hxxp://exMPLE[.]COM

Analysis

user interaction
yes
max time kernel
658s
max time network
653s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://exMPLE.COM
Sample260824-la896avfpg

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Badlisted process makes network request 17 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
124	2672	powershell.exe
125	2672	powershell.exe
132	2672	powershell.exe
133	2672	powershell.exe
134	2672	powershell.exe
135	2672	powershell.exe
136	2672	powershell.exe
137	2672	powershell.exe
138	2672	powershell.exe
139	2672	powershell.exe
140	2672	powershell.exe
141	2672	powershell.exe
141	2672	powershell.exe
143	2672	powershell.exe
144	2672	powershell.exe
145	2672	powershell.exe
146	2672	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	mmc.exe
File opened for modification	C:\Windows\system32\gpedit.msc	mmc.exe
File opened for modification	C:\Windows\System32\GroupPolicy	mmc.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	mmc.exe
File created	C:\Windows\System32\GroupPolicy\Machine\comment.cmtx	mmc.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	mmc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\TryMultiplePivotTables.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\HighlightDuplicates.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ReadAllSheets\ReadAllSheets.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\New-ConditionalText.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\XlRangeToImage\XlRangeToImage.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Testimonials\t1.png	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\changelog.md	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\GetConditionalFormatting.xlsx	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\Highlight-ThisWeek.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\Top10-DataBar-TwoColorScale.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ExcelDataValidation\MutipleValidations.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\InvokeExcelQuery\testOleDb.xlsx	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\TestRestAPI\TestAPIReadXls.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Read-Clipboard.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Export-StocksToExcel.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\AddImage\AddImage.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\AddWorkSheet\AddWorkSheet.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\CommunityContributions\MultipleWorksheets.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\Highlight-LastMonth.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\JoinWorksheet\NorthSales.csv	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ReadAllSheets\GenerateXlsx.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Charting\dochart.md	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\New-PSItem.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConvertFrom\testSQLGen.xlsx	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\CustomReporting\CustomReport.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ImportByColumns\import-by-columns.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\InferData\test-date.md	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Add-ExcelTable.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\HyperLinks\Hyperlinks.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\HyperLinks\Races.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\MortgageCalculator\MortgageCalculator.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\InferData\InferData.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\New-PSItem.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\Charts\Multiplecharts.png	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\ContainsBlanks.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\FormatResults\GetAsYaml.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\InvokeExcelQuery\Examples.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Plot.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\OutTabulator\tryConvertFromExcel.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\SpreadsheetCells\ExcelFormulasUsingAddMember.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\TestRestAPI\testlist.xlsx	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Add-ExcelDataValidationRule.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\Highlight-Today.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\MonthlyTemperatuesDatabar.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\CustomNumbers\ShortenNumbers.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\SpreadsheetCells\CalculatedFields.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\en\Strings.psd1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ImportHtml\StarTrek.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\VBA\ChangePivotTablesVBA.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Set-ExcelRow.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\GetExcelTable.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\JoinWorksheet\Join-Worksheet.sample.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\Grouping\GroupDateRow.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\InferData\test-string.md	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Export-Excel.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\MergeWorkSheet\Merge_2_Servers_Services.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Import-Html.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Merge-MultipleSheets.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\New-PivotTableDefinition.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Public\Read-OleDbData.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\GetConditionalFormatting.ps1	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ConditionalFormatting\test.xlsx	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\Examples\ExcelBuiltIns\VLookUp.png	powershell.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ImportExcel\7.8.10\SUMMARY.md	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\logs\StorGroupPolicy.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6044	powershell.exe
6740	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5728	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320368780595479"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	notepad.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{A79735CE-ADDB-4D69-8D3B-42513BE5670F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{F72D3208-68D6-4DCA-8BAA-E438C63ADA1D}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f0005398e082303024b98265d99428e115f0000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2540	notepad.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4644	msedge.exe
4644	msedge.exe
6044	powershell.exe
6044	powershell.exe
6044	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
6740	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3992	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe
Token: 33	3992	mmc.exe
Token: SeIncBasePriorityPrivilege	3992	mmc.exe
Token: 33	3992	mmc.exe
Token: SeIncBasePriorityPrivilege	3992	mmc.exe
Token: SeDebugPrivilege	6740	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
468	notepad.exe
468	notepad.exe
3992	mmc.exe
3992	mmc.exe
3992	mmc.exe
3992	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5468	4864	msedge.exe	89
PID 4864 wrote to memory of 5728	4864	msedge.exe	90
PID 4864 wrote to memory of 3088	4864	msedge.exe	91
PID 4864 wrote to memory of 3088	4864	msedge.exe	91
PID 4864 wrote to memory of 3088	4864	msedge.exe	91
PID 4864 wrote to memory of 4704	4864	msedge.exe	92
PID 4864 wrote to memory of 4704	4864	msedge.exe	92
PID 4864 wrote to memory of 3876	4864	msedge.exe	94
PID 4864 wrote to memory of 3876	4864	msedge.exe	94
PID 4864 wrote to memory of 3876	4864	msedge.exe	94
PID 4864 wrote to memory of 2604	4864	msedge.exe	95
PID 4864 wrote to memory of 2604	4864	msedge.exe	95
PID 4864 wrote to memory of 2604	4864	msedge.exe	95
PID 4864 wrote to memory of 1420	4864	msedge.exe	96
PID 4864 wrote to memory of 1420	4864	msedge.exe	96
PID 4864 wrote to memory of 1420	4864	msedge.exe	96
PID 4864 wrote to memory of 1296	4864	msedge.exe	97
PID 4864 wrote to memory of 1296	4864	msedge.exe	97
PID 4864 wrote to memory of 1296	4864	msedge.exe	97
PID 4864 wrote to memory of 2632	4864	msedge.exe	99
PID 4864 wrote to memory of 2632	4864	msedge.exe	99
PID 4864 wrote to memory of 3908	4864	msedge.exe	100
PID 4864 wrote to memory of 3908	4864	msedge.exe	100
PID 4864 wrote to memory of 5664	4864	msedge.exe	102
PID 4864 wrote to memory of 4216	4864	msedge.exe	105
PID 4864 wrote to memory of 4216	4864	msedge.exe	105
PID 4864 wrote to memory of 784	4864	msedge.exe	106
PID 4864 wrote to memory of 784	4864	msedge.exe	106
PID 4864 wrote to memory of 784	4864	msedge.exe	106
PID 4864 wrote to memory of 544	4864	msedge.exe	107
PID 4864 wrote to memory of 544	4864	msedge.exe	107
PID 4864 wrote to memory of 544	4864	msedge.exe	107
PID 4864 wrote to memory of 1412	4864	msedge.exe	108
PID 4864 wrote to memory of 1412	4864	msedge.exe	108
PID 4864 wrote to memory of 1412	4864	msedge.exe	108
PID 4864 wrote to memory of 5596	4864	msedge.exe	109
PID 4864 wrote to memory of 5596	4864	msedge.exe	109
PID 4864 wrote to memory of 5596	4864	msedge.exe	109
PID 4864 wrote to memory of 3360	4864	msedge.exe	111
PID 4864 wrote to memory of 2592	4864	msedge.exe	112
PID 4864 wrote to memory of 2804	4864	msedge.exe	113
PID 2672 wrote to memory of 3460	2672	powershell.exe	116
PID 4864 wrote to memory of 1456	4864	msedge.exe	117
PID 4864 wrote to memory of 1456	4864	msedge.exe	117
PID 3460 wrote to memory of 4988	3460	csc.exe	118
PID 4864 wrote to memory of 4644	4864	msedge.exe	120
PID 4864 wrote to memory of 4356	4864	msedge.exe	121
PID 4864 wrote to memory of 4356	4864	msedge.exe	121
PID 4864 wrote to memory of 4128	4864	msedge.exe	122
PID 4864 wrote to memory of 4128	4864	msedge.exe	122
PID 4864 wrote to memory of 4696	4864	msedge.exe	123
PID 4864 wrote to memory of 4696	4864	msedge.exe	123
PID 4864 wrote to memory of 5620	4864	msedge.exe	124
PID 4864 wrote to memory of 5620	4864	msedge.exe	124
PID 4864 wrote to memory of 2836	4864	msedge.exe	125
PID 4864 wrote to memory of 2836	4864	msedge.exe	125
PID 4864 wrote to memory of 3196	4864	msedge.exe	127
PID 4864 wrote to memory of 3196	4864	msedge.exe	127
PID 4864 wrote to memory of 3196	4864	msedge.exe	127
PID 4864 wrote to memory of 784	4864	msedge.exe	128
PID 4864 wrote to memory of 784	4864	msedge.exe	128
PID 4864 wrote to memory of 784	4864	msedge.exe	128
PID 4864 wrote to memory of 1724	4864	msedge.exe	129
PID 4864 wrote to memory of 1724	4864	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://exMPLE.COM
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffad452c188,0x7ffad452c194,0x7ffad452c1a0
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17743706425716839646,4669595448983308590,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,1345155196159286042,16103448514694063884,262144 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,3640592509059022982,2504908880099472634,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,4328108972319243411,13683396602547978440,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,12587930055440795279,3030565766351495670,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,10143073925438416383,10243744026406406559,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,102054370358659379,2876714065084265394,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3722631645085250331,13647917107385657870,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,18413610725761724281,4900029769263397150,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8056784486825653188,2447973754742960877,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8056784486825653188,2447973754742960877,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15143458133197003428,4134758971624941810,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6744,i,17513003379654688990,16473309540663523892,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6944,i,6345932540117820877,15670638290567019794,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3832,i,10931399801459077522,4475747727886561412,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6676,i,9358991711963150775,16555861257600286194,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,3755963530577519819,16782775499359880107,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,13663826190867024910,15058636082540746336,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,9780118553467966571,10775502352954501024,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,944004571575055743,14441959505629210857,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5384,i,15834105979101704826,6405414396831997462,262144 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,6070728487622086919,5339560014465116930,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7775812179079249703,7401189991443420719,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=1552 /prefetch:14
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15588019304706098103,7135044884911042493,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1552,i,7566576507959346086,1129883431622522784,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,10299617965905712220,2732196174648128109,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3452,i,837862969703158216,10603965562920376110,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6216,i,2558560130633318271,11398625259591370944,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7476,i,5120030187607787386,13401867445658079576,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7984,i,13501537906737397597,4576272010754028412,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6220,i,2151960836710171765,9036645563671228744,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7996,i,12594187006310533516,16311372118512530444,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,13975961035042582906,4285954450501596950,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,9558442581484552726,9128272267213490030,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:12
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=2612,i,1527567200380378474,15059779494360161197,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6676,i,12963022649425053702,12705594773969337985,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:6992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8324,i,1986919059839874762,7698871052196002150,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:1
  2⤵
  PID:6228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8168,i,16648413740710115520,11609838141760897786,2097152 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8632,i,11725479671819284665,2954337031835416098,524288 --field-trial-handle=2372,i,6049177900415001095,7369965287795401027,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:14
  2⤵
  PID:6672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gb4myvu\2gb4myvu.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF061.tmp" "c:\Users\Admin\AppData\Local\Temp\2gb4myvu\CSC15B791278E964D44A4994FCD9968FD0.TMP"
    3⤵
    PID:4988

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1660

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Downloads\tets.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:2540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Users\Admin\Downloads\tets.ps1 "
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6044

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\gpedit.msc
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
- Drops file in Windows directory
PID:6508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Users\Admin\Downloads\tets.ps1 "
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6740

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4412

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.PackageManagement.NuGetProvider.dll

Path C:\Program Files (x86)\PackageManagement\ProviderAssemblies\nuget\2.8.5.208\Microsoft.PackageManagement.NuGetProvider.dll
Size 170KB
SHA256 de2ebfe08d13ab88efc596dcc2aa39982ebc61366a6a222789fadf8f902efc4a
MD5 628da2d060916bba4e8623eb3e53cdc8
SHA1 2f7bf1d2a9bf85ec1a7bb7eaa5f24e3c281d96d5
SHA512 2d4db1b3cc0a91f000ed6e8e8231b3824297cb5f34ee551b8208561e079031f9a63bf37da62f105f324ba4ee2530cc152aed4e01ee1aabfa66d7be09220d838b
SSDEEP 3072:CNAQHZ+Scp5yD3NG99urukd6D3Gy6gdkZkFpT7BKaEm:S53Ui+Gyb6GV
TLSH
T1CD045B76A3F8565AD6FF4FB8F47450804FF8FA076800DB8E5C25A0DD1A237829632667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f98f58ad3402775d4070b1a35dd090e2be85feefa9e4be13697ce8c2f23eb5e2
MD5 25bcdc0006590027bbfe325e50ab471e
SHA1 9a2aa6fda58f464e72c4fc513371d51c208a3e4d
SHA512 3e9930e547cbac36573a4a13b20c18e1e3b65b7ebd8ed73f21b8e514270fc15d35a1bb19dacdc13a7e7d5daa97c6cf1a8912a4cd49654e993b7d94aff59653a6
TLSH
T16BE07DC406D8D2BEBA3068C7517D930CC391360FD6C8A9CA1700CDCDB246C44B6C6AF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 faf27c6b970ca37ff13c66185747c950052cee5a86f4cc0a9b15f75521229eab
MD5 4e5ddd8b3771db614cad154b49b747b5
SHA1 b6b9261abfa7e57ba1b172fa46d3bc780eec9c0a
SHA512 f9c8f81d355b9909997b4944c9d80c8d77384b60eff3acad6adc10b3f8259b7e749616f13e72bd997d02e806e98e9f381f6d5f74dd7b40be406672022bef6075
TLSH
T13CE020EC08CCC23F96006587516C974DC1903B0E92CCA9C51704C648B181040B2969E4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 66KB
SHA256 77df21477abc909a61db33e0f54965cdb1588e475d46dee935168b4721f73152
MD5 6c69688b96be5181ec89806cfa8d2b4d
SHA1 3644a8787779e8923fea45158afd682122665301
SHA512 d69d561629563334e5349e8fc844ee492c0e4eb67fed5de624282497c26efa0156d75547e7e47e3aeb7a8cb66a912f641a04b12e8f77e3466ed615bd7cbd36bf
SSDEEP 1536:DgUqrxl8iiX9x05j5QZPF+HX7wuxcDH+DphcgQBH54tA:DYxZRjCZtm7wux5pGkA
TLSH
T1446302B0BD7247F8E2920C4997B1858633681B755ED8B963F4704DDC660DC16BEEB350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 61KB
SHA256 300ab06fa3ab93bf62406e4c6f56950cbfe38716910a90e8d68a05daad52c6e2
MD5 7088bba2c986ecea3ad754d835666d1c
SHA1 065b000a0f370c39295cd8d064d7fa5a495933f1
SHA512 29ecda82668f039ae1306caff44fab2442a0e965a8b962998e72f4e96f2cac8d0eb6c74e63d436c6e34682e1ee9ea481b319057d182a1f7c2f0f38a4e7ac4c67
SSDEEP 1536:ec8R0HWk8YHa/32tRok58aKuTHYkmmRECDpaXtPp:1g/2tRjKuTxmoXDwtPp
TLSH
T1D2530270744C44AE843D07711BE11455AF9B602EFA03FCA94D7BB4BD94B5CA25BB60E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 39KB
SHA256 28bc2090a696abac3f58b64052819146d487884bf63dfaa5b15c95a948e2b6d6
MD5 730c2d34c1758691b03f81479c4f8d97
SHA1 1353462d20e4eb282f6f7ac40ecf91628b1ceaf7
SHA512 a07e73c6cce577aa5be5ed0a307c6ec118acea5969bb0971799ba062b31bf01f5d1fdc2fa6299b86d4a1a3f96482f374280c3daa57cbc8763038348e7cd23455
SSDEEP 768:Dxjx1Coy6lWaLRB1FDdSEbmIovkJPx6CnE8H8lgDUTo/yX+Jy43:Dxz87SHCPFvOXHYgCo/yXRM
TLSH
T10D03F12CECB27134442817E581EAEFD9560EC6A7FA452041ACDBE741E0999D2D78FCAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 27KB
SHA256 05f5d3caae4f896106e9e46f5378cd67170047d4610ac9e27b14d003e1e75690
MD5 ad125dc3b4ffa623300b8942f64b1017
SHA1 c12bdd73c74c56ed93c582f6d2bff286564325dc
SHA512 e4f4db6f3a4da9e7db573f1bea6464ab3c9a01ab9eb6876ca130703b6fc76aa20ca446472b8d2e88295b7eb9279f9228d0fe8f96265d5c6993a5cfbac1f3f31c
SSDEEP 768:NE0GYUyYc7KD75idYY2MlQmUD3Cf8N8X4vztFpY7i1:NCYjaP5sH28QPg8FHpYG
TLSH
T10EC2E1C1B424C590EF78B1BCC4E4C62279CE979187A59A8F3DC7511A966C9B050FF8CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 18KB
SHA256 613b03dad1e7c940404de301a8f42e17d67ea661bcd7e1dc21859580bdab146e
MD5 c5e441082f34a2e4870c84b23f100e03
SHA1 86a59d7a5e019f84d1e14dedbc4287465db1ec59
SHA512 2cb679bbb7650b4fdf421346e9f2e25d1f57e5b19a1a87670c660b6a8263065485182c5acd1e6f87e4b458e2941e7e3518652a598fd7e923491a4dd99fa25eb5
SSDEEP 384:Zd0A4IpSDqxeVxCySjPKjcmwysPAtJsF7+JaizPEdeGuCGo1wTzpakSwcRb:oVGxeVxojKkt7c+ey1wEkcRb
TLSH
T15792D16CC733941795FC3EDC3004369309ADA44750E3037DD1EB186E458E7AA79DAE55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 288KB
SHA256 882922ceab4df980ebadbf13cd6a0f06fc404dfa0591c8c31a951e57a5493040
MD5 ba86d7df036e873a6353dc347e9f33c5
SHA1 54df1b46bf4e930f01a66312373d77cdaf82ce8f
SHA512 3443dd8e3f814285a127f13b490bd0f0e9b5571c795aee9c9eaea1c648467e6eef14d6f8fdc46ae87e49812a4c0f16ddc5cab73eb7e31e6fb02e4d3b9d02f8d8
SSDEEP 6144:a6CU0sUc+N00ikY7EgjaUs4a/QsxUe700CCQzEEAY4QM2tYAGsYT8A7m4gYSPQ0Y:a6CU0sUc+N00ikY7EgjaUs4a/QsxUe7N
TLSH
T16C5452D2E41010DF775BD81BB2C2BA6AA607F053F995CEB2E09B6D4487809891572F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 275KB
SHA256 00d04ee889384a5e9daf7b974f2baf734b0a4771b6ae534e22468ecf12c7ea4b
MD5 10ffe8a4af22c99906450ea2b4da7be7
SHA1 2cdde20b1f5e3c5a08753c290e9f8c71aef20b68
SHA512 8952761c4a9204d190eab4169b2ad729947ae3a3baa1291c39187b04f791caf3314399c3689dcd7b4aeb3ada4df17de4d7e7277399807fe9277aacfd05cf9bbe
SSDEEP 3072:ZbgOFHyfXvHVq6P6EBWulM0t52D/4bRDv9ik0YQOnhCq3nA/8zjvHdi7tg:acSf/1O0t52DwcYyqXA2Mg
TLSH
T1755419CC7696B0224BA770F4006F010BF13A6969689E9514F0A8E8F97DB8D4D517BFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 115KB
SHA256 81bd9c6953694abf461e6f47173b09535424d58f3764515d2d1a9f409594559a
MD5 0ca20a97f688c550b0731cc09436cb64
SHA1 fdd6106e143560e45906d2e29e9ef6bdcf930be9
SHA512 294f2a9d714260dbbca26c7aebb5ac3848e6af4138fb9110ec00e03ec58e720d679a0c695dfb787948515ef0ea4b34a2840b92170f9cbfdfab3109235d1c970d
SSDEEP 3072:I9fN2p7kNNp3v5Xo8reiJXTry9YN5mvFUgSejso71eChTgeoBiPV:I9FJNb/Roejr8Y/0Fugsop5SeMiPV
TLSH
T1D9C313E372073872932F8ED3757898E1807610518BDCBF83FE7EBA5611E0652887562B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 87KB
SHA256 b87204ca074a62789c9e871ccbffae254fc335edabcd2ea1844b905e8f24de9d
MD5 9c9d30c0db15dc7867fceae5ed4609d2
SHA1 1e05617ae7fc867adedb65eff300ec4eafe73b83
SHA512 2a6e692084739b79e3d959b772a2b304d4c5fe61b33507bbfce01fbe034a735feb00c07efed2d81b3f2bfb283fa38e8946b663b696d735edfe97a1e79d6c5d7a
SSDEEP 1536:jWSDm9FJM+WOXMxQWNkyq7ZT+M8Mvg6Ur7K7dppv6FEBQfOmgh9a6ipWI:6sm9F1XcQWNkyqFTsUUr7Kxv7jVh9zi7
TLSH
T1D89312ED7EC7A7A560E89A7862C07E085B29254DBEB3B0C9650ED8E517C0DF0D014B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8c0d9b92d086378d83357df817fa97bbaa9f082a2daf6751376c09923f364cd6
MD5 207f08be0c3280f140581179d3e549a6
SHA1 b0f10e48bb2cc025c63517b3d8dedec930424161
SHA512 0952cfb30f3e1ab49c9f431ce468613fe4bb920d8ffa67d33e8b23037b87a5a3721ab4ee3fb8528dcb78d154044ad992659144ba404f15513015a09183325d22
SSDEEP 48:TEZbIGflxuKH7vT/aoJChwtaIWla5KV//zUMhTpoo6t7qzitoCabWUHc9O8LyRh4:of7fsatafa45YKTS7qziKbiO/9a
TLSH
T170A121E4C35E90F1C7D87DB128D5F4F2B333788A0507EE9261796B34F5127462560AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 d27298ff3635373bddfe515eebccb8e056f1c56e82d23ccf7a0c2121c130aa3c
MD5 83b9da997d1907078d065c4d794fcc01
SHA1 1d4e5a6ed055b55c432223c876182557191ca7ae
SHA512 37ea7aa5065df023eb4f6180b53289958c436852bd3f628b8b1e1ca3c1cff379d7d410ffddd4cbe9523068f50f48eeb6166b4313bc11abf4bdf8bfa76838504d
SSDEEP 96:43A7gtly3j7E3BRM7z81E7YEjNf+pEuRUVu8fAb+4rRvs8Oc18zsfyRcbLRznFKc:jgA43BjS7xAYo0AbH08OckwyRcvRzft
TLSH
T10FF1FEE0DF6EC3E4C7D42CB128E5E8EE6A37B9CA144FDE86B0781A34B45639510219DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 05fa2e6b92603f0989c0528c969c27e52c0759e6981578a769f0b629d4808162
MD5 ce3027e5ec2a98c94d753237bba34b4c
SHA1 d111954e1ddd1ee7b278c8aa85f89f5b73611bd9
SHA512 b26311a55041468d5e290cd050a69329e867d5c58ff8bc43accb2b092690db5731d8e9a0c695962f0f6052caae021f260ee9e83e89de0bd790a21953894b7096
SSDEEP 96:tkAEGtOgFBjPF3ppwIz8NHKhGjNffprYo9lUVpbv7ts4rRTbssB6BKQ//KzPMnfF:dFt3pQkYvEgufjrTbQwQ/w2MvNnBQz
TLSH
T1141244F8DF6ED3E0DBD42D7038E598E9A63775C9094EDA46B0380B3CB6573A810149D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f080.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f080.TMP
Size 3KB
SHA256 46de79d26002e46a994ff879e752d84e4908e200783d280b10ee99c73b649d45
MD5 a80141497cc177a96790594060b9ce0a
SHA1 0b122a4dce3ec3934b2fc92e6212cb9fd8f33df9
SHA512 190b68f4d9d1bb815e3243f6220a63d411e91c82c1d90a822f74be2ff3c5c9b9162322a76741022542b4de1cf61597a0e84b520f535111fff22a329f23cb6984
TLSH
T17E61A785C72F05E1C7D8B8B17CE9C8D6B73398CA4947EED241BC6E74585274A20302EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 07f582d7cd7e94e319ee34cc1de6eb0e528fc0fd58ba56f58ec028126619323c
MD5 d4e999eb16b87b6c8dbe667ba24d9dc3
SHA1 80020ef61ad1c240742adc9a7913dcfd5ec17da6
SHA512 391d4298b5b16bf9d848662f2883fcf95b1dfed9cb3bce3d04f3aa0a4fff77790566f2c648cd7bd837290e9f3d654fc95bc3131cd989dd233332b9b3e37c3519
SSDEEP 192:DW9Hx6b3CgtJ6ySpwtCJ6JEJb1ajSu7o0a6atj44jAbv5U75TrtsIGGEiuwf/vae:DW9Hx6b3CgtJ6ySpwt66JEJb1ajSuE0A
TLSH
T15F42A9F7C3E9822DC9115AF4DB15AF1BCE290914432C3D6A84D8AF1BA3F2471E151B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 aca38e3da0bc8a3be0e241e7c6f5a1931cdee80ca9387614439bc8662b6ece60
MD5 479747fc6f2e8a2d59f4a1eca9faa604
SHA1 09637c4ea90120de5158d9db907d3985483a908a
SHA512 0937d98c91a42f6b7bbe5ee53245f14973015099ca0edadee85096e99c09f4830f3c796170f5edff54112a414cb89ffb5cceb6daa1556076451dca4f28fdfa4d
SSDEEP 192:DW9Hx6b3CgtJ6ySpw11ajSu7o0a6atkj4475cjat7RigAbS9w0nu5H5OZgUE:DW9Hx6b3CgtJ6ySpw11ajSuE0a6atkEn
TLSH
T1EE1279F7C3E9822DC91156F0DA15AF2BCE2D0515832C3C6A84D4AF5BA3F2871E151B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b99177bdb5caa22ffdcefcdf2d7c06ef5dfa1a617c6d1968c8edeacd3c91c000
MD5 479c1f63019d2bceb96187f50b10d339
SHA1 164b525dd622953d975f737ed1fbb9008f1aef26
SHA512 a452d954e80e0b2f374c1c0f20c92911681e07adad9e416260d555c277d3eee48146a80cc78247badd18e56d4a51731ce043ddc6404f227e5f374e2847947721
SSDEEP 192:DW9Hx6b3CgtJ6ySpwtCJ6JER1ajSu7o0a6atkj447RigAbMs5U75TrMNtqsIGOas:DW9Hx6b3CgtJ6ySpwt66JER1ajSuE0au
TLSH
T1F52298F7C3E9822DC91156F0DB14AF2BCE290525432C3D6A84D8AF5BA3F2471E151B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 012cfb7b269c2d2d468abfeed0c377b4a91f97bbe2f4f93f45f50494d32d0d04
MD5 755ed4c5ac507b13d393fde8c1626645
SHA1 f8825419db49803e8033947e845865c45155e91a
SHA512 d84e3c9882c227f5915005a31c890e51c4f82a50caf6ff89acf1d20dd57636f1160feb48fff3163ec8a9d52eb5d29c6f897701bf8111aba549102796523d243c
TLSH
T124D022A31601B0B9A6EC3E9648AAEC8FE33710200803DED821E0F899063247D0907244
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ff4c460e66a94c0acbc7d01373cd52e7f507b2ab9e04e402b1b260314da7ebbf
MD5 74b0f86518ac541056adb03778bd98d4
SHA1 474bd4d591a9f8cffa79e130cbfa8f90b0839269
SHA512 5e3d2cc382f7e75225ea428f9988ffdcc5fb9c20d493599f941544cc6ae0e647599286a039791b9a0496edee100a58d41ac27f8e2c029337c77dfd20007b3abb
TLSH
T18AD022671601B0B8A6EC3E9155AAEC8FEB3A10A80803EDD824E0B8A9173186D09170A9
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5e441204a21de7448cd351b49c4d4e1ae85cf14226ee9cca5edba7296ee2e43c
MD5 3de548845d094f932fa3ce51c3baff93
SHA1 57b07fbced44c7e929d65859a150c173aafe116f
SHA512 dfd5be4f5559038f65b202c221a19a554a578255e6f09b38c822d6cfe73a228ff9c9f05e41778cd7a45b270cbbf8c09c7a33ffc88de3e34fa04ac9ba4870b176
TLSH
T14CD023531200B0785ADC3D95C459EC4ED337101004439DD410D0BC58053146D0607044
MD5 SHA1 SHA512 TLSH

Submit Download

cbe8d81f-d729-4aad-a643-04dc1ed01f6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbe8d81f-d729-4aad-a643-04dc1ed01f6c.tmp
Size 4KB
SHA256 b9380a9b2d5dcef33c7509026c4e3e7e1073ca92a27c58d4aa13533c770fda04
MD5 3778f9f92c0a4aa32fd9f879bad29b5e
SHA1 22b3f7ead50d8e1dbcf021b3eb2698864295906e
SHA512 946fac8d7dcfebec55243b79b46e9024ed1f2440ae0ad5238c7398004baceb688a524e2839c63d4404c35398a29d66a5bfe5709c8e06625f6be51c87622d4be4
SSDEEP 96:DQOP55t/oz7nYxiE2bGjwzSu7oABa6KBk:DrP55tgHnYxizbGjiSu7o0a6ak
TLSH
T1F7919AF7C2F8866D8D1255F0EA187E2BCE6E0515832C3C6E85D4EE1793F2075E101A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 51be9c5a3e1a4f5c7481820f638a3f2a976d534908395cc40d986c8465e00fda
MD5 de0a28f74b3fe9b0d6433e2512e65adc
SHA1 467109cacab4e218260cc98d63528939f7d99ba9
SHA512 1fd92badac48a0083dfc8b915254d53cfcb69c1a884bb20a4018b9a9ae7401d1debc985ab3837e7ad67192ad36e27526150c697b863b62ab81243c4a6ac0fcc5
SSDEEP 192:sxR4RAyM/jK1Ml8wHcBzu/fDsU5ksmZooA8pK/Wr/en6+WNTs1qH2O/YxPlzJb+1:sxR4uZmzu/fDs6kR1/F77/SbARxZt
TLSH
T1B772E75695249977CCCBD30DFA617FA3D7F81462A5910E48AAFCCA1C00DA6FD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 422595cd08830183a2c89b9ef838b41a64ae314d2df7139edc3d7c0ddbfc254a
MD5 d19a7ad82000df91abc94124a9d0b3da
SHA1 557efad31fc3cf543f1fd7fd97e558442ed27d76
SHA512 c1bd66906bf51ec8865ec53b1118bda5eb01308db3e41dd89b8217864534dd04027653ccba6eae9643f0f4897aa4307ee2a9b1929a2762db1da87dc4da966527
SSDEEP 192:sxR4RAyMojK1Ml8UQ4HcBzu/fDsU5dfsmZ5oA8pgxWnm/en6+WNTs1qHI5QeH/Yc:sxR41qOmzu/fDs6JqS/F7YJ/AbAzxZt
TLSH
T14782D75295249977CCCAD21DFA617FA3D7F81463A5910E48AAFCCA1C00DB6FD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 45b037872a727e190a4c476781ff15ce9562ada42f1bbeefa9ffa6a3baa1bab2
MD5 04df7bd12ef23db978e3dda6582ec5cd
SHA1 f9363372d6f7387f149fc1b9750c95d83d2e1798
SHA512 99179187a379ee17bfeacfeef4c876128dffdb07eb0a765c4056b9b7c960f46589701bf107fbab0476aac28eadda01382cd566b666ca9771771e26606b219d26
SSDEEP 192:sxR4RAyMojK1Ml8wHcBzu/fDsU5dfsmZroA8pKxWnl/en6+WNTs1qHI5XYxIllJS:sxR41Zmzu/fDs6JUr/F7YXFbAzxZt
TLSH
T17882E75295249977CCCAD309FA617FA3D7F81063A5910E58AAFCCA1C00DB6ED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 570346285bd8f6d6f3166b99eaa1679f9383ced1795500228746188de5cdd7fa
MD5 3d9d873b5d454e281831f38e3199afe0
SHA1 04f891a940456beaada76e4f3c068ba953908835
SHA512 8e51a5336b6b0abdbd922d87e7d2fe74d44c6c83354dec1c640e504aceafe86f3b5569e6d2883c1b249df559cac9d1219172c74b7869707781b8d77cb417806f
SSDEEP 192:sxRDRAyM/jK1Ml8wbu/fDsk5ksmZFzoA8pjL/en6+WNQ1q/YxwlzJb+GuIgIJ:sxRDulu/fDsKkKP/Fb/HbAs
TLSH
T1C762C705A5389977CCDBD30DFA557FA3D6F81573A1901E44AAFC8A1C00E66ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 34KB
SHA256 bb179e43efce8863eff7c3c4237f9864b0610b19101951030643c0745cdcaceb
MD5 9d6b2977d74d3fefd3496859f29e2f6f
SHA1 e7be4490a76c8358de6af24a7c5e259aa17fd9a6
SHA512 19ef05831e07fc9ece46eaa274bf50062a80f5b0b4c09041b0ba67c96a5aa7736f1a589b6fc1f9e2149c7abc05d8b8041006aac3021ab303d7a9c2457fef62a2
SSDEEP 384:sxRW1qOmzu/fDs6J66s8qMpRiYnazAW8pZS15posJWeT+DRJNXwG/FEFoR/6bA0m:sakOmzu/f1J4Mnc7WeT+D11/Fn6bcX
TLSH
T11FF218059424C877DAC39E19B83D7E73DAAC10925685DEDE2AFCCA1C009E1FD6B07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5d38181bcd9d177eea7fe98e20ac9cb40f7eb6eafde482f5bce9bb5ae00fca4a
MD5 03a313d862f87b419b84857b2962c3d2
SHA1 ebec0979f554da18a2b3648d0e1d4987a78bc084
SHA512 367316545554b79d15f527c3f7213853fb17fae1e20f95952fe5cb352bc2c09805152023c26295ad792decc90f57358b4dc9c16f845adc0a3697132489ccf2ff
SSDEEP 768:0xCyAjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAxroJPe2A:0xCyAjWgbrfM1u1jacpAKJPPA
TLSH
T1F5C2EC3B640CC77E4F844AADEC25AED77DD802CB97984D544BEA880C03C77EB521A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0790ddfd-e0db-453f-9fe2-4786b33c9052\index-dir\the-real-index
Size 96B
SHA256 ffbb56b699a547a08af8d7c5fbb7e8bab6101d1974e422075d103a4f4366dc02
MD5 a44724dab348c40533951fdb28bd05ac
SHA1 90dbe3b722fdc95fd5fa33062a07870a841e69da
SHA512 09922312bc5f05fb9a6f33c01696358df9a748656a5643cdec3cb4898a8606acfe81ab85c54b12c695a391250f8b090edd5a3e4a76a54b0c8a6c0e84c11259de
TLSH
T153B0126DA608D185D10543F4108102203351C8810207762331E0A2BCC5002110182411
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ef1ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0790ddfd-e0db-453f-9fe2-4786b33c9052\index-dir\the-real-index~RFe5ef1ef.TMP
Size 48B
SHA256 7123ce905671b062a58dc391c3610887f0ec7b2f0f0eaa7dc47a6b2e4905bce2
MD5 9bbb56eb3a15f5513ee79a3b81aab797
SHA1 894b84456aa6304ce0784006f795256a262d3cf5
SHA512 a53b6206ad597f09cccf484ec1688b398130b26474c406bc796edb690e8ffcd9cbd0f4cd1521e3d6fd01eebfc70824b96a18567676cd966c9f655d61ccd50504
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 3KB
SHA256 c90ff5a8a427760fb06535195f1768b407c52b6223504bb397faf7e516d57a6c
MD5 6b05a8e9d80f6d6065d45ad77ab548e0
SHA1 7f497893c21170cef935347cf667c03c0e37b9ab
SHA512 055087990521054adeb384fac6e4a6250510485aec8839b9fbb322e4a77249414dca96f0a25b74029b96db3c89cc49d8ea13805134e96c50f96a6c8f9712ade2
TLSH
T10651B84F8D4B1D19C5ED05B268F9048177781CEE4B54C98736DCA271ACD337E1D0C55A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 1KB
SHA256 b433129f7a81c23309f9197aa912b9ad13daa7815e73f43a1e83854aea76bc62
MD5 ed2560284e34c2946997938ea3f370ce
SHA1 f753b60e211ad685c4985f226b40cc08f8e48192
SHA512 53d64821d0c72b32f4dfac78c07c105e152c7704301f943227d0fe1bef66e2800e2ea198f4eb477de417c64b9ae7c4c630d3e38aaddf39cadad094be89251313
TLSH
T136211222CCC76807DD312977957E18D72F75ABDC1607EB87141C15319DD62286849244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d9a00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe5d9a00.TMP
Size 1KB
SHA256 b322b49d8d5b0c28d06033ed72a0560e9f2416d5191fa5822c86c4a192c6ee2e
MD5 fb6ce8f9321e03f6c9faf62312600db9
SHA1 0f665c4967bbb4b248b19cf9965a035597254710
SHA512 86090b191234d23a148e6199c7cd72618eea60aef56523bc340690b4db0ae7133f904af9511101ff09d78adcf4e7c6e8490fdf0acf32a8c2fb65541d207ee04c
TLSH
T14C217063C1C3BC87ED3120B9A24A04EB3B3BD824234AC74B24AB6D601C826289C52996
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 2a14e38e13e6ef0f063b66e102ec1a889bda5085bf9a58b3b273d23c6c797617
MD5 e4d3ffda9b0551277f4e63d4e6cb3ea7
SHA1 e5c1bf61d67a18b5e9633eabc47c626df55462b9
SHA512 3da86f371c2cbbb43c6b36c0870b76b0aa5c4486b313bd1b6624d65c2f715a5901de7579c4246814a3443dfeca1bd785fa1ed7a9d77fa1c3f5af54a2d95ed5fb
TLSH
T15FA002660284921AC006D2F425D612666F96EDF70245D30753D00044CC6094A4F6500D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f25de63-2aa5-47c3-9175-acfd1b9ed14a\index-dir\the-real-index
Size 72B
SHA256 8d7562fe81d9e202b7c5e6ecfcf6716cc2285c41812c88da12776d8e6bab6e6a
MD5 2a654bd14ea7381d22d0f134025d2eb6
SHA1 3d03296e0913d8c287c2069b4b6050bb0aedd308
SHA512 cff1d0609ae58f0337740c23c1c1a3c4358b9fcc938fe2a26ec0e8628b651fbf4af4217179cad73328355c9c1ab38ef796dcc7218cd7f5d7f19aaef470b52909
TLSH
T1F4A0025947C41047C12291B996D202B123018813B110524655911244CC545704A5310C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9ffcb8-5887-4dcb-a7ad-0215e9e045aa\index-dir\the-real-index
Size 72B
SHA256 0feed6cc0cc01046829e4314b10bf3380758ec2aa22973a55dd7b5406f7ec4a8
MD5 6cf832acd3948832a0b075ebe4970dfd
SHA1 36301f85fcebad654a7c4686eaea72542a7bb46d
SHA512 6f68d9eb9a4f2e4656a9d577d793e4ba82dd5e06f3ddc26f11a73d78eba92d3decf2ea60e2fef55315050d97c25a1caec398f5745593cc730e65cde91286bd1f
TLSH
T15AA00261415CA151C2C4177514DFE5E1326D691521119A4596DAE878D8D0140CA17448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ef1ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9ffcb8-5887-4dcb-a7ad-0215e9e045aa\index-dir\the-real-index~RFe5ef1ef.TMP
Size 48B
SHA256 e8bba0e2e448f10eeeb95b347f0dfe802bccbe0c2da50476ea9ad39cd06216c9
MD5 acba31012fb14c3aa9a184a90f3e998e
SHA1 8d8940a0c7b83e7c31201913787741d8b388adf3
SHA512 a9ae461b9bfc5861713ba3402ad564acf7f50ef7df374f1709f58b994d088cc7db77a163e4c3636fc30f3c743cb86e6d2bc43c156fe1198e69ea16095588c7c5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c819d147-382d-4234-83d5-648af5917f2d\index-dir\the-real-index
Size 72B
SHA256 a487429f52d71e04c080b812fe087ba960a81e9ff188c21c56d292c6538b5cca
MD5 e44816d77d681098a0d9c562233a27b8
SHA1 cb303335bb3d7fb494963642acde9b85647331c3
SHA512 0a0767d51d495465c68aaca5d92fe319b0245318a2d0842f06351ca6ba436211d071b5a2cc072e8f7dc2a2f3ef9cda780772e10add5556a47c27e4a7e85eada6
TLSH
T1ECA0026021E84171D01807B25F4205622318DD160201474F509847698D6559D4B21283
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 78e5a250960fd009903aaae3ffbb56caf679f291f301184b661fae8abd632273
MD5 52b919baecadbd7d8a8235c5ec1e15df
SHA1 c4d0ad18892b397e0a93ac9fdcee8cea0bf48398
SHA512 099857b069c061213c75768c8a29920000259769010a173c97cb3fe6e07b8a20444b2eb3d4f6bb64f2145870510b30fe1c0255978b8ff03f3fdea2bd35f87f35
TLSH
T1D8F028B37FF72924B9AE93EA243004B54955BD148404AD1F6022A58694B2350246ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 b131eaacbd85ffef403a25b09b7580c87145ff8441c8cc0f7ccbc42a7b22c4c3
MD5 12c01b7cb2d345b45db8ce2f9c960328
SHA1 085edc49684c618e2c00d0aaaedcb0111899188d
SHA512 f163586e33649dd887d735e7ba8d2d7b5a6bb7d536a59899c77b91ce7d9ad45301fee936c3c495e61b9262cb546d9b5f5c6598f69ab5dd2e166fc6da449bb42d
TLSH
T120F09EB73FF62524B87FD3E5283049F58952BD14C900AD0F6023A18714723906459C72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2d75940f1097e1e1eca04230b8874306b7041f94f8acc9b411153e7cd7c98f1d
MD5 873b2788d089294603f118d48a522538
SHA1 e8ddffbbbb58f16acb21be564523581c9c3a271f
SHA512 0d54589839d61188b9a8483a0156853d707eb88004e0aa4d97eed109c83bd0702fd153d4e2d16c8518a15181de4d1f9cff5aef743a87a15faba21b99ad2ffcbb
TLSH
T10EE0D87B2EE61624F96FD3D218308AB1464279589900BD4F642592C750B1364645AC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 51eff9ba222c0c351922071d2dcad12da86911c02cb3c4145a1572eb1f92ed0b
MD5 ead700f5f8928689b9eaba7c447c6528
SHA1 c3fc49ffde7639fcfdbb138484039eaca46e6e4c
SHA512 60c08a2edfad6ae8823317251f2cd4b2d5dec2bae7ae589364e7f27b089b08ce9d2ce34ee81c79d543a8d705c8457fa3a111bb081b483018c155da55b79dbd7a
TLSH
T12FF0ACB37FF72524F9BFD3E9243004B54A067D058400EC0F6422A58B80B23902059CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 05d928fda532eb79dc1f62e723aeb86205a5421cffbefe730ae8ac6923424366
MD5 68b2ab3f6984f520bc28976c852fc2c0
SHA1 136dce94f3dec0b10bbf08c923f487f07bc1e39e
SHA512 bbde4645a4bd3282729d5fb1f9dfbc87b490cb50982760c9e0ca9575cd9af2744bbdee9dd564fb019f652740bc17024afff7963665a0da0565a6483575b1e233
TLSH
T114A002A1DB56C145D46006B0907F01A8B224ACD846B97B7570ACE0588EA9B5085A2509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e7165.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e7165.TMP
Size 48B
SHA256 c2d7be5a5c352f8c2bdc43973e36b878ecbb5ecdcd667c650149a2ad06653daa
MD5 1a156c9311e6642bab86937296b76d88
SHA1 4a8b73db5250c12228fe10f2197909f29cd95d4f
SHA512 7181631088c9a61a67a379bf7b635855fde05e0dcfc959f965f6d7da81b49788ddf96ddf3cc4cc66863c5816862645e549275aacc10bdde2023c56debfbacc46
MD5 SHA1 SHA512

Submit Download

22361f1142cd0213_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\22361f1142cd0213_0
Size 511KB
SHA256 f5f391cf40b984cf7e336bb2657a9316dff183703db3af4f5418be473393a7f3
MD5 39545c000b992825b396178e1b154df8
SHA1 a8d6f306b2745fa8fdc948ffe6f302b775decac2
SHA512 8b709b5bde02de2c855d83a3fb9e14a5549bcf34a50091a8c8b845582d579d1957f8886788d978da0d2893ee1e974f914f76ced49041fbec2f3bf7ea2f146579
SSDEEP 6144:hkYk80/6aQ1fnjNpOdpHlXEKusL+K/b7pZuOZYD53cY2nuQx7gCqoP3:hlKusSK/5Z6DCY2fgCqoP3
TLSH
T1E0B47D703320AB3B14AB06D2EEF96F4D3872E313DA6612F8A691C16437D5CF6E49B514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28447a3ec75489df_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\28447a3ec75489df_0
Size 191KB
SHA256 197f44c492bb02f90a6b6478d4a4ce1381115d49ff136d2aa2253b5593426199
MD5 ed28ebdc653bb0a3f899ae9bb8b468cb
SHA1 1c72bbbb7a70e9204d947a68d3a201bc2ed1de26
SHA512 4f404170af1f2000c3bf41a85c5369280d90f90fcedd1dc0a075dfefca8611be103e118710fe76752310c3e802c8b5b4d6cc8ffa2fb90519389aaabe6f4da884
SSDEEP 1536:po/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:6SXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T16C146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 65fe4c29a434c23e58af9309c149d915971a3ad09de11cd3a1901627cf0d4434
MD5 a564b2549405cf50200771639e567fc8
SHA1 136def3b7b442aa645ae8dcb119210e97ba00a5c
SHA512 b0e32fec34d71ddce9bfff9019487d582d457855c9781ad50d95f6c371fcaf9387f5746ea122c2e5707a57a7f42b7a72342e518a7e057f61081d93bd7fbb7589
TLSH
T1B6B0029D225575C3E81447F45ADB816B3F603D217327430764916499843665249E7C48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 081abbe08ed7fa2c277c4cbe9dbc0748bb1e28290fe02f344cab44b4ca13cb62
MD5 28ea6db9c08c6ca23de0e379250dcab5
SHA1 e2a1a3149a27614cfbf675f7341d3fb2dc39f2ff
SHA512 62478656c6c0832f7a95682fb0f8479bfbb6b104e50959b249dd4409d42745899c87050c03559bb15eddb6001374a07fd4c084031581909a8969320a8eb1944a
TLSH
T1AFA0025023C19E91F80853B027860759335048D0022D8F0351E1404589729604945D00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 144B
SHA256 2a1c223908d8e639473560f8a66d5a1a40423fd546b9bfa9d93d886b5d314aa8
MD5 dcaece3dfacbf49ed3c88317cd636405
SHA1 0488aceff404a14b7afca35b3b6047162e0d44d1
SHA512 3f4e12c72e34800ec29e692d99e946d2021df3426752c2ecbf1dbddbf9b9abdf8069c959a811753f64603b32bec9f7c2f68857e93e0ef0427a10a01ad2b4d2ad
TLSH
T1FFC0126CA2416555F94C52BD14CBC0142B505794A131031F10C1018CB6611021981C19
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 deb10923642c9994137682f4899d9a4c9e75c3f749454faa5bc194912610d27f
MD5 40f15656b288d6649ebfd9fa16c98696
SHA1 5c94317dff9318f4f39112f37c76b5a196a92456
SHA512 e0950484c872cb36b7f978564b3349b092e7e93649ac306804b46fcee8ff5c77bf946ad4b3704d804ca87674251f9fb9f4ab9bdff95a2024f457826e45217f76
SSDEEP 48:KQzIJKQIcryoZKZjZGZaZwZkZoZkYZkZBZPIBZSZkKOZBmZIZkiZ6Z0TZhZwZfQL:KQzSKQICGDyKUU7QgKduSN
TLSH
T16A912142B4BA12422CBE790D8060DA77D6C270A73258E56F7BE914760F76E221DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f3ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f3ad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f566b6570cd50439e4ad859b6b781413f2f3ace28513adae85674e10494bdd3b
MD5 260947aa849c241f15b3048992a9c6f3
SHA1 b058100c72bb264bc27176c7fc9abbf6068c8143
SHA512 bfb2ffdceaa5c8aa3c9a76bdc3033a3fdbdaa6397fff4d5c9a9734d90fa9ae56dde94c158e9e14848c63ef42b83b3870e2b9061f012f5abcb78be797e6d7d1a9
SSDEEP 768:6rv+4UNbdN3UgqXkKL2xqtijF669yrqUjWiIwwxMtOh:6bsbj3Lh/jF66INWZTMMh
TLSH
T14603BE70B8685AB3CCF6D785B11336C3BFB4518382C50F98C9DDAB0D459B4D9274B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 26b74c4cf2ff8bd514d1214dfbc2a82a99b049ef275b30aebc6efa90e3094d2d
MD5 ab5a89cb2a620617217267a9b4505ff7
SHA1 47fb8196a6cb4a9515fcb289d1c83cca3f5d673c
SHA512 6e3aff438d03c67565ac12eab64b59859ab4c82e3882718e67acbee9a30a6eb7aca287b6479d53e8285b094907aaad76a5107d47155098f4440140754489c90e
SSDEEP 768:kFzs3BwgMgEnnkKL2xqtxnF669yrqUjWiIwwxMtOfJv:+s3zPynF66INWZTMMfJv
TLSH
T14D135BF158D74576C8ADC783A33E2E82AEBCC093B1858A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7784dc59c0ee85ea1df556731c2cce3be3219f6e3876ac70cba84b587595267a
MD5 499f36951ad7de6d6d8ddcba78809727
SHA1 4e1ff261d8bd708c3398317240773897a0834f6e
SHA512 d523588d72c3cd585442429e66aa993dac270a3486d9e21345d70c0759f915e320062f2b50a5dd3470be5c7c2cd8fe737f444366d2367c2aaa424c49bbdf9bfe
SSDEEP 768:arv+4UNbdl35PkKL2x5jF669yrqUjWiIwwxMRFUiler:absbX3WzjF66INWZTMzUsQ
TLSH
T19403CE34A8585AB3CDF2D28672537783BFB4109396C50F98CADC670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ea279da448e07eaf3edeae661ad4cb9ff4744113005efd41c0965d13feb7e3e8
MD5 4d5fec2454770e04f836f9a1e2546062
SHA1 11eeb4e000532e9ca1309bcf80507d12a42dfb95
SHA512 50da372f4b57a12d8b858c05b4aa1003d037478a63d74b502d4239ccd993e35d1c866f383130e21c8f5cea43328e522e778f51159d23ab3789bc542b32713ef8
SSDEEP 768:yS3Ug2XkKL2xqt+jF669yrqUjWiIwwxMtOfJv:yS3LVhjF66INWZTMMfJv
TLSH
T1AEF2AFB06C645AB3C8FAD785B21236C7EFB0409382C94F9889EDA71D099B5D91747C3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8246e94dc5785fb99d26ad9ef3dcf31a5fff49b1181537e76090f34dc40e352e
MD5 fc1f597266a90129694ed6beafb66c84
SHA1 a674e698d6d61adbd5c6aa24dab1583a21935615
SHA512 8bb644f3772279eb066e3766a9bfce658693b7211ba0e783444e591103140dd5d1ab07ee6a2b1da084176cf546eec725c1933f3859d615d3db30dd637b208b18
SSDEEP 768:GS3ug1nnkKL2xqt+jF669yrqUjWiIwwxMtOfJv:GS3h2hjF66INWZTMMfJv
TLSH
T12EF2AFB06C645AB3C8FAD785B21236C7FFB0409382C94F9889EDA71D099B5D91747C2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 294597b07a82835dc2617df9cb07072fe11892a7e838957ea7af7c92ac22f839
MD5 dd698f7e0bb4e61f50d24c2d31f07d2f
SHA1 8f3050ddffddf48a9465f875dc22726494f2fe83
SHA512 d05c22af58f2ff50c219e30e7ffbba3f8477fb99636e124720db335c4faab614c6c9f3dd94ea1667612d502e4e07c16a56393c669e2bae4704268fe95f9edd38
SSDEEP 768:V33Kg1nnkKL2xqt+jF669yrqUjWiIwwxMtOfJv:V3312hjF66INWZTMMfJv
TLSH
T163F2AFB06CA45AB3C8FAD785B21236C7EFB0409382C94F9885EDA71D099B5D91747C3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 267bcb4fb2172f180f901816b9dda9f948e17a3e26f1799f59d4d5a5cc111b4f
MD5 abb8d33f9e1e7042bd0df2f1b878fa7c
SHA1 7c121ef2b0d3dfe84a348f88f9e543ff070c23cb
SHA512 bace4abe8f3836806f4bf39b463988c1b946b1fed833269d0345e8b6a3ecccb5392ae799f98fa955aef14b18a9e498f964f7ab733b02fbf4c2b4d74a79c42ee9
SSDEEP 768:kFHm3NwgNgt7kKL2xqtXPF669yrqUjWiIwwxMtOfJv:8m3GiUPF66INWZTMMfJv
TLSH
T12C135BF158D78576C8ADC743A33E2E82AEBCC093B1854A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1b688ad81cdfa25d6df0ab2548a242fe24cd0ccf26857a80155022acf26c2ac2
MD5 af376f96599b3fe16797741372f49772
SHA1 95225cd7d15c219c157956b46ffe69d5bf6fda8c
SHA512 44d8dc930d97645e3acb38e0c50986b9457f6abc312e68bf150622f09ae00d3a3b06dc626478733e9979979142a3012bc2cc30df04aaef3887aac4798836c3f9
SSDEEP 768:kFPn3PwgNgX7kKL2xqtHPF669yrqUjWiIwwxMtOfJv:an3soMPF66INWZTMMfJv
TLSH
T14F135BF058D78576C8ADC783A33E2E82AEBCC093B1854A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d1d60bcd7667c5a23ea57cb5155b31d88d755b5fa47fe3254445941eae957846
MD5 595504d09ebbca8c1aa7b95a9499895b
SHA1 d48be1113e7492a87dffdb2e7908cdb1d8cc911a
SHA512 13cd37a8ba892c2f946b9664222bdfbd367e314e57e806f9586657eae8d2cba7237b2d5aaac5fe7ddfacc9d4f376656e9bf7ba928890ee70f6176c2dc6bb9eb9
SSDEEP 768:kFbq3LwgNg97kKL2xqtJPF669yrqUjWiIwwxMtOfJv:Oq3QS6PF66INWZTMMfJv
TLSH
T183135AF058D78576C8ADC743A33E2E82AEBCC093B5854A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ba2275266bf7ac476bea070bfbe3188a02d7354f6cac09c20962c50469304232
MD5 174620afa3acbf6b40e46d1fac7f3fd9
SHA1 a505e459bbc4e3050ab1acc98142bbaa9f729c6c
SHA512 c116532f8848cbec062e6d616a6b17a5781d05f2a0d36c6c9243bc9019a00472e5332f243b18dbdb2cad6d4f2bbb83cab10f1d07708ee9260afc838596752f57
SSDEEP 768:Srv+4UNbdl3p1kKL2xqtsjF669yrqUjWiIwwxMAOUiler:SbsbX3oXjF66INWZTMbUsQ
TLSH
T1AA03DF30A8589AB3CDF2D786B11376C3BFB4518382C50F98CADD670D469B4D92747A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 32e5dc8859cd3cdc7f28a270f627d79c11d61920b8b94c68007e0e6329fe2642
MD5 c80915ee69bdb024a0e517c245722902
SHA1 6ad46660d9d1ad4bc7a217fc60f59b3c7083d710
SHA512 8268afec84394d0ef1daff409871e44e0e1b07cca7706f736ebe52834ed698f63bffbb0eb74ee1e8baafbfd34bbcf5d5a183fdd7c05e6650e92ea0325d669caa
SSDEEP 768:kFlm3NwgbgannkKL2xqtXPF669yrqUjWiIwwxMtOfJv:Im3QpsPF66INWZTMMfJv
TLSH
T121135BF058D74576C8ADC783A33E2E82AEBCC093B1858A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 70dd0fbbf17937294a4765a61dce7f75946349dad5761b4d51560ba29d30ffa5
MD5 e4e5de1e52d8075db661bbf12ab8d1b4
SHA1 6e8ed0a38035c3c27b016f306ca138e91da61611
SHA512 3f7cca4fee9c8b1895128645f1fb16cbb913659d961cf09b7471004e10b1ec5e781657cbf7a50164f29de95e21b93ef77960fc78634802f7f7843c1cdf379c07
SSDEEP 768:kFDw3LwgNgg7kKL2xqtXPF669yrqUjWiIwwxMtOfJv:2w3QfUPF66INWZTMMfJv
TLSH
T14C135BF058D78576C8ADC743A33E2E82AEBCC093B5854A94B7D8951DCD460BFD347829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 827f38489a79a321a2dd558c0b89f1927b86fe7540d8528170a8d8701c757865
MD5 48872082cdc105688d4759c82eaf71f4
SHA1 c0e533e4c7723982097f8a208b99c29ff262e50a
SHA512 342e117d5db19df28bced6565d7f04d83e472f852d1532b58822dcf1ccfdb3d07d57e4e8992128e6888bcdb8dc82ab8d6d22ed6ef8f6f07dbe15bd856703b461
TLSH
T19FE00403D31411D5D01C013001475F111FD3C43510710347DF30114C7C313047D11D50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ab5b2e057f1e7d3a673b0542a873973f52c268626167531250b66e7e518c2b91
MD5 0bff101e1205698d759930a58d870445
SHA1 fe1194f46daa26d7b92e75a38fba87c309e067a6
SHA512 33e89e9b510c46f7bd27faffeb68cbbb2797731ccd005096e68c60b0ba8ee8aa4e4646e2d2fac90535a374c28e5c35df2958ba9dab437abc76c9aff053a4be57
TLSH
T1DDE00913932411FAE4AD173005D79A216AE3E43662F24786AE1011A8BC673086E75F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7094f5564958c524f0862b7efcd6cc25cbbb448c32296050052daebb66a0a6e8
MD5 6ba3d78e5ea04a995eb1b1be6ced64e3
SHA1 5b46de7cf2ddec2271677d353833bee3b5042939
SHA512 2e0b34784ae72b54e9f2437f1fa24bf47d7d290910aa847cb8cbe106b7c6b61b96d298c6d7bd840d02a8b6efa7405b50ee10817eaeb5a8d6713873c2d307ef89
TLSH
T101E00203D32411D5D018023001475F111FD3C436107103479F30114C7C323047D11A50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 418515ac07e1e0e73b89faa41c248064b18f80782340e3f71bcb8142b04e4d49
MD5 c352f3ce1c869e97d22fa40a61298f2a
SHA1 c4df356e6fc3e9cfc0a6379027bb843ba6f1c975
SHA512 d32ef58c5b5273a1660f1c9e7ea5113517a76b1e675253e9de29bb0f336b4abce2e284907d354061808ca756c10b92ed401cd1cc725f6f9263ff146cdb5ba9e7
TLSH
T16FE00923A32411FAE4AD173005D79A217AF3E43663F24787AE1011A8BC673087E75FE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 77e2181798718d5405116de879747c4715ed74c7de8b315633f02b7419c0950c
MD5 6748fa407acfe1b5a1271da29338f08c
SHA1 b9e09f1a0d0b64b34a6dba93a2bc5aea929169a2
SHA512 502653fdb2b03035771b84e069c3895af4760459494f5da01a30b0abf8b5a68c7f76cb6b57ba7fca346e33b6e3b057ce446f687dc563e19457c6fe3cfbcc3316
TLSH
T12DE04823E31400FED06C033000D3553131F3943A63F242825E5211286C1B3046F31FE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6846b0feee186df20f696ae5675bfdec5eed4a084e660d7dc962c989a18bea04
MD5 a2683e785bbbd9f705f106dc43de1180
SHA1 0305fc5e9367d1b6c63a62b5fc62fde772fac0ac
SHA512 064dd972c095a463312b247b86c09a7b50c20705a8263a800bf479f50989bc2c7340c41339dd864058c714a101cc86ba1354a82a8b9b84676bae77843ada3ebb
TLSH
T1A2E00103932411FAE4AD173005979B116AE3D43661F10786AF201188BC673087E75F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 495fc619eb4a5b61b89e3fafe2375d50390e8cc00d3fae7d4ebc22e99ce564fe
MD5 4de6f2810556169fad4cae4d6271306a
SHA1 f9ba32f94c55926235a7f973400532b570855114
SHA512 8e2e926dc7f3c640a85d8f01d1dccb8c9d4ed7683df13eced0ff4479c0236964110a0e4dd0c6fa53c7a8119d3e886faf5d7b5d3fd57940ce7a6f9aa2871114ab
TLSH
T169E04813E31440FED46C033084E3993232F3847A63F206829E5201286C2B308AFB5FE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9087931d2f6fb9905e313e6e121ef02270f2b58cd695250b8d6f4d556b55b9e3
MD5 c346c1939dacfe6bea5f0b5c19081802
SHA1 4ebbd0264449e39e91f6897ba728a19a50246829
SHA512 44dc1b2ec684411c31b4b4e4ad5e87594c6b7af47aeaead53da5d1ccf3b08900589e82c64ef0c8f6100e959beb7faca072927bdc0bca491a44495ba5d3c88757
TLSH
T1F7E00103932411E5D059033001579F111ED3C43621B103479F30114C7C333047D21F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4217f4eae9abc574f81a52354fc0ae2016951133c707f37bd3eaa911327980dc
MD5 08192bd27104cb661fbc6b6623fe623f
SHA1 e56b4ff46c23e5cf7cff14cbdcaebf16b94b7b36
SHA512 54e7bdc0236cdc3ce01c034f86c1a757d8ae6bfa6f734afc26b9f3ac04c3f3975c93a4031783c6872f8892d1208f202a95d999b0343cb6985ae1c2bb446fcbbd
TLSH
T1A0E00103932411F9E0A9033005979B111AD3D43661B107469F30118CBC733047D35F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b6ed72e788770374b69855257df17d73c7bf79831c78cb059906e310e7d30b70
MD5 5a32f341432eda0913740ee1cfe887df
SHA1 9dc66201b523666d67dd187d13cc846ae5e95cca
SHA512 00b81112ce4b16b1a2a5429b5d5428c173e86ab52b9551e673c74720b49ff2e0cfa1a2b672522a802476521d3a39688d19af129096e07b42f2106bdeff78577a
TLSH
T199E04813931000FAD06C03300093452038E3D43662F202825E1010686C273046E31FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59792e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59792e.TMP
Size 392B
SHA256 93fa10a2aeaf73e16e28e2c98fd5410015618b8dd86aef79d9740dab6cc93dc1
MD5 1a12688733e9aad7371ebad1bb272e26
SHA1 484e07858aae1ed0a854d37f210dd41bfe6b4ebe
SHA512 ab84e785bac8f5f254453116bd122f2f79e1520712de31f71996d2ca4ba41876cb8750f38bb5bd74e3dcc9e0adb3d5ccc1462bd05cfe580347fedc2c367d964a
MD5 SHA1 SHA512

Submit Download

8d60b295-d7e7-4d34-8adf-5cba968dacef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8d60b295-d7e7-4d34-8adf-5cba968dacef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

views[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2T3RVB22\views[1]
Size 3KB
SHA256 e6bfdfbb9a0649ea9d38de4255c355c581097e6a1035a54943260b22ad45f172
MD5 a726593a8261930e4786375106fc6bfe
SHA1 13916b1e1825549e9c36c64e35baca204a83ef95
SHA512 b093a2513b2c4f8544093d6e983ec580e14625e1529bc3db22c4011980cdf44a78443c22289b11a6ed0afae2786d480f94b354b71496ee022e439d2bdefbedd2
TLSH
T1546133127FC0E87CE477874B8772E888EF1560835791899975DCA52B4FF49908C376B8
MD5 SHA1 SHA512 TLSH

Submit Download

views[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NRITAB13\views[1]
Size 1KB
SHA256 edcad5b1ce8a304b70b8c9ea57d4aeab740d979ffa59243b943011cb1ba4d57e
MD5 bee1758a485085bb8a121eb74ba7e96f
SHA1 8024492e1126b17f832e36c932d433200180b693
SHA512 bb1fe94a523ef108c49f75da187fcc28bbf80d72233454c329134bee2e12268d3da344a622987b081612aa2a1edac8b91eef27619c7309517ac52e7aebf32f1a
TLSH
T16B31AFA89C1A58B99D7742075F2DC188FB36210320218300BFDDC48A6F759DC98B6FBD
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 19522c7e140736208a28a9056be124d495ec75471725dc9d11fbffd9ba767070
MD5 b14c5f52c7c818e7f55db88ec807c3d9
SHA1 95f9d7165d7637c5e32450477922de8e08e8d57b
SHA512 a2fa55a5b8737c99e2f5df59add5b15c7040d6b3719ba0777f88cbf66e86d74f1d0a315267b7b483ae21d3e869268d2ad58b3a674720ed6996c2f86eefe5099a
TLSH
T1CA116673F3CC8624DC5A403610CEA91137B687CB44DEDE6B7B84D155B82F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

2gb4myvu.dll

Path C:\Users\Admin\AppData\Local\Temp\2gb4myvu\2gb4myvu.dll
Size 10KB
SHA256 1ea94a1cc81081036f7d9a4813f0d28d13b1039de77a8c9fdada71ace147f756
MD5 8bee961d44e08a0be711ba9576df038b
SHA1 9c635f2ac76ee360d0d7ae7056f841a832776aff
SHA512 0178cb5336e65bbec57914e13ceba64fd1e0ee0b6cc071d5050a982ce4aa67ff69bb334e30cd1e81b030967b45fee4c2fe99bf14e2f5f803dd291948e50975e1
SSDEEP 192:4OOnIU1gBJrkPAxCv1QraUEgiElOI/JXm99QuiQUfn77q/t:4lX1gBhbxCCaUP52t
TLSH
T1DF22D81EE7EC8616D6FF027BE973D64583B5E88F2032CBAA6CD48121A8537580F53395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0nw40ksw.tbk

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\0nw40ksw.tbk
Size 810B
SHA256 3a5b53e1432339fffade772213ee60c728d385d3b0a51e2968a92ab8e62fbb71
MD5 8c5ef7b27de9645a016afff410cc1445
SHA1 787f07e30b37039bb2427d864cf8b2ad5b2797d8
SHA512 2b60860ac6c5659cfaeb4cf2e9287a0bd7770d5861240ae82bde5011db16c583e8e6bdd3955eed463c159b3274315d765f5dbf46a9caa3fde16e132466df77bf
TLSH
T11F01F191F017DA3602B25F75BE89EC4CF36E72C308A8228D3C934837F2274876553288
MD5 SHA1 SHA512 TLSH

Submit Download

diixofue.or5

Path C:\Users\Admin\AppData\Local\Temp\Microsoft.PackageManagement\diixofue.or5
Size 1KB
SHA256 5990b841a5f3756f945adaa9d2e590759757b05794e54962ef50edb62a5049d5
MD5 58929bee31064a00a6bf785ae594b0bd
SHA1 7b0e8c8a1550e17b8084df95bdfbbde31262b355
SHA512 f1efc29e26e4bc7b376b57202e9f1d1b166fcd1fbc2369720d99223b3a8c7a66115d42c7357e9c63708a35ae9d872b1ef7689ed0918d1bdd5ac39702dbe0aa1b
TLSH
T12A3182D2AC16946D07311CA4FA49E90CF33B54ABC98471AE3DD60432F76B096F83718A
MD5 SHA1 SHA512 TLSH

Submit Download

RESF061.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF061.tmp
Size 1KB
SHA256 6a9bfc760fefcd098837672667289debc9386c97d40090296eb302ab83a5b6ef
MD5 8ccb7a0453439296c7de0a68abea95d4
SHA1 0d8f266f4f37e9e967c8b796a6154079c378d75a
SHA512 339182065daa4e82090613b62ba003aeed35427742b11df430db9bf1ee8a3656bd1d8af22236e2af7296a2209a5d2a007dddffe2dbd1b5092a2af3312d699495
TLSH
T1CB21590993FD471FF0735732A9F6032B9665FD95EFA2675A8480422C2C51608EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4qwxf1we.pm0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4qwxf1we.pm0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

First10Races.csv

Path C:\Users\Admin\AppData\Local\Temp\z0ca5l30\Examples\Grouping\First10Races.csv
Size 5KB
SHA256 a06fccc78265f3c21702c500a6076e9ad7cacfb87b1faa58f848142669668290
MD5 80ff1389b00a0f039073e4e7605adb69
SHA1 a2b51aa0da5f961b004ffb3c544a648a787cb1e4
SHA512 69813020cb8def4b30b2969749472b74bbe27689723f0ace87e9463fa8cb2b36fd35e7746de9bee9f7860ccbaf0b9edce27d166748ad69e904dcd4293d234fe8
SSDEEP 96:Hy1vuIHFnCJpJsjoowKkNqrx+y4M4LGnDsQ0KBmn2c1HrTkpa1zzwuXZrBw9oP8o:gvVhCJ7sxBcqrx+ygGSaU13pJruGP8ir
TLSH
T1C8C1DE2D5F389EDE33A215C7129BB1828BC5056A5B3E37DD8E64CBED13544C73650934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 7b699536efd46702446d4668b987ae3253e1b8aeda376a75bc3b612852d28cac
MD5 1dc31611648327d9e48906055d35ba99
SHA1 f51ab095ffb67133588148368067635fb1664f6f
SHA512 4b9bfd95556ffc44ddb62e3cc7b8e263f7a8ddf58878fd8b6d7576ba34786d6205af4c232e501e53b3a0219bb8b68c5193ca61739394dc8a116005812c40e97f
SSDEEP 96:kbHNCDHrRWFukvhkvCCtU4QlMLWQHf4QlMLWQHd:SH2dWcU4QlMLW44QlMLWc
TLSH
T1DED1CB0023F24619E5B78F3A6CB9A331A731FA46DF068BCE02419059DC35625FE3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 6f653df843ddcc073f69c4f41c6e3a91a31f4da4898db419949a034135911195
MD5 3828d3d6084217333727edb2c1ded1c8
SHA1 351f7ca68be3409b2efbc71a3226a95b346e7b50
SHA512 9eab17a7fb739168c86b6a6d6b1e23ecdb327695eb9ed84605bd340250d45d1437f24466aab33dd167eda0116a3c8a8e7e5c0cf0cbd703480e49299383578fa1
SSDEEP 96:k6HNCDHrgWFukvhkvCCtU4QlM3WQHf4QlMLWQHd:TH20WcU4QlM3W44QlMLWc
TLSH
T180D1CB0023F24619E5B78F3A68B9A731A731FA46DF068BCE02419059DC35625FE3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tets.ps1

Path C:\Users\Admin\Downloads\tets.ps1
Size 1KB
SHA256 866ee6ecf61d30ac6085b5226b22cbc6edb31fc4916b192acecbea348264a526
MD5 08912f9d4b912f76349c5f598ae94034
SHA1 f0646d7408634dcc7f72848dc36e4d3feff0c727
SHA512 7afafc42eda1f17916b768694b503be8b9afac22a0013cade1164bf89ed82c4fabcf9d38ca5ca91b8b9601604737b5d2d2976fb11d466625c4c95a9f77b4cd62
TLSH
T1F341233ED642199F99F33454A8C11499F3346207035B280A76ECE44DBF7EC74B15CA6D
MD5 SHA1 SHA512 TLSH

Submit Download

2gb4myvu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2gb4myvu\2gb4myvu.0.cs
Size 10KB
SHA256 f447865e0c75b6c39becab9b9527fcc583def24c18a66cc815a9419f375ddc11
MD5 a29444398ac9a819c5d208948b81a14c
SHA1 fad400b1b7c8041846304012e39c8e80b60b0305
SHA512 b75a16673e7c7e37cb8ac45d6e6793694890b4b5293cd5b2a1ce477211dd79a8c80ca4df58808eff85315fb2b0b6bfbe4cb36ddd3dae61105707a173776685ff
SSDEEP 192:NSoSAdettFc98gbCKrcye5F+/9dYfWqw7AGOd7QS/w6oGLC:NSOoe984BDif+7AGOd79I6oGG
TLSH
T1842274596E0D9A369D77E13A8B03EA42FB5A1137396ACD50758C03604FB3494C12EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2gb4myvu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2gb4myvu\2gb4myvu.cmdline
Size 450B
SHA256 b6de78eb86df99a6e03f2254798a6047e24f9dcb0d773fbbbdb76af53947cf6c
MD5 7e751d44e152798066d56032af651b6d
SHA1 6429ed1947daaa5090d846d72c09490395dfa67e
SHA512 e47336c2214c8fc5dac73f88c21ecb29558b27c67e20ca63cf042489148374e10b1c0325883de2fb5e4eedc8ae4bc6b45d18f391cc105d493af33294d47800e4
TLSH
T169F05C2B631BC67F45FA200B166A896CD2B213C724426F845564893DE5F30205B91790
MD5 SHA1 SHA512 TLSH

Submit Download

CSC15B791278E964D44A4994FCD9968FD0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2gb4myvu\CSC15B791278E964D44A4994FCD9968FD0.TMP
Size 652B
SHA256 60a5be8b3b4d4a6e36531d71a661f0fc95e0895dea386dda0f83212c06dd52ba
MD5 fb67b3289411835515777a5e0d567db7
SHA1 05cb7bcc5a9fcd4d24e8380f96e557a99b6a8078
SHA512 53ed357bd19e1825022541164f2add4297ae2fbb0d79eb5c6052e6f097d73af6dcf11ac7be0461da77e93e2ad21aee4f0bedd504dd1c0aa07690f1611aac1be8
TLSH
T18AF05E19A3FC020EF4F34B31BDF643A791A9BC65DE3293ED549043196C645149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2672-503-0x0000000008160000-0x00000000087DC000-memory.dmp

Download

memory/2672-688-0x0000000001220000-0x0000000001232000-memory.dmp

Download

memory/2672-687-0x0000000001000000-0x000000000100A000-memory.dmp

Download

memory/2672-661-0x000000006F8F0000-0x000000006F905000-memory.dmp

Download

memory/2672-660-0x000000006FBE0000-0x000000006FC83000-memory.dmp

Download

memory/2672-657-0x0000000070A50000-0x0000000070DAB000-memory.dmp

Download

memory/2672-655-0x000000000A720000-0x000000000A796000-memory.dmp

Download

memory/2672-654-0x0000000008830000-0x000000000885C000-memory.dmp

Download

memory/2672-584-0x000000000B670000-0x000000000B678000-memory.dmp

Download

memory/2672-583-0x000000000B660000-0x000000000B66A000-memory.dmp

Download

memory/2672-582-0x000000000B680000-0x000000000B69C000-memory.dmp

Download

memory/2672-581-0x000000000B650000-0x000000000B660000-memory.dmp

Download

memory/2672-580-0x000000000AFE0000-0x000000000AFF5000-memory.dmp

Download

memory/2672-579-0x000000000AFD0000-0x000000000AFE0000-memory.dmp

Download

memory/2672-578-0x000000000B000000-0x000000000B02C000-memory.dmp

Download

memory/2672-577-0x000000000AFB0000-0x000000000AFCC000-memory.dmp

Download

memory/2672-576-0x000000000AF80000-0x000000000AF8C000-memory.dmp

Download

memory/2672-575-0x000000000AF70000-0x000000000AF7E000-memory.dmp

Download

memory/2672-574-0x000000000AF50000-0x000000000AF61000-memory.dmp

Download

memory/2672-573-0x0000000009360000-0x0000000009370000-memory.dmp

Download

memory/2672-572-0x000000000AED0000-0x000000000AEFA000-memory.dmp

Download

memory/2672-571-0x000000000AEB0000-0x000000000AEC6000-memory.dmp

Download

memory/2672-570-0x000000000AF00000-0x000000000AF44000-memory.dmp

Download

memory/2672-569-0x0000000008D20000-0x0000000008D4A000-memory.dmp

Download

memory/2672-566-0x0000000009370000-0x000000000937A000-memory.dmp

Download

memory/2672-563-0x0000000009380000-0x000000000939A000-memory.dmp

Download

memory/2672-562-0x0000000008AC0000-0x0000000008AC6000-memory.dmp

Download

memory/2672-560-0x0000000008C30000-0x0000000008C5A000-memory.dmp

Download

memory/2672-561-0x0000000008AB0000-0x0000000008AB8000-memory.dmp

Download

memory/2672-557-0x0000000008C00000-0x0000000008C26000-memory.dmp

Download

memory/2672-556-0x000000000B040000-0x000000000B244000-memory.dmp

Download

memory/2672-552-0x0000000008A30000-0x0000000008A50000-memory.dmp

Download

memory/2672-553-0x0000000008B50000-0x0000000008BF3000-memory.dmp

Download

memory/2672-548-0x0000000070A50000-0x0000000070DAB000-memory.dmp

Download

memory/2672-551-0x00000000089C0000-0x00000000089C8000-memory.dmp

Download

memory/2672-547-0x00000000708F0000-0x000000007093C000-memory.dmp

Download

memory/2672-546-0x00000000089D0000-0x0000000008A06000-memory.dmp

Download

memory/2672-534-0x0000000008B00000-0x0000000008B4A000-memory.dmp

Download

memory/2672-529-0x0000000008070000-0x0000000008086000-memory.dmp

Download

memory/2672-532-0x0000000008050000-0x000000000805A000-memory.dmp

Download

memory/2672-533-0x00000000088A0000-0x00000000088E0000-memory.dmp

Download

memory/2672-531-0x0000000008110000-0x0000000008128000-memory.dmp

Download

memory/2672-530-0x0000000008030000-0x0000000008044000-memory.dmp

Download

memory/2672-528-0x0000000007CD0000-0x0000000007CD8000-memory.dmp

Download

memory/2672-507-0x0000000008DA0000-0x000000000935A000-memory.dmp

Download

memory/2672-506-0x0000000007B80000-0x0000000007BA2000-memory.dmp

Download

memory/2672-505-0x0000000007BE0000-0x0000000007C76000-memory.dmp

Download

memory/2672-504-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/2672-502-0x0000000007A90000-0x0000000007AD4000-memory.dmp

Download

memory/2672-501-0x0000000007A10000-0x0000000007A3E000-memory.dmp

Download

memory/2672-492-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/2672-491-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/2672-490-0x00000000062A0000-0x00000000065FB000-memory.dmp

Download

memory/2672-487-0x0000000006230000-0x0000000006296000-memory.dmp

Download

memory/2672-486-0x00000000061C0000-0x0000000006226000-memory.dmp

Download

memory/2672-485-0x00000000059B0000-0x00000000059D2000-memory.dmp

Download

memory/2672-484-0x0000000005A40000-0x000000000608A000-memory.dmp

Download

memory/2672-475-0x00000000053B0000-0x00000000053E6000-memory.dmp

Download

memory/6044-3274-0x0000012734E00000-0x0000012734E22000-memory.dmp

Download