hxxp://fern[.]best

Analysis

user interaction
yes
max time kernel
599s
max time network
601s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://fern.best
Sample260818-raryrshf38

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2984	msedge.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315352065189409"	msedge.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7843"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4570"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4864"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{39F61E63-C294-4131-89C7-8D213233D7F0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea07050042006800670079006200620078002000760066002000700079006200660076006100740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000b26d17250e3dc016dd6082551e3dc01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070500420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000d46ad8ac4ee3dc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3832"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4034"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4864"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134232014455135091"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8673"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4034"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4570"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{E2F499C9-37B8-4D8A-B36F-A69EADFB5F93}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8379"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
2932	explorer.exe
2932	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe
Token: SeShutdownPrivilege	2932	explorer.exe
Token: SeCreatePagefilePrivilege	2932	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
2972	sihost.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe
2932	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2932	explorer.exe
2768	SearchHost.exe
4156	StartMenuExperienceHost.exe
2932	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 644	5024	msedge.exe	80
PID 5024 wrote to memory of 2984	5024	msedge.exe	81
PID 5024 wrote to memory of 3612	5024	msedge.exe	82
PID 5024 wrote to memory of 3612	5024	msedge.exe	82
PID 5024 wrote to memory of 3612	5024	msedge.exe	82
PID 5024 wrote to memory of 3044	5024	msedge.exe	83
PID 5024 wrote to memory of 3044	5024	msedge.exe	83
PID 5024 wrote to memory of 912	5024	msedge.exe	84
PID 5024 wrote to memory of 912	5024	msedge.exe	84
PID 5024 wrote to memory of 912	5024	msedge.exe	84
PID 5024 wrote to memory of 4628	5024	msedge.exe	85
PID 5024 wrote to memory of 4628	5024	msedge.exe	85
PID 5024 wrote to memory of 4628	5024	msedge.exe	85
PID 5024 wrote to memory of 4360	5024	msedge.exe	102
PID 5024 wrote to memory of 4024	5024	msedge.exe	88
PID 5024 wrote to memory of 2616	5024	msedge.exe	89
PID 5024 wrote to memory of 1904	5024	msedge.exe	90
PID 5024 wrote to memory of 4360	5024	msedge.exe	102
PID 5024 wrote to memory of 4360	5024	msedge.exe	102
PID 5024 wrote to memory of 4024	5024	msedge.exe	88
PID 5024 wrote to memory of 4024	5024	msedge.exe	88
PID 5024 wrote to memory of 2616	5024	msedge.exe	89
PID 5024 wrote to memory of 2616	5024	msedge.exe	89
PID 5024 wrote to memory of 1904	5024	msedge.exe	90
PID 5024 wrote to memory of 1904	5024	msedge.exe	90
PID 5024 wrote to memory of 4348	5024	msedge.exe	92
PID 5024 wrote to memory of 4348	5024	msedge.exe	92
PID 5024 wrote to memory of 4348	5024	msedge.exe	92
PID 5024 wrote to memory of 2500	5024	msedge.exe	94
PID 5024 wrote to memory of 3472	5024	msedge.exe	95
PID 5024 wrote to memory of 2500	5024	msedge.exe	94
PID 5024 wrote to memory of 3472	5024	msedge.exe	95
PID 5024 wrote to memory of 2540	5024	msedge.exe	96
PID 5024 wrote to memory of 2540	5024	msedge.exe	96
PID 5024 wrote to memory of 2540	5024	msedge.exe	96
PID 5024 wrote to memory of 2456	5024	msedge.exe	97
PID 5024 wrote to memory of 2456	5024	msedge.exe	97
PID 5024 wrote to memory of 2456	5024	msedge.exe	97
PID 5024 wrote to memory of 2064	5024	msedge.exe	98
PID 5024 wrote to memory of 2064	5024	msedge.exe	98
PID 5024 wrote to memory of 2064	5024	msedge.exe	98
PID 5024 wrote to memory of 4760	5024	msedge.exe	99
PID 5024 wrote to memory of 4760	5024	msedge.exe	99
PID 5024 wrote to memory of 4760	5024	msedge.exe	99
PID 5024 wrote to memory of 2816	5024	msedge.exe	100
PID 5024 wrote to memory of 4360	5024	msedge.exe	102
PID 2816 wrote to memory of 2036	2816	msedge.exe	103
PID 5024 wrote to memory of 4828	5024	msedge.exe	104
PID 5024 wrote to memory of 4828	5024	msedge.exe	104
PID 5024 wrote to memory of 4828	5024	msedge.exe	104
PID 5024 wrote to memory of 2948	5024	msedge.exe	105
PID 5024 wrote to memory of 1772	5024	msedge.exe	106
PID 5024 wrote to memory of 788	5024	msedge.exe	107
PID 5024 wrote to memory of 2948	5024	msedge.exe	105
PID 5024 wrote to memory of 2948	5024	msedge.exe	105
PID 5024 wrote to memory of 1772	5024	msedge.exe	106
PID 5024 wrote to memory of 1772	5024	msedge.exe	106
PID 5024 wrote to memory of 788	5024	msedge.exe	107
PID 5024 wrote to memory of 1820	5024	msedge.exe	108
PID 5024 wrote to memory of 788	5024	msedge.exe	107
PID 5024 wrote to memory of 1820	5024	msedge.exe	108
PID 5024 wrote to memory of 2972	5024	msedge.exe	109
PID 5024 wrote to memory of 2972	5024	msedge.exe	109
PID 5024 wrote to memory of 2972	5024	msedge.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fern.best
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffceadfc188,0x7ffceadfc194,0x7ffceadfc1a0
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,14145405621376154327,1155600176780967322,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,10497160525362161057,2476538853421612371,262144 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,3312104319400465595,5641397993321996606,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,10373815607591653278,6698561965231798215,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17026103239603032248,11797876836792053829,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,12650977456731741261,16438167101904083587,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4244,i,18281847438392686555,13134393135783592611,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4256,i,4525849581144834097,4987712632943667292,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,8723169528322593747,9963942222211207958,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5476,i,15123370103244232424,17030164550015586817,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,7077689445162192547,17186231124744137237,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,2716083946758436890,6975049815218931386,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5908,i,14535768733710231975,15505301076845350394,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6056,i,10564957566909039475,15906313656335589273,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6248,i,2973061488425284081,15108328072222376278,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6680,i,14188895703505728960,8690141932624709949,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6621266878828322180,4774051219488667980,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,1147947865792231838,6821947226327663969,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,1147947865792231838,6821947226327663969,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7220,i,16425222144019267166,5065385020714730322,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6660,i,14312138221263390074,8259080081131923044,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7424,i,2410064512392524785,5685222882653458508,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7432,i,4869616283602098668,12998310347297043655,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,15320310022261750571,2314233493547859943,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:12
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6148,i,13169742967160050433,14770401280224643022,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6864,i,9294464912416220397,17619827202339208366,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6660,i,4317223705845228969,1140617416820429402,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7208,i,11407104490169846114,1841526646640018811,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7412,i,5575505940230919058,1434750596424474684,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8148,i,11917129278437192546,7396648723860004876,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8200,i,15527786784268631641,4576161199502879569,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=8216 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8508,i,13286396313051588292,10421260094716625201,2097152 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,15533140833797365023,3935799858308900627,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,7343355492781967421,13961836804304067876,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,10029471656255803809,16374402972613564958,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,10645816388698129734,7465426771190327791,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4692,i,5415495092353648652,17439001976739171440,262144 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,9464363526420317211,5906482630172874272,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3240,i,12626225832023743290,16500028521289499933,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,17232748725479334553,13610615418763871316,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,16385925572073906329,7300353799156311550,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,2072430742779743912,5168235327365467836,524288 --field-trial-handle=2244,i,14031155141017650020,3907466130426088057,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2972
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2932

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

25e970fc-b86a-43d3-8769-38b2a250a45e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25e970fc-b86a-43d3-8769-38b2a250a45e.tmp
Size 13KB
SHA256 0988831d9bbc911449caa9bef158c304110ca2c9605d00728782b2367189d92f
MD5 2f34711a8df1066ae6e4e4b87ffbea35
SHA1 0f0b8ada8a8bea9c4a1d1e2623e3bf1fe97d0105
SHA512 35abbcccd7ca2cb5708eaa8d83033da5bdb2a7fb0ec42bd34cdd91f92def4657b6e642f36d6ca559d04fce0c6df560d64e5f7dcd77ce5492e322e182aeef5370
SSDEEP 192:zZ3RTyM/jK1Ml8MFcg/fssUisRXEdpTmti/W6+WNA0q5/Y0s1lGQ+eZIgRJ:zZ3tdt/fssUisRUt/bs/5gzhb
TLSH
T11852D8126A346977CCCBE319F951BB53D6F9546292A40F44DEFC9A2C00E2BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8c198ed6d1156b1621da720f270f10f9d8c61968ab4ef9088205f41007b050fd
MD5 65e387d78f3a129582cef05daa47bd68
SHA1 ba8bd5b320f3e2bdc78b3a7f3bf57fe9b5792871
SHA512 3b6b43edd1f80fc2f4f99cae12f1249455bd311001f7280aee3c979a047e1d0c610e54faa00f163d3695fe6a852e09ab9475ebae4a33b548a00f01c4415dd1ce
TLSH
T165E07D8434C8C2AFEE84664F52AC770FD3A0360AE6CCB90B374884C47581880F7C3AD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b68924282d7d29aa3549e52e1bded2447a47958f2be90f807f3c04c468a581d6
MD5 1330825b299d6f83bb72a92712991ca8
SHA1 eddd180d4fcd8442a0c339d648a2bed457e8ae2d
SHA512 2c16ccc6829953700aa07f6d52699813144fe606add25368d49c4e40f6d8054f1908785a748f49a539fa79e7205ad72a79ba455a277744896567833a39285053
TLSH
T11AE0269625C8CA6EBA41678B51A9970CC280760A97CDBA0B3701C8C870424A4E2D3B91
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 161KB
SHA256 ac800043271ebae075cbe7f5a1937c4e2981610faeade4a9fa9b7f7477bdc930
MD5 5c4483d26b17d86bb232599dad8fdaad
SHA1 b17e1e7baa2fdf08245db6c48ede1e88adcc6ee4
SHA512 14f0d665dc336a037c61dd6a81c9ee38f864df6429c716858b56d168ee734ebcff7fba44b0f00d271e21cc9a8dc0e1ff0066e220a60e01ac04a25e5bb7ef47b5
SSDEEP 3072:gc1xlQZcTJTfhkA3VFWjopcOxBVBzD8J22qCvoZ8KqYFXspI+qAd0L2N:gwFJTKGVgjKcmxDVCvgoHIy0L2N
TLSH
T183F313284A4F17347E6A9C8534E33E90D5D376BEADF47A143B635A28E30375122C9E72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 62KB
SHA256 976c28d9fb79c6e56806c5a4768bcafd107fbac60a33d64b207409de8e8c6dfd
MD5 b3ff11236247075c1db67bd60ef190ad
SHA1 3c8d38b06729d7664709238b238e9dae4e6943ad
SHA512 530afab2538552e7fa0d8d34bc3f42fd54d1571e2d13e2430cdaede34d8a392a444257b198a9ad888b036a903c7693071552059a72baddf0714db4d77f67acc9
SSDEEP 768:/Ky/3s6elxO9TSEWNabl5dNzWJtAUE6oQ0zzK6tPLb31Yuk42Z6L171xkO8vR89O:/Kr1o5dwE630ztb6uZ24L1iW4JseBEK
TLSH
T1B75302BAD07ACC028655698370DBDE5055525F7B328B0DA770ABF938E2AC9702E917B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 104KB
SHA256 e3d44da12c78cc4b54d3283b297c25efc4582ae579153bbb93924bc1d3691bf3
MD5 ca0ed8495b6179896725201e3206bb9f
SHA1 8ccdda2376b963869eabac113e0f18472deecef0
SHA512 af552420e3fe23e4e25ced86cbde27cd4563ff8120972c64ad4e8ebc6253dd19547bcbf2cd7c8b6b44ed7b25e0266e94606fd67a3770861012058fa4c68b0262
SSDEEP 3072:/Y6+nvp1p9a/fD6iNSlPGZoA7i7u4+/V1H4sTW76:/fKvp1pkT6i+0iSN1HDTWu
TLSH
T184A312E3CCC079C4E34AF9A3CB2074D3956D91824D983C8626735B03BDF327A22AD260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 99KB
SHA256 1339b345381ecb5d28b651125bc6b2b4e427c1c704963ff2756a5bbbef633f4a
MD5 8888e55585d06cdbca3f7ddd9d923a1b
SHA1 9d35301b3bcd6cf7048d0cb10f45376f37082f8e
SHA512 d72d14db04f88928cf3b67e77e47f7572394d319df03ebb9a6b057c4d95f81270924f068163a2e820991d5935666046841d3f2023aa277c42122e5d538c20277
SSDEEP 1536:CtsFsdTsBAKS1VObimOMMuaBjwC6anhSFh5Spc32YjY/am5zMJQ8bcha9l2OzDtb:e1doBI1gmCWjw3fr5N235UdlnDtPT
TLSH
T156A3D0058798A17EC23716CBAE2D4FFB63411D254E4E6F5B768C375EFC798AC0960188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 368KB
SHA256 4562707231e67b98d299ca2cea803be63322b4b6f600c8133cfb57235584ad73
MD5 6c16d2bd44af131cbc62185283e9b58d
SHA1 9056c0530e96c39a22d6cc05cadda5039aaa8f40
SHA512 c9197109a7df4e3fb9770e9060c1741a4dda8dd3b95a3d9da46a03e3335439f40d628a77804533daaeca782f78fa161136fee0dd9c32d1ad447067e58989d6c2
SSDEEP 6144:wKUoO26uAaAkWaqWCpR/2im9tDTtJtq4nC6wSIlpsZxHoRaNJYbErpRXkT2R1:qoO26HacLF2tD/tq4CUypsHdYwOm
TLSH
T16884239C9B9E379E016B496319AD3FE22B010DDC5DEC5E63E68CB60849FB1DF5C21800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 152KB
SHA256 89e31b9f5975656d1d69f2213300479839748d327daf8af150d42d2455cc4d18
MD5 930606d2742672801e74649365894566
SHA1 c2cd2b25fe3fa2c4f5c24dc371fe6efb781c6070
SHA512 3eb50ce929f79293dec073993657e3167136118a334f32361b7aca8c64aff6c3c56bdad7b02c9c5ff7dda87dff4379fc0524e8d3142b02a7bb194089e334c5fe
SSDEEP 3072:gk085rHRHsb2oJ1sKKXXHxDYDUio3scKMmzV12uPqDqOII85:zX5rHRsdtmXRMD+snhp+bW
TLSH
T143E31250534CD6B4477729BF1CAE66F176837C5AD8649BAA2DE0350F2BB20874FB8390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 175KB
SHA256 628671f80505622468a530cd6f3cdd0a3e7ee97b14b75988a12701468eada869
MD5 d595ffb5eca6c9681c608dd00e4ec31c
SHA1 07187077b972a3637a444afd451def00051660c4
SHA512 485bd13ba9cd27cc057a8f05e20c93b0ce419f5834392152c9690198c1f17440299fe8f3c6cd77d4da0c688715f6c88791ca356f3be9e58497138ffcfe3b272a
SSDEEP 3072:CDBHSGvGgtRSaPVSCxNpxASOKL+yjenqnIENR1rP5dVs9W55ZvyZwyk:CVyUGgqkVSepaSOKiGen4hR1NDCwyk
TLSH
T17804E0041BA8D4AE153B6FC39F0C8BFA7B495C544E4C2E1B7598338EFC755EE8852A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 452KB
SHA256 ece85c0a950f60d73e6fb0dd74c9682de41508495ef25dd39141cedeaf9765b9
MD5 41458508e0cf413978092ad137fb919b
SHA1 80cf8d522689b91a22780cd25f9d2463a9fe5042
SHA512 12c9061a08e054577a791d4262b4b573d1f5d4e82760d395deac6723d79bbc425fc2ce2930b5d403145686dfdafe1f9aa645fd3efa770c671389e4af3da1249d
SSDEEP 6144:UGgbOEG7rZu7f0xargVLBzdgNunRXFM04knMowm6GrrffOD+oz+HEUDIHrpgJSNb:2qnqgVLBzdHnDIkWsaZz+Hz8Hr6ob
TLSH
T1F4A412041BDC627D4A2A26879F0DEEF372564CA01CA85FA7658E374DFDB248C48B0E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 213KB
SHA256 78a8e8239ada785a2b14b275590a728498a8444d2dd00c95066a0c0736870ff9
MD5 0bac5b7da79a9ec60039c4f126294d4a
SHA1 0a044a09c0ec63344e7fa4c3947eaeb9cd770be2
SHA512 b8ba9d30b757f934765ce4ecfbdb6d16e56554b1679a308c6900cf4ba8eb4a2d05558f547e2b054b5381a2a8a0525b0027796464b5282458cdc4695eb634a91c
SSDEEP 6144:V8ZSCGSVG0sYlc4PtnswEJTkdJjJf53OcERH:3zYG7KnswuIhB3ONH
TLSH
T17B24F1081BEED03EA4432A820F5D5AFB77011C296E4CBE63749A375AFDB19EC1D115CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 143KB
SHA256 140161c71ae24efde0b828d44fd657ee5e8a223db3ca015e6847c1ae8b637528
MD5 7329907974ee9ae69f3b8c57d3a836c6
SHA1 31b253c6a9ae29c5734cfe65c80796e2cd4fe53a
SHA512 55e5c06965c501c03f738080efb36dc649e481a42ad2c56690954c58005e03cb23f1b425996544ba0264c9e67bc572af0124b62515357888ec398da2c80ccaac
SSDEEP 3072:I8AOPGnjuW6v19tFSXJkVMEwxRrwLqJTDh+9NKlgZZQxkVjrHe9/:NAOPeuWe9t0ZkVMEwlGTcgZaw3g/
TLSH
T135E3024D1BCD54606E33A6574A0E7AFA6B494CE49E2D0DE726CC36CABFF70190C44B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 167KB
SHA256 c2ffbfc1fbbd0e3d463c89e0d17a1f75372d09dbd36b8769af88e7d6af94e1ca
MD5 c4081b61e3268adee0376526d7980e29
SHA1 d5cc591d2781df8395074fbdd8ff31e2f969ea90
SHA512 8f1e62afa0936dd44cbfe91fc901bac9b6b262c3b897d52f45360a0afc81a6ba319e9a6fcc56c66f6759d38ad4fe89a7b9037aef5abc507ebe741956b88f035d
SSDEEP 3072:g7Ps9dv+hpQPHcymKIdXEGfNOWInMCs+2Vw4vZCAVgCt0i8Rkkv4GqfcC1F:O0b+Hg86IjnpCuS4xCAVgZi4kkv5qn7
TLSH
T186F3F1444F99897A043722834F295BF2B2961DA92E5C3F9F74DE7A0CF8B25CC8D522D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 245KB
SHA256 5f93d552046db87e6685cc93dc3b36a814e1312aadcfd4980f6b63d3ffc62559
MD5 d3d8b9039ec8a5ba6ed0e2c6f3bfeb1c
SHA1 439d9994f467c3b9f6347ccb16aeb1db12cd1c84
SHA512 48c011b7cfdf088c78acd55478cd62b7a663bde0a2f82a7adad48961f8e061d251d823679b2a897c3a839d58a8035d3c0f396b608296aabe40dd1bedbe6108b2
SSDEEP 6144:gYbpka2A6hqh49YBWjV8I+HrOSOKb0mCdYH7nRER+/paw:gIR+hqh49sKh+LOuTCgRbxaw
TLSH
T17F3401585FD89ABEA5271A634E4D8BEAB3212D614C9C2F43B098330DFCF94D81DB19D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 138KB
SHA256 646c001d3b7ac67b93fd4d0f5eafb54bc84adeaca24d23c1db9426b6a3e4380f
MD5 415f38ded3b7c4b54c6b5f8472a94afe
SHA1 0c473d780f60e3504debf9dd895b86286e415272
SHA512 57b70ea61e5cbf10675bfdeff88883cecf8d2681ff91302f8ef8f10488005e54623b1e06d83078c657495846c1ab6ebf416410741d4a7f66819c31e66f62c0fe
SSDEEP 3072:TH97lNwicPZFrW+/nRV44Lty1z43d6136JY9r18NI4CuFCcchnor+:TH5lNwi4ZJWuRld611/eIzlor+
TLSH
T1F6D3E0042BD4D2AAB9D216C39E0AAFDE37461E419E8C6F57B11E370CF8F95EC2C50589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 84KB
SHA256 c9f2afaac3951df52fe69aef51e1d40175f7616d90572bdf410c2d90fee2916d
MD5 b5d00ad74d54680b3c6eb7e7646bcd0c
SHA1 59603b13b3ab618086ec50c717b3ebdb1d965f68
SHA512 81dddc9118b0083c367425d07c2ae4db81b6fdc6cc1529b109d797ef529a6a9e8fbe4340f9094c064b9e3ad2c112bf5add1184a2eede9f690c4d6e05eaaa6bb5
SSDEEP 1536:m/mu3cWuuzPDNHrToz3zhqr0JTktu+/GhcCS4/8vvGG3d/ytKvmLT8j1/Wvr1x:m/NshuzJHrTo8r0ZuGCTv3d/mKvGg2rD
TLSH
T19783F11027B8F25AF1224FB10F1E45E86B412D844E5D6F3BB50FB70DFAB52E44AD2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ba

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
Size 351KB
SHA256 56c0c6449a3d4b11680fca2d04d06ea98f92c49bda4389ed63385da1b8a2a1c4
MD5 342c844ff53615da078a4c3401e0478e
SHA1 7d8c7f77925944d2017c18b927600d07e2c6db55
SHA512 573847759ff2d3e1c114c89d83403eaedafce58e0eb6e4b024aa979e035b32ce9c3a6f8a1c29cc2631882c28ee15e5865750d108349e71847fc8660e2d6d6f18
SSDEEP 6144:tc8atnFezrfRuVf1L3g6PVyIECv6zr2dPn1LqkOPrl4RFNC4trozCp:tW9FefJuR17g6ctPI1Lyrl4RFNC4ECp
TLSH
T14E7401045FDC202E23131A9B1E196FF677850CA55E8C3F97A9887308F9F64DD9D2AE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 62KB
SHA256 72e8bf4bdc0a65e77dd868f8d13dd714e5e8e2a77add72c011d7636269279115
MD5 59822e9f73a75c453220cdd259b3fd49
SHA1 17d57da6b4479b3aab67affb9a99c3141c2605df
SHA512 bd3f9b377691d018e9e7500ca8af09751dce300b74cf14251b9b9a45fcdf8f1f983bcf85dfa059f4065e174c27eed37e73df2114e1f254c2f4cc750c5507f6be
SSDEEP 1536:L/aYKur2MmIEQe0GBAs2MMFqI6cVtNAynSHL40:LAurPy0GWMctVtivr40
TLSH
T1EF53F1059F6DA0285317096BAA07A6F1F2C89E544F08AD3BD6DF3259FE734C9CC91A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 298KB
SHA256 83bec33b2a507851d30f6bfbe020f65c4b225fd7ec1034841e3608cfbb915983
MD5 bde9a7bdbc4ab798760a69ad00f1ff80
SHA1 45fba8a39365df93ac08a4f12b43d605a6cc2b25
SHA512 1923ed0948d7bcc392dd4c5bc8771735183cc561666db2353e4d697450a22bae36f662f96aee296f95d0453f2cf4e87ce69ad6a274a3db683618fbf7c9311d1e
SSDEEP 6144:kg91QykH9NwjTNvh3+8BSn9F3x3WsxOofYmCPnHwApESO8ZFEtMkC:k898sXun97wG6Q5dG7
TLSH
T1EE5412048796543D043367162D2E0EE673429C90BE8E2F5779EA372CECF35E98E19AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
Size 166KB
SHA256 b69653ed5310fa862d8e1154afad42cf1a2358ff4b41250ab3969ec361d4b3c6
MD5 ccfa6a76197635624698427420693941
SHA1 f092ffb8cf0f0a24a7d8d4f06fbdb673f4b39631
SHA512 4771f7b2623fef37f68dc6ea2904abf790309a9012bd44a1b643e48cf79d5d3969a4793d88d431e202ebfc0cb6b154733e08b66a50c067c204305e5baf6d0a8b
SSDEEP 3072:z/fSzVZGW0B1zpQQrIUgrZil3jlY9HGTnq18LwPBTnn4jKAIKq/Mo:z/fOGTz9IUuZ03RY9H3BTnncq/n
TLSH
T1CEF301484FEB453A510316E72F9D5EE537425D884E0CBE57B8A8334EFEB689C0E61AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000be

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
Size 52KB
SHA256 d2ec8c6d8bc5eeda37d3a66f1cd7f973fb673518b286f203a3fc77018004232f
MD5 585d9ed8694ab3a91e06134bf5023d99
SHA1 e46a930a8215903727dc0c599e06722c225ffc55
SHA512 a51e726efa0e937a5599fc0bd8ea66529c9a6e808cfa9c4304d074bb0592927636b96d7e2f2a7b49a1d69af60362d50ac92a6bcb65fc6323a7002c55a44d48ce
SSDEEP 768:FWJdLMdJ7MHSI/Gm4V71uWs98h6cBnoJ/DEufiEaJ98DP608NMdQtzO:UMdISI/IpuW6M6dPfyD0xQo
TLSH
T1A233DF15035E64B8B06A56CB3E0D2EF16B636E621D0CDF2B759CB32CAEF21D80C6D594
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 179KB
SHA256 ce7b6784387dacd6fa5c6860fa056e4b13c9818d2e8b9fd637f5bd2a7cd38b87
MD5 52d5910391ee11d7f76b83ed9a8e32d8
SHA1 c5bcfaf07d187bab022d1d59e68cc14c6a628eb7
SHA512 5f68a7f7fb607d2720172e8ebca8f99490fa47891832ca984d50fdc0988fc6504cb8095127bd6831fdf7a84d1c8eee2c25ed29e40cdf21daa94630508e6ae151
SSDEEP 3072:CuAGG1LfGjCDPwGX+5RjAKkqnDCN2dkrCRAPHMLPsl62sIubxnUEgNoyW633kOtu:hWbGtCk+Cww+CmHMIl62sPUlL33N/LY
TLSH
T1DB04E0009BD9843E65631E830E4E5FF177482EA44D8CAE5BB09D3B1DBEFA5ED0D50688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 39KB
SHA256 ef8db5f32a74c159502b54a3a8f14a677b2f5f602d1b856c22aeb7261d2f40ae
MD5 77293f5797e1198d1fc38ce37f5314a3
SHA1 2f8650af1491fbd9ed7a6ebc7ef8b76265c11947
SHA512 20ff46759c9dd56ca92187c522f05f3d21e3cc39ab3b26a87ad8ddbaa174684607c781eded47925122ca779e989b266b2d23dd655dd47ec953892f9995c69c63
SSDEEP 768:GHiByTUw/5M9YFfMSjSzgiZAPki6FHrKdM+iBoW:7wD/3+QS88ski6FzV
TLSH
T14B03D08A078590AE2E132E177E2D3BF5670A4D51AD4C6D2BB0CC3B6FBCF74649814B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 83KB
SHA256 2ef20be4a13ece949a8ac17ecc81d3bea0b1525ff003698ed58cc815864cc7a6
MD5 658651e700607a4af513a12ea9dfdd08
SHA1 6611a4c9378ed908a38e8d207c484f035668f02d
SHA512 632c0cf08e4e2f52e1f4c7b821a9a96b565a6f18cc12e0f729d600ea06066f02da305d073b03f3d0ab55666b0398f7e248204b7ffe6dbbccbe89873c470064c9
SSDEEP 1536:7GHFoyER4WdECI4Uqiiag7eIyPtYnewgFWLZNDKTKqr/:qHFoyC4WdEIF+Ynewg5Kg
TLSH
T105839D840B8CD1BF91236BC75F588AE677002D94DE4C6F8BB488734AFC7A5EC0D952A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 594KB
SHA256 2cd49e56fa5659cf8a958353b9912446ea1430ae89a53c6d13ce53a36fc25099
MD5 160424b9abf55365332dc915bf8877ec
SHA1 5df1ae039c899e138944a609a22caac3ade094f7
SHA512 8fc95652df6bf404bd02fe69e6d02c4d482dcf8d649f1f3bdd743d9750cad3aa5712984ead5294dc2901eff121575a2f67d83b75cb8330ba22feb2d722953220
SSDEEP 12288:jtb+be9yh0BhUDWVZbleRxVOxLUiZH3YnUHc2q0O6W6:jtbieYhahh7O/Ox/jp/O6W6
TLSH
T193D412292FDA447B5827416A096C7BF3B76A0DD1AD0C2FB72A8BB30974F35940C54ED2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 204KB
SHA256 03f6ce6dce18e9cf462db224131b20670a0b7aa63f699a500ceaaa3fb10d01fa
MD5 85d97650b30b7334c1c55d225f06fe40
SHA1 1ba96df5d2838c28b45e540a9a6982ab3989717b
SHA512 bd289775036b2d2ca7ce599361ada5119895bf48eb3e632dd1b76071842e8820f7138beed6767b2029fe1d73bedad6d4b206959d378ce2cb7adb3f4ab9dcb627
SSDEEP 3072:xAPsT/h5YkeAJ/912dVkQblIamp4amhRYknY7abhDxgrMTSnliKNLYIGptbaJkmp:+Ejh+cJ/ufIa7hnQatDCAKNLWIlnJT
TLSH
T1762402892BCD516EA1B27BC35E283EE473124D690CECDF577206374CA8F69C80C64EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 189KB
SHA256 2eaa1b2ed031e87a67bec3a2b88466635913132c60c0991e39e8a1ffcbfe1c6e
MD5 0f69c111cfd8a16aebad1167636fb9ab
SHA1 c5625a875411986ba5eb4e00989d8c2c72873988
SHA512 e9331e80f88bd1041ba283f81e7655911dd20f2fe10c81824e9487dac85b31833fbc6fcf00126787d62dd8c9ac22b657aacc948666ffe08327340e84d0531e29
SSDEEP 3072:xTaTqSfSXAT5D+Sx06dCJ41aoYj5kCpHhflu6yX9cGxTKj2x4tXeVI5p6278Cn:hoh06K41Kj5kEVyyGxT34dmI5p6y8u
TLSH
T1BE14F14A179CF16AF13256C72F6C5FCAA3090E844ECEEE13B50A331EB9BC1D95964784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c5
Size 170KB
SHA256 8155d899e47b830831b3f543caf03e7af8ff66e16be9cb8618ef7df4170852ea
MD5 94a5881bbddb26abc7397e9bfc9787d2
SHA1 b4cb7947e8207c0c646ae1d46699a54aaaeae8de
SHA512 a15369388f361c1cb3fcb1111b8b83e36483f13000b16cf44242dd6285b7ba0312ce42940b191a0cccb16b70cf85a019b7bd006d802d46fb55b7c3c283b35051
SSDEEP 3072:rZLT3Qevpy6D7vVIVlhK5aL2s29z6AWF3DbxjvFLDQBjo/bSJk9:rZLT3ZD7vVIRL61QxjNvQab2k9
TLSH
T1E704F1495B89C16A743B2AC37E28DAE737501E944DCCAF2B302E734AEE790DC0D856C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 17KB
SHA256 12e15ecd6fabfcc0a87d9fd8d47592d58f4973baefb0d7ce08c02afeabd0235f
MD5 4f16e76c847e4b08b7dd900f1bcdf5dc
SHA1 ee24cc6fe83f08c00f580520eb922487b66c1649
SHA512 178c82c6adc7388b63b41c8144a828d76b3e1d59dcbf8b042653501bd47ab5070af563596ea1d1e7a5c41d7486bb7010358981826a73b3c831828e64a0c408e6
SSDEEP 192:gEdIVABojRAtLayGEJTnFst2deQQkZch7sVv+Qs7kMKh7htnoBddA7sq/Tsvg:gEdIV/jqxJst2deQQkZHvIoMu8BddW
TLSH
T16272AE5587DCD36C44692D5B1F6C1AD5E31A7C1ABF8C1E1FD40AF30A72BECE81881894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b194e21fb9b216e8ba676e2b88a128cd315b7d57602dfb915ddec6af94e474b3
MD5 6c766e398c2d6ffb91de4f79b6fde0f5
SHA1 46c681b9aa04b163ead8e4d61eca4df1ffdf2d7a
SHA512 966c13ab096788fa3708883fd304202932d42a2a3c954b1bb799aa9dd47a1851e69624e8a37ffb29a6994d7df11aa870a39a13450b351b006047d65d8b4f5420
SSDEEP 96:ZxhnG7m8UDLJNAVP6M3kvTb3QL0msI361E+Y64k:1nEmH3J6SMwTrQAW361Em
TLSH
T168C1924653EF6D44FBEB21F8B0DE5A34303140DF95279E820FC88DF1194A7A6882794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593d0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593d0f.TMP
Size 3KB
SHA256 622d2262f9d3316d9db169de2f69c3667f127a3280ced2bb0db9bff9e085e8c8
MD5 a8c01693bdcf84c01517b8fa10f6382e
SHA1 9f17691ba6ab2cac1703e90123babb4709421758
SHA512 d7995097ddfc07fae2d5654852d0f9b9ad2f97d435b4343134bd3920e72647a02a280782952ec0ffbd04f4620fd9125b76168c25ae42de17c7cf308d83931fb1
TLSH
T1E3710C2901DF4C51F7EF32FDB1D25615307184EF8A276E930CC4C6F52B1ABA6486650B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_fern.best_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 af70ecef4d377606f5608735427c22259d238595735816813b95267397222333
MD5 13eba4af82f4bfa6f79f8faa580dd077
SHA1 959830bc520cb16781e90834ab2864d87b47e6b3
SHA512 0750bd3796bd8cf751839d340c6054fc1aee71866062bbeb56c8b125a259de4fe58358f64482a4162aa48c57917a7b92daa855210bd27afcf2455462bfe9e0f3
SSDEEP 384:DW/gZ4eceIBeNLLJASqUJbp2Upto86fNeEJnXJUf4+J21WAC+NABCPTjCNi8qMCP:CuUPsOrLPkbjfbZbUBlvK25
TLSH
T11892AAFB83F18A6D893572F09A2CAE2BDF581422435C3F7589D15E4693E2071E305B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 289c94c1d513bd9770c20b4b36b98fb3f6291619da8d4c1a942f16656f5c426b
MD5 10eb834094c777ba06db161392a42015
SHA1 b4ae2cf506f9637f49b51dd6b717c7c6c76a0717
SHA512 6f89d4c8a9570123ab79fe327c198990f47f1e21e4a5f0c32bfb9866758320c6fed7d85937bf6f2d1ec13fac3d5e6f43202fba6605629395b8ab2568e2324db5
SSDEEP 384:D8h/W9MereqBeTc0JVC6EmSryCMhOIh3Wf4tLgq6JmB1WAC+NsGBCPTjCNi8qhCN:X4ejNO2Lq+bJGTGbO0JDZG
TLSH
T1B6B2CEFBC3E4862D883672F09A2C6E2BDE59051543683F26C9D55E4B93E2471E301B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1499d19a197746286eff4242f124b3168127fc9c6c585685ea83fa9141785c97
MD5 8f4163cd4aa431790d1da6042b294fe6
SHA1 0f5c6354dd1979498353a835a1c709ba87875bed
SHA512 1b428cd9cf007333a2bcf5b925f2c47b233f14f89623786bf1c0a95e64b7d92e27388b0071712004782bdcb6bc87f2c3d839851ed0cf08102b3992aef9174b87
SSDEEP 192:sxZ3RTyMojK1Ml8UQVFcg/fssCi1RvIdpFmm/i/W6+WNAg72NdY0s1jANQ+eZIgV:sxZ3Aqzt/fssCi1RAu/bud5g1hV
TLSH
T19E62E9126A346977CCD7E719F545BB93D6F5547292A40E449EFC9A2C00E2BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4ec70a5ffe0a8787ad3002c5cb20ad93d706cbee9cab5ea31b5537045d6146a
MD5 a65607b23d2404343bf59e2cf1e8dcb8
SHA1 327c2eb990ee2a4c157f10bb29749f6741ae496c
SHA512 f41fb3a8c98792dc4ff86c5275d1ce36f7a4ddbc382653ed7d1bcb9c6c14ee26b0dfaa54391e1467a3ab3424d4f3ebdffc7684fb5b66e059658fe5bfe85de84e
SSDEEP 192:sxZ3RTyM/jK1Ml8MFcg/fssCisRvIdpTmm/i/W6+WNA0q5/Y0s1lGQ+eZIg5DJ:sxZ3tdt/fssCisRAk/bs/5gzhr
TLSH
T1D952E9126B346977CCCBE319F945BB53D6F9546292A40F449EFC9A2C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c6398b917d1ea43622c789e7bd5a6ba2c66518f7d2976285afd4961f8889deff
MD5 64778ed7efeb900a1a2203c1ca56d9df
SHA1 b9684422c3e46ebc88215e54bccbbb04277b7555
SHA512 f44792c7ee81c50bf3a532800060efa9993a4dda05ccda3286ebb15b46b1575195cfb5c9915ca4bba0308b3ec9e60d16007fda9d20a3af79943c5cabe7e8eab3
SSDEEP 192:sxZ3RTyMojK1Ml8MFcg/fssCi1RvIdpTmm/i/W6+WNAg7K4rY0s1dKQ+eZIg5pJ:sxZ3Adt/fssCi1RAk/bLr5gjhV
TLSH
T13362D8516A346977CCDBE31DF545BB53D6F5546292A40E44EEFC9A2C00E2BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 13d3e9e0346e9d4e1259bbfd3c58727b373f3a50efc5cd48419f64ca618f0322
MD5 7dcc30462e0f730f1657ee8172c9d171
SHA1 43ffa9fed69387e915a9cf49bcda5cc9c0e05602
SHA512 3a5e61dfddfdf5994d21c69d3c2369aed3e7876f616d0a26e57903efe9e4d1569ce970b590183afd26ee4586bb1a3417e40490fb25477c851699c14f7537f548
SSDEEP 768:4T/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k6010OroOj:4T/Xh8dF27kWRmwcQDwu1jaKmjLpkD1f
TLSH
T157E21B3F280CC77E4F844E5DEC26AF966EE802CBA6584D5447FA894C03C77EB511A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 1KB
SHA256 102feb883243fd3cdc397182428ebcad5d6d916aa6e1cdf9bebb410f824fe581
MD5 54cf90b3bd86bf562606747d37fcb836
SHA1 6e6d51f9f6d9f63bdc216a972243353aa4941f11
SHA512 c0788eaf2baed1be17bdd782d38dd1f1825558a56071cd26877f1cdde52122a1b5b6f44ba705df093a3be8f76a3f284a6e20cb719a79cefb64242634032918a9
TLSH
T1D231720E8E908A1BEC6444B2267775B47374C9CC0712B243087C62357E233691A4B2D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d35d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe5d35d8.TMP
Size 1KB
SHA256 81c31fd98ac88250b5c2983382d80508d25aaa35e8ae8a58cc95a6ca0711ce3a
MD5 5538b1db318e725f6d3e4a4e0a03035a
SHA1 94284280e30c18ed77d16203588e1e9289607b10
SHA512 639aed517ff5106a55cf16fc0b9a48ec72531c10fc48555f3d592dfd8217a7c2295fb29096d219d29edcbba4c8b9e3d20eda4af3826ececdfa0222aba0d7cef5
TLSH
T11131AA4B4E848D1AF8C440770EA3A8B83335D8404311B783947C5134FD627AD1E4E0DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3d49401089fd46ae0e8d78a27fa57d77c1c3636e9d78a1511543794e94ea6d36
MD5 7b10bb881079dd744e9c3386a7744079
SHA1 0fc586fe9e6250cb9f36e1d60c451c3b4089e7b8
SHA512 f6568fe2967317ad9be8dbc4c1fe24df85752b34895d676ae9051ff9b61d3ff380b72673d4cacf2ea6bafe3162f7ccf5ba279a13562403bec0a56dd2c13a0bda
TLSH
T16AE0D8FA3EA31868EDAF93D5247141E00145BDA88586FD4E301AE7DB50B13553455E61
MD5 SHA1 SHA512 TLSH

Submit Download

013888a1cda32b90_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\013888a1cda32b90_0
Size 178KB
SHA256 895ff733f66555b45ca7d6b7e1d7de6b7a06bd7c15307efb406c78becb5f85fd
MD5 3d4b11dc30ab6a1a6ca4d15f4046630a
SHA1 930332a66db90e06d8e3e6dfd827bca3f7eea6dc
SHA512 cb9e630c9ca1ad903936e84dc7d9ee7bad83734016095bd6354d61c49df6f09abf449305d5123bc35c595d010b2e7d694d3e27dd8c078acb2bacb399031c4f9d
SSDEEP 3072:ZMLMQ4+jpysdk/gDRaFBgKU5+MpC+ybk0BR321+20DDTx:ZMLGs3RaUohm1+LLx
TLSH
T131045DD636A0B83787DF529990571905B23D01386049C07DF6BCE8EA5BB4A4B923FF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 361KB
SHA256 ee57f227016dbbda7817b26adc4fb46de29edfa34c8bb1affea6c218db1aa199
MD5 7fb0c77c61163086ff8b9afbf32149e5
SHA1 0b0390537598f3c204b52e4070392f7e70567ce9
SHA512 edb168e49357df8741f0886bd78b3ce7e9ab0519b4a05a361f2265bc38a1be95eb89e0b9373bc0dbe24aaa81c1c79c5ffe4027f7af5a6e74267978d64b9420de
SSDEEP 6144:fgEh3UXHtC3q6wmz4WHG8NGOL45eAuw1XQ:4Kk3Dm/JG1puw1g
TLSH
T1FE745B343686786A935A41D6DC7F110A76F494946848493CFFBCD1EFB924886303BBFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c28cea6ed9dfc1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
Size 7KB
SHA256 84a8bfc3fd74907f69b4d689fcbd7e2f285b5ca4dcde94bae5fde8c9dd0b2045
MD5 f64b9048d4ae22a9f26f47d181ca1527
SHA1 2488308761cac67c542000fa8fc7bf45a76c1396
SHA512 1a9dee741a404962319c3bd9936954040477375eb4190d4313451b4cb54f5ace5060f16bde8fdfb9bd4791d3a6e3e95ce629d9d82b87467242670cb51173b83b
SSDEEP 192:v8FPbolNet9gSuuLahw9PtZ5mZFVHJFC2:EF4NogSpLahwVt4g2
TLSH
T16DF1E9AB26FFB421035042A9D9906B14321154466046C02DFB3CA5FF9BE0F49DA5BBFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 5KB
SHA256 3a8d37e23bfb0f92d033d37f5bd82a9acb71a642dea11ee59edda63d38f4e075
MD5 3d3aa7cc662aa0d4761410092765fe10
SHA1 b9b0164485e293b41d2c0f0dcc6e3bf29c8c9ed7
SHA512 af978c1703b3ab9440dc54cb87c25130ae4c4f74a7d89ce3e246f1dec0e2f266631abfae2d87ddde69d2b20654356fcb47663802b44329e913733e6d0f22920b
SSDEEP 96:x8HVgB5WgQEBtDJ6Y9O34oFdQwfOfFmk7oGwF50gfHQyO1V9+l+OqS6zRR:x8Ww7Y9O3/FhKFmk7hwF5VfHQf1+FqtD
TLSH
T19EC118D6072D58B3C3A29979EE86C0AF2C7E64B23FC99023B156497980C47CE8561D6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 168B
SHA256 1e2af55ea1160ee3a1cf9261e7529303e50fea2437c97fe93b394ce98d8f1886
MD5 179bf6a32dc63e1573c52850a1975bee
SHA1 a9bc9413d1a7a5c6e6f61977b9aa856bd6e0ce46
SHA512 8a365035b2e1d767d090cb4a5a2f1f4868775526945551642c6fdeb707101753fc9459c7e0584cb4f7005ade7767165c1af3af4c0c1c6104cf5a968cd9758713
TLSH
T195C09B5D45141151CC5D0A3DE81E40ED7614745515194B5B237C631774731715126106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fa3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fa3a.TMP
Size 48B
SHA256 03c504a46e1ce314874bfa260190abe910daf88340ccbe82b070997b7600998e
MD5 a1766b1c2c1f6146f0cdc1a8543821cf
SHA1 8f181df63e4e9a2a3cc65d3c9b90cfc9695d675a
SHA512 a58caac83c70ab12514872717bc1af6c04a1112f2bbf49f99e495f794927a267c6e2d3fe6fdc542915eaadf3ddfc6f52998b8e8b413c1ff35ec54444789b8e09
MD5 SHA1 SHA512

Submit Download

7af000435d15b529_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\7af000435d15b529_0
Size 64KB
SHA256 1a03338de154e2f3c227cc741915e790a99b3b0ab72640e4608e33b6db9ae9ad
MD5 7d374bf19f7aba60c9f4a4b0c67f8925
SHA1 211caa2b8cea1a2af50790d851fb5c9d54779719
SHA512 f3ec94cdc5c8311b39f893290cffec914ee462b6db7026677b4bd407233f2159c3792f72200a6db0e6d7a5f3548769bd034eaee90a8b47bcc272e2af6d8823c7
SSDEEP 1536:08k3vI6M483O4uubRX1yXbRxkY8Yf3iP6O:08k3vFM483O4H1bl
TLSH
T135536B96337174B7427BA1B1909F130B713EE167B404C4E8A298EEE44E54B9A4277FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a68472321a7ae87c2d4106e9d148f00af1dec82e2e40cb1ef079092cc787efad
MD5 4c38a61f2eb576f9000ee19ab85b134c
SHA1 d37667ecbb71c42bccc978d6bfa37d7a83002e5d
SHA512 6561bec2b8fb28795a3e115651d0530921c345724569444b8dbf8eb5464eb1144f933633d94fd86fc77e1169f2492466352abe4917899d50eb02d3e3948ebb59
TLSH
T106A002110B800842C1021FB1E1D9C3643711EC10831107A365D0009A8C705D19E0A020
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5917f55d2109c63426948b43385c9a7e50d2dd0fbfb4e66bd7f2b1d1ebcfd988
MD5 facd5904d4c22a7142bb4c19bdfc0b11
SHA1 846f2365a70dcc7a4ee4fa967e41a54afcf0a4c7
SHA512 456a581eedc7f81ead0e3a25366db55e639de3fb26aaadec5fdfb25afb79648b57528388cdc986469d56e6f409b00f06e5b6e888c7fa7c4688d1fc29b4fee9ca
SSDEEP 24:KdklfkQkDk6ak/dkHkzkL4kDkn+ufByzagd0QM4kw+XIj2MKi/haQM1EOcSmiMzn:KAq3IFKMkY3yl3IxKIg0UKI/KzisL
TLSH
T1DA91121675BA13813C7E250C8356973A5682B2B33828B47B7BA900B60E66F521CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5988be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5988be.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 69e784d06a26c09f505f8e00ef0f428cd3c8b2caa1f17872a7ad9f55e39e774e
MD5 6be5e9b2bd6b5af7443ba612616c8370
SHA1 42fd54518a2fda094bee5f7f65aa56fd1c49ed29
SHA512 353c092ec2348c288a9fd31ac3d89dbf85c1e5b338ea4297202acb444ae2f0ab81bfa00d1fc13f12ddc8e995dcda387d15c95fb0550ff29cbf56fde7675b57f8
SSDEEP 192:ulI8NqUEQ/8U6H3i+nsQmiU1CY2F8Br/rUH5mVResrYuJkc7qdavuYglOlSX:t8NqUEhXXi+8QF2r/E5CjxvPglIY
TLSH
T174424A3168B8AD7B9DE39654F40B36139F74906B97C82F84E5DC6B2E02DE1EC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2f316d38106cccc65a3acc61549a4c97feab4f1357a7bb86c59d30af2082d90b
MD5 fba78e74478836c4330667b1060d8f8a
SHA1 09a7fd45d2025b2fb1309d9ee09046f8a4f99608
SHA512 528af8512e25984875c913f1daf22b456db2cf5f30347894db7dfa0d972aa478507cbb132b0b426c11875c8525508777bc50c30181eafdfe9f867e2fc965a854
SSDEEP 384:DZcIF8NqUEhXXi+HpF2r/E5CnxvySllYJTfY81F9Dj1Bus:bFd/FM/EgxvZuTHnVBus
TLSH
T1C1928E711874ACBBD9A7A615F44B36078EF8817BC3DD6F84D4ED6B2E01EE4D80316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 54c8d811614a94f7dc3013dc5b189a88dab1582ee240a6333ae8350b9dcff011
MD5 beeb9b5f90e91d553bbe552b8829bb2b
SHA1 84a63cc9b29ed177ba3f0513fc6cf3bda29efa7d
SHA512 14787023f6711d11da8a3c9c15b39fc474c71edce362bef2efe83a620881f018667f4144bbe96a09a35befb3409708bfc4bcce73684e8252e0006545beef12d1
SSDEEP 384:1iFpZcIJ8N18TUNTUlIRvsXXi+HyF2r/E5C4xvySllYJTfY81F9Dj1Bus:8FhJowg+EFM/EnxvZuTHnVBus
TLSH
T167D219F118D7987AD96E5B07A77E3D038EBCC067B2985A80B7D85A1DCD960BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b78ad22e0dd94123f5397e3c941cdf78c7aa7128f5dba8912b54a45ba0cb042
MD5 45d7bc4d0acbc5ec03eca5d49d49ac83
SHA1 9f707c017a6167f679b98556119ed0258b4707c6
SHA512 4b6dbe238495d652cabc7ec0a6f9664bcf89b298b51b7791281dafcb3a95ed1276fe77b66d29026a504c6f9a1ba7b368ceba10f3311831f0ed507311df286742
SSDEEP 192:1GN76t6H3BQmiUygHBH+2Qq/rUH5mVReED9MFs3U6:1GN76MXf3I2Qq/E5FW3U6
TLSH
T1AD02FA3478A8ACBB8DA3AE45B48777178F94113FE7D55F88D9E81B1D01DB28C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 130c0aba4dd32d4da3a6a6c46e22ab05f83b4656502b3408b3655cecea731404
MD5 6ac7ea0c18504ef7a66b29824382fa81
SHA1 1d97344bc0624b98676b65330c972039a280de87
SHA512 daeefe74536b290f7677f79dba3a4f06d16c5866cb1f83df5569c113bab25fdcd8cb9631227696114049d3750796872c5f15a979472e7d9fda2de23d8510168d
SSDEEP 384:cZcIF8NqUzhXXi+HqF2r/E5CnxvySllYJTfY81F9Dj1Bus:KFQ4FM/EgxvZuTHnVBus
TLSH
T1EF928E711874ACBBD9A7A615B44736078EF8807BC3DD6F84D5ED6B2E01EE4D81306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 db7750d7913e8d9653d4cb357f76a587dfb85cb9bbc9aeeb4a4b6ab895e11a32
MD5 0167f9835d2535d5dbb6d3aacfb1f13b
SHA1 30c139113802b12c8f9ec88007c4a72735617ca3
SHA512 90dcd52f2d9346afb2e8dd9e49e92cb462ed10dc40c7928378ae390f994b8f53ec6379a96a843001bfaf244296db96c6f191d8842c5e9d5a851abb7a96eddb02
SSDEEP 384:1iFiZcIl8NP8TUNTUlIlzhXXi+HqF2r/E5CWxvySllYJTfY81F9Dj1Bus:8FQlOwgX4FM/EjxvZuTHnVBus
TLSH
T124B26D725C54D8BFEDAB9B55F94A36078EF48077C3D9AF84E6DD5A2E019B0D80306C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1bf58b01fcab401183618c5592862b22015ed09b32c8eca0c2cd09ea86f9b55c
MD5 f379fe2bd390671cbf6cce4268276f53
SHA1 1528af13a47f4a11941b8eda1b825cc28b6cb484
SHA512 cea9675cae26e60a4f4315bed6464e2987e42c48bff2e5f5e5d6a0741e7fb9473d070914f93280f3479dd69e20af1e469225b13daa4faf2fe7a402bb2c7fff2e
SSDEEP 192:cGN46t6H3HQmiUyv0+20q/rUH5mVResrYu5/9n7qdavU6:cGN46MXp820q/E5CDxvU6
TLSH
T15A121A35B8A8FCAF8D93AA54F48736538E65512BD7C96F84D5EC2B2C01EF5DC1306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dfc5cc0f36edc2973772489ef2453b72f59ff24ff3d0859985d91cbba56640a2
MD5 d6c76a798fc6dbf215862e2f99538fef
SHA1 77279d29b5f782703c3ff99db8f4751b515a2ceb
SHA512 e1eff84ad7e402cfaff7bd1dcc49b9676dad115db70e57ce0a4cffa5a5b19966e6edb22dae06c3f55b57a1de76e5ad59201fee877c45294285b3c4dc7451d42f
TLSH
T1DAE002421304009EC0B413301087273C26E3846102B20259595001654C133001F203C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 81d0462ecacbb0410ac7eb8fc551d9cc5c0f6d114b09470fe9ce38586a7149af
MD5 4c9cd53619699ddbb887aea1e944075d
SHA1 84306ec81aa9402ee7b0d64e2c2d60c7615a38d5
SHA512 50b5454ceba6f2febe11c30ced74368ece9083ca750e442d9f0a0f2a9fdcc2b343bcb38f3406b0ede1a91ee31532da7f1ff4c0657972b938383e082804be3c77
TLSH
T131E002431304009DC0F8137010872B3C2AE3847201B202599E61516D4D233002F203C4
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

www.bing[2].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2KEI6GG0\www.bing[2].xml
Size 7KB
SHA256 b4695bcbda4f4e9b6ea2ef4585b26883982a710616dfa1f25e5c3302f92d2e5d
MD5 14efe958fd1866af31522cfc9b64eff4
SHA1 e43ea8ecb90b579ac6578a1e206f5fe457208d5a
SHA512 7e1f5877c42d27ce247525dc7d4ea83ba35739a5c27fe56fda130049be33d3f4ebb7708e3403844182387b8101a125baee2064fb28d2e8bb340f97f35a53ba43
SSDEEP 96:GE6a1u0bOhG+VVHm6aHuvu9ucn+G+aAHi6aXahTMylJsaWh2dgs9s9ZITKP6ad2b:GtMY787azpE60nf4f
TLSH
T184F1753AF1F38BBE847DB290E2A5BB9953EBC3072BC52BF245601589275450E6D230CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2768-1135-0x00000241C4200000-0x00000241C4220000-memory.dmp

Download

memory/2768-970-0x00000240B09C0000-0x00000240B0AC0000-memory.dmp

Download

memory/2768-1004-0x00000241C2EC0000-0x00000241C2EE0000-memory.dmp

Download

memory/2768-1003-0x000002408F980000-0x000002408FA80000-memory.dmp

Download

memory/2768-1020-0x00000240B0B20000-0x00000240B0B40000-memory.dmp

Download

memory/2768-1103-0x00000241C4F20000-0x00000241C5020000-memory.dmp

Download