990d202fc77841d5a7ad6f6527c70d9e305e8868e167c6a7e05359fcdcd15438f1f4b545dfd5a4e10fb76eea0f665fb8170cc7
TLSH
T1FAD02317215470F5655C7D91409EEC4FC32681200401EDD811D09C5C053249D5537144
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c687.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c687.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ef43cae71edda1439198dc6f3bd123677b43bc9f4d9227e0c1d4f931966ef4b6
MD5 7cf5bd80cb2bab46eb471900a43168dc
SHA1 b43468480eb295a2950d80542be3653733f31393
SHA512 bd040ee217e13663be437ce6c30d0504f6e53f5322dfec8319fa57060b7630221155bd9e90a81841cbf12eedd6ba2b2eb90367b138a8dd2ee4608526063a0de9
SSDEEP 192:sxZJ8RhyM/jK1Ml8Mkh/fpsd20IdpdXHW6+WNGYCkmbVlIgrJ:sxZJ8PMh/fpsd2tdHbGDb9
TLSH
T12942E8116A34A977CCCBD20DFA557F53D6F9043292910D58A9FCDA1C01E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 51ab55fca376c009da8c0125874d5f836342d685a72b91a4d8c0d959973ede3e
MD5 6aba448296bd3ac67fa40d11beac3cd6
SHA1 1b2e0e847b03edce183ba6a102113d0a9f64d9cb
SHA512 3d07c38e68249bf992fbb4637da6cb2924a565b9183b302b86c21f04279c13b655b20937d7e8fca0ee06aecbd74b7e768b587211acf9deced895f5c8e12cef45
SSDEEP 192:sxZJlRhyM/jK1Ml8Mkh/fpsApeIdp99vngHW6+WNYHF/YCv4bVlIg5EJ:sxZJlPMh/fpsApP4Hba/cb2
TLSH
T18F52D7116A34AA77CDCBD209F945BB53D6F50432D2910E58AAFCDA1C01E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8b8ed08c701579593d1d1f3f48012533fe6f2dff9352db1a25a76401898fed99
MD5 b332f494a11b5f8a41e81cb5d789698f
SHA1 7604e0af68defae77544dc5740079123b39ef317
SHA512 70cda905e021b72687dc6e83d2c63546ed593792c6d6c0063aa56e77215639f46ab97f7e83d9952403e0e6e7f5b2aed81698dcba26217d80b1a086a6062cdcc3
SSDEEP 192:sxZJlRhyM/jK1Ml8M0cB1h/fpsApW0HRbyJddp9GM4q8sgHW6+WNifHFqvVHKw/D:sxZJlPsm1h/fpsApWToHbW0p/xbz/WG
TLSH
T124820752692489B78ECBD609F965BF57D6F80423C9914E5CA9FCD91C00EBAED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 2b0667c73fe3ea2fe649058e24841f70470019f1aa1c2e2dfe66fa6273770603
MD5 b14e2695611b67e161bedd56121aeb36
SHA1 0748273bcc450b3f8f2560af0e5ab40fb770aca6
SHA512 ccfb254c0cae61c01a9e943ef17b5ce4c82bbe517c91180e1522add6ad009487d0d8f7448b79111e02839b6930653464cf1c38bf457dbefa68b112e5ceef7712
SSDEEP 192:sxZJlRhyM/jK1Ml8M0cB4h/fpsApW0HRbyJddpvGM4q8sgHW6+WNifHFqvVHKw/j:sxZJlPsm4h/fpsApWTSHbW0p/Rbz/WG
TLSH
T15D82F852692499B78ECBD609F965BF63D6F80423C9914E5CA9FCD91C00EB6ED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 cf5a485b4ebfc5eb22d43e0278023332bb5647cfbd730a7c744f390ee838bdc0
MD5 575ac41705ab5f880a21d6ea026bf1dc
SHA1 29f1eb89af081fd2dec64fe48c012b63174ede26
SHA512 9420f6902fe42b86a1460f29d22ddc847043ec9a1ee92ddecf5eba5a94d1ad1c1ed3677bb048d896f068a8aa1e0d43aa931b0daa8f279ad0c9b0869390139ef5
SSDEEP 192:sxZJlRhyM/jK1Ml8UQC0cB4h/fpsApW0HRbyJddpvGM4q8sgHW6+WNifHFqvVHKZ:sxZJlPq9m4h/fpsApWTSHbW0p/Cbz/WG
TLSH
T1BA820952692489B78ECBD209F961BF53D6F80423C9914E5CA9FCD91C00EB6ED2303C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6d365b86-d525-4e01-8e26-ef60b34462f2\index-dir\the-real-index
Size 72B
SHA256 922cc1ffc47853db2d0e030b3ee69293b690c784ce98976259b3b056e4237f67
MD5 d581597a59d0a58ee9643fbd412f84c2
SHA1 e369926de45de78f9d7279c9b03df65ed80beca8
SHA512 a33ac54e22ab6cb08ffd48f758e8b589078931c0d53d678a391abadc3c6bcef9d467f391df3293cf50d94b14eec23e0f06c33dcaa2c587b60396083f3c4d6a28
TLSH
T1ECA0023141901491C180C7B95853078037D08865051146024790E1A88DA06434561949
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8a11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6d365b86-d525-4e01-8e26-ef60b34462f2\index-dir\the-real-index~RFe5a8a11.TMP
Size 48B
SHA256 f6d912a08f2670118cbb8723b7a57a2d4384b0911c989b4f7425dfa487f5f6e4
MD5 c88a5b395ee712146646db1ead106059
SHA1 756ce801780c42d10131399c7a56d4532b5be09f
SHA512 3f5f4c225745429a5745fd6fd1f47e42e67f551b9d8e697dce8860b4a823d80c7c9f4f6833c192dc40438d57faf389f6709fc6681026f0942217fe774ee21e75
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 3ad365a716b7d3debb6840029554225e888fb63572669df3458749f88f1b7897
MD5 4170c7912d61d14be2cd1da5e8861f1a
SHA1 2ec833a4a61742a7d578cd3ef10d11bed56cbc3f
SHA512 a81ddb41255c38e4a1f18e6eae7dbf1af40c8c20450947c65cd1cc12ad8fd0004454f28d65e021df332c4d1d384563143e84fb2c8d28ef3b069d153bf58c2885
TLSH
T1DEA0026225D40171D01216B8514205992319FD25410A430588D69C57887995CC601179
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 b4475f411c23646be80f0dc9732d1870c6409df2c4d129f776fedd52a719a038
MD5 afc993a59308b5bd362f60783d97e3ee
SHA1 993ce7f6e8fd155a44147800463717763f552e26
SHA512 ec7a8b35103dcba011f5cbb1290ba190e42bccad2848ff82499e4356a4f1807192d9ec7c0a36cdcf1c0a6c8a683fde9436de3847cb7bc92ef2c83c201ea5b120
TLSH
T11CA0021452C03101C0627BB336D615653A245A98430363264196449CE8D4759594100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 66ad5e917537dc99d0f9d55d331973946f0aae58b42148c0beee768013166f7a
MD5 e9037aa497549cb3a4a93860a2f45bc5
SHA1 588c1a5277d88145f4ebb74f1ba70f6e26fab4ed
SHA512 70646e040d1a3822bdab78e10e3b804d2716745dfc03b27962b91f8347bcad55a258f1c56c21068f2a30ff903aba68f2c4a750c312e45d73a8e2ab60c7ebe848
TLSH
T19BA0021013831005C85A11B116531A821300CE213A00970750E20044CC527D08D4155C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 1KB
SHA256 02d35e651526f4dc11ac04c431d5646653caae0e737e09ff4c8f1d4a0d1911ca
MD5 478aac9f77c63978dee94919ee26174d
SHA1 b3cc3fec9ada6f87417bd3b1658b257763c83070
SHA512 833ffafed8973bd60b9cb3115f31faadba85ff99eeaba4e3b8202a960e241006f826b26598922c8d6edfe383fc6d84d07887326aedec91b929dc3a42454f088b
TLSH
T18B2161594EE08D1FF95544761573B4E473708ADC9311E763287C22721E2234D1A4B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 b324fe11abf4dbcf72f27bb6c091f3d6cb8ebc6a7e640a42d4ae982b63ccf11c
MD5 0e90eecdf8489a1bdec668fc825ef623
SHA1 20a4fc74a4eacae53ac419c45c3d242ffa9ed212
SHA512 8ae7054f0b37fa9f7a74c1ad343fcbe293dfb86e6dbe162dec70f9f626800cbaa609cc5d476b525a5c403a9c599967aa20e8bcb7eb3b6fa37a76c84987449e5a
TLSH
T1ED51C98E4D467F65CD9C24F228F61882733524FE96854B07959CA8357CC32292C69515
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58777d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe58777d.TMP
Size 1KB
SHA256 0510e3fe3a81297f6d22a6180edf00096819ea22f673873302337289e146538d
MD5 2adb3f43cb9c7a9ff300658d5701e408
SHA1 e00c96a2c0a45dc8b9ee92611d50a5fd4c132b09
SHA512 a0fd267d678e8242f79192399b5038991aef0b3700311bd5d4a0d9b73ad3892d6399a5add12d9a341c21621663ac8f48190acebf1c642340a9e214833b62aeda
TLSH
T1CC21449546E28E0BF9C4517B1A53B8F4B3308D009322F3D3A93C26798D35B8E1A4B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 76a99d16f53a64ebac165a3ce857ebe52633faede30316217691e45d70af4164
MD5 3e0acbd7334ad1def1f9b93e5965a3df
SHA1 5b2f874fff93713bbbc5a59696a5d778dd1fbcf0
SHA512 f570667593bbed192bc82ad59de8f11966350f68fda96f003ce36e16bd89550a1c0b8495e5cc92ff1b842b4d271d7664ec8d37104092708bb84cea794aefeacc
TLSH
T1A5F027B72FF72828BCBBE3F5247058A4024A7D84C996FC9F0465B19741F23662499C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 19e6de46d8b745a9a6aa0ae471f30eb6c58f017ff3679957aca814cdf6e8fd67
MD5 d10c7258e8a5a9c781103fbfcba4a4b7
SHA1 50f389dd180144236ee7a60151121485c86ab6c9
SHA512 adeca5f49ab9631bae9b5d96a991376f321f47a4a8d915afcdd756568f937e76206e040fc93c5189de8d5b433fd262f8e6498d77c11d08e082c0666819f1b946
TLSH
T17BE020FA2EF72864BCBBE3F5247058E0065A7998CD46FC9F1069A1D750F3361385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 87c2640702cde1d4f9441719f7420904cd20bf735f445e94d23ef4a2b4c0aa53
MD5 c162ffe2d655559828de6cc7e4c0017a
SHA1 6954723a8fe02eafb47972bc4516708e47a822b2
SHA512 49b4a3049b85dd43016b920f5acc62772aaef5226481539bb69dc6f75f933b382d4ad89ba488ba2cda75cb964fd042edc4b29018b48fc4e34c33d7feea490ff7
TLSH
T1EBF027B73FF72828BCBBE3E5147058A0055A7D84C886FC4F0466B19791F2366259DCA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e6eebad7500f692cf0cf1c99c61a23ad9e0edcb33c202bf71e44e447743b6c5b
MD5 4cf0d8a46fe1eea64a904368ab28ba30
SHA1 09dc2d237bf8f7048d57879df9c6280315722ede
SHA512 3ffb780917f555c34df1f560c66438af46ef98c5dce54f78b8461bfbe636defb639f02c8b87f81653089ca38880a631db239eaa57e99807dd96e55802b4b1d1b
TLSH
T158A0022ACF6C9046C0505672D0A5118E6E159D9C5615631948AC2056C9BF6508592164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cd2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cd2e.TMP
Size 48B
SHA256 e93097d9b5662d88710d25884fc7cef1bbcca6cbf0df36aaef1fc3b267a4e181
MD5 3cebc624e3aa093f7439807efbc13150
SHA1 5feef0ebc083df45132c8c3dcb4b06212f42495e
SHA512 1dc0bfe51ed3ea29de042b2bf9a99d0491447c518ab216bd500b2cc42e9548828c4ecc194e6b636ed974e3b01ed79dee795406d9399fcf5a75b1cefbf3810852
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 795a27a406b9a08a45e093b41b39173985081f1817b1236dfebbbc5407c9d0df
MD5 1e30281ce6e4d7f129a1d1487626de3a
SHA1 bb214180a954f3abd9650fc751238c0f17838e07
SHA512 5fc8d0cb952981eab8c48c5bb78976f8c8a1b2a3659ba8cbcebfd75d6f330c27476033606844ba669907e2f4218229a2312ca896ed7b576f80ff33a53cc15867
SSDEEP 96:KwZ2KCwiWliKuEN4QKFWqrshAc+62kG6DPg0kKoH:MhJtjn
TLSH
T10BA15301307F02413C7E690891AAC93ADE46B1663658E87FB7A891E35F66E611DFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58c280.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58c280.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7221f61e10bd27243ccb0c8c2aed5b9336b792f92e8cdae5b8c85abbd8d20ae5
MD5 1e9ecc9f8aa2ab141b11988bdbe1768e
SHA1 92021d5a105c051673331bcf8413ace4a893a620
SHA512 0a637b45db04796e4948a2473662d70291c3e6dc931bbc9b0f505fc3417500cab9ed4bff8ff681d87c820c7bc0468a8f2a08ab81a2e281b46b296c5c493e357f
SSDEEP 96:EqONkEQsjpf1bxX5ih/cIPURHl8h4otop5gAnD6BfPgvE5BzatIRdy+jCOmhsR1X:vONw6Db6QmiUy5qHBa+jcOmiRqRgZbU6
TLSH
T1EA02F83568786CBB9EA26E48F88B37275FD4103BDA966F40D6D85F0C00D765C234783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fe19118f9ea4f7ed81855bd3560b9f869f29fb38895f50fdb6fdb368c6749d2a
MD5 13115382e0237aa647a949a7647d13eb
SHA1 e897c2e5adbd8353fdd82d5ca025b34fc14f3e49
SHA512 165359d0dbfc8adfa97b0bce0d183f212674a5b106febccf3c7ea3919f3b5006a53a0127d3c84e9c6b730bf37687cef67283d33eb5f2881de118bf0a2beede09
SSDEEP 384:tiF+ZcI75sNt8TUNTUlIR+TPYVvksEa+wOS7+29tnTKwBODNZOCpKDr:kF8VIwgEl3a1OS7l9tnewBKZOeQ
TLSH
T158D229F248DB9836D9AE5707EB7E2E034EBCC063F5856954B3885A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 70b96cab0cd3adf2ebcd3fedc930769c51ca0ef60dc982ea5d079507acbdf52b
MD5 e75b2e471070bea165bc906edefe5e97
SHA1 4f49513fea668716c3ca1bd66fefd1f45830ada2
SHA512 370839e2b4ed771aaec323f9b7fbc120d08a114e40ca8bfb25410ae40c410c5241eae46b781c39b13998246f87df344ea1cf8988b38fb2ce4a701f5133cdbab3
SSDEEP 384:tiFPZcI7IsNt8TUNTUlIR+TPYPvksEa+wOS7+2ztnTKwBODNZOCpKDr:kFHMIwgET3a1OS7lztnewBKZOeQ
TLSH
T154D22AF248DB9836D9AE5707EB7E2E034EBCC063F5856954B3885A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 33fa00f8e55b57f8a29f7756558797b2bd051a773c4e6cc161297e5b5830f739
MD5 6dba1e3a7caa19d7a4ac75aba61992bd
SHA1 52f605b8a6c0235c5371dc9c9df0b6f7bd177b77
SHA512 9541fe0ebde4bf5119491889f7183d7850c0857bae4233c782bddb10153c1b8d1ddf0bc83f83bbf42e18f95795f0fcc9ff29dd24a30a3c2cb2ea3174619b32e6
SSDEEP 384:6ZcIhsNVXRYTMAEa+wOS7+2OfnTKwBODNZOCpKDr:4hwzza1OS7lOfnewBKZOeQ
TLSH
T11A927D716C3C9C775EE6A544F88B32075EF89073E6CA2A64D6DDAF1C00EB598130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a8ba324f4c77662e5dc85284375f676aabcb367b12152a618c212c561a09a4bd
MD5 bcab120eca59d3fcba35b29cca1e4430
SHA1 dbb9ada7b455c8c52d3ff1473108a94e115a8bb3
SHA512 2975a840385f9cfe003ef80e3ecfc4bb0e18d1a9f9c7ce4a901d3eade23642ab7b6c81ab94fb0df09d1f6e56bc2773f7a5d8fee797220b3f67761a564fa69603
SSDEEP 384:tiFIZcI7nsNt8TUNTUlIR+TPYPvksEa+wOS7+2ztnTKwBODNZOCpKDr:kF27IwgET3a1OS7lztnewBKZOeQ
TLSH
T121D229F248DB9836D9AE5707EB7E2E034EBCC063F5856954B3885A0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 54d4c13c51177066871c15259e06b7c45acf2d0e4892b3e7770642133b2a8ef0
MD5 556a977b542eb79822753281f9108c33
SHA1 c3646fd40be988a4122bfb85ad6e5f4900ee55fe
SHA512 93ba293bc6607363bde275dfe1e7608c9cf1b43f006f462a6217f2c07d05629f5773a7b17f369ec09a4cdfa7d1464ce0f9a63b35be448f5ff9ee6ee88fc25c9e
SSDEEP 384:6ZcIhsNVyRYTMAEa+wOS7+2OfnTKwBODNZOCpKDr:4hHzza1OS7lOfnewBKZOeQ
TLSH
T16F927C716C389C765EE6B544F88B32075EF89073E6CA2A64D6DDAF1C01EB598130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 542e120e443d82c81686cad45511ba9e51e5407e4b98bfc8396008f71a18b9cb
MD5 9ff1c25460028124c3246d33b830d8ab
SHA1 bb7279c0f84c5cf1577050a40123989d503e4ddb
SHA512 962c6656bf6358196682324ac4406810015d774ff7242e77c245e51feddd3b6ae56a06c1548f9e5566e6cbf0d534d8adfec4d39272e13bbec6459958d5186ccf
SSDEEP 192:NONQ6DblQmiUy3CqgBa+jcOmiR67+2DNz3qUU6:NONQ6bMgBa+wOS7+29fU6
TLSH
T1FD1219366868AC775EE26544F48736175EE8502BDA8B7B90C6DC2F0C01EF65C234A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fbc72f9b43611a0c606fefea2f5009b7d7889dbd4e8dd1fa4b73a4e05e476215
MD5 b9291c0b057bc0685bfb8f0ab66767af
SHA1 34375b7c863da32eeabde8d6862e247c0f1b1e8e
SHA512 f9281c3a157c39e0838372fde87a0923361aa5cebdfcee03cc78d50f0d228121ab02dead0653678afcb57e77ef0f6bc706f3cf926b8e43cc3d9ed0ece96edab2
SSDEEP 384:tiFLZcI7JsNv8TUNTUlIl+TcY5vxsEa+wOS7+2ofnTKwBODNZOCpKDr:kFT9Gwg5k3a1OS7lofnewBKZOeQ
TLSH
T19BD23AF248DB9836D9AE5707EB7E2E074EBCC063F5856954B3885A0CCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4a0a04da7e19b16c42073af3c1ec0d71f73e3a7880491dfbc649b897a46eedb5
MD5 afc23be56dda60d58b0218bb088cf309
SHA1 af213c261831fa22ae696c54340a00a67b6f331e
SHA512 e0d8d7468c47e08f58fca96d20e1deef28333a23fd5d45f8c4945805c645f26a9f81bbab399f2373a605aca837e86dbae202850f5e705931aa8de6d03398ba88
TLSH
T1EBE00242120504BDC02D073020032F304DD6402140F105574F30458C0C333007E31F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eee5a95be84da6aa4db260c45d7cf5a1b69687122ffb3300fb06d68b6fdb1443
MD5 178cda4a867de954bd9924f8e2a4cfbc
SHA1 3bc57f7427075d5fdec4d9b770f32de4ca134b68
SHA512 2f91d2610c5500adbf77c7e90ee32857d46ffa4f7daf627eae74dfed4fa17b29d1c7be286c2300024460e6276b29c1e6847216f6c967b777a01377553c2ee8c7
TLSH
T15BE00143134544BEC42D073020872F306EE7803142F206574F3045AC0C237006E31F10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5885c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5885c5.TMP
Size 392B
SHA256 9c2b01ea3432e34fffd20df0d6c57dade19821f36a721370b7876a4a0cde1867
MD5 86c51162318ef428128f8b429707f7e1
SHA1 6455a41372f01444c2f9d7f2b64fbce99732d46f
SHA512 a77d68588650e658f874a8b050e6aa632c2c9f7fb89ca05582a619ae96e15150f09799b7e29b5227cadee17a6586f4d8eb73b8a0f5b4ec8acd71363a2e68ced1
MD5 SHA1 SHA512

Submit Download

2da58a32-49c1-4b35-873f-a9899d247558.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2da58a32-49c1-4b35-873f-a9899d247558.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7e83d3602271f726fa90522cdbbd1dcdce3982aba6a895093d9bea9867a73bff
MD5 0db55eefd5c24a5b89a5f504945864a7
SHA1 dfd4f282403285586da3d4be0608b2963984936d
SHA512 0cb383a3dc731f11210c9a5e9adc0d9e44661d107667b8caebf5930f4e24e2ed2028df7213b0ff3fe198d1d92ca627fa869f11d2b80fb8bf95e51398162ecd41
TLSH
T14B41F858ABFA1144B3F37F5AAFF6A46E447BB8772E06D45E00110E4E0A66B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe

Path C:\Users\Admin\Downloads\Loader.exe
Size 4.2MB
SHA256 bd96be99c8d53726d7eaff6a929ac42b0aad1650a353c6c68eaca382ae36c30e
MD5 790a271b0603fa43e917bea9fa578fc7
SHA1 3554780f8bd0373a9a698f4d202ee9ab46e9a703
SHA512 06b9044ad3273cce5484753b0aa457df600bc0e8a066d873519daaf16db469b9d524729aa8137621c90859b16508513fef9fb05ae77caf06ad4c508103063d97
SSDEEP 98304:NAv4jg8Y/kz+htchELLP/jruat6JjEkor2Co4HRmjWH:2v4PY/kz+htchEfXjru86BGrdJ0jO
TLSH
T18416CE4BA6BD00F4C5B6D1389142621BFAF27C5943349FEB67D04E5A0BA37E0A97E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x32dbg.exe

Path C:\Users\Admin\Downloads\release\x32\x32dbg.exe
Size 162KB
SHA256 822028f0755dba773e445eaf57fdb3dba84c9550ac7bdad2afa449912b5fba41
MD5 d30cd1d8d018f4de50069f66825c187a
SHA1 f34cea0623fb7f878132f3fd010855378d87e3eb
SHA512 bc143b3497876b0890f832a47a1142fa82c440f13ff32d4d58b2697030aa3461fda8f6786ddf6d028cc9b76d9dfbc4bf86f389a26144c7efd6454e8e9e37a687
SSDEEP 3072:vjJNPJa9cEcMAHguUCqdDURszP+g+z2JFmUcY1kGIYhW8fV:VNxaHQgTC3szShUcYrhfV
TLSH
T1E1F36B01BBD1D832DAA5083189A2DFA18E39FC557FA0EDD763C40DEE09206D1EB36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceNameResolver.dll

Path C:\Users\Admin\Downloads\release\x64\DeviceNameResolver.dll
Size 74KB
SHA256 c6702029a705fb5db2775f31331b8314566dd84d9702b0c6ff513515c160629c
MD5 1a4a1e71f2e948608ba80e901bb2b969
SHA1 6dbd88b0dd59ea30647ccda1830d33d454044990
SHA512 a285f2ae8d9021da5c2e05ecef5b62945e442cf62c234fb748a8644f77d55462b129c6583e290cc6e7aa43055509c9d75f6eafa2a76bdd324fac1d8b5a07ee8a
SSDEEP 1536:TZBMWi6zZbz0eZdTQIijtFe4TPRmoXuXOqH1NIEk672iD3:TZBc6t/VZdTfixw4TPRXuXOqVNIEk22c
TLSH
T178736C5A33A800B5E5679239C8E38E17E7B2F48663B552CF5378429E5F633C15A39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LLVMDemangle.dll

Path C:\Users\Admin\Downloads\release\x64\LLVMDemangle.dll
Size 593KB
SHA256 8de391f11ceeafa007badf71b62560368f8c71623486ff1c2e4c5373fe482834
MD5 1228e59df447f4e6476546ae24638071
SHA1 7ec87e01e60f8f571684cc929fec414c224156e9
SHA512 acccedd27f10123e9f572d868fe11cd5d600b4f1a45a9e38fc263dd4d75cde022eb0d3c74fc3700148b4cfba7146c45d4591cda5fcbef8814427980658975c60
SSDEEP 12288:jo0iiwc1oIuS1jRPhvaIsUag9pbYggoFKQZELWpzizUqZX0aqlyT6kcrZ21ribar:niiwc1oIuS1jRPhvaIsUag9pbYggoFKj
TLSH
T1E1D45A2A77A40279E17BE13CDA934A64EA72B8450721A7CF13A453AB0F133E1573F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\Downloads\release\x64\Qt5Core.dll
Size 5.7MB
SHA256 ffe7dd4f3edbf6b87d1855c16b9f9c245cc3bbefb4d032537c5686699f91790c
MD5 f598f1151f894dacdea21a47a214c209
SHA1 b1ea19d9f361e1d4596abefb51df82601fa09b64
SHA512 3c0ad8156248d25a1194c2c21e21886973855f9c681ef231129f5fce73012a2787ba3161cdd3559991d86894bbbed11449bac56d5e676346802bcd03c69decd1
SSDEEP 98304:fys+BX0av+ePwBluJsv6tWKFdu9CtuS74iYRrqfC:fys+X0g+dBkJsv6tWKFdu9Ctv7irqfC
TLSH
T124567B57BBA60161D0B6C23CC9EB9252F6B2B8014B328ADF1259574A5F377F1293F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TitanEngine.dll

Path C:\Users\Admin\Downloads\release\x64\TitanEngine.dll
Size 401KB
SHA256 0f4f992b51218b4bca6a0a8aaf7d1044b56666634c9d62948a8e7873736200d0
MD5 00b08ecb2b9722781137e2e46ea4a508
SHA1 0006d992b3541b5972d3ad3bf2aed6f2f4d377ed
SHA512 a5f77efc48205cfca9d3263437d6debc176c356ca8a168795dbd9c8da570465109b5a220407e361c552122da36b2ff83b4be355fed57ce185ff20d40803cd9fa
SSDEEP 6144:BiqeDykJCv8McwZSZys6mj42G7VsOPxj9QeQjtHVy:oVNtbwZSoRuC9I1Vy
TLSH
T154947D2BE76954F8C56FD13C8B679627F6B2345C0310ABEB06704E566B13BE17A3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XEDParse.dll

Path C:\Users\Admin\Downloads\release\x64\XEDParse.dll
Size 1.4MB
SHA256 7237ace651d8ae8e3285c9a0256bf34d50e7a4c9722ce016bbcf74e80c3071d6
MD5 e9d2d4b4e5c2eaed37f9e27232339858
SHA1 b6ef7424c927b788e5875198c690e96be1f23f99
SHA512 5444f5516c74a96cd3152039469ea79f0e7d9262f21410a8e92593e4f870c2da3b8c67a4c85c742338ee6af582fc905ecb4f3704096dca3a791377e48aa1dd2a
SSDEEP 24576:ZpoHrP3dUN26xvJ9TkdQbgbBO1uGaWAXIcbsYV1tM8o+gxUOKPClk:ntI1O8o+gxTi
TLSH
T1F765D549EEF2AE96C441C2B8948FDFA7FBB4A0050B15CB97029434F56D4279729BB334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jansson.dll

Path C:\Users\Admin\Downloads\release\x64\jansson.dll
Size 146KB
SHA256 eb704b761c638dc9cc4690941dd0de71e4f0575280d41243a5b0d40ebd38f4e8
MD5 89d701f3bcd052251e023441d5fdf97f
SHA1 3771038e2de2135d9bfb62254fe83e5c996a9e53
SHA512 ea377bb175ba51a63625352156ed4c848868def18af9bfdcb0eb76bab6b4b63ef091ef5ece49f47de652d508bd437f2f113766b86fe53ca1174fb1c13cd4b122
SSDEEP 3072:jvxRwyqpVmfBbIaLbhBTFp0pwxgBUmameJ9qDx61PlEk22t:j7ecfBbTZBTj0pQMJasCPlt2Y
TLSH
T15FE36C4B739400BBE5B3963889E78516D7B2785203719BCF17A442AA5F237D09E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldconvert.dll

Path C:\Users\Admin\Downloads\release\x64\ldconvert.dll
Size 56KB
SHA256 293539875b478fc2b554104f8c1e0e80a169e75c829a5b882e10b601e6e99744
MD5 5ed39b88a4a05adde32153e5d583e424
SHA1 c139a5761b5e8e2cb06c3229d70ee6eea9bfad9d
SHA512 9c9e438abca22502e0430bae7cb3292ff768cb9de0ab06ec1bf261ac2b67750a0172b084b05e7b21f786feac622990edb674619602d118e94e8b0202cc5fd3e0
SSDEEP 768:dYr76PNgLM9oSep32jm/0cW5597jBhrUGUm/fLlFHEk672iRPjSGU:dXPN9VkIP37j/UsHEk672ixjSB
TLSH
T19A436C87B39364EDC54FC1749ADB5B32BE70B92226246E3F47B0E6302E01D543F5A629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lz4.dll

Path C:\Users\Admin\Downloads\release\x64\lz4.dll
Size 96KB
SHA256 5cfae56f5319dc343799ac7e9738bc367f9843ce4bf4e795d2ee2ca268fa9c5d
MD5 be36901afd7394b0355d787c407d2d5f
SHA1 1d9c3bb6d06efd4b56a55140361f747e0b40d475
SHA512 1356c7cc6ab1625d0fa055ed57fb79e4009fd354b72c4e4357d07a9c8c40e8dc2389cc9134638daea4a6f065d5457d60985a9c378fd9d53748621a4c9a14c019
SSDEEP 3072:expC15SOPYC2TFUNnWyH2L+xqfbQTkx2fEk221:Oo5aT6wyH2CE/Gt2w
TLSH
T1F6A37B5A33A400FBD8968678C9E79A0AE3B17827033457CF63A4466A4F537D25D3E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdia140.dll

Path C:\Users\Admin\Downloads\release\x64\msdia140.dll
Size 2.2MB
SHA256 df6bbbfeff8af9c26493a58aab7ee1073f54b5196d72ec0a090bc23c64f751aa
MD5 b9b9965799883042a734af2016955c71
SHA1 44401d924be33dc28ce40bc50718f7eda0cf6ef7
SHA512 68892d14361d5229317b87a1bd072411e211dcc0606480dac68731183794dd7fd36268df698eef379d6d917522180b9d2d3da56ce934258e087f2ade033b8129
SSDEEP 49152:2DlNGTh+yIr0q0ZzhdYRUucdh1cSk+aME:2RI00ZzUUucX1q+aME
TLSH
T18EB57D67E3B841BCD0FAC078C55B9607EBB278460720A7DF12A5466E6F23BE059BD311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\Downloads\release\x64\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Downloads\release\x64\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\Downloads\release\x64\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64bridge.dll

Path C:\Users\Admin\Downloads\release\x64\x64bridge.dll
Size 89KB
SHA256 39730aea3509e275bc2d69d8d27f22695821b7caffa30943fa0dcf36f9f558cd
MD5 6e4475c143495f41e36b3e4860ee0fb1
SHA1 d38da90c57eb25434c7021ee2fbbca7484d6f8d9
SHA512 f2eadca04a156fec4bd5b5440133bacb0cd38a6ac18e7a9d015d1277a5da610c90713f26a3a1164e71279ef891d363875d287ea9599212bfec48e49217ae7ef5
SSDEEP 1536:Hhs69Looud/uWb5het238pLmMmMdcmAnV:Bs69Loou96g1MdEV
TLSH
T1B0935C36BE15907EE26A89B8DA574982CB72F8469B9157CF43500CD50E36BE44F3E383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64dbg.dll

Path C:\Users\Admin\Downloads\release\x64\x64dbg.dll
Size 2.1MB
SHA256 dc9d5ff18d6e5fc9d667a2c2bc8fa9cce15fa5e0da9728222259a4525d542c0f
MD5 21f99a0b87516930d340c6c27c6073e6
SHA1 edf83e8c497480c2f26b77d1ad1ac8f5232512f6
SHA512 a5336c049eb0a11357637ec0aec18c544ee3dfe4f69de71ccd64ae665f7684bfbc5c1d2495a10937a1dbe39b0cad2fb2768e02973872e7a1634c651725793b85
SSDEEP 49152:dYlnisJyHWuY0LCwP66viTKUrR7ur19RJCz3puBh5:iFy2uoCt+5uB
TLSH
T142A59E37E7041079E476D2398B974A53E3B2781143719ADF0690299A5EB3BE01FBBB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64dbg.exe

Path C:\Users\Admin\Downloads\release\x64\x64dbg.exe
Size 202KB
SHA256 68d6afc2cc5a5bfd74a1b4066c0651254661355a0e384524cd1a8772adb95092
MD5 7b593b1acaad3e6c32c5dee37bad668c
SHA1 5c7a22d4566d1720325445c7db43ae5c20ae9862
SHA512 08dbca787b3b12bda8ce1a2c593c14cbfdef1cfce9bef4080c1567eff760625d57d5428b20ef078968947748097ffe9bd6ea57befd86d9047908ed771df1cfe8
SSDEEP 3072:FZlFX9Inkz2iLOPvXs9GKlazxB7NKwNrPY+hgWnESBf/rWXSbV:FZlFX9IkqiynmGzxNrQgJ/rWIV
TLSH
T1FF144B47A7A1E0F9D966853886924F05DB717C6277A0EEDF47D00AED0E227E09E39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x64dbg.ini

Path C:\Users\Admin\Downloads\release\x64\x64dbg.ini
Size 50KB
SHA256 e04e7604e1d9652d3f96df51c492fe582a98964932c55b9f1693fd627ad3e317
MD5 5deb81bd194588eef24e1acdf809f497
SHA1 09e9d488ca971cad05cfbf62165671eb7a1a3eee
SHA512 542959deabf5b5bba79cadd5bdbfec0d4a4c515bbe27b066d22a3b84460ac5688b0009fca36fcaf51145ac297fe6a7d115c911f8c5ce883553afdbae009be05c
SSDEEP 384:mDi+Revjjjq7sBu9pwbwiy7Lrbriy2cr6HG4le1kuiEA3KErhknVas0m/5tLT4yM:V+8v5pYr6HG4Y1kuqc8
TLSH
T133331D9E1C0F5A888D473355E3FB340867DF390A10E918E80B38DFCE9F5965944F69AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.exe

Path C:\Users\Admin\Downloads\release\x96dbg.exe
Size 194KB
SHA256 7473d96b13c350643fc8f471a2e840494f8ab771b35e3e316ebf8a66660df158
MD5 550ca69da5d9c92a5287456220c4e1cf
SHA1 c5095ca3c2d7b5f1b51ca47f8e52ffbeafa523eb
SHA512 b06bc32977418d1dbeaf0a927683ed153b8132afd875b3429ac464d793cbbaad2d90057c22a365ca73377ab91e313b5b2ac3d8ac1b289e8336c64015393d30eb
SSDEEP 3072:NqVO3SCNXhEnDl+dUc/+Bc5Ja9taJlJHPHqy9dF6JNq6oIo4iFk04sZVc:BUwK3c5JStaR/1+DRiN4qVc
TLSH
T14B144A117BC1D933D796093149A18BB1893DBC603B91EEDBA7C40EFD0960AF0DA3A657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.ini

Path C:\Users\Admin\Downloads\release\x96dbg.ini
Size 122B
SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
MD5 45c1e010baaeb6b086b93c73cbfa1433
SHA1 6570b66b77103aac30dc7cccfacde1e42413890a
SHA512 6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50
TLSH
T1E7B0022A0DD3515E3769D195C2B095A03702F4167C595B2C8DC0574958EB6096442C92
MD5 SHA1 SHA512 TLSH

Submit Download

snapshot_2026-05-27_12-11.zip

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip
Size 30.1MB
SHA256 d41966dfc5b435a372798245300ca0ab7bb8e48bdbf48512c6fb20fcca427697
MD5 92f0d724a9b174c161e23a95f19a54c6
SHA1 4f70bf300e79e0a88d59ab3bfe68d22daf003cea
SHA512 4acb68e66fd10d6a1a582e38bd92e13e8f30a21b717ea6b6225e691a959062500ccd78ade0c022106e75caf4c0f324c90d6d24bf9b80ac727758eb98385f15c2
SSDEEP 786432:7tNbaw+FcDCi5hL4PLxZiFOhbJjcg74hw9NoiBDm67fv3aH1nbmHFvH:7i+DrjgNZiFQdJqwUGDmEfvKH1bml/
TLSH
T12B67334EE2ADB50ACF4F7B7366F2A115CA8DE560607CF32E46E6340D49EC5F4A46E240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.txt

Path C:\Users\Admin\Downloads\version.txt
Size 5B
SHA256 8248f7772687aff0b103b36898908deb82126337f933e49a5ac04829093c58ff
MD5 5337810b0c500ace9c4cd745f4b8bcf5
SHA1 d1325bb186bd83303245e504f7c6eceae7f19e44
SHA512 5753b285d3f7881f06c35bb16931cf2a5408f13701855d5c7b2810f34e9bb266392d80ff15253a79f89d30a9ed0eec3be0e7e81677a7dbfa1e15a3907a50b02e
MD5 SHA1 SHA512

Submit Download

memory/3548-2842-0x00007FFEFDF20000-0x00007FFEFE475000-memory.dmp

Download

memory/3548-2861-0x00000000502D0000-0x00000000502E5000-memory.dmp

Download

memory/5396-2162-0x00000000502D0000-0x00000000502E5000-memory.dmp

Download

memory/5396-2149-0x00007FFEFD110000-0x00007FFEFD665000-memory.dmp

Download

memory/5396-2166-0x00000147B8F20000-0x00000147B90EE000-memory.dmp

Download

memory/5396-2163-0x00000147B8F20000-0x00000147B90EE000-memory.dmp

Download

memory/5396-2165-0x00000000502D0000-0x00000000502E5000-memory.dmp

Download

memory/5924-2646-0x000002AD4C920000-0x000002AD4CAEE000-memory.dmp

Download

memory/5924-2724-0x000002AD4C920000-0x000002AD4CAEE000-memory.dmp

Download

memory/5924-2159-0x00007FFEFD110000-0x00007FFEFD665000-memory.dmp

Download

memory/5924-2169-0x000002AD4C920000-0x000002AD4CAEE000-memory.dmp

Download

memory/5924-2168-0x00000000502D0000-0x00000000502E5000-memory.dmp

Download