Overview
overview
8Static
static
3Velocity.7z
windows10-ltsc_2021-x64
1Velocity.7z
windows11-21h2-x64
1Microsoft....ET.dll
windows10-ltsc_2021-x64
1Microsoft....ET.dll
windows11-21h2-x64
1VelocityApi.dll
windows10-ltsc_2021-x64
1VelocityApi.dll
windows11-21h2-x64
1VelocityLite.exe
windows10-ltsc_2021-x64
1VelocityLite.exe
windows11-21h2-x64
1VelocityLite.exe
windows10-ltsc_2021-x64
8VelocityLite.exe
windows11-21h2-x64
8WinRT.Runtime.dll
windows10-ltsc_2021-x64
1WinRT.Runtime.dll
windows11-21h2-x64
1XamlAnimatedGif.dll
windows10-ltsc_2021-x64
1XamlAnimatedGif.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows10-ltsc_2021-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows10-ltsc_2021-x64
3runtimes/w...er.dll
windows11-21h2-x64
3Analysis
- max time kernel
898s - max time network
897s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/08/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Velocity.7z
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Velocity.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
Microsoft.Windows.SDK.NET.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
Microsoft.Windows.SDK.NET.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
VelocityApi.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
VelocityApi.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
VelocityLite.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
VelocityLite.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
VelocityLite.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
17 signatures
900 seconds
Behavioral task
behavioral10
Sample
VelocityLite.exe
Resource
win11-20260513-en
windows11-21h2-x64
26 signatures
900 seconds
Behavioral task
behavioral11
Sample
WinRT.Runtime.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
WinRT.Runtime.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
XamlAnimatedGif.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
XamlAnimatedGif.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
General
- Target VelocityLite.exe
- Size 232KB
- Sample260818-wdyb6seq9v
- SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
- MD5 e4df8ee6e755c3da3088701eb1c05b76
- SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
- SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
- SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
- TLSH T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 89 4488 msedge.exe - Loads dropped DLL 1 IoCs
pid Process 1244 msedge.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1048142461\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1048142461\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1174665302\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1174665302\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1174665302\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_2121084543\deny_full_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_920116205\domain_actions.dll msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_508550439\safety_tips.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1477856026\protocols.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\edge_autofill_global_block_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Cryptomining msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1060833657\ct_config.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Cryptomining msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Fingerprinting msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Advertising msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Analytics msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1174665302\sets.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\keys.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_554743719\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Entities msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Staging msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\TransparentAdvertisers msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1477856026\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_508550439\typosquatting_list.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1225618255\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1362510212\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1362510212\office_endpoints_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\travel-facilitated-booking-bing.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_554743719\crl-set msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_508550439\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Advertising msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\classification.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\CompatExceptions msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Social msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Staging msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_398604954\typosquatting_list.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1813879951\arbitration_metadata.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1813879951\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_508550439\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1362510212\llm_user_input_extractor_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Content msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\_metadata\verified_contents.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\autofill_bypass_cache_forms.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Entities msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1362510212\smart_switch_list.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Fingerprinting msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Other msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_398604954\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_2121084543\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1225618255\data.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Other msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\regex_patterns.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1060833657\kp_pinslist.pb msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\v1FieldTypes.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Mu\Content msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1060833657\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\extraction.js msedge.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe:Zone.Identifier msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4488 msedge.exe - Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315490209221672" msedge.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\ = "0" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7112" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{987F29A2-291C-45B1-96B4-DC475B32AB48} msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com\ = "0" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d8 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\Total = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134232014455135091" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4030" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7112" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7125" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \Registry\User\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\NotificationData explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4566" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10207" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\ = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "4030" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c005a007600700065006200660062007300670020004200730073007600700072005c0065006200620067005c00420073007300760070007200310036005c0042004800470059004200420058002e0052004b00520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000393000000000000000000000ea07050042006800670079006200620078002000760066002000700079006200660076006100740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000b26d17250e3dc016dd6082551e3dc01000000005a0076007000650062006600620073006700200042006800670079006200620078000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000ea070500420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000d46ad8ac4ee3dc0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ea070500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3118" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com\NumberOfSubdomains = "0" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "1" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7661" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "4566" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{2F3CC8EF-1130-4FA5-AD99-BE3C5986A117} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe:Zone.Identifier msedge.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4900 explorer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 444 msedge.exe 444 msedge.exe 4900 explorer.exe 4900 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe Token: SeShutdownPrivilege 4900 explorer.exe Token: SeCreatePagefilePrivilege 4900 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 1244 msedge.exe 3716 sihost.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe 4900 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4900 explorer.exe 4900 explorer.exe 1676 SearchHost.exe 4604 StartMenuExperienceHost.exe 4900 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 1244 5004 VelocityLite.exe 79 PID 1244 wrote to memory of 2108 1244 msedge.exe 80 PID 1244 wrote to memory of 4488 1244 msedge.exe 81 PID 1244 wrote to memory of 1140 1244 msedge.exe 82 PID 1244 wrote to memory of 1140 1244 msedge.exe 82 PID 1244 wrote to memory of 1140 1244 msedge.exe 82 PID 1244 wrote to memory of 1364 1244 msedge.exe 84 PID 1244 wrote to memory of 1364 1244 msedge.exe 84 PID 1244 wrote to memory of 3876 1244 msedge.exe 85 PID 1244 wrote to memory of 4964 1244 msedge.exe 86 PID 1244 wrote to memory of 3876 1244 msedge.exe 85 PID 1244 wrote to memory of 3876 1244 msedge.exe 85 PID 1244 wrote to memory of 4964 1244 msedge.exe 86 PID 1244 wrote to memory of 4964 1244 msedge.exe 86 PID 1244 wrote to memory of 760 1244 msedge.exe 88 PID 1244 wrote to memory of 760 1244 msedge.exe 88 PID 1244 wrote to memory of 760 1244 msedge.exe 88 PID 1244 wrote to memory of 4200 1244 msedge.exe 90 PID 1244 wrote to memory of 3220 1244 msedge.exe 89 PID 1244 wrote to memory of 4200 1244 msedge.exe 90 PID 1244 wrote to memory of 4200 1244 msedge.exe 90 PID 1244 wrote to memory of 3220 1244 msedge.exe 89 PID 1244 wrote to memory of 3220 1244 msedge.exe 89 PID 1244 wrote to memory of 2192 1244 msedge.exe 91 PID 1244 wrote to memory of 2192 1244 msedge.exe 91 PID 1244 wrote to memory of 2192 1244 msedge.exe 91 PID 1244 wrote to memory of 4992 1244 msedge.exe 92 PID 1244 wrote to memory of 4992 1244 msedge.exe 92 PID 1244 wrote to memory of 4904 1244 msedge.exe 94 PID 1244 wrote to memory of 4904 1244 msedge.exe 94 PID 1244 wrote to memory of 2824 1244 msedge.exe 95 PID 1244 wrote to memory of 2824 1244 msedge.exe 95 PID 1244 wrote to memory of 2824 1244 msedge.exe 95 PID 1244 wrote to memory of 4032 1244 msedge.exe 96 PID 1244 wrote to memory of 3460 1244 msedge.exe 97 PID 1244 wrote to memory of 4032 1244 msedge.exe 96 PID 1244 wrote to memory of 3460 1244 msedge.exe 97 PID 1244 wrote to memory of 4256 1244 msedge.exe 99 PID 1244 wrote to memory of 3080 1244 msedge.exe 100 PID 3080 wrote to memory of 3424 3080 msedge.exe 101 PID 1244 wrote to memory of 2016 1244 msedge.exe 102 PID 1244 wrote to memory of 2016 1244 msedge.exe 102 PID 1244 wrote to memory of 4428 1244 msedge.exe 103 PID 1244 wrote to memory of 4428 1244 msedge.exe 103 PID 1244 wrote to memory of 1804 1244 msedge.exe 104 PID 1244 wrote to memory of 1804 1244 msedge.exe 104 PID 1244 wrote to memory of 3468 1244 msedge.exe 105 PID 1244 wrote to memory of 3468 1244 msedge.exe 105 PID 1244 wrote to memory of 2100 1244 msedge.exe 106 PID 1244 wrote to memory of 2100 1244 msedge.exe 106 PID 1244 wrote to memory of 4440 1244 msedge.exe 107 PID 1244 wrote to memory of 4440 1244 msedge.exe 107 PID 1244 wrote to memory of 1768 1244 msedge.exe 108 PID 1244 wrote to memory of 1768 1244 msedge.exe 108 PID 1244 wrote to memory of 1768 1244 msedge.exe 108 PID 1244 wrote to memory of 3952 1244 msedge.exe 109 PID 1244 wrote to memory of 4812 1244 msedge.exe 110 PID 1244 wrote to memory of 2016 1244 msedge.exe 111 PID 1244 wrote to memory of 664 1244 msedge.exe 112 PID 1244 wrote to memory of 408 1244 msedge.exe 113 PID 1244 wrote to memory of 408 1244 msedge.exe 113 PID 1244 wrote to memory of 4796 1244 msedge.exe 117 PID 1244 wrote to memory of 4796 1244 msedge.exe 117 PID 1244 wrote to memory of 2164 1244 msedge.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa127dc188,0x7ffa127dc194,0x7ffa127dc1a03⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3340197574781697581,16914828449481016875,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5447569704471925897,627243167396094392,262144 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:23⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,14544205683726494122,8254261484303190818,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:133⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,17401858069123862125,15929243078312395821,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:13⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,8148939851221536274,1462054437683565697,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:13⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,7326209880684119952,5737301615195714381,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:13⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12932081611928397169,6338207510495801261,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:93⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4356,i,5783977802645049708,15478538587701750667,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:13⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4484,i,10233865854457985084,9934008377047366204,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:93⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,10564664414891922536,14829134121138710145,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:143⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,3881309263097018611,18148258856685219708,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:143⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4420,i,1457730006696446914,13185201246951854997,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:13⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,13599328313092269827,17044177337674430228,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:143⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,8975639948823821819,9420507758593243197,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:143⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15015231986210553300,5033774405692245423,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:143⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15015231986210553300,5033774405692245423,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:143⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,738127438318169163,11645384107630948447,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11124⤵PID:3424
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14557803876753347599,16883932339583153288,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:143⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,16925446768231070950,2545946734286397649,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:143⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,13721788710307216091,7431589992325959823,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:143⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,12035935898002801533,15641139521773216769,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:143⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,3704100432460397301,3501112782274474867,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:143⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,4537531960211512327,15653086867986068890,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:143⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6588,i,16080460443559310988,9643955198535348691,2097152 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:13⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,18424013616932862929,17888335797030892293,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:143⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,15555032249148254092,3403149562969178546,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:143⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,14787302000110121048,2049233561806610546,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:143⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,11450164628222783321,16677290491269665641,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:143⤵PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,8430529341744583129,2164836430787809498,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:143⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3268,i,1836723868037981652,2445426158386152496,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:143⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9719244059706737652,6446933994147262799,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:143⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,12325846957213440646,15898032433505049346,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:143⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,13662520298427575891,6669687036903313476,262144 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8590423077791524204,15988095917073708455,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:143⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,6738661970088371430,10432704870466513764,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:143⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,15343225594923701628,12725342817962201822,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:143⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,11154844311027720483,9199041053775482705,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:143⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,14032022119455760786,6062197144719874333,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:143⤵PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,13485613436086358937,3878901757005211203,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:143⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,2240611931819035286,3908907781516961845,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:143⤵PID:3836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4647317853167043169,13121258620105885921,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:143⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2908,i,17837470350703109796,7737995270902640946,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:143⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6986200694164890429,14065445845738385882,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:143⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,4720076269220946133,14833694432642415363,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:143⤵PID:5908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,14792059009463565526,15531194436489909250,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:143⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,8843286542597164592,9970299443387293775,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:143⤵PID:5492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6001741597199654360,9193362220315816298,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:143⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,1534802049296636536,3879081472554379639,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:143⤵PID:5960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,2734770493864816336,13837718083531216562,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:143⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,14023001583096522920,8612800066620039406,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:143⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,14948998340496292309,3739848655621974942,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:143⤵PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,13409156069297773083,12121659305874480705,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:143⤵PID:5668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1814904565058653296,16488551500332529973,524288 --field-trial-handle=2116,i,13873692725589778573,15893809037949033708,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:143⤵PID:4392
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1808
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:3716 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
PID:2480
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4900
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:1496
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4604
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
- MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
- SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
- SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
- TLSH T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
- Size 161B
- SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
- MD5 4b1a79b1996f03fb926a97912835c881
- SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
- SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
- TLSH T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
- Size 6KB
- SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
- MD5 5d4464dabc1289c3a010e14c05b92c57
- SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
- SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
- SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
- TLSH T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
- Size 509KB
- SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
- MD5 b1c140ef49f01eea089d3957da1a529f
- SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
- SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
- SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
- TLSH T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
- Size 22KB
- SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
- MD5 d01869348d5a783f61f90cbb27b82a78
- SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
- SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
- SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
- TLSH T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
- MD5 9391bc4c1d157f197ee937c50a0513b1
- SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
- SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
- TLSH T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
- MD5 5ed835b9bd8886391af7b9dc575ac02b
- SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
- SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
- TLSH T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 3bdb4024bf9ef8f066d5c9656fe3dae08e4665265eb6fc723753fac422a3786e
- MD5 fb6adb50dc9160ef60d5b69e67f96317
- SHA1 a821bdbaf18b3b75946adf19a414cfbfc9f6ddeb
- SHA512 af001a54413a8c13c36f3813579967552338e61184e38e97216a952c2f7234f6568920403d2c4c7708c91c074929c4e7354b1fb46155210e427972e6cc4acabd
- TLSH T100E0269815E8C62E9B44B58791FC730DA2C0361A92EEBE0F1708848970034D0A683598
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 352B
- SHA256 402afb1046932e9a197406f087078901ae1e58dc9abf514c89e9cbb7712cbdf0
- MD5 aac359a38b582719ed1ca4590fe5b2a8
- SHA1 974123623f539644e9ae729632b4af597668bcb4
- SHA512 906388ab350e6064ef646a099f226e267f308dbedbc758539e38e5817a5416467f573428fd05e93329ebe0c1494385d57195b6c8020a04c4be15bb8b77433c0f
- TLSH T138E0DF5BB2F7CEA58FA49A87A35C7216C1917007DA8EEF5F338B708C248008082970A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
- Size 158B
- SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
- MD5 886d3a2f30ae328537f8a8495b7ac587
- SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
- SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
- TLSH T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 766479e86fab829669c512ab622f79d0140822868d377d8d75b501271e63bb76
- MD5 d590d3f8c5f0915019cf61d4146a91cf
- SHA1 f511a4642618d91bda03f2af12dd671fa7ec9fc1
- SHA512 922262daa1e93dbade44a93b4887eaee29b8dd0d51185abb112de597ab23e94fc7b7f991dd27263d6dbce6fcbabfa108710d05d01708b97a09dea56cdd249e4a
- TLSH T17A71C61426DD43A2F3608D32B8E327957DB1B4BA09873F1641C4993A64BEFE68C9C4CD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b810.TMP
- Size 3KB
- SHA256 a7b49c8e43d60edb1ab6cb74f38dc3792b07045d1fc6866f453fb1e49d50aa80
- MD5 a8cf76fe505e30d19c9f900570e57389
- SHA1 04d5d5ac66832c09daa073fc990ef2e5347eadf1
- SHA512 f5470e9c4baf34f632cf7b2a79f6788d4c239116d2b2ee3213b610d0d14805377cd81b0ee5e9cda0248f07a89f75b0791c4a5346cc0e5301d9053ecad5d597ae
- TLSH T13071A11936CD47A2F3200E31B4E3279A7DB5B4B909873E1640C0963A61BDFE59CAC4CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 4cfdcd1591eb3a9b3dd12b6a256a2c43aabe7517802ce1d6f513d2df8d52dbbd
- MD5 bc484a45142825a30de14b2d2b407f99
- SHA1 6958fcd87c31299c2a52547226a77025879d1839
- SHA512 b9593ed16bc10ff78c613b8eb340b4586ffe60ebdda3be4e6198dfc4517a4a3addf638d39afeeb16e4ca57cee0217af74ce0fe9b48830c00f00dffe5eaead830
- TLSH T1CB618BF787B4856E8A0196F0AA18EE2FDF2D0615431C3C6989D4EE27D7E3472E00265F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- TLSH T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 3649536b9fb1c62410c83dc4f4eea5eaffd979249abbf9baba760f4b5915ab79
- MD5 ecee130a0857f47d99ff0c65d2533a71
- SHA1 e1e47a31efb94240cd887ab7da3196f080abd4cd
- SHA512 9cfbee15025f8fc66fc157782515ff100ce264dd5c44165129d89f77644c2b5de139ba58ecd2573e99b875d23118c1602a7d552c3e0059bb2caa5f5424e225ad
- TLSH T1A7719CF747B4856EDA0096F0AA18EE2FDF6C0115431C3C698AD0BE27D7E3472E00265B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 a0bf958efa471f2127de43beda93bc884f2396564ece2664c551335ccf9ca821
- MD5 8d3bb8933b6356df5ab2a16f965a7edc
- SHA1 afc927bba69651d412bfb0c60675d80c95809ae4
- SHA512 3685141211bf992abb89c2b43bf2ea0540370e5dd8e5d2cd40dd874c94b4ef924580a68f06c1db12183279dbc19446d70bd5ea3af165b88c37fadf2520969d99
- SSDEEP 192:sxZ6R8yM/jK1Ml8Mlk/fnsjOCnnyPU9IdpfR/W6+WNrL4/aZICHL0s4VHsIg4J:sxZ6utk/fnsJnf+Z/b4/FIc
- TLSH T17562F905AA3469778CDBD319F956BB63D6F90462D2910E449EFCC91C04E7BED620382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 b2bae400b753da037f7dd9976f1364b23b7c8b0ee547a17a8cb689179961fdc0
- MD5 148e59eb86e0bec4e14f195c6c7066fe
- SHA1 f5a441e968415527fd0c0aa7dd686b302d9f8024
- SHA512 2d2a6e44fa37a4ac5b116fe492b5db9571d2e761a87b07f850fc85b79ae97c35e3db849d62ca6d0a4dab60abee6c790ede03db8520ed92793019dbc3fb4414e6
- SSDEEP 192:sxZ6R8yM/jK1Ml8UQelk/fnsdmOCdnyPUhqdp5R/W6+WNrL4/aZICHL0sO8PsIg7:sxZ6uqQk/fnsdUdfhaf/b4/Fj7
- TLSH T13E62E905AA3469778CDBE219B946BB63D3F94462D1910E44AEFCCA1C04E7BED610382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 36KB
- SHA256 a054dd6f777af1a04ef116812ca7715c8383ae77516b8f830fe9bce8972fab27
- MD5 bf915a296be2b555eb7875bd1df757f8
- SHA1 73902f7fa668e2068e6ebef755884ae7095d651a
- SHA512 dc6eb730050d317428fe7182e54ca691086d7b845d5c5246ef8e734a99da63cd08cb8cedcbd4e689426e456dcfa4b8083bc8c2832994354ad5d0582f2100b84c
- SSDEEP 768:KF/Xh8dF2Kq7pLuLzwkWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EihjLl+:KF/Xh8dF2KCEzwkWRmwcQDwu1jaKEihw
- TLSH T119031B7B2C0CCB7F4F844E9CEC26BE9A6DE801CB5698895447FA884C03C67EB55161DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
- Size 1KB
- SHA256 eeae8c5154231089b8f074dd17d5aeaec3441b15a0d725ced82b2264b38c4a7a
- MD5 1245400cf4df20f8b457c760afeb57a6
- SHA1 ef0dbae88b2699eb4c10c143246d66b6bc686f5a
- SHA512 ddee241243d3632da996d3b1c56243afdc91b14590c1e55c80713c8f93fb80abe225534f4c332052507d19fed99bc7e7b59f855d499c7ee414a271d0508cb3de
- TLSH T1B041A84E8D90CA5FECA440B611B779E433B48DCC0B62B6530CBC1536AE6732E194F5AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe5ce96d.TMP
- Size 1KB
- SHA256 319f3f65827ec5b893559e8e8d566eabd6443a6d2315ca392568ff48bcd9d0e0
- MD5 22aabc3bc4cac818acc4a022e3508ef8
- SHA1 073fcad00049deef013a04bece38561163574529
- SHA512 04440cb13df4f86798fb90b9b853aebf8dde06fdaebdd02fc7ee7e9f835e8bfef1990a1e24f97942bdc1842a1598feeef9b966af5b3dc0eb55cb8daabc69e1ba
- TLSH T125418A5A4D948A1EF8C440770EE7B4B8333558404712B74364BC5135BD617FE2E5E1D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 3f8d44e587412e197ffeb4a0d082c6369540a5e14f512af3984dcd9a748efaa2
- MD5 a220bb4bbe28ddd273f962f77dbada31
- SHA1 192157ea4cdca0d27fa24b23cd3d42d612058617
- SHA512 c617601ee48c4d33ba21b2dad7413a475536f44559ca98313d0bbc095ee9c4f117f996f1fd05b414015ac6b77504af622048e0acbad3ff601ae102a6b613d257
- TLSH T14EE068FA3EA31868E8AF83C1203040E00041BCA88586EC4E301AE3CB10A13553409E20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 08d9271361c894b13f8733d7d02f4f95e98c4a84c2ee4abb7be90cc2c3b727b8
- MD5 dce85f0e53dd2a1c5c4af6f2edeff204
- SHA1 4cfc3e7a2ec0615f85b52bee8b2b246ff6dc8a56
- SHA512 21edaf03029fdfbdab53f3a9a2ec1e01b756d62af197dae589fffab70b1b8eaf13c9adea383c5ebc4c8b45ba0ff3f79abdfcb4b251acf26800731667eff88ff8
- SSDEEP 96:KU+AKTyGyMYKxGqQgKBWulTMF57JlDMVGyqxDKyaq3DOjLF:ezDi/r1
- TLSH T128B164123ABA02412C7F2E1D92A6A7176641B0B37114AD3F77BD10764EA6F115CFC5CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
- Size 82KB
- SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
- MD5 aeb538c29f46cf0e19827ce47594488b
- SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
- SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
- SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
- TLSH T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.20\data.txt
- Size 150KB
- SHA256 6cae7622dc0a64a464ea43e7041ebf2a76a958277ffebdef86da57eae46cd496
- MD5 0551123bf21c85e69ca030c3ecc90288
- SHA1 b6ab84fc32deb3f0f7587fad2b50c8d60c41d83a
- SHA512 f833e356e659b5e1863b2e46189c2a8b706574ec9a69985345f1d16e58fdc5edb848b4e508dbe568b8de543df73246c1dd7da811b05541e1c264829ef1ce0ea3
- SSDEEP 3072:2PPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYERRf4jniQ43SFNyuj:2HX1aI5aZoKzMJ07NR2iXS37j
- TLSH T1E8E3F224CEC85FE8CEB8191C60FD0F0963E1869E493BB5C9E7A3BD0A6FE35040617589
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\428ef76f-35ed-42c7-81a6-c23741a9dd9a.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592a23.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
- Size 9KB
- SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
- MD5 30719122f9edf4e23019a3b74e4f4325
- SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
- SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
- SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
- TLSH T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 30KB
- SHA256 009d9c75bbf619ae0fc2722ca85b685c5099d79f3b2528e6abcb649d81968c2a
- MD5 6666b7bab020b262874abb9bde860f9d
- SHA1 31614c31d6051ea57d9639a6a9436c1eb19dad7b
- SHA512 0a5b70d28ae74fea8fb3e4048a39a27b914b998dc918f8399745bffd5b3f1d968895c33975251ebd1149f8106501cc088b56bd56e59552c45f93da240af6649e
- SSDEEP 384:nj9iFcZcIv8N38TUNTUlIl9nJKXipxV4hlDf4z/E5nItB6ySllYJTfY81FSn2TBS:j0FKv2wgx4Qz/ENg6ZuTHsYBur
- TLSH T1C1E2C5F198D39976D8AE5383A73E7E468EBCC063B5884984BBD95D0DCC861BFC706811
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 2eace612d49d61887872d33ad8a46cb04e06f26f62f53f9bb981716d139ca55c
- MD5 214a1ed98bcdb15ef66fbc86dbe71a38
- SHA1 2f5d5e044d510b67016dcfb5e263ccc5a32c589a
- SHA512 33229bb953949dd436dd6f82135ecf486fb7e39534a10274cc36f682d482e6a4462e012a846400b373326373efcc6ae0e4f958ca2b23bf12aef60ac077e0a126
- SSDEEP 192:1GN26t6H3BQmiUypHBHy2Qq/rUH5m4hJGD9MNDU6:1GN26MXfqk2Qq/E5nJ1U6
- TLSH T1F402D83478A8AC7B8DA39E45B48777139F95117FABD55F88D9E81B1C01DB68C1306832
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 c3a0070cae5348477489e861a35dfe5115e335517a650048e39ee31898b73ce1
- MD5 248b64bf3955c9c1144957f32bf0d947
- SHA1 1fc3c3a8ee3ea34d44760fad22cf12a7751c0338
- SHA512 1f310957bf911fc32f4fe989262e3e6e1de3c6d47ef04016468c43bfb1d0a259bc686fc77f5adbfe0ec740c5120ed687dc24d656271b0fed09b06c688fe66d93
- SSDEEP 384:nJZcIa8NtGnJKXi8Vuhr/E5nItE6ySllYJTfY81FSn2TBur:BamuJ/ENX6ZuTHsYBur
- TLSH T144928E701864ACB798ABE105F44B7B138FB890BBC7D54F84D9ED5B1E01CB698171A823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 31KB
- SHA256 16c0e59053583e31344f66ce2c3a4eb3357a0bd3e074e1f438114842052e0fd1
- MD5 9626e3cb36ab13ce87fbbeec1411668c
- SHA1 6f61a98d23f36defea8473a7ec1f6af33ef7cd3e
- SHA512 888820613b485951fa1bfc7b2dc5811bda4f562a77157665eda898fe8f681eebb4ef87bc0f9c666b1cfb17d0d92a82bdaac18f26363de91c9e8b2eafd3322d0c
- SSDEEP 384:nj9iFMZcIi8NR8TUNTUlIR9eJKXi4xVqhlefoXz/E5nItS6ySllYJTfY81FSn2Tg:j0Faigwgtqzz/ENp6ZuTHsYBur
- TLSH T1A7E2C4F198D79977E89E4787A73E6E428EBCC063B5884984B7D91D0CCC861BFC706816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 1cddc6fdb1f70596303f84d0ad27b5f970b275f8cd30dbabd5908aad4b96543f
- MD5 78a900ab16587bd7bdad0c50cb5dd9d5
- SHA1 f987b87e7260270e49f8478b498f4719123805da
- SHA512 52437e83fbcabcd89226dce5b542864deb478148eb0a0e41cc97941a3ce30c3cc57175185814b0ad56cc969d2b8eff970c538edd76bbf2f80dd7800a183ccae8
- SSDEEP 192:8GNo6t6H3/QmiUygO0y2Tq/rUH5m4hJgtRe/9nEqY3U6:8GNo6MXBBO2Tq/E5nIt46U6
- TLSH T1B3121A7478A8EC6B4C93A501F48777939E9421BBDE854F44E9E81B2C05DB6CC2B0B923
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 1597235f455ab903fad0e4bdbb66fb5db4b502912fb7eb4fc3a53fe91692cb95
- MD5 7de739e1cd16ac29c1a2319bd91698ac
- SHA1 00f9aa7e38ed117b57e759e3ab9e349178d19770
- SHA512 f992a7cf88755d90055d1a0623f51e2d7e5549aa60c55a5dd3917b9a4cf5a55f5f5ea20994fe56cf3d04020baa96d1da88011841af710a12f5119e11841e107a
- SSDEEP 384:nkZcIa8Nt9nJKXipxVuhr/E5nItE6ySllYJTfY81FSn2TBur:CaguJ/ENX6ZuTHsYBur
- TLSH T19E928D701864ACB798ABE105F44B7B138FB8A0BBC7D54E84D9ED5B1E01CA6981717823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
- Size 233KB
- SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
- MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
- SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
- SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
- SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
- TLSH T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
- Size 16KB
- SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
- MD5 ca6e253c3fc7718b4455493460053be3
- SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
- SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
- SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
- TLSH T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
- Size 10KB
- SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
- MD5 8061c7027f406f3e20ea5d26969f00bd
- SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
- SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
- SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
- TLSH T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
- Size 163KB
- SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
- MD5 bd6846ffa7f4cf897b5323e4a5dcd551
- SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
- SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
- SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
- TLSH T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
- Size 3KB
- SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
- MD5 17c10dbe88d84b9309e6d151923ce116
- SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
- SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
- TLSH T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
- Size 19KB
- SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
- MD5 897eefe311c18078a34e06f3cf624a6a
- SHA1 98246e769fb513b8aead588024d1ceadc65422d9
- SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
- SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
- TLSH T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
- Size 3KB
- SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
- MD5 b55f84fa839160086b8b337b59f80ded
- SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
- SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
- TLSH T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
- Size 689B
- SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
- MD5 108de320dc5348d3b6af1f06a4374407
- SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
- SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
- TLSH T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
- Size 4KB
- SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
- MD5 0e3ce75aaf5e674dcd7508251bb839c5
- SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
- SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
- SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
- TLSH T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
- Size 552B
- SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
- MD5 39461c6ea4ff09d663a65d133eb47c98
- SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
- SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
- TLSH T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
- Size 68KB
- SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
- MD5 478a605d5578236f2d1ddc93c2f22456
- SHA1 917f05453d497b3e3de684a905e141972c34a267
- SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
- SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
- TLSH T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
- Size 1KB
- SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
- MD5 f665b35df3c2a7b4efd9dc396f2af9bf
- SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
- SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
- TLSH T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
- Size 34KB
- SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
- MD5 d32239bcb673463ab874e80d47fae504
- SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
- SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
- SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
- TLSH T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
- Size 754B
- SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
- MD5 1d06d58fe9131c14ba5ba5ff740b020f
- SHA1 e6ed812e23e201b20170e928686a5d612165df85
- SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
- TLSH T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
- Size 36B
- SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
- MD5 0163de1b14421d4eee3757ff76fd81e4
- SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
- SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
- Size 105B
- SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
- MD5 57d5a3548911886de2f3bd3172e808ed
- SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
- SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
- TLSH T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
- Size 21KB
- SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
- MD5 452f3e9d40539cd65cafbd008308b5b8
- SHA1 34203b4a803009ff56bb28d3a14305348082990f
- SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
- SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
- TLSH T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
- Size 3KB
- SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
- MD5 c4c782264f4a6a6ba84801c8c148afdd
- SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
- SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
- TLSH T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
- Size 5KB
- SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
- MD5 7c5f5e42e885211f783a06b1317ba145
- SHA1 079ab890b012120b89f776e4bfe67f3789f67096
- SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
- SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
- TLSH T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
- Size 32B
- SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
- MD5 4ec1eda0e8a06238ff5bf88569964d59
- SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
- SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
- Size 128KB
- SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
- MD5 87b4b75312dedc7106ac746153153c1a
- SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
- SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
- SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
- TLSH T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
- Size 2KB
- SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
- MD5 427724f72baa3d5c91671853a89245e5
- SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
- SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
- TLSH T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
- Size 66B
- SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
- MD5 5b7baf861a48c045d997992424b5877b
- SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
- SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
- TLSH T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
- Size 3KB
- SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
- MD5 af4c6f2598c45087a32c4f410f242553
- SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
- SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
- TLSH T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
- Size 1KB
- SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
- MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
- SHA1 d454811443284aeaa0294d30caf65e624182b150
- SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
- TLSH T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
- Size 8KB
- SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
- MD5 ee666d1b2290efa6cdbc89ea3d317333
- SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
- SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
- SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
- TLSH T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.8.16.1\typosquatting_list.pb
- Size 754KB
- SHA256 21805688e41b37896d29dff1a834fd9582767efeca533e6e5d49b3df76feea01
- MD5 1d5e28a893b538e4b7d15371170cbad7
- SHA1 4697ec752c83cf0b1907b13aabba3a8a059cda2d
- SHA512 d47a97ed958367c08444c393803ae88421733c65dae7bb040b4bf5414e9e29c1f9eeb4d320f45e85923d33638408eab4a3ff8f34f98b1efeabf936f08b8e8112
- SSDEEP 6144:16UldcK+MWNwkZj+6o7j8jPIHptD+/ffTeonNH43+IaVm8+GLlJoJ8:EEdcK+MWNw0oIIvXo6q7LlJoJ8
- TLSH T1C1F4B5B9DFC00154DB78112D20BE71D8181412A580EADFEAFE7C855F2BC6AC977E85E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
- Size 2KB
- SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
- MD5 499d9e568b96e759959dc69635470211
- SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
- SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
- TLSH T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
- MD5 880fe67d2d8def8a73d1f09d09f8f2ff
- SHA1 adad7fdd0652919461f89bfe36b449081489052b
- SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
- TLSH T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 372B
- SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
- MD5 80c2dfaf9affc09798a4976ae70f1b0b
- SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
- SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
- TLSH T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 492B
- SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
- MD5 c1bec3bc77db46888e279f8b3eeb18fc
- SHA1 c2d14f387c796193ddc6378267768745c10dae14
- SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
- TLSH T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 612B
- SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
- MD5 5ca920f0e1c81dfb329b916e242a4065
- SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
- SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
- TLSH T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
- MD5 5791c60bac582e1f169aefd7494e8b65
- SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
- SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
- TLSH T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
- MD5 bc900814bda342e30ca622ecf6edf1a1
- SHA1 58549077a989da91156012baf9dbfc98ecfe429d
- SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
- TLSH T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 732B
- SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
- MD5 87299a8105078d6252386ba9d333ff05
- SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
- SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
- TLSH T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
- MD5 c854428d46d0bd8106d3a4b26b2c17af
- SHA1 3414466742a52757c163c28cc508953129b9067d
- SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
- TLSH T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 7cffb53aa771e330cf6f2977045f4c8ed1482ca623c76ed54436c17c2fb3bc34
- MD5 ee65d1478524f0ac6ac8e7a8633e1f28
- SHA1 db2a1937caa4e9bc70d10bb859b484d651b81b83
- SHA512 93985d792fc252309e3ef2a80dce6d338aec723461976ac2981393e36be3ec0d737a217f3001e99a8d119bd9ce4f8bcd72a9ea424f5554c2ea0be0c7bae636c2
- TLSH T15A3110E0587D1AD1D0BE0DAFB04729FC44D89212F8A434386899E9689A7E51E255087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 852B
- SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
- MD5 1a8162cc03c34509f59ea81728419884
- SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
- SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
- TLSH T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
- MD5 13fbadbf74e4028d922652c3b1fb7281
- SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
- SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
- TLSH T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 290c47f16a77a8c56d1890de9be5d50c9f5e730f9ee6a4d249f490ed2c0a63fc
- MD5 5db66ce3aa3c6ec4970dd243fb876bf1
- SHA1 d43a86481b0ade68457623f1ffa0509d3d294a83
- SHA512 996f82a16b0cdea315cf0b77214319c7236f9937f30c8c2d50c0389fe14667674546146415de540f92310f5850fa8a84f29723b5ce5cd630aceab14948611a5b
- TLSH T1AA3123E0587D1AD1D4BD0DAFB08735FC94D89211F8A434796898ED685A7E51D354083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 6531717fb8828c3907681f9478370384c0c10cc24afa904b56e9112c63c994cf
- MD5 bdc21d0913e43146bd3fc5be5536e175
- SHA1 dd7434e03cc6a3d201cf22d3db6686d240f4ceba
- SHA512 61551f4323a370886e4faf7c25b2e704a51cf2e76f27a6cd110700693f9a548dfd9e1014875219721454bfc2b94737d010d5c7c2fe7f74d542937489e428bc81
- TLSH T1F54142E0483D2AD1D4BD0DBFB08B35FC94D89222F4A434792898ED68967E51D254083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 972B
- SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
- MD5 54b0cf5610d4cbeadf10f35941bea007
- SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
- SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
- TLSH T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 bf9b8a1f94e78a1e1e288259c486c44340d1c530295a921a9c9158aa3b66e732
- MD5 d4c1adfe85041464ea849af4afff2b0a
- SHA1 07ccb9d908f77a5bb91a81886685f142efd9978c
- SHA512 f8835ab1394c9064f6e0a08f60541bd80800b79bd230eab2d32eafa4ce4e9eb416c2df5bda81320b837130fcffe9e0b01950060b8bf6bb75f377bb88dcd00767
- TLSH T17A414FE0487D2AC1D4BD0DBFB09B35FC94DC9222F4A4347928A8ED68967E51D358083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
- MD5 95ac3c4f8946991b2f4b965a390aa896
- SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
- SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
- TLSH T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8ec5b9e5-92c7-42af-9745-5dc37238f56a.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 95f6c6a882577056a8b4cc601a13fb643ad17c256b057ef2a42e6f8f7796bc50
- MD5 e00d43cc05d84443e5b277492ad8881b
- SHA1 8753de877697a99a7eb2d3f49609b7225e86fd43
- SHA512 80e9175d19c518d739d055be7c3163c37c42f15edb96d3217809f7f8740f672d7d4280754d34af37d5d664cd97439d184601452a206567feb72d9d45b4001689
- SSDEEP 96:+SWlZL12xtD86vQ2DY2lZQe+LtGorm0hwAk3WljF+pklLFdQTEka6:T0Rz67JlZYJrm0hwd3Wp0aLFd96
- TLSH T1E0D2EB26F844EA22DD492C72DFEBE9EC62327E25CE5A131739C5B73F49B71C00915544
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2c7a6e11-8dec-48e4-b92b-91805faa7106.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\50cc226e-cd1d-4d8c-8730-3dc877cc009d.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1244_547126122\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1244_941483832\d862a818-b343-4595-a990-4c4aef27ad68.tmp
- Size 154KB
- SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
- MD5 a922bd2071b7aa9f2154c991d41885c7
- SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
- SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
- SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
- TLSH T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.11-win-x64.exe:Zone.Identifier
- Size 187B
- SHA256 e504422e0eae31e804cfa280755779a314cc77dc8d07889d20597a8ed605715d
- MD5 43a0800685db5310994dfa2108e77add
- SHA1 4f980c48dd39e0f9f06a01eeb4e442601fff781e
- SHA512 3edf5ac36ee17fe8b815ed730d9545739686f752511fcfdd5b0b1ce9f4118b0478127c409122e59d8bc1841a7e1b29d663729c50df3a921827d6467232db0402
- TLSH T103C0127BC80484520E3023825B7FD5A8EA4F1E435E81C38C8CC48492E9B39D7C152899
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\LICENSE
- Size 1KB
- SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
- MD5 ee002cb9e51bb8dfa89640a406a1090a
- SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
- SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
- TLSH T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1027233834\manifest.json
- Size 78B
- SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
- MD5 259f068207f60fb9d4448c02c27b74ba
- SHA1 99131d95cce94750a928738a99caa5c710bbc924
- SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
- TLSH T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1048142461\manifest.json
- Size 160B
- SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
- MD5 c3911ceb35539db42e5654bdd60ac956
- SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
- SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
- TLSH T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1060833657\manifest.json
- Size 102B
- SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
- MD5 19322c8a94f1ac01a70f8c58cdbbc720
- SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
- SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
- TLSH T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1174665302\manifest.json
- Size 85B
- SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
- MD5 8ce95626b39ebc2401eee0b34c24fc7c
- SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
- SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
- TLSH T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1225618255\manifest.json
- Size 53B
- SHA256 584e92e2b45fa9a2675d6b662059f0153a9ce5a771607ea4d7e87cd5be9e0dac
- MD5 126409b338902b6cdf2befcb054286b4
- SHA1 7a4734851407a64a0f493e0411fcc7567fb56a62
- SHA512 faf1148b96096266618914670b402143edeb79641951c22d1112abc4678ff4793748b225661ee59e163970281265eb4c4ecc5d182d5f2c0ba55b02b0e5c76ee6
- TLSH T1BA9002700414921716C10E506570B881A391661955854D1E04551558029586CE050298
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1362510212\manifest.json
- Size 165B
- SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
- MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
- SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
- SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
- TLSH T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1477856026\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\Sigma\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1500567601\manifest.json
- Size 132B
- SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
- MD5 c9209ab189a035569ba3c65d7375d220
- SHA1 1987aaec8f436325415fe36c168c9a37829523f9
- SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
- TLSH T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_1813879951\manifest.json
- Size 238B
- SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
- MD5 15b69964f6f79654cbf54953aad0513f
- SHA1 013fb9737790b034195cdeddaa620049484c53a7
- SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
- TLSH T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_184571539\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_2121084543\manifest.json
- Size 177B
- SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
- MD5 2714a51ed8c2a891ad73b7488ab655b9
- SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
- SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
- TLSH T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_398604954\manifest.json
- Size 118B
- SHA256 3d30c78fe8e6c039f72e1f32de3c07444644fa7b2f7e141d558f16db82289b50
- MD5 1ccbe3fd358e86d7cfb1570166a15973
- SHA1 ab86c0b94ee1ddd4f8956545e7d166d3319086b0
- SHA512 6e23ccb8d40335b3ef48527f53d8fdb0abcb9ad370121214b0727439ecd1e2f5dfd4a742d24dd518652cd0076aa255c7686cd257859aadf0b78e54b1ddb3488f
- TLSH T129B092B00C0AA03B22C49320ECA06A82D3F80218F8421B1A088036881F8917880362B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_508550439\manifest.json
- Size 72B
- SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
- MD5 a30b19bb414d78fff00fc7855d6ed5fd
- SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
- SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
- TLSH T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_554743719\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_854475934\manifest.json
- Size 119B
- SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
- MD5 7382260298fc06c135b7c7399e9acff9
- SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
- SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
- TLSH T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_918479573\manifest.json
- Size 135B
- SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
- MD5 4055ba4ebd5546fb6306d6a3151a236a
- SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
- SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
- TLSH T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1244_920116205\manifest.json
- Size 165B
- SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
- MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
- SHA1 180f08a503c8145e50e715a1dbe202b491de0011
- SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
- TLSH T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
- MD5 SHA1 SHA512 TLSH