a438a71579153473d2fc941231c5cc16293fcc39ea274801e384a298f280bafe

Analysis

user interaction
yes
max time kernel
259s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
acd54c6a06ad6e5155014fec4033434a.jpg
Size 33KB
Sample260816-vywhmsshke
SHA256 a438a71579153473d2fc941231c5cc16293fcc39ea274801e384a298f280bafe
MD5 fff51ae6ce9695167d089e26b131682c
SHA1 74fe89a59ae8dc15cb6f4a034b96bf4289075259
SHA512 c6f82ff7be68cd732312dbe36bcf22a13cbafe0dfeb60a19182d04a2f2bac1df6ea4429a3e650b09d5b97000eb0648f98a1ed0a5db56522e771a27065c4b686c
SSDEEP 768:j/PRZDNTCHthwEYbO2q0gCJEAmbPvEo4ckGvGi0UV5i5liHt9rhEQqaz:jRZDNTYIJFqBCbsPvEo4c7iWIwH5Eb0
TLSH
T14AE2E164B25CB5E8E8AF7A3150FE97A753C91C9848E70BFF00D14FF149A54DDA0442A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
577	5792	msedge.exe
577	5792	msedge.exe

Executes dropped EXE 9 IoCs

pid	Process
4032	YouAreAnIdiot.exe
1772	YouAreAnIdiot.exe
5668	YouAreAnIdiot.exe
1448	YouAreAnIdiot.exe
884	CookieClickerHack.exe
1976	CookieClickerHack.exe
1016	CookieClickerHack.exe
856	CookieClickerHack.exe
1772	CookieClickerHack.exe

Loads dropped DLL 2 IoCs

pid	Process
4428	msedge.exe
4452	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
575	raw.githubusercontent.com
576	raw.githubusercontent.com
577	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
246	api.ipify.org
247	api.ipify.org
254	api.ipify.org

Drops file in Program Files directory 41 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_498524468\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_498524468\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1531903520\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1988846981\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_498524468\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_832443230\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1988846981\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1988846981\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1723397406\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1988846981\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1723397406\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1912019566\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1912019566\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_832443230\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_832443230\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\CompatExceptions	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_832443230\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1531903520\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4428_498524468\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4920	4032	WerFault.exe	162

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5792	msedge.exe
4480	msedge.exe
2084	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313747387910121"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{98DA1DBC-79F4-4E22-A18D-D428E1D7F01C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6040	mspaint.exe
6040	mspaint.exe
464	msedge.exe
464	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	firefox.exe
Token: SeDebugPrivilege	5856	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
856	CookieClickerHack.exe
1772	CookieClickerHack.exe
4428	msedge.exe
1016	CookieClickerHack.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
6040	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
6040	mspaint.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe
5856	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 5856	3856	firefox.exe	94
PID 3856 wrote to memory of 5856	3856	firefox.exe	94
PID 5856 wrote to memory of 3068	5856	firefox.exe	95
PID 5856 wrote to memory of 3068	5856	firefox.exe	95
PID 5856 wrote to memory of 3068	5856	firefox.exe	95
PID 5856 wrote to memory of 3104	5856	firefox.exe	96
PID 5856 wrote to memory of 3104	5856	firefox.exe	96
PID 5856 wrote to memory of 3104	5856	firefox.exe	96
PID 5856 wrote to memory of 3104	5856	firefox.exe	96
PID 5856 wrote to memory of 4232	5856	firefox.exe	98
PID 5856 wrote to memory of 4232	5856	firefox.exe	98
PID 5856 wrote to memory of 4232	5856	firefox.exe	98
PID 5856 wrote to memory of 4232	5856	firefox.exe	98
PID 5856 wrote to memory of 1040	5856	firefox.exe	99
PID 5856 wrote to memory of 1040	5856	firefox.exe	99
PID 5856 wrote to memory of 1040	5856	firefox.exe	99
PID 5856 wrote to memory of 3408	5856	firefox.exe	100
PID 5856 wrote to memory of 3408	5856	firefox.exe	100
PID 5856 wrote to memory of 3408	5856	firefox.exe	100
PID 5856 wrote to memory of 3408	5856	firefox.exe	100
PID 5856 wrote to memory of 4404	5856	firefox.exe	101
PID 5856 wrote to memory of 4404	5856	firefox.exe	101
PID 5856 wrote to memory of 4404	5856	firefox.exe	101
PID 5856 wrote to memory of 4404	5856	firefox.exe	101
PID 5856 wrote to memory of 3828	5856	firefox.exe	102
PID 5856 wrote to memory of 3828	5856	firefox.exe	102
PID 5856 wrote to memory of 3828	5856	firefox.exe	102
PID 5856 wrote to memory of 3828	5856	firefox.exe	102
PID 5856 wrote to memory of 2212	5856	firefox.exe	103
PID 5856 wrote to memory of 2212	5856	firefox.exe	103
PID 5856 wrote to memory of 2212	5856	firefox.exe	103
PID 5856 wrote to memory of 2212	5856	firefox.exe	103
PID 5856 wrote to memory of 4540	5856	firefox.exe	104
PID 5856 wrote to memory of 4540	5856	firefox.exe	104
PID 5856 wrote to memory of 4540	5856	firefox.exe	104
PID 5856 wrote to memory of 4540	5856	firefox.exe	104
PID 3728 wrote to memory of 4428	3728	msedge.exe	110
PID 4428 wrote to memory of 4276	4428	msedge.exe	111
PID 4428 wrote to memory of 5792	4428	msedge.exe	112
PID 4428 wrote to memory of 5592	4428	msedge.exe	113
PID 4428 wrote to memory of 5592	4428	msedge.exe	113
PID 4428 wrote to memory of 5592	4428	msedge.exe	113
PID 4428 wrote to memory of 4304	4428	msedge.exe	114
PID 4428 wrote to memory of 4304	4428	msedge.exe	114
PID 4428 wrote to memory of 4052	4428	msedge.exe	116
PID 4428 wrote to memory of 3368	4428	msedge.exe	115
PID 4428 wrote to memory of 4052	4428	msedge.exe	116
PID 4428 wrote to memory of 4052	4428	msedge.exe	116
PID 4428 wrote to memory of 3368	4428	msedge.exe	115
PID 4428 wrote to memory of 3368	4428	msedge.exe	115
PID 4428 wrote to memory of 3968	4428	msedge.exe	123
PID 4428 wrote to memory of 3968	4428	msedge.exe	123
PID 4428 wrote to memory of 3968	4428	msedge.exe	123
PID 4428 wrote to memory of 452	4428	msedge.exe	125
PID 4428 wrote to memory of 452	4428	msedge.exe	125
PID 4428 wrote to memory of 452	4428	msedge.exe	125
PID 4428 wrote to memory of 4380	4428	msedge.exe	126
PID 4428 wrote to memory of 4380	4428	msedge.exe	126
PID 4428 wrote to memory of 4380	4428	msedge.exe	126
PID 4428 wrote to memory of 948	4428	msedge.exe	128
PID 4428 wrote to memory of 948	4428	msedge.exe	128
PID 4428 wrote to memory of 948	4428	msedge.exe	128
PID 4428 wrote to memory of 3296	4428	msedge.exe	133
PID 4428 wrote to memory of 3296	4428	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\acd54c6a06ad6e5155014fec4033434a.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5844

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {5bfc228c-957c-4b42-a0b9-e6cf45cbe11c} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {efc775b9-5447-4950-9f53-d1e938414e2f} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3580 -prefsLen 27276 -prefMapHandle 3584 -prefMapSize 270279 -jsInitHandle 3588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3596 -initialChannelId {c74d47b2-88c3-4df6-b233-e77c98a2aa68} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3768 -prefsLen 27276 -prefMapHandle 3772 -prefMapSize 270279 -ipcHandle 3580 -initialChannelId {fcae0e90-2c20-44b0-b187-083e8af4589d} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34775 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {d6bd7d4f-7822-49c7-b5f7-55f691699001} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4820 -prefsLen 34905 -prefMapHandle 4800 -prefMapSize 270279 -ipcHandle 4860 -initialChannelId {55550699-cc9b-458b-bff7-a876627a3a49} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4992 -prefsLen 32793 -prefMapHandle 5020 -prefMapSize 270279 -jsInitHandle 5024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {2d5279dc-768b-413a-80ee-9f781e0bf895} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 32845 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {e2c125ea-b938-4962-b37e-2c1e3b8e3c9f} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 32845 -prefMapHandle 4992 -prefMapSize 270279 -jsInitHandle 5020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {1326e58d-bd65-488a-9e7d-4abf7ecf69e6} -parentPid 5856 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5856" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffb1f4cc188,0x7ffb1f4cc194,0x7ffb1f4cc1a0
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,11066307619317591502,12485816703988193218,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9231709966528641503,3727074828534977120,262144 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,10032259801518517660,2577521311416387156,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,5880828194738300040,11449531268105410951,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,9497298228469764564,7333094432061585154,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4996,i,108331477391883660,10048829923255903978,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5360,i,17036598385164427150,7939194928958305295,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5512,i,14092542665160713814,9944516991269303490,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5480,i,13248920642244367266,344879961088609350,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6156,i,16124530410758738443,14978362778824645331,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7984780762532662554,12012940746764956424,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,11834617179252758709,1128241384601838748,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,3407045303933090201,16212486014411822007,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,3407045303933090201,16212486014411822007,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7176,i,11033364713317493381,8409643311621298830,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3416,i,1010625354627993779,17676331697766255306,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5904,i,170568765945233005,4877952902390508687,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6160,i,13836143583542406494,10481624252857296573,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7464,i,17318974511057342571,11673595760764087921,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6068,i,2624855719669395732,7862160254343475655,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:1
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7592,i,13146169257834086054,8528116319432485685,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,12768008511508429210,980031860241436747,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:8
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,11270426209871408784,8542032701530372953,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,11267604231053519400,6730444985705928477,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:8
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8080,i,9494163615195239370,12826101466871066145,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7352,i,7457902496384681692,12718854623912617147,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8132,i,9194275219135312088,4224426246717747778,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3468,i,2539680578736250594,13337833793465577330,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3588,i,11606100821657540535,16067451660781100195,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,4481362032092308528,5530850881533273752,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7896,i,2664362655828685186,3053126570019545387,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:8
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,14853504379264318644,15825702737990991819,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8492,i,9247690854358888839,6640516402998892203,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13573563465500065331,17363260004542444939,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:8
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8972,i,10886593536305600304,13394781678841092423,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:8
    3⤵
    PID:1796
- - C:\Users\Admin\Downloads\YouAreAnIdiot.exe
    "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1260
      4⤵
      Program crash
      PID:4920
- - C:\Users\Admin\Downloads\YouAreAnIdiot.exe
    "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1772
- - C:\Users\Admin\Downloads\YouAreAnIdiot.exe
    "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5668
- - C:\Users\Admin\Downloads\YouAreAnIdiot.exe
    "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,4819506382757499499,11699525882029157053,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,13068550941044909569,19122992640990664,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:8
    3⤵
    PID:5668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5275587823416232952,12124855611736522447,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,1677035342399841118,14195699211134314680,262144 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8980 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6346436542493759028,12922941138742442812,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,6298592588483616063,7565428686027682616,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6692,i,9384652495751160967,8936581542664806510,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,1627246641976906418,10077091081195855488,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,12061955621127373150,4708280062166418944,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:8
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8692,i,11866055961356510499,14472442314037435316,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:8
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8692,i,11866055961356510499,14472442314037435316,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:8
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8560,i,5238891522004390507,5666473841597935747,2097152 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
    3⤵
    PID:5764
- - C:\Users\Admin\Downloads\CookieClickerHack.exe
    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
    3⤵
    - Executes dropped EXE
    PID:884
- - C:\Users\Admin\Downloads\CookieClickerHack.exe
    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
    3⤵
    - Executes dropped EXE
    PID:1976
- - C:\Users\Admin\Downloads\CookieClickerHack.exe
    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:1016
- - C:\Users\Admin\Downloads\CookieClickerHack.exe
    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:856
- - C:\Users\Admin\Downloads\CookieClickerHack.exe
    "C:\Users\Admin\Downloads\CookieClickerHack.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8672,i,4996009435559357267,4297540138169265880,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8256104119284634653,12626244756269623776,524288 --field-trial-handle=2448,i,1017743897139035039,5525224821099460983,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb1f4cc188,0x7ffb1f4cc194,0x7ffb1f4cc1a0
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,12932827576242202113,6420441623884203161,524288 --field-trial-handle=2220,i,6094200079801789605,15811384314590661939,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      System Time Discovery
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,15072833176298020247,16199836468194375296,262144 --field-trial-handle=2220,i,6094200079801789605,15811384314590661939,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,5393960463579900588,6965990297510284702,524288 --field-trial-handle=2220,i,6094200079801789605,15811384314590661939,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,27856660984158654,7825709314330880712,524288 --field-trial-handle=2220,i,6094200079801789605,15811384314590661939,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,27856660984158654,7825709314330880712,524288 --field-trial-handle=2220,i,6094200079801789605,15811384314590661939,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
      4⤵
      PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4032 -ip 4032
1⤵
PID:4908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
PID:5896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2018c728,0x7ffb2018c734,0x7ffb2018c740
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1860,i,9871160811376063537,13184132169250040209,524288 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,8645870817075844542,13958406396575374704,262144 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,16138952942458994669,15047222235348454150,524288 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,10745500271325286190,7804853592340663946,2097152 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,10479446028204170231,8995864496463586627,2097152 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,8003984944501829648,3348837722854088247,2097152 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,9108639707457175724,14057142817226525578,2097152 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7295492254678969159,13225165620738083081,524288 --field-trial-handle=2228,i,4197903381471466213,2857463126403369121,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:8

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Other

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1271086339\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1531903520\manifest.json
Size 53B
SHA256 584e92e2b45fa9a2675d6b662059f0153a9ce5a771607ea4d7e87cd5be9e0dac
MD5 126409b338902b6cdf2befcb054286b4
SHA1 7a4734851407a64a0f493e0411fcc7567fb56a62
SHA512 faf1148b96096266618914670b402143edeb79641951c22d1112abc4678ff4793748b225661ee59e163970281265eb4c4ecc5d182d5f2c0ba55b02b0e5c76ee6
TLSH
T1BA9002700414921716C10E506570B881A391661955854D1E04551558029586CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1723397406\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_1988846981\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_498524468\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4428_832443230\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 57492f72144f4962d1950b0876342ec66d4e7cc9bd3c240c2dbf2e0d4e437aed
MD5 11917640d8c0f514e50054a86ddf858f
SHA1 360d7021b7faec4416f715a56d2c837a68e8a422
SHA512 f6f93b291f04028dccdc67ac20bb63eb9a222565fb1fb90509c8a652bbb08c8ff4b0ae4b4994d98ebb77a4a07ffb9e56f71b4a3c9576d7668e99eafa928c4c0c
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:8m7Rkm1tYpBeh2BAo3
TLSH
T1ABC312275E71A9375D79BB4EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YouAreAnIdiot.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\YouAreAnIdiot.exe.log
Size 1KB
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
TLSH
T1D3219D303222B5D94D022F530C186AC523EF474DBB74EE1C7959231EDD2A4579B221E3
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 110d3f52d5ee708e756475c42c9d7696a9f600de79d860a23196205019c54e9e
MD5 91d4e9de75d02eed75be1e704645d7f0
SHA1 d2e4f69a97b4cf6daaa2b363bfbcd0264f01b808
SHA512 469a7fd01e674783f481c9ad0d98d20f9afdc148ecb0a22e7831f840a2bf0931adb051c36568c96641584525b796852be513a5fb749693d1f60dee1ea4ac60a7
TLSH
T131D097F8691AB2A0E03D083260204600B22C06A228A3A306E1AD180CDDB800062CAAC9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 205f111cf82421998e0b95768dfa51372f1c88d78b5bc3eb1181f3b1f812c371
MD5 93a112a8655c76b26e1b418e54b0e55a
SHA1 3e16084581b853f70505f9b4f9d95d12b32ca2f6
SHA512 a02b0745643720c154e0bf89fcb40ea6611018b26ea7449e5e33ab735566626199c987220a13a07a66ef1b4cb10007138ce9cc3f00340df1bf63cbb5feb82bf0
TLSH
T1A0D0A7FD754B6211D59A0832B4545640732A05703CAAEB26D1FE6409AA9902477DE19D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

6c65e3c2-1613-4bf1-92ca-666c0f07e8c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c65e3c2-1613-4bf1-92ca-666c0f07e8c5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 0b345050ed8d5ad259053aed53445564ce087c3ddb72e0fc03e95fa913cd8853
MD5 90aaecd11b1977145fa60e4df047c5ea
SHA1 f4987476bdea5dc2561d2a9c0287ae01e7266bab
SHA512 1ec4e108e78d4384f808555e887b9135706fc0a97984155640777f4c39bf6d74a60e59dbf454dc3c30bd789992d51b1cd1d7e1c345b15a6481b356145187a5f4
SSDEEP 192:D3jg7fjlKliXiXigigigiRiRiRiCiCiCizizizi8i8i9i9i+i+i+imimimiFiFip:7j05WIIfffKKK555kkk7722VVVNNNOO+
TLSH
T18CF16A4A82D4C6ABAF4521CB49A0635D51703F0AFBDCFA08239C9ADD354F49EB4B7690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 20d28083520cb2d41f647730e4c6cb8f13783a3f83e9bcabe04ec9f1fbdb2650
MD5 6f6af39cdc984f280bc4d8f78dcaf08a
SHA1 130160531f3bce9d77c44fc432afb7e16711b346
SHA512 4796f4fb9c2d419ad3c72be38122df6ec4ec31e1e11be87e58eb732f7c469f370ed0abf341867461136ee283299ae33fc5786f1e0514e323dbe3c05ebb9c750f
TLSH
T154E02BB5D921FC2718FD1B196449564AF75013673A40495F3E3C82098FB462645D9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 38KB
SHA256 3370f2e33b0f3a2dae282f78a6bda56adacc76aaf06c7b388db4fda41b90b92c
MD5 b06c7a8dd8ad214e1f952bfae09f9301
SHA1 a0ab87119773fcc0720f1732763c28db8200f802
SHA512 9755d8ce26ab5b0d2293f00285d2334dd48e4c1b6f78a452758821133bd3d7aa3c8134cb2fab12eebb7120e00feb0b719cacacea7c12eb977c937d5cc50c4c43
SSDEEP 768:MS2Glq2FZ5dIEmd9C/imy3NUm07IARvRqLI:dSYfydk7IARvRqLI
TLSH
T16003F12EB1C51EAC510CAB3D92B74368952353063E6952F08DC297CE8584BD06AEF3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000111

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000111
Size 62KB
SHA256 5362c5a5823ab49422b79e1277b2eb00be4ae478c45131b4630e9e925dc18543
MD5 c6266bbdcc06f2f601c2e70daa1625a1
SHA1 c5166e1ba79895013539afc1537bc4c15f00f70e
SHA512 f83512b82c137daab71892b733b2e4b3f625bce030f81b8452aad04ffa149aae6d5c5bb68ab05767fb15f4641129882d19bd2ecfb2c67928c9ae2dc4603d39cd
SSDEEP 1536:hmTu+mCyYO6wXP5pBJewwVT/xKeGArTlQuoVHjYmhAzjjTVm:euJCypPPbBJewiT/x5GWTlQuwUmmjTg
TLSH
T10F53F128ED906BF354E7BF311364D6EB68240DB6D45B9F8F87003D0A6E6DC8A3E46059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 12KB
SHA256 91cdc37ebc651b24535f4c9f46366b5e05fab3d51e3b51260a3aa107da09ecfa
MD5 3d410433c3b4adaa6ec154c60def6dbf
SHA1 c3f77c7091dc53951d2fd3a62fc69f70a399602e
SHA512 23876053544d87e79898e32ed3c7b28594fe975e6252eabb132e4ada1b28daf60a1acff4d0465442ee389bb291d9cfa8cc7bf900eecb43980ca7ce4ae81532a5
SSDEEP 192:4JDk0ifZsmTT56ri5E5g+rcNPQ6DGb4VUKeQCDDDJsVY:4Jsxs8Qie57aPreQ2DDJf
TLSH
T1A542877054E96BD2EF8D1C716EE01A5432B3F6D6E143BF4A63511C72AF933E0124B8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f330.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f330.TMP
Size 3KB
SHA256 fd171f5d1bc1a4a3d440947e81d503f6ebc215ca49d220c3e62c1a069f27d136
MD5 24c2739e7a22e9088527355b8878a861
SHA1 29b57eb626931580e267b9f8d2a3e4339c49a948
SHA512 cd34df332a5d29a63e5b47a88311bb83666522490f06f15868798456843488d1793378ce1bfe7796e52d74c0262fac5c411bbf88d8c78cb5ea3ec56c75330e2e
TLSH
T1AC715C3908DD04E2E7C80D727DD41D1533B3AAD9FB03AE99E25004B76DF67118A0597C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 48KB
SHA256 46fb7a0df81a39b79eab60907c885d0908334e2e6f7e28b2b0d695b00208061c
MD5 85e3d0a5d539acb32d12b0b2eb815c0e
SHA1 a51d0216006f4d5dcc00422846eaf1458716a980
SHA512 aac40ea139d1341e8ebbd674024b6c726f507e2517808439f88908031b5e4de41f43383833374e931e9e4165438b5138f17c0869c884626861ac02b383eee1c9
SSDEEP 768:Cc5nj2fFlPystsk+s9hg7LyEhHr7XzFwO6:9jqFlPyysfZXwO6
TLSH
T1BB23311866FA8812DBFA576F29B2393C88B7B5117448DCBE80552CED0AF7BC06505B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 53b42d205cb820f8b93d9696fa5f593f2b821edce9ff75ce9bc1fd39959affdb
MD5 dfaf6cd6cb352bae32551aaf3405dec3
SHA1 20a3bd93831b22e26eb8b9d6819e7eef4093c2a7
SHA512 adfe4cb08fc2f35b7a90f7e8135d83547247c7fca6cb33633e041e1374857a8bf9192911fd2d4e91404841a8e8a913b305edae1c8c7ab9fd954ce39a694d83ac
TLSH
T1BEE068B880C8CB2B1A4414D658347B0A92B3220EE788BD8D0E42D818B4C2044D1AF341
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bd1b0e041f4c916e51da5012156ede1d3c89f4c476ab034701361287ef51ade3
MD5 246d259d7bfdf2e2d48759ae5e495456
SHA1 29fe4b4dd8ca983b498d5816fec8202357159605
SHA512 9dc999e070e4bd04f5fb0bf502bf9260356aedcfbe8413305782803ca7ba0bf4410646c6568cfd09babbf8a83de6f794876aa98578ef2de7650928b2f6cdbe3d
TLSH
T1F131A0F783E8856E8A1195F0BA18AE2FDE1D0510436C3D9AC5E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 926141bb69342cdfde53ef6244b0b05f42460d32695fd727217126a2c98b7c9a
MD5 a8b0d68f36a3c46ffb3287e9d1bfd9cb
SHA1 f45e7e6ee51161d56bc962915c185c9e972ba8bc
SHA512 6f2474799e93d05bf7f860bff4ec772546d35eb52e1af00d9ed174f93daa7648d58353d73950a23f64bbe5febb67628501cffb9b35e71fe294e6e5980460022c
SSDEEP 384:D1jezmyCtpnpdpLpap6Ts9k9h6AeTnCsefJPIsGeqcaaiGS175F/2ZtjpUpVpxp/:/3sdgYzWkis1p8/iQSx
TLSH
T12C92CDF383E58A6ED91151F19B142F2FCE290528536C395EC9D8AE4BE3F2471E181A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 40e446b4f0b11c5ac57ba0ed25f33a61222bc42cb9ef11249577ac01c0b22181
MD5 c0fe874c8aec09aa524fe34c012f5d13
SHA1 817e4c26d2de1c123ec1dbc4c4651ec5350aa9cb
SHA512 73609a94437657aa6427037ee980792bf1fe4049a08bcf2275b6b66a7ebd26d75a38bbb54e1d1b6d8e3339c8f8e31f8903258d864645180dce1d6bbdf50d2808
TLSH
T12A31A0F783E8856E8A1195F0B618AE2FDE1D0510436C3D9AC5E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 7675a3d6d593f350573f8a0f49227560efec2ade83db33954b4df594314b5987
MD5 9320b7b5fa12f1750bde5716c66915ed
SHA1 0111bcb9a66224bfbc43d0b26efef56c2bb1b341
SHA512 101a8c538cdf533af318599958a974dce368941ee0aa2f93d2b221b45b6134fdf7f0d9069a104eeb40a82db3f7828ac04c24dda1343429d1fb4fc9657563a4f1
TLSH
T146D022331200B0F9A6FD3EC982AAAC9EDB2612240822DDE555D0999E96314BC2A1B247
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ff2995e6c8ae96437c695fe145b6971e5b6a07101d78f91c000fdb49735f398a
MD5 de8bf518b57bbf40284745ba8fdbefd9
SHA1 186df0673b60b6e4afed70d5852f2474c1d922ff
SHA512 f02551a743441d3f2c41494466fde5c0bc8d1a8c62ff9d62a5377f4140b1761cb65c5e5440e11a3b463199c08f526a8b5a8bd979d22940c359f77a460183ddaf
TLSH
T1F2D02363110070F596FD3ED5D15AAC4EC72542240811DDD555D0995DC5314AC2907147
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 a9e3475709031ecac6348fb64782f22667fd79a03111227bae2eb00ed2f65026
MD5 73d409f8a1007eb5946fccd632331484
SHA1 4fbd24dad19198b0c09d6357625e2e756d66bfae
SHA512 1a7311f97dfdeba692fce6f828096417efc3615adb7d2ce838fb7647abd884d09862cbd4164fa3c1ec6d61fd899a842df45d4690ea401acc2f11914d2378805e
SSDEEP 384:sxZbgam4G/f0s360zIKYkuJXI2VgHbI6cZrXJ7BrDV2KKaGH:sj/m4G/f/HzdIeHbUbFB/MXH
TLSH
T1AFC2E797A430C9B74DDBD919F960BE2AE7A51062CD905E8CDEFDC90C00DA6FD2602C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 e9dcb12b681dfb20ac0e3d3173d4e3153081bd9a14e53084062be22f2e06fb00
MD5 d79a336c2e49881f9a5962b192442cdc
SHA1 2140bd7b4644dcee8d4da721859db7729191b233
SHA512 1ac697f0253558563b966e5a927d0a208b535e63ab89664ef612b9348b290421687d6870e8b63bb5cc1df77633c306ff501bc1f88031554565c5ca323f135540
SSDEEP 384:sxZbgsm1G/f0s360zIKYkuJXI2VgHbZcZrXJ7BrDVIKK8GH:sjBm1G/f/HzdIeHbObFB/GxH
TLSH
T123B2D797A430C9B74DDBD919F960BF2AE7A91062CD505E8CAEFDC90C00DA6FD2502C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 cc08165add0e15c7235bdac1da110410b3396681a6d0902f3ca288d448d409ac
MD5 f36959d1b11144db88ffee6fe35de40e
SHA1 c55728647ba58f7e5cc06ed7b7052517b1ab7637
SHA512 9d6c3eb477a7a6977d839533bad8b238b40a408987de9bce6616a286189e041605f2e1e565fc5dce85254418c831136d0ea388a6959e29cb947602e87e78e58c
SSDEEP 384:sxZQgsm1G/f0ssf6razIKYOuJlZHbZ3/HKjqRH:soBm1G/fEfeaz/yHblHnRH
TLSH
T1EE92F846652489BB8DDBD609F9257F62D7F81463D9904E48ADFCCA0C04EB6ED3212C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 d7acfc33be7acd662bd8767c61e2ec5b129cfbb5c2a07c88f1d50900efaf6f0c
MD5 47db2f1171f5b201284b0428a46e48fe
SHA1 863ffc52534eee828ab9f1df3c11a99ae07367bb
SHA512 75dcd4344013751304f1fca1f633f07162829d60b9090d9dafe205fd135e19d16c0da2432d51c3607b53b9b74421dc745b3769e7afd2b92a2b3bdc764fb9e766
SSDEEP 384:sxZbgqnm4G/f0s360zIKYkuJXI2VgHbz0cZrXJ7BrDV0KKaGH:sjHnm4G/f/HzdIeHbRbFB/uXH
TLSH
T1C0C2E797A430C9B74DD7E91DF960BE2AE7A51062CD905E88DEFDC90C00DA6FD2602C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 3fdc30048723a04029fe8e987b456c6b00a2808ab30be59903f20af1dcf6a473
MD5 07052e461cca66f44868a3d57c84ebcd
SHA1 152545eeb567af617a492572f91d05651726a5dc
SHA512 60f680cf0de30c76324e1e9470071a5af544172a51e9329706b1e5e13a03cb5dcee666a869fb4f10d4035bbe7b5ca1cb3ea77b7ae8cfb77c0354cddd77c7ea13
SSDEEP 384:sxZbgqHm4G/f0s360zIKYkuJXI2VgHbzacZrXJ7BrDVgKKaGH:sjHHm4G/f/HzdIeHbXbFB/eXH
TLSH
T19EC2E797A430C9B74DD7D919F960BF2AE7A51062CD905E88DEFDC90C00DA6FD2602C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 5d4c9145d4c72e821df7876612298e105a61626c8dbab0e9306ac2571bd2e729
MD5 a872f185a6e99e7c6d05107d51b584ce
SHA1 4d38bf4a87d29c523153edd9012b3971f721b2d5
SHA512 a64fac0bb84f8ffb24e3b7966ddea6ebef21ecf5d7592d20868294e1f9c14cef317e55fef75078dd6bfed0b2919f8ba281cc60b995d97f02333a7221f946f337
SSDEEP 384:sxZbgqcm4G/f0shWv060zIKYAuJXI2VgHb/0cZrXJ7BrDVMCwaGH:sjHcm4G/fJY0HzfIeHbdbFB/apH
TLSH
T1D7C2E797A43085BB5DD7E51DF960BF2AE7A91463CD905E889EECCD0C00DA6FD2202C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9e8efc818fd19de3120ed12c60072dfc164b24ef1429323035aa7cf67d6d42ed
MD5 68a289942343e7b069f27df6829b6753
SHA1 004ee86bfac304f57eaa28fea86f1dff504fd08e
SHA512 84050ec6cb059a348e68ed8917a252e0c5cf2f1572dc00bda3882b58216b4e1ca5a9ef9361d42a6439f41fcb8277ef76e97ceec48ea9286d082145d1e6f51f01
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/ysy10Lls:eY8Od/HEnFhWvFvmXu1jaLt10Lm2Nues
TLSH
T1A0F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 17957dac1fb66661e59867784e993b97ce0f06e94c7ebeca280eff8869a07a32
MD5 a5958578e8f1d21e4a57efefe1235155
SHA1 d8398749664c4c37b0239e3d5fac5f3a9d3a3835
SHA512 46f3e7a00a758ac10ff524f26431199ffb41f5d025aff7dbe15a053fdc3962ebae762c8983bf10294465745a396f59f43b127fc23e4175397dfa60f54aa400cd
TLSH
T1B351D80E4C451E6EC9A901F25CFA1841373A6CDEAB85DE5B66ADE030BCC333A2D14265
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 e5fe90a8ffcf01b84579c65fd6d0d96268b81c2fba27b162fdbfee65f455d866
MD5 bb38469e83a76cea1cf53f8e6c836141
SHA1 d2c1f2791343a0b153dfb43cf9e53300cd833a47
SHA512 4c0faf512672943536df33150fe0d9dfb6bd75489302bd4e23bdab202a4f905b18ebf5997f2428faf6d5b48d56e8202a7e4399ab8aff32be8900ff0e14479895
TLSH
T1E7A0023C02C52003D1CA92B435E6477523118E11A24A230946E41796C854665554304E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 5a103c8edbf58938335cd9efd16e9104c283f3e642a9117551a20873d82efc8b
MD5 f43f2442ff8b5a6eaa31d0e3976a5966
SHA1 c4b742ed10e36b7edd6b267bdc2ed6c1e78ca63a
SHA512 1e45137d84f78a6a0937832af523607aecb44d7e122c7fd8db6e81b2d51a5a2036406badb1ff24cbe684720a60402d8e1b2b1c315b60da178f8a202013c621c8
TLSH
T1E8E068B33EFB1C50FC6BA7C6213059A00006755098409D0F2826A28725B1329205ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a28205b33add8b24456990855cbc7c02f77b12a4\61ed8b94-f246-44eb-bc1e-0b8bebeb6109\index-dir\the-real-index
Size 72B
SHA256 b0cd7eafa05798c3858a83a0425b455ea0137944e0b280d6fa81f09cd973958b
MD5 ddb996a1d211050eaa40d2c3da5931a8
SHA1 6a5b8cc888822abaf861b2d4487764e72107faba
SHA512 68ab6815b915697fc699318705abb8b2ea95ba867a4725e914cbe68db4dc5e1598936eb5d05ce86cce849143a0741788bffe7d7631bd3a7d2b037baf7b0b8762
TLSH
T169A0021046414E05D14E16B4608A42402270CF1C814A5301C0A8E0D89BB07538613044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599428.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a28205b33add8b24456990855cbc7c02f77b12a4\61ed8b94-f246-44eb-bc1e-0b8bebeb6109\index-dir\the-real-index~RFe599428.TMP
Size 48B
SHA256 1d00abdee90738b0e37261b1de21e000386a1af0ba1e8dbae74cacc2b3b821df
MD5 1574104006f7c1c59491e7493924e55c
SHA1 d8e4795ac4e1cad300372bd179f2f2f8fe420135
SHA512 9e44fc18272b70debca709521291eddd80657fcc42386f97d1a2db53da217749d101aace6bf640a8f4b4bb9d34a1d1879f1ac6f17c89f6cf6e4e87f1bc6efe39
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a28205b33add8b24456990855cbc7c02f77b12a4\index.txt
Size 135B
SHA256 c81af5406441982f4ac0ce9d40038bcf7094a2331f619cf5bf0565bf1209c0ee
MD5 249d73120c4fdf4d8289e694df2ce5f5
SHA1 c4f634073e6944c58d3806af84ade9a2bbabd8b4
SHA512 115b8073586f2461ba745f8a6a6c544a87cc147df61e69cf0cf69598eaf15bffc82f9fb988d9aeb4d2d1a8e849cbdc3cc9aae990d44b979fe7e45ea7de4f37b1
TLSH
T145C02BEBA22340081F10D3D0FC318D2DC78A4CE91C10C0DCE40044802B404231007A92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe599457.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a28205b33add8b24456990855cbc7c02f77b12a4\index.txt~RFe599457.TMP
Size 141B
SHA256 03f310f51ac003ff3b9c879b3228eb22d72c9e5eaa3722c909dcf2509f6a396a
MD5 803353d84f62cdd98f15a3ed2dcb1460
SHA1 7dcd74e7bf83c5bc2e61a7fcf6d40f17dcecaa17
SHA512 ff2c4242c57184df1a91bbfe54bd5736387a927b7c7f675ddfd9d049f36409bf00a1d6a965feb8bea9437bbda2d66d1854b51078694aab1f11447b9e6ad8730d
TLSH
T1CBC02BE7A23310082F0093D1FC304D5EC7AA4CE41C04C0DCE00075803B70023130BAD2
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 8KB
SHA256 15bb5df43db980b59e924f7b7063f0c260db43e30cc80b74b4328accd7d50980
MD5 24db6414313caeee5e588b471216da8d
SHA1 99063aabb62ef7b3df1e33c0e15f0c0d2ff96803
SHA512 f9213f954d3bf7d879e52270ac60959d6ff1581b1bf1af986061f4cd9bb42806cd6200202c676fbd306975ffa5cf4c5ba93f02bc133e28281b04852c1ec83569
SSDEEP 192:Trcq09bV7jO0zKdF4WodWxhc8J3Wh+FqtR:s9bZrWDNZWh+F0
TLSH
T14812EACDBF6C905A4BB31078A846D487287F70B31E8FE893E19D4968A5806879366F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3c00c56ae00323c5a0c8dac9be67878a18dbf8e4216b866cd849108b59bbcadb
MD5 f7159269b24f426bd3bd3818f0116f8f
SHA1 8a699ba3e9adeea0cdcac7dd202ac92fc14048eb
SHA512 b8a44c08a7a4784a459205679020be233b172a6830d663912696fd550f1953d7af9193956e9c400543e2ccbcb3bbce44a1f8191dc9fa00523e0b60e336b2143b
TLSH
T1E9B02450CC30C041C1D44334F071035431FC5C744F171113007C4334D43C14003C7045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 225066b3b4373be0709b518cfd2e128e0f4db435d2a12d8ce2b6cd1bd6874b27
MD5 aafcd1fd00bf2330bbb05950f21b35b8
SHA1 3c38535da89f6615c1629d9da2b9b5b04b20e0e6
SHA512 65f2e116e80aa3c0178ab6e5ab8c866f1d2a6d8e6f2bb93b6b745da8856a10b2d93030e2f904e539210ba173ab1a3bc08f365bea65f85469c45ba02c8b6a2405
TLSH
T1D4A00272CD54C342C04C0379D07102E46250CED96605336341AD8054BA6934845DA108
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 64f88957b56848d5a9d0379b583eb8957cc85db837be7d1ad285f67d76cfb720
MD5 558bf201d1e2f4ac823df439dcf21f9e
SHA1 64a5011d78495770916e7a456201d20aa97fd12d
SHA512 be87095756b629779a06b2a918eba2424d018f8c56768bd2abffeb3c28c3066849dd2fba8783016788aedc48d2b2da4340ee73a3c2cc89e3fbb86793bbcc5669
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGx:05ppxnY753RNBvRJJdt7p5J9xxNH
TLSH
T1DBB2895A713B0211397E2988B39696364F4235A37058E4BF7FB814A14F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt
Size 80B
SHA256 5721f317980eba62d45fdcbf7bb3edce3ef719fba306075306417bbfcc268634
MD5 29c240bc5b0fce8d22e68978f4ef8630
SHA1 b5c440bc35e0b0a61885da7cd2687a477c5948af
SHA512 ab7dcee2a87d143241812a59855bc6cf6f9b66dc9d94d4ae0ca6f4cfe067fe0318998e454d57ba51c24401c60984bd67164779697e746ea242963f7f3bf436fc
TLSH
T1FDA001F75911809A0E34A8E9A434BB6EE18B859C9CC0CDF4A40880422178A331402810
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5966af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\5\CacheStorage\index.txt~RFe5966af.TMP
Size 164B
SHA256 67a5a793871ed8db45ef73119c70a81f4f28b19cb4868ba71c5b8d0f50490a85
MD5 783c173d0756e39bfaa8689c85833e04
SHA1 4693cbcd916f1f49bf0dfde98fd0e344065ea208
SHA512 9cd127d32b4bd230c3ac82d76c301cd7a14cdab6c459955f70d21c8eed0a68bd33ccd1d92b56a906a936a5ef32f4acdd17a27481652d1a35fb3908e76f4faab9
TLSH
T144C08CEB963254561B3098E6D030E68CD1AB4D9D5CC0DCF4E884B05130B87238502529
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.20\data.txt
Size 150KB
SHA256 6cae7622dc0a64a464ea43e7041ebf2a76a958277ffebdef86da57eae46cd496
MD5 0551123bf21c85e69ca030c3ecc90288
SHA1 b6ab84fc32deb3f0f7587fad2b50c8d60c41d83a
SHA512 f833e356e659b5e1863b2e46189c2a8b706574ec9a69985345f1d16e58fdc5edb848b4e508dbe568b8de543df73246c1dd7da811b05541e1c264829ef1ce0ea3
SSDEEP 3072:2PPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYERRf4jniQ43SFNyuj:2HX1aI5aZoKzMJ07NR2iXS37j
TLSH
T1E8E3F224CEC85FE8CEB8191C60FD0F0963E1869E493BB5C9E7A3BD0A6FE35040617589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ab6ef5643591b72a2682c90244e92498009b9addec40434bf7348e14716d1a32
MD5 e716b79764b8ec62400328f0a923f5ba
SHA1 3a5ef4840d85658fbaaa8c2a725cd0bdc060f8d2
SHA512 bb46e81458eab61e909ccdf99fd18ac2bac520b9334e134ac4b6562699c973e1fc16c60fe36564a54aa49e168a71a8931436e245b283addc29ff0d66b1ffde9e
SSDEEP 768:pqFQ63GwgpkIZbbGCtD+qEip0MjeLROi9PP:R63uVtD+qEiOPFO4
TLSH
T1CAD26A32E868D9ABBDE69BC9A74A3607DFF44253C5C89AD4DADD5D0C01C71AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7c428e17d08da2819d00dbde98bb27e066d18a7f4d03864a197d24c0b84c9208
MD5 186dd0462cbe31c02273b7e1b886cd80
SHA1 8ab9e0b7a86ddd2b67595720179c94f677ad0229
SHA512 e24019514cfcdc24d3d99ed7cd420f1f5bba463f41fcb9fcda76fa659c64cb10d95117728018c0453c0eb1785a4cccfeff0d08afd7e426f84917e568afce7857
SSDEEP 768:pYFccps3WwgbkU68bGCtD+qEip0MieLRI8p0TLY:Cs3YrtD+qEiO+FI8p0TLY
TLSH
T1EAC24B36E858C9BBFDE24BD9A75A3907DEE4526385CC99E4DADC1D0D01D71AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 45d77d5b5a0a03d74310534b8d681454aceb9878dab6eff824472f7fc3d72953
MD5 79a09fd445678a420362ac8ce1f51771
SHA1 c9dd7584c088f12b124c758ae04cc4f93ea66c4c
SHA512 b4e2a6800a6b88b59db4ace211b42d6835b107aac9f591d3215c4bb1ae32a1621872d226c0ff6bb482e0ed78ebe277a2c5b9e104950f6675cf06e838dc1dbded
SSDEEP 768:AFPtTBwg1kePLa/CtD+qEip0MhyaRG16KRshkOi9PP:0tT15rD+qEiOl16KyhkO4
TLSH
T195137FF194D69DB6D8AD9BC7972DAD025ABCC133B4884448B7F5682DEC8B0BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d7a66628405cc09ff6b8dd913d3b021de68f54eea9d3796566170dfd2500bb22
MD5 aced2d189ef791e75c7d4ccbb35d87d9
SHA1 72f1c1a74c1a935d29ab44c707f1ada8abe27021
SHA512 c5f1c177abde16a2ce736c26569c0e4dc0417411fc0dce904c14a40c687acdd6208e3400dcc30e2d2f1aa2c25b70144b999d1661b6d4541c58df9159478af0ae
SSDEEP 768:AFuy3TBwg1kAZLa/CtD+qEip0MyeLROi9PP:py3T1ZrD+qEiO2FO4
TLSH
T127F2C2F198D78977E8AE4B87A73D2D069AFCC113B5885994BBD85D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1cbe60c2b1777c0aac6c64f4653a57da4d2f5cd49a61d5056d2c48fdec0982fd
MD5 b64d204e38f507a00a591ece14377c6a
SHA1 bea812b890fc2aff5db8406f8962901eb9e0d123
SHA512 29d390f10eded9d87872d393b8a04a3749fd2f6dcf066025d092f6ee0f66f46e2ad30fe8a5863ded11d1c9827f889e0cb6fd861b9819fa9eff179c104396a777
SSDEEP 768:pqFccps3GwgPke+6obGCtD+qEip0MPeLR9i:gs3u0tD+qEiOhF9i
TLSH
T132B23932E864DABBEDE65BC9E75A3603DFE4526389C899D4CADD1D1C01CB1AD030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 e1b1c35c5b519d219f62485a9b90a20b4887656b5830a398e28ab63427f60f88
MD5 bbf1fc7ab8f354b3f069e4ead20e1a61
SHA1 da0ac2b31414dd941f5e2ef3d25441668da83ded
SHA512 bceb7fb3600ec76e0d57f07fb1b8972d7b5df74950092f096a3ca3dc6851bc8fb57495ed71098ca05b492cca7cc1f9d0a0ba5d7f9812d4720c6a3c7c53cf5d19
SSDEEP 768:pcFccps3ywgbkUxkbGCtD+qEideFI8p0TLY:Ks3U4tD+qEiwFI8p0TLY
TLSH
T134B25B36EC69DDBBEDE24F89A75A3A07DEE4526785D899E4CED85D0D00831AC030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c65d79f5840cfd7be13b490b43ee5719461d7c99440a75cef3ef83eecc34136f
MD5 eb2db95c05de01296e93f886f3090b22
SHA1 d273978c7cc40c6f594eb8ccafa6997db1485735
SHA512 e8e990d0170005f4dfbfc76d74a6966f204688e480adc96966c61b14bd345c3d60ec9df2141a493297049cc9796fad28a4ac83b07ec610f0a04b6e5542929d0a
SSDEEP 768:AFQb3GwgpkIlL/GCtD+qEip0MyeLROi9PP:Zb3uBhD+qEiO2FO4
TLSH
T1CED26B32E864D9ABBDE69BC5A74A3607DFF44253C5C89AD4DADD4D0C01C71AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 826e54518a766236387d7594caf4089a23966345ca333cc6c00ac8b7edfe743d
MD5 a273b8bf13f026cacaf65badf9055cd2
SHA1 ad9bfdec8d00a5b6ca34e49472ffa11f23d1c653
SHA512 f5ce8e5af1fc35b6b34ca7eeaee5c4e4f27381653ebb17bba9a41b209a68f118412fd91be3e3923588ae122a71edb2c392d836e9db86d39c67108fd7ca17e455
SSDEEP 768:AFAD3TBwg1kxZLa/CtD+qEip0MoeLROi9PP:DD3T1orD+qEiOAFO4
TLSH
T123F2C3F198D78977E8AE4B87A73D2D029AFCC153B5885984BBD85D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3c04c1cc18deb601c83851d66f9045ddad257dae6ad896b2641715d3581bdd4
MD5 a93f2d2f1bd1833c06b6fa1d9b13f67d
SHA1 53ca697a412b8e79724b49632e0923012614f4be
SHA512 820f70ecb9447863ed16bc18905930cfc0360bf9449e28a793b173840c95ba72935e46f02f3f06201a84949c9fed7716486fba982d1445d5366c69765c90dfd8
TLSH
T18CE00152E70010FDC02D033000071B718BD7D52112F90397AA26256A3D233013F76FE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 66df618e8746519b215479485f5b627d640638d00b903cec8dac8429b80dec57
MD5 9329eb9d725d7957542289b2fe8141d2
SHA1 1f09fa82350fdabad9f7d4d7c7436d4758a519fa
SHA512 cdc1c42a7960089ea94fc3cfcc463a64eddb6e3806c0a65ac5af4c335ef29c2b42e30b7ea49100559e1a39a93801b43a0686e5796fcaa6b28e48a999df2ac305
TLSH
T1BDE04803E30900B9C18D037400631B24AFE6C82062FA1393961B24257E233853E3AFA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7c7071abc29b4acf075098ba153dd09cf3245262b7f45a2c5e67a72949c2ab3f
MD5 5055d88a6f8d1c4ae49e33881d0a9b29
SHA1 a8d1805c7b0046ad8092d989521e0139795b96f1
SHA512 98cfc620fca9a8edbc59198c706ea827ee4d3cf581fdcbc99d9319e791a648a679659297a5417b07f71a851dff84a5dcad4839a7f6b57b3c2b6033105a30f53f
TLSH
T1A1E09202E30000BEC06C033000871B30AFE6C82123F60393A52664257E233003F36FF0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 00dedd888e3fab8c3af0ac64e7a2b4e7d2c0ab469041a1246ee18dbda016a091
MD5 393e34352577698091847a13293939e6
SHA1 dad68d37522319eff542355aee90dd7601bf01ee
SHA512 56da308e559c09efdf69488764266d23a14337099b1b79d123a6274fc50411aea3fde6bce00b13b21877f7bebe4ab9cb6e9dcf52a0d3c579747f7e3661438e3a
TLSH
T15EE04803E30800FAC58D037400A31724AFE6C42152FA43839A1A25266E237893F3AFA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bdd3fffd671d0de2a83e4eb86f414697b3b27476bc093632397f52e19cc2e605
MD5 0cd05a2deb9847848c7cadb53de666e3
SHA1 16bd904deea84f8181d91a0ba7cc2e68f5d7984c
SHA512 7c2fb3f67d0d5860d65f939696a9bb20b870f394e7b739540edaa85d88b464244c25364b83a20e31bfbd7e01333afb48097d36fc5d91e51418ec74561a8b0ae9
TLSH
T17EE04803E30100B9C08D033400971B28ABE6C82222FA1393961664257E133843E3AFE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5b34e03ab884cd18c07ab51b919d8504613f7f84493b0f717a92e9d5549a1e4c
MD5 87f31ddbedf47c03bedfbc4e1399fed3
SHA1 093cd8dfe2af9d2aa16cecc4683e6cc6b4674c15
SHA512 5af3232a48a5b7cbb956070cc0c17f2cc1fb3737d78343afdc6e4b2778733b38151e909cc05e272992a10ed745916404fd0f7e51a992a294cd9ead3af95d7df7
TLSH
T1FDE00252E70110BDC06D033000571B759BE6C51523F51397952555697E233513F76FF0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d7606d188ffb04425d8688a91145ecf75fecbbcdc1e36ab6ce9f6f828bfb31f9
MD5 7e86911ad72ba75fae23484ae9162619
SHA1 c7990237f68482f79921e26c5c1c4c4f68fcbd1f
SHA512 153d891a8764105942eab150c2fc06d11082a8e480fc626d1aad2dde09baf4a0186d10cbc9532d2760794e94f4626c3aa349eeeb60673653a0efa8668c7e52cc
TLSH
T1DDE00152D70010EDC039033000031B718BD6D52111B50386AA26155A3C233012F65BD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 09b2f11266d5e003300bc650ddc378b60a4c010e61b74add5c4d188da66c6fd6
MD5 1e68e9119107035921b52c279c1c1b7b
SHA1 b785de95d216d62e13daf24cf7a6822df88710ec
SHA512 f5ae14d0e525e8149cfebc04ed6b3e994fdb33a7bf62af0b55ff10a438657f7fcb33d717f0eaccc2159553230308528272e2d17d7edcf354d1278741716174e6
TLSH
T14DE00952E70010BDC06D0330000B1B758BDAD52222F90397AA26696A7D233413F76FA0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59528b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59528b.TMP
Size 392B
SHA256 2e23f2bcded8750a7279282265dbf9a503544ce4e7f7b9be74c530aa1d18bc3d
MD5 c84469c06a996efeb4b74ac056cdc1db
SHA1 a893ce45af892258433079ffd8a2508a345cca5e
SHA512 ede9d3c9d8965b74e1cf2596163660c1b2ceea8c46f0eca63bbf8055e4da853586314b9cc04dcb046f515ad18afdf8d732712a64fa2df82d4600cfb973a9153b
TLSH
T1F4E00242D70010ADC03D033000031B31C796C52111B503C7EA1615563C133012F35BD0
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 fe6dc7b795eb3d2105a7b8a0a49958ef83ddea4252b8edff0e78043dc20a9cf2
MD5 0fe58b5cb8b491436450892fcc56d0e7
SHA1 d525944a9fc3261f15ca5626a82f034c05caabb0
SHA512 cb338432f0f018f982322eb5855ae66c5e80a5a192872d8508cd5dae09f07ca09a1066e2c8f6fdc88f307c4bc550f278627f12fb0ca6faec5fcf8d3d1204e1e4
SSDEEP 3:MsEllllkEthXllkl2zEUltO1:/M/xT02z/s1
TLSH
T1A54404047FC5C51DD50530304111C35C0370D5D00511574334D10C135CC75400C01501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5ab5eea92d50cb11a5848ab322ec71e162da89fac45562372d22478151dd7771
MD5 447ce9bc4b2138c80a119351a60eeae7
SHA1 9f96013c7ccd96b2b348f61310b09cf12f40e532
SHA512 35310a42b780080f618d1fc69d6d41ab63dc9f995d5f8b199de0562d996849cb0b42bb5b476a364e4af5d350a9ddcbbf896e6763688e32779351344598fa1d64
TLSH
T17C3142E148391AD6C8BD0DBEF0C739FC94E8E225B4E434791898ED689B6E51D304083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bafd6399969bbde6ea7a791b637e935dd60a2a1eb457a2dc68ca015df2464bad
MD5 b18d40d7a6e731500b7e11a3853ea8ee
SHA1 c67cd78f497b8856b651f6813c2982e96c22cae9
SHA512 34f5e7cf5541834672d9522d48fef20404f2eab8a48007addee21742e6d52c85a6e48f87bbfde92c6f9834580a52c37b0b1afbb8c527d761cb429ff426840532
TLSH
T1C42123D15C380EC2C8BD09EFA4873AFC54E8D21AF1D430791888E954562D55E314043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2eac15eb9868ff7be7d160dfdba4f35461d02bb1b6749e661272c40cef177be2
MD5 18dba6658e02d8133f0cb5278113ec2d
SHA1 29523daf86d70249a4ba3b10b725f14b3aaf5e58
SHA512 bf5852fb0a55bb908b8b8857009aaf2ffbf99b3b6b86702865c1afadf29b6ff6ae74a5947219f898571d3ce2ba56ae62ab007b564bab0d59daf4842a1a5e2822
TLSH
T1E13144E15C3D1AD2C4BD0EBFA0873AFC58E8D216F5E4707858C8E968566E51E345083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a5d1e9d2a315b0c492777c42ea7cf11f0db298874de114486c893ea13ea8cf30
MD5 9b95be97a4680c14ab35f0355916b6e0
SHA1 9655031bcdd7894c32986c7ef92a5e2a0ffa8f7b
SHA512 ae81e2d352cf9dc566bd685f907f61c4af80c28b14e1b06ff9817693631861f690b7f2c567e3866faaa17ebd0be401598cb358ffcf838883904ca5c5c6c1b5f9
TLSH
T11A2110E11C3D1AD2C8BD0EBEA0973AFC58E8D216F5E8703968C8E954962E51E745083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 920f307c1c584e75519624486df8ef174bfd0830c037feeca1edb2c2d3bc929c
MD5 6f3623b8900afcbf554778f2b0411a4b
SHA1 d419bee09b4b43b8b930b02187d2ef2feedf97f3
SHA512 28ee784d5981731334b8f7621a591f1d6fca38989ab98cbdde68f02dafbe6a24c53ee23e164361abf115a74d408759353aeb6cddcf7889fb3384ac9c1dca04fc
TLSH
T17E3144E158791AD2C8BD0DFEE0873AFC54E8D215F8E434795488EDA85B6E51E301083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 a8710f49c84df35f7b2d71dbb38b546ed4dfa42ad550323213a371336f6a1892
MD5 c83a69132c72ab4f5731b48a849cf737
SHA1 967199c24e7df0bf01a2bd277e15656498020490
SHA512 2cc4ff38e1db719c629c457b1faad1867b4b2ffc9961a793833237cf7d4a67049e10e2962ce77befe8b828f2bcb27aeeda59d04eb81f081a8456b38f47ec4681
TLSH
T1DB2112E15C390ED2C8BD0EFFA4873AFC58E9D216F5D870382888E954562D51E345083F
MD5 SHA1 SHA512 TLSH

Submit Download

f84aca59-6760-4906-b4f0-0dccf5be3318.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f84aca59-6760-4906-b4f0-0dccf5be3318.tmp
Size 28KB
SHA256 9032c79e3beb269a250646038a4272dd01899b2a933a71fe15c2d4a99ccdd04e
MD5 f64b6f9f0ae3991dd43362750e6c4073
SHA1 7e3f5b904713e5b9d56ab0048234c4d66b7a2f76
SHA512 076d0387a2acf5657d1963c580e191646653ef825c99ec6a0c1cf6b5729d921b277a5e97d2abf3d9e747892c66eef3d70967d1ebd36ef81e18e4cbe06a0a3a3e
SSDEEP 768:pFQ63GwgpkIZbbGCtD+qEip0MjeLROi9PP:o63uVtD+qEiOPFO4
TLSH
T1EED26B32E868D9ABBCE69BC9A74A3607DFF44253C5C89AD4DADD5D0C01C71AD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 87abe7927eee0274c0c2cbc1ab803075ef3749a25830a35907cbb104658f9370
MD5 8f9f357be0901553cbf1c733b43d2a97
SHA1 d5b5ee282ca684ef476c5e79e06e0525210e5634
SHA512 41d0624d738d43f98b408885a01ba094c45ad8a71d240d23239113e5460ea849ff327b2ba989ad6cd012f54846c05634005bbd1495695810d6f36389a6b4925c
TLSH
T19D41485DB6EA1148B3B7BE5A9BF7686E443FB9772E0AD45E00110D0E0663A40D872B33
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 91f73068490910750cfb17480f8b3d926dd8a9282d5c35431c878e5c38f4cf0c
MD5 a350ac3fd84013b41ed8b3184fb90789
SHA1 df269959476ef4235d74141b6f42247c37f495ae
SHA512 82d9199c11bee9cb5c2d45bee3b3b08930e63d076b0edc603ca10704fdff3f171702cc232f42cc6fd8e7e08ee042a390ff8ad6d939f965e61f86fdbcd0f8081a
SSDEEP 192:7Ov5zboPP3VTyjDOtsrurFoj1d66JozGzgCl6mc0dz:kbon3VTyjdrEFoBd66JozGzgC1jd
TLSH
T135E1DBA4E628863FC418027BCCA61B414F39399B984E3F29359D601C2D972DD769E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d918a98b8fb06b57e3345d885313be83ff67d0abab6420dec90be8c7f7266fd0
MD5 1deb268baed084a8e58417e04c77e85f
SHA1 537aae76ee07cb99e13bc56554d35e683dc7de92
SHA512 75129292aae84cd8f3b4ae5f6cfbf74a7b0dec7cfe49fb8faf80f6b628ba0af4c09b718b414b347c8fb1d558551c82e3aa8e0b1a9e2d6d52ca837e21c7118149
SSDEEP 192:psrurFoj1d66JozGzgCl6mc0dTOv5zbowZVTyjtI:mrEFoBd66JozGzgC1jGbowZVTyjq
TLSH
T149D1A868E63D963FC458023BCCA62B400F76398B984E3F65319C601C2D963DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38d36846-8153-4a63-b2ad-3e6ddb5fe6a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\38d36846-8153-4a63-b2ad-3e6ddb5fe6a6
Size 235B
SHA256 2237025a9889a1329d990b860c4b9c42db9b7da4bde5249c729d6b1d50936ee6
MD5 7c00406c079b785193ab1ffa575f725f
SHA1 cbd81fbe9f32a8a8f27e38a174cdda88c09f0341
SHA512 fab60c7faed8141e19c512845537896c8c41f5a84ca09fa411450811385d809b488e1cd1c26ecccbab127632d977c22c64cee2fc06bbcd3fe82e7922cd4b5a90
TLSH
T110D097A014E8231C18100F17B0E0B9C371864C3310A4A82086D040B89AF9EC842A2906
MD5 SHA1 SHA512 TLSH

Submit Download

63751790-d80e-40d4-9844-f778394c7479

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\63751790-d80e-40d4-9844-f778394c7479
Size 886B
SHA256 b5633e158bb5ab009fc2a499240d75c1d5ee334c5583a18e4fef974fc90b64f1
MD5 e8515ea5eebd16728de2130dc7237b9f
SHA1 247f53d623a4194e2b5aab1d5cb3cc922a35981b
SHA512 e7b43a8213fe435028e357d1dd4fa70d34ac052b763256f89e76e2c7558f68328e52a59ab8400786058f818a4a7e0c00f2f526651fdf2156e4bc645a9db2a602
TLSH
T1001140408A78B5B2CC78925F95E237434BE0312380CA2844BE516B1C0CFA15E53A670B
MD5 SHA1 SHA512 TLSH

Submit Download

756aad57-13a3-4998-b282-e723d2b452e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\756aad57-13a3-4998-b282-e723d2b452e6
Size 883B
SHA256 b3afbb3529129761cd6020e1a5a014879f465d457939dcd012b75b0d9ffeaafd
MD5 f20847f510afeda25c1f29af99f4e746
SHA1 d223e45911a06c566c39af838b8369d203bc0f17
SHA512 94fb38c8de4329d32666e009ac01f89fc91a0f967be9ecf41a63551da34d283b0e8abeb8e95a070400af3b42cd163d26269ea8d42a2cd599468e6c797c96f848
TLSH
T1FE112391E634B5B3CC78D21FD9A577524BE46533C0C968183EA189080DBE62D63AA74B
MD5 SHA1 SHA512 TLSH

Submit Download

9a6dbbf7-686f-4a01-b196-4145998b136c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\9a6dbbf7-686f-4a01-b196-4145998b136c
Size 235B
SHA256 50f982c0ae4d83742781b87780b488ed2ac570deeed7fd7ab286c12fb1d994b7
MD5 07cdae97fa178a72bd521e76c4e8cbad
SHA1 ff57dda30658ffd05975e61cee2358f879829bdb
SHA512 a0fe96dd561cb1dde24ea55822a1e3ec72225ff2d47831f33fac08845aa44c8e2ec3e58bca19266793fdd7a2e58914a7249fd57b88bcdbaf1eab8dbb2a243c9f
TLSH
T1DED0A79568D8676D48144F07F0A06ADA71889C3B68746860D97145B8D9B9FC84162CAA
MD5 SHA1 SHA512 TLSH

Submit Download

a9388bb4-81be-491a-b04e-9ff1e9cff124

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\a9388bb4-81be-491a-b04e-9ff1e9cff124
Size 16KB
SHA256 a77c0e0f6b29d9f88d263df3997b1321db52c4ad77632163f763b70000d1eda4
MD5 68f34badf75fe023398f9262fd692c36
SHA1 37fb2e159ca633e428b319013e29f9bae84b6e84
SHA512 3e4190432784a46112a5af7db21da3ad84e234ca6556394ff197092e8b497fe37bb02497592dfe4530b82fd99d6d937b295c39d671f9cd73d0dd3a0a0605efca
SSDEEP 192:2KArZLM7Kjd3k0VBAOxtzWsZMEiRwazadVVCP1JF92Bz+vylZNFuBQtZ1tWhBjn/:2KX7RwaOdVVYJFMp+vylZNoytejnBh7
TLSH
T11072CA162860497A8691E36C94F87FC3E6F538CF4C419FCA9BE47D046ADB06D113794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc78f21f-a3cc-4636-bed2-f28e49bfe841

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\datareporting\glean\pending_pings\cc78f21f-a3cc-4636-bed2-f28e49bfe841
Size 2KB
SHA256 f7a36f646e733e03a3838adda23190bd681d07ff3daeb6f5cd85d6b29f69ef38
MD5 d443af5610ebf9304aeb517e8e2cd117
SHA1 a775660f11b55002a5dedb9cdf86c962017f5e42
SHA512 1ef609f44602bd07eaa5dce70753e1c6d319973a23ba2bd20861944f6dee4b991fb5c72d8bb2f390f119cdb3053d24b34d2f418a27f529186095ae8895fb978f
TLSH
T13841235C35784DBB8DDAE69CD482334E57A18E0300C72CC76E61EE0C8CD669A336E52A
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs-1.js
Size 7KB
SHA256 8b2de335061c728baec4818bf621efa4f19adb2aa6b07834aa6e40a2c76d0ff6
MD5 1e5cded1b99fe8e8780feceaaef4e176
SHA1 1d4f83bc5408e1d887541e872d798b515cde4742
SHA512 fcd36440b745574a90114b313744d4c5db1dcb10ffb43cadc239b123fa72081b986f1ff7939e24ff0a49e486f9e7ad53197660a2d658aabb5ca459197f6b855b
SSDEEP 96:xHXUTUDqGqd2EfNqWNbzSSSSlDdv9jOEnhHOZYu9fBw88n8L4cnaVNeGS:teRRfNqWfSS8O8ZxBw88D8
TLSH
T1F4E11F7891088F7F65B676ACAC684C316AB2013BB6BF68C750B594C4014CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 0ecf260d6d24ccdd90faee5c69ecad0e14e54b649cb6331a63f7b01de9414aca
MD5 602d1572a1139438f1b9f988fbbd7bfc
SHA1 8b7c30715305c1bc6a2317e8681c4129172110b4
SHA512 b3a851949b6e341c54c7700141ded7a1e5f424f73565904fc3df7a9796a5c3a7ed065017e0600234dd512ffa44db0670b640471b2d5d8ec80475fb9709539b1e
SSDEEP 96:xHXUTUDqGqd2EfNqW1zSlSSlDdv9jOEnhHOZYu9fBw88n8L4cnaVQX:teRRfNqWoSS8O8ZxBw88Ds
TLSH
T15CE11F7890088F7F75B676ACAC684C716AB2013BB6BF68C650B954C5014CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\prefs.js
Size 6KB
SHA256 41f24646b0b8172cd9a24c019c07ccdf2960fd2d0686b0f040a50f5450e1505d
MD5 d1ec46390aa0e34fabdcdff05ddd4577
SHA1 c9b4c7185f15fedf6bac477cdb6a6f2cf38c1071
SHA512 82dc4f50ff341a84d408ede142ac25bbad9c8613b858bfd2b8f9668dec6c57df0fd130bc34f776db0f9abd7e840900e64094db8cfeaf3080a89d80f47e158e18
SSDEEP 96:xHXUTUDqGqd2EfNt01zSlSSlDdv9jOEnhHOZYu9fBw88n8L4cnaVQX:teRRfNt0oSS8O8ZxBw88Ds
TLSH
T17CE10F7890088F7F75B676ACAC6888716AB2413BB7BF68C610B954C5014CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fqkq4vem.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 e95f043afee3cc72da404ce69c6ae7a5a531433deaf9eb3b74465c48259fd8a9
MD5 c57bebd67fd67973d7a96ba4f2b7af31
SHA1 dd91fbe72bf76d803fd29bf76d675230ca025132
SHA512 257439c9f4d92838eba32cffb09349d227579d9fbf9fe9ae9c477a4de78abfe068fee01dbf0b61618d6954130f4ab671ddef6686f21dc8fd9c694fb45e731110
SSDEEP 49152:c7xufsJyaP6ryMtPHd1C9S8rRz3UghkR0bPHYRpqZ:GofsMaP6ryMtPHSRz3UghkbqZ
TLSH
T1301639F824D1A257F3818037668563EB21AFD00C6437DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CookieClickerHack.exe

Path C:\Users\Admin\Downloads\CookieClickerHack.exe
Size 68KB
SHA256 13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401
MD5 bc1e7d033a999c4fd006109c24599f4d
SHA1 b927f0fc4a4232a023312198b33272e1a6d79cec
SHA512 f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276
SSDEEP 768:bhU+D/no2u+6JaAcNRFJ67Pn975JqiG6BwUqdVBF+G2JOnCC6G2JOtCCm:bhjDIrU0h5Jqi7qzb2ICCb26CCm
TLSH
T1C763C55613886B63D43D97798451D13107FAECA7C326EB6ABECD6CCB3952E090780B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YouAreAnIdiot.exe

Path C:\Users\Admin\Downloads\YouAreAnIdiot.exe
Size 424KB
SHA256 1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69
MD5 e263c5b306480143855655233f76dc5a
SHA1 e7dcd6c23c72209ee5aa0890372de1ce52045815
SHA512 e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113
SSDEEP 6144:XgasGR5rnK2Qh9lp2E9ThHZmnRRQh9lp2E9ThHZmf:XgasmWrjJ1ZmwjJ1Zmf
TLSH
T1C7949D42E94041F4C9E97D355CBA96010BF22E5B80D5FA5A78C8BB013D77D02E72ADEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/884-3012-0x000000001C7D0000-0x000000001CC9E000-memory.dmp

Download

memory/1016-3011-0x000000001CD90000-0x000000001CE36000-memory.dmp

Download

memory/1976-3014-0x000000001C9D0000-0x000000001C9D8000-memory.dmp

Download

memory/1976-3015-0x000000001D7A0000-0x000000001D7EC000-memory.dmp

Download

memory/1976-3013-0x000000001D640000-0x000000001D6DC000-memory.dmp

Download

memory/4032-2568-0x0000000005480000-0x000000000548A000-memory.dmp

Download

memory/4032-2561-0x0000000000950000-0x00000000009C2000-memory.dmp

Download

memory/4032-2569-0x0000000005680000-0x00000000056D6000-memory.dmp

Download

memory/4032-2565-0x0000000005490000-0x0000000005522000-memory.dmp

Download

memory/4032-2563-0x00000000059A0000-0x0000000005F44000-memory.dmp

Download

memory/4032-2562-0x0000000005330000-0x00000000053CC000-memory.dmp

Download